Launch failures: the “Oops!” factorIt was not just American boosters that have suffered such failures, either. Ariane 44L no.3, carrying the Superbird BS-2X payload, lifted off from Kourou on February 23, 1990. At T+6 seconds the Viking first stage engine D suffered an almost 50% drop in chamber pressure. The D engine thrust continued to decay and, at T+90 seconds, the other engines hit the limit of their gimbaling ability to correct for the loss of thrust. Flying almost sideways, the vehicle broke up at T+100 seconds due to the excessive dynamic pressure. Subsequent investigation found an Oops! situation. The Viking engine used water as a coolant. Water is needed for the engine test firings but you don’t want to leave it in there afterwards, lest it promote corrosion. During that cleaning process someone had left a cleaning rag in one of the coolant tubes, which stopped the water flow, produced an overheat condition, and led to loss of thrust and eventual engine failure.
Less than a month later, on March 14, 1990, another Oops! failure occurred, with the launch of a Commercial Titan III mission. The Titan III was capable of carrying two payloads to orbit, but for the 2nd commercial Titan III launch only one payload was available, Intelsat VI F-3. The mission lifted off from SLC-40 at Cape Canaveral AFS and all went well—until it came time for the payload to separate from the booster. It failed to do so. Investigation found that the vehicle had been wired with a harness that could accommodate two spacecraft. Normal procedure would have been to hook the harness to both the lower spacecraft and the upper one so that the one on top would separate first, followed by the lower. But the wrong connector had been plugged into the one and only spacecraft, and as a result it never got the signal to separate. It was a single Oops! that once again that killed a mission. Then, three years later, it was the Atlas program’s turn again. On March 25, 1993, an Atlas 1 lifted off from SLC-36B at Cape Canaveral AFS, carrying the first of the US Navy’s new UHF Follow-On communication satellites. The launch proved to an inauspicious start to the new program. A mere 22 seconds after liftoff the vehicle’s sustainer engine began to lose thrust, ultimately reaching only 65% of its nominal thrust level at T+103 sec. The Centaur second stage performed normally, but was inadequate to the task of making up for the low performance of the sustainer. The payload ended up in an orbit far below the desired geosynchronous transfer orbit. The spacecraft used its own onboard propulsion system to climb to a higher orbit, but one that still proved to be too low to meet mission requirements. Analysis showed that the sustainer thrust decay was due to a simple problem. The Atlas sustainer engine thrust level was controlled by a regulator that was adjusted by turning a screw. A set screw was to be tightened to ensure that the adjustment screw did not move due to in-flight vibration, and that had not been done properly. The result was another fatal Oops! It was Titan’s turn for another Oops! moment on April 9, 1999. A Titan IVB booster with an Inertial Upper Stage was to carry a Defense Support Program spacecraft to a geosynchronous orbit from Cape Canaveral’s SLC-41. The booster strap-on motors and the first and second stages worked fine; so did the first stage of the IUS. The second stage of the IUS was supposed to fire next, and it did. However, the expected performance did not materialize; the payload was placed into a useless orbit rather than the desired geosynchronous transfer orbit. Investigation revealed that the IUS first and second stage did not separate from each other properly. The result was that the extendable exit cone on the second stage IUS rocket motor did not deploy properly; the resultant performance deficiency, combined with the extra weight of the IUS first stage being towed along behind, led to the lower orbit. The cause was another case of Oops! The wiring harness of the IUS was wrapped with an insulating tape for thermal protection purposes. The tape had been wrapped right over an electrical connector that was supposed to separate when the first stage had done its job. The tape resulted in the failure to separate. Things were not over for Titan IV, either. Less than month later, on April 30, 1999, a Titan IVB Centaur booster launched a Milstar military communications satellite from the Cape’s SLC-40. All went well during the Titan’s flight, but problems soon developed during the Centaur’s first burn, followed by the vehicle going out of control during the second burn. The payload was placed into a useless orbit.
The mishap investigation showed that during development of the guidance program the Centaur roll damping constant was entered as -0.199 rather than the required –1.99. While not immediately fatal, the programming error led to some unnecessary maneuvering during the first Centaur burn that so depleted the attitude control propellant that the vehicle lost control during the second burn. So that’s it. A single error by one person can kill a mission. That’s what happened in each of these cases—or did it? In the case of the RAF Thor, not only did someone fail to cut the safety wire in the programmer, but also no one properly checked to see that it was done. Even on “operational” military missions quality control is essential. For the Thor that hit the trailer, the reality is that the payload was substantially larger than earlier missions and the fairing was 44 inches (112 centimeters) longer than those used previously. In retrospect, it is obvious that a much larger fairing combined with unusually high winds could result in the vehicle’s control authority being overpowered. And it is also obvious that it should have been obvious. And that was not the only mistake. The southerly launch azimuth and the location of the launch pad made it a challenge to ensure that the vehicle did not fly too close to protected areas. Later, all missions launched on southerly azimuths from pads such as SLC-2 at Vandenberg AFB had to fly a “dog leg” trajectory early in flight, taking the rocket to the west, out over the ocean, before turning south. This could result in a loss of performance of up to ten percent for some missions, but was a requirement deemed essential to ensure safety. Also, there were actions of the senior personnel involved on that day on September 1965. Reports indicate that the range commander told the MFCO not to blow the vehicle when it first crossed the limit lines. The commander apparently thought that the vehicle would correct its trajectory if given enough time—and it might well have done so, possibly somewhere well to the east of Santa Barbara! As for the Thor with the misinstalled rate gyro, not only was the training of the technician apparently somewhat deficient, but once again, inspectors failed to catch the error. For Atlas 76E Navstar 7, a technician made an error, and both contractor quality control and Air Force quality assurance failed to catch it. But the problem was deeper than that. The launch review team failed to follow up and require a borescope of the gas generator, which would have detected the problem. This failure to investigate the repair was due in no small part to concerns raised by a small group of very senior analysts, who focused on a recent engine modification as being a potential problem. Eventually, the issue was resolved as not being a valid concern, but so much of the time and energy of the review team was consumed addressing that non-problem that they were unable to focus on what proved to be the real one. And, finally, the Air Force program office was undergoing a management change at the time, which diverted attention from the upcoming mission. In the case of the Ariane 44L with the blocked water line, it’s clear that the launch organization failed to implement the type of “sponge count” procedures that had been the norm for US launches for some time. The sponge count was inspired both by earlier failures and by surgical procedures that are designed to ensure that no tools or sponges are left inside the patient. For the Commercial Titan III with the misconnected harness, the company failed to recognize that its own quality control procedures would have to compensate for the government quality assurance that was not present for commercial missions. Every launch company made that same kind of mistake and had to correct it, even as uninformed “experts” enthused how much smoother and cheaper things would be without government involvement.
For the Atlas 1 carrying the first UHF Follow On payload, this lack of government oversight took on an added dimension. The US Navy came up with the idea of a “Delivery to Orbit” approach, where the payload contractor procured the launch service commercially and provided it to the government as part of a package deal with the satellite. While potentially more costly than the usual Air Force or NASA procurement of the booster, it offered the advantage of enormously simplifying the management interfaces for the Navy. And of course it eliminated the government oversight that the earlier approaches would bring, since the Navy would own no hardware until it was on-orbit and working. In the mishap investigation for the April 9, 1999, Titan IV IUS failure, identification of the cause was aided considerably by the fact that the close-out photos—pictures typically taken of the details of the vehicle before it is launched—clearly showed the tape wrapped over the connector that failed to separate. Not only that, but review of both close-out photos and telemetry from earlier missions showed the problem had occurred on them as well, just not as severely. People were taking photos that showed the problem but obviously no one was looking at them very closely. In the case of the April 30, 1999, Titan IV Centaur failure, the problem with the improper roll constant was spotted during guidance simulations. It was thought to be not very important and no steps were taken to correct it. However, for both of the 1999 Titan IV failures, as well as the Titan IV failure of August 1998, there was a larger dynamic at work. Air Force Space Command had been asserting the need to adopt a more “operational” approach. But the 1990s had been marked by a series of delays for the Titan IV program. Failures in flight and in testing had led to delays, and the delays themselves had led to more delays, as boosters that suffered the effects of sitting on the pad for long periods had to be destacked and inspected. The Cape struggled to launch a couple of Titans each year, but in 1998 they were ready to speed things up. The Air Force would launch four Titan IVs in less than a year’s time. It was an ambitious goal, especially since two of the launches would have to occur in the space of one month. It demanded a strong commitment to keeping on schedule. And they did it: four Titan IVs went up between the middle of August 1998 and the end of April 1999, the best record since 1990. The only problem was that three of the four were failures. Today, over 60 years after large rockets became feasible, essentially all space launch failures are due to human error. Aside from outright mistakes, failures also are caused by not learning the lessons of the past. And one of the most important of those lessons is that of human fallibility itself. An essential part of any launch operation is the need to ensure that the work was done correctly, and that requirement extends all the way back to the beginning of the design process. When one person makes a mistake that is not detected and corrected then the whole organization has made an error. The Oops Factor must be a key consideration in not only the design of the vehicle and the associated procedures but also the structure of the organization itself. Home |
|
