HEADLINE: NASA SET ASIDE A 'FAIL-SAFE' RULE FOR BOOSTER SEAL
BYLINE: By PHILIP M. BOFFEY, Special to the New York Times
DATELINE: WASHINGTON, Feb. 12
The space agency waived its requirement for effective backup safety seals on the space shuttle's booster rockets three years ago, agency officials acknowledged today.
They said they continued to launch shuttles even though failure of a single seal could be catastrophic because they were confident the primary seal would assure the craft's safety.
Those seals at the seams where sections of the giant booster rockets are joined together are a prime focus of the investigation into the Jan. 28 explosion that destroyed the space shuttle Challenger and killed its seven astronauts.
Enormous Force on Seals
The booster joints were originally designed to have an effective double system of seals to prevent hot gases from leaking out the side, where they might cause an explosion.
But by late 1982, according to documents released today by the National Aeronautics and Space Administration, engineers realized that rotational forces generated by the enormous pressures in the rocket could inactivate the backup seal, leaving only a single seal to do the job.
Under the agency's Space Shuttle Program Requirements Document, most critical components are required to have backup systems, or redundancy, so that if one component fails, another is available to do the job.
Titan 3 Experience Cited
Unless a special waiver is granted, components other than primary structural parts, such as a wing or giant fuel tank, are required to have backups. They are also required to be ''fail-safe,'' meaning that the shuttle mission could be terminated without loss of vehicle and crew.
But on March 28, 1983, NASA headquarters approved a waiver exempting the joint assemblies from the redundancy and fail-safe requirements.
L. Michael Weeks, the deputy associate administrator for space flight, said in an interview today that he had approved the waiver because the backup seal on the rocket could still be counted upon to operate at the most critical early stages of the launching and because numerous tests and experience had shown no problems with having but a single seal to hold the gases in. The Titan 3 rockets used by the Air Force have only a single seal, he noted, and these have not failed in flight.
The waiver permitted the shuttle to fly with the joint assemblies and their sealing system classified as a ''criticality 1'' item, which NASA officials defined as meaning that failure of a single component, in this case the primary seal, would cause ''catastrophic loss of the vehicle and life.''
NASA officials have said that a plume of flame appears to have emerged seconds before the explosion from the side of the Challenger's right-side booster rocket, either at or near a seam that was supposed to be blocked by the seals.
At a news conference today, William R. Lucas, the director of the Marshall Space Flight Center in Huntsville, Ala., disputed suggestions that the shuttle was flying with potentially hazardous seals in its rockets. ''I wouldn't conclude that there is a safety problem that is not resolved,'' he said. He also cautioned that NASA had not concluded that either the booster rocket or its seals were a cause of the accident.
Officials also disputed a study done for the Air Force which concluded that there was a 1 in 35 chance a shuttle booster rocket would fail. Lawrence B. Mulloy, the manager of the solid-fuel booster rocket project at the Marshall center, said the rockets had a demonstrated reliability of more than 90 per cent and an analytically calculated reliability of more than 99 per cent.
Giant Rubbery Rings
A Presidential commission investigating the disaster, headed by the former Secretary of State William P. Rogers, met Monday and Tuesday to review NASA documents concerning past problems with charring and erosion of the booster seals.
The meeting was called after a report in The New York Times on Sunday disclosed that NASA engineers and analysts had been repeatedly concerned about the seals and that one analyst had warned that the seals might break and cause a catastrophe.
The seals are essentially giant rings of synthetic rubber that encircle the rocket casing and block tiny airways that remain after two steel rocket segments are fastened together with 177 steel pins. At each joint there is a primary O ring and a backup ring, but under certain circumstances, according to agency documents, the secondary seal can be rendered inoperative.
What seems to happen, the documents indicate, is that enormous pressures build up in the rocket and exert rotational forces on the joint where the seals are imbedded. These forces do not dislodge the primary seal, which is under pressure from the gases trying to escape, but they can cause the secondary O ring, which is not under pressure unless the first seal fails, to ''lift off'' from its desired position.
Listed as 'Critical Item'
The problem was described more than three years ago in a ''critical items list'' for the booster, dated Dec. 17, 1982, which states that the primary O ring seal is classified as ''a single failure point'' because of the ''possibility of loss of sealing at the secondary O ring because of joint rotation after motor pressurization.'' Under these circumstances, it said, ''only the single O ring is sealing.''
That document described the effect of failure of the O rings in these dire terms: ''Loss of mission, vehicle, and crew due to metal erosion, burn-through, and probable case burst resulting in fire and deflagration.''
The chief focus of attention in recent discussions of the seals has been the erosion observed on some of the primary seals as a result of hot gases hitting the material. On a few occasions, gases have actually gotten past the primary seal and left soot in the cavity between it and the backup.
The documents released today indicate that if a primary seal should ever be eaten all the way through by hot gases, the backup seal would quite probably not be able to prevent a massive escape of gases.
'High Probability' of Failure
A document issued this week by Mr. Mulloy, project manager at Marshall, indicates that there is a ''high probability of reliable secondary seal'' in the first fractions of a second after ignition, but that as time goes on, reliability of the secondary seal deteriorates.
At a minute or two into the flight, encompassing the Challenger explosion, the document indicates, if erosion penetrates the primary ring there is a ''high probability of no secondary seal capability.''
The same statement is made in a document prepared on Aug. 19, 1985, by Morton Thiokol Inc., which builds the rockets. The Thiokol document adds that ''the primary seal should not erode through, but if it leaks due to erosion or lack of sealing the secondary seal may not seal the motor.''
Nevertheless, exercising its engineering judgment, NASA concluded, according to Mr. Mulloy's report, that ''it is safe to continue flying'' as long as the joints are checked for leaks using proper pressure tests, are shown to be free of contamination that might interfere with the seals, and meet other tests and examinations.
Recommendation on Cold
If, in the wake of the accident, it turns out that the joints and seals must be modified, the job could take anywhere from four months to three years, officials said.
NASA officials also elaborated on their previous statements that Morton Thiokol personnel had raised concerns about launching the shuttle in the cold weather prevailing at the Kennedy Space Center Jan. 27 and 28.
Mr. Mulloy said that Thiokol engineers had been worried about the possible effects of the cold on the seals and had recommended that the launching occur only ''within our previous experience base.'' That would have meant at temperatures no lower than 53 degrees at the O rings, Mr. Mulloy said, but the Challenger was launched in 38-degree weather on January 28, ''the coldest ambient temperature that we have ever launched a shuttle.''
Mr. Mulloy said that Thiokol's top rocket manager and NASA officials
had concurred in going ahead, based on an engineering analysis concluding
that the backup ring would function if the primary seal failed, even under
those cold temperatures. Mr. Mulloy also said there was no direct connection
between the temperature and previous incidents of erosion and soot blow-by
on the seals.