Launch failures: the “Oops!” factorby Wayne Eleazer
|
| It’s as if someone makes a mistake, fails to go “Oops!” and recognize it, and thus dooms a launch to failure. |
Take the example of the loss of the Space Shuttle Challenger. It was not simply a bad design of a solid rocket motor joint, but also a questionable rocket booster test plan and the refusal to consider temperature limits as an issue, combined with the weather experienced. As for the weather, it was not just low temperatures that doomed STS Mission 51-L but also unusually high wind shear conditions aloft.
But sometimes it’s a lot simpler. There are a few cases in which a single specific act by a human being can be the cause a launch failure. It’s as if someone makes a mistake, fails to go “Oops!” and recognize it, and thus dooms a launch to failure.
The launch of Thor 191 on June 16, 1959, marked the second Integrated Weapon System training launch of an SM-75 IRBM from Vandenberg AFB using a Royal Air Force crew. Project Emily had deployed 60 Thors to England and the system was to become an operational part of the United States and Great Britain’s nuclear deterrent in December 1959. Military launch crews were a key part of the system, and so the need to demonstrate their competence was urgent.
Mere seconds after liftoff a curious problem became evident. The missile failed to enter its pitch program and simply climbed straight up. There was no obvious reason to send the destruct signal, since the rotation of the Earth would carry the missile out over the Pacific, so the flight was allowed to continue in order to collect more data. Higher and higher it climbed, still with no pitch over, and with no commanded engine shut down, either, because the required velocity was not being achieved; all the energy was going into altitude and not velocity. Eventually the range safety people grew concerned. The destruct signal was sent. The vehicle exploded; high altitude winds that had not been factored into the destruct decision carried some of the debris to impact near the town of Orcutt to the east of the base.
Subsequent investigation revealed that a certain piece of safety wire in the missile’s Control Electronics Assembly (CEA) autopilot programmer had not been removed as required. The Thor guidance system used an approach for preset maneuvers, such as the pitch program, that was scarcely different from the controls of a washing machine. At liftoff a 35-millmeter plastic tape began to be pulled off its spool, with holes in the tape allowing metal fingers to reach through and activate the required circuits. It was very important for the tape not to move until commanded to do so; among other things, a Thor going into its pitch program right after engine ignition would prove to be excessively exciting for everyone involved. So a safety wire had been placed so to restrain the movement of the tape prior to final insertion of the CEA into the missile. The safety wire had not been cut and thus the tape never moved.
The launch was a case of “Oops!” And not just for the launch crew; the range safety organization at the launch base suddenly realized that upper limits on flight had to be set, as well as horizontal ones. After “Missile away!”, “Liftoff!”, and “Back Az Green!”, the call “Program, Program!” that confirmed that the observer located at right angles saw the pitch program taking effect became one of the most anxiously awaited announcements over the countdown net.
| Failure to follow established safety procedures caused the only significant damage to ever occur to a dwelling occupied by innocent bystanders in the history of the US space program. |
On September 2, 1965, a space launch version of the Thor lifted off from SLC-1, a pad not far from where the RAF Thors had been launched. The vehicle was a Thor Agena D, one of a long series of vehicles that would launch military payloads from Vandenberg and compile an enviable success record while doing so. It seemed like it would be a routine launch, except that the wind blowing out of the west was unusually strong. The surface winds were not a problem for the vehicle; Thors in that configuration had absurdly high ground winds capabilities, on the order of 70 knots (130 km/h). The winds aloft caused some concern, but the launch proceeded.
The mission was to fly a launch azimuth of 172 degrees. This required the booster to fly close to the shore immediately after launch and hug the coast of California during much of the trajectory. But soon after liftoff the rocket headed too far to the east, eventually reaching some 1,100 feet (335 meters) from the nominal trajectory. The vehicle crossed the abort lines but the Missile Flight Control Officer failed to send the destruct signal. When at last he did blow the errant vehicle the results were catastrophic, and almost tragic.
The debris fell in a trailer park on the base, impacting one mobile home, occupied by a pregnant lady and two small children. The kids were at one end of the trailer and lady at the other. A large section of the rocket literally cut the trailer neatly in half, not even damaging the white picket fence surrounding the dwelling. Fortunately neither the children nor their mother was hurt physically, although legend has it the woman went into premature labor and delivered her third child some five weeks early.
Once again the Oops! factor came into play. Failure to follow established safety procedures caused the only significant damage to ever occur to a dwelling occupied by innocent bystanders in the history of the US space program.
A few years later another Thor behaved very strangely after launch one night from Vandenberg. The rocket engine nozzle slammed back and forth wildly. Finally, the MFCO sent the destruct signal when the booster wandered too far off course.
Examination of the wreckage showed something remarkable: nothing really had failed on the vehicle itself. The Thor had three rate gyros: one for pitch, one for roll, and one for yaw. The technician that had installed the rate gyros had been a big beefy guy and had torqued down the units very securely. In fact, he exerted so much force on the yaw rate gyro that the locating pins had broken off and it had rotated out of the correct position. The vehicle lifted off with three perfectly functional rate gyros, but it was with two gyros installed so as to sense roll, one for pitch, and none for yaw. The guidance system had no way to determine the rate of yaw correction being applied, and so it applied full yaw in one direction and then the other when that proved to be too much. It was an Oops! by one technician that led to the gyro being installed improperly.
| One mistake, one oops, and Navstar 7 did not reach the heavens. |
Thors were not the only vehicle where the Oops Factor applied, and the problem was not limited to launches in the ’50s and ’60s, either. On December 19, 1981, Atlas 76E lifted off from SLC-3E at Vandenberg AFB, carrying a Global Positioning System satellite, Navstar 7. It had been a difficult processing and launch effort: various contentious issues arose and repeated bad weather, along with a serious guidance computer problem, had resulted in a number of launch scrubs. The liftoff was greeted with considerable relief, but it was an emotion that proved to be very short-lived.
At T+6 seconds the General Dynamics telemetry analyst, Gary Vick, viewed the strip charts coming off the recorders and saw a familiar data set. “B-2 engine is shutting down,” he announced calmly over the countdown net. The charts did not lie: by T+7.4 seconds the MA-3 booster engine had lost virtually all thrust. As the engine lost thrust the booster pitched over sharply and began to roll out of control as the hydraulic system mounted on the B-2 engine lost pressure. It reached a high RPM before exploding just before it impacted the ground at 19.8 seconds after liftoff, a mere 500 feet (150 meters) from the launch pad.
Examination of the debris quickly proved without any doubt the cause of the failure. During inspection of the B-2 engine before installation on the booster, the gap between the upper and lower sections of the gas generator was found to be out of spec. This was not a terribly unusual finding; it had been seen dozens of times before. And just as in dozens of times before the two halves of the gas generator were separated and the cause of the problem identified. A metal O-ring seal had slipped out of place during the engine’s overhaul at the San Bernadino Air Material Area in the 1960s, resulting in a larger than normal spacing between the injector and the gas generator lower body. The engine hotfire test after the overhaul had gone well, despite the oversized gap.
When the cause of the anomalous gap was identified, standard procedures were used to correct the problem. A new seal was installed and the problem was solved, or so they thought. No new hotfire test was required after this process.
The new seal was installed and, as usual, was coated with a sealant designed for such applications, a compound called Plastiseal. The engine manual called for “no excess globs of Plastiseal material to be applied to the seal” and this restriction was followed. But there still was enough extra Plastiseal on the ring for some to flow over and plug three film coolant holes around the outer edge of the gas generator injector.
The design of the MA-3 gas generator handled the problem of making sure the temperature of the gas did not get too hot in the usual manner, by using a substantial excess of fuel as compared to the amount of liquid oxygen allowed in. Part of this design approach involved a ring of small holes—film coolant holes—around the rim of the injector that ran fuel down over the inside surface. Aside from keeping the stainless steel of the gas generator cool, the film coolant holes also ensured that the local mixture ratio at the surface was very rich and therefore cooler.
But on the B-2 engine of Atlas 76E the Plastiseal had covered three of the film coolant holes. Within four seconds after ignition the temperature in the area where the coolant holes were plugged became high enough to melt the stainless steel casting. The tongue of flame that spat out from the hole in the gas generator speared the LOX bootstrap line, the feed line for the gas generator itself. Normal shutdown of the engine involved first shutting off the LOX feed to the gas generator, to make sure that the fuel rich condition prevailed during shutdown. This produced the telemetry signature of engine shutdown that Gary Vick knew so well. One mistake, one oops, and Navstar 7 did not reach the heavens.