Reliability Inthe Apollo Program
Total Page:16
File Type:pdf, Size:1020Kb
T ECHNOLOGY Reliability in the Apollo Program A BalancedApproach Behind the Success by Yasushi Sato cles and the Apollo spacecraft. In the dated the Saturn launch vehicles. Earlier beginning of the 1960s,NASA hadno con¬ missiles and rockets were also complex sistent philosophy on how to achieve high and expensive enough to call for acute Reliability assurance is a central reliability of those systems. Engineers at awareness of the importance of reliability.6 concern in the design and development of NASA headquarters, the Marshall Space The primary means for reliability assur¬ space systems. A minutest source of unreli¬ Flight Center (MSFC), and the Manned ance in those earlier programs was exten¬ ability in a component or a subsystem can Spacecraft Center (MSC) had diverse sive testing, not only at the component and cause the loss of an expensive system. assumptions on this question. Only after a subsystem levels but also at the level of the Reliability is all the more important in longperiod of trial-and-errors and negotia¬ whole vehicle. The test firing of many human spaceflight programs, where human tions did they attain workable approaches. flight models directly demonstrated the lives are at stake. Thus the disastrous fail¬ Some explanation on the word rate of success. Only after the reliability of ures of Space Shuttles Challenger and "reliability" is in order. Sometimes "relia¬ a vehicle was actually proven did it come Columbia have come under intensive bility assurance" and "quality assurance" into use for human spaceflight. Thirty- scrutiny not only from technical but from are understood as mutually exclusive in seven Redstones had been fired before the organizational viewpoints. On the other meaning. For example, an engineer at MSC missile was declared operational and then hand, reliability efforts in space* programs said: "In simple terms, reliability means was used for astronaut Alan Shepard's sub¬ ÿ that underwent no catastrophic failure have the thing is designed so that it will work; orbital flight. More than 100 Atlas mis¬ not attracted much scholarly attention. This quality means that it is built so that it will siles had been launched before the rocket does not mean that those successful pro¬ work. Inother cases, however, reliability carried astronaut John Glenn to an Earth 8 grams achieved reliability with ease. is a more general term subsuming quality orbit. ÿ Reliability assurance was an utmost issue assurance. This article adopts the latter In the beginning of the 1960s, in those programs also. Their reliability usage and uses the word "reliability" to Don R. Ostrander, director of the Office of problems are relatively invisible retrospec¬ mean generally the ability of achieving Launch Vehicle Programs at NASA head¬ tively only because of the lack of conspic¬ expected performance. quarters, still upheld this approach. uous tragedies. ÿ This article does not intend to Ostrander, an Air Force Major General Official histories of the Saturn describe the whole reliability program in temporarily on loan to NASA, had an over¬ launch vehicles and the Apollo spacecraft the Apollo program. Instead, it demon¬ all responsibility for all of NASA's rocket do note the importance of reliability. They strates the fact that divergent philosophies programs. He argued that NASA must also briefly review the techniques used, in the early 1960s interacted with one "create a fleet of standard vehicles with a including the failure mode and effect another until workable approaches minimum number of different designs and analysis, the closed failure reporting and emerged in the mid-1960s. Some advocat¬ configurations." Then, he continued, corrective action scheme, and the system¬ ed extensive use of statistical techniques NASA must "attain a high degree of relia¬ atic implementation of design reviews. based on test data, while others stressed the bility through repetitive use of these basic They also discuss conservative engineering inherent soundness of design. Striking the vehicles, much as the automotive industry practices of NASA and contractor engi¬ proper balance between the two gave rise has achieved reliable cars through the mil¬ neers, such as the use of proven parts and to the high reliability of the Apollo space¬ lions of miles of driving on each of their techniques, the pursuit of simplicity, and craft and the Saturn launch vehicles, which standardized vehicles." Here Ostrander the elaborate deployment of redundancies. in turn enabled the successful completion was talking about launch vehicles ingener¬ These studies, however, see the question of of the program. al but also had in mind those for human reliability in the Apollo program in a large¬ spaceflight programs. ly static manner. They do not tell how the This approach" of actually verify¬ reliability approach at NASA evolved over RELIABILITY OF THE SATURN ing the statistical probability of successful time.ÿ LAUNCH VEHICLES flights no longer worked for satellite and This article describes NASA's launch vehicle projects of the 1960s. They effort to establish effective approaches to The Needfor a New Approach became so expensive that reasonable finan¬ assure reliability of the Saturn launch vehi¬ The problem of reliability assurance pre- cial resources did not allow the building of QUEST 13:1 2006 22 many flight models. Nor was there long The center's intensive reliability effort As MSFC aimed for a balanced approach enough time for testing all these models, extended to its contractors. Marshall engi¬ integrating statistical/analytical methods especially in the urgent circumstances of neers closely supervised their contractors' with engineers' unremitting efforts, NASA the Cold War. Thus the development of the operation and meticulously pointed out headquarters also came away from the Saturn launch vehicles required NASA sources of the unreliability. In 1962, von purely statistical approach. Golovin, the engineers to formulate a new scheme to Braun once told D. Brainerd Holmes, strongest proponent of the statistical estimate and improve their reliability. Director of the Office of Manned Space approach, left his position in the Office of Flight at NASA headquarters, that the pen¬ Manned Space Flight in late 1961. A less From Divergent Philosophies to an etration of contractors' operation by adamant statistician, Gephart, came to call IntegratedApproach Marshall engineers did "more for reliabili¬ for the integration of the two extreme In the early 1960s, officials in ty than all the statistical studies combined - views of von Braun and Golovin.ÿ He ÿ charge of reliability policy at NASA head¬ in my humble opinion, at least." His still considered it "essentially pointless" to quarters were engineers with background observation was justified when all ten discuss reliability without quantitative in statistics such as Nicholas E. Golovin Saturn Ilaunch vehicles achieved success¬ technique. He did not emphasize statisti¬ and Landis S. Gephart.10 Even those stat¬ ful flights from 1961 to 1965 despite pes¬ cal methods too much, however: isticians were aware that it was impractical simistic predictions by theoretically-ori¬ "Reliability engineering can be viewed as a to directly verify the success rate of launch ented reliability experts.ÿ mating of sound engineering disciplines vehicles through large numbers of test At the same time, however, with analytical techniques." 20 flights under actual operating conditions. Marshall engineers did not ignore analyti¬ NASA headquarters' reliability Instead, they argued for the indirect use of cal methods that engineers both within and philosophy changed even more when statistical techniques: first, components without NASA were refininginthose days. Joseph F. Shea, a senior systems engineer, and subsystems are tested under simulated One of such methods was a technique joined NASA in the beginning of 1962 as environments, such as vacuum, vibration, called the failure mode and effect analysis. Golovin's replacement. With his experi¬ and extreme temperature; second, func¬ It was a method to identify the most likely ence in military missile programs, he had a tional diagrams representing the relation¬ patterns of failures of a particular system practical view on the problem of reliability. ships between these components and sub¬ and estimate the effects of those failures on He considered the statistical demonstration systems are translated into statistical terms. the sound functioning of the system. Then, of reliability impractical not only for the These procedures then make it possible to those patterns of failures were eliminated entire vehicles but also for subsystems due integrate the reliability numbers of compo¬ one by one by either deploying redundancy to limitations in cost and time. Cautioning nents and subsystems and thus to calculate or sacrificing the systems' specifications. A against the tendency of engineers to be ÿ the reliability of the entire system. closely related method was the criticality attracted to the superficial rigor and preci¬ Von Braun and Marshall engi¬ analysis. Engineers assigned criticality sion of numbers,ÿ he argued that "The neers, on the other hand, tended to belittle numbers, which indicated the relative statistical confidence must be replaced NASA Headquarters' statistical approach, degree of criticality of components or sub¬ with 'engineering confidence.'" 22 The Von Braun admitted that statistical reliabil¬ systems for the success of the entire sys¬ key to attain engineering confidence, in