William Gerstenmaier, “Transitioning from the Space Shuttle to Constellation” - MA Space Grant Consortium Public Lecture at MIT (4/15/2009)

Search transcript...


HOFFMAN: My name is Jeff Hoffman. I am the director of the Massachusetts Space Grant Consortium. Space Grant is a NASA-sponsored organization involving over 750 universities nationwide of which we have 18 here in Massachusetts who are members together with the Museum of Science and the Christa McAuliffe Challenger Education Center.

Space Grant is interested in aerospace education, in increasing the workforce of trained aerospace workers, engineers, especially systems engineers. It is also a presence that NASA has in the many states which don't actually have NASA centers.

And one of the things which the Massachusetts Space Grant has been doing, really, over the last 20 years-- if you look at the last page of the handout, you'll see a list of very distinguished lecturers who have come here to talk about their work in aerospace. And this year, it's our great pleasure to welcome William Gerstenmaier who is the NASA associate administrator for space operations.

I'm not going to give you a complete biography. It's printed out on the inside. Probably all of you have had a chance to read it. But I just want to remind you, first of all, that with the responsibility for spaceflight operations, that means that Bill is responsible for the operation of a space shuttle and the International Space Station.

So you can do the arithmetic yourself of how many billion dollars a year he's actually responsible for and how many billions worth of accumulated hardware he is responsible for. It is a very serious responsibility. And I think NASA and the country is really very fortunate that in Bill they've found somebody who is not just a competent-- more than a competent-- excellent administrator, but is also a first-class engineer.

I actually first got to know Bill way back in the early 1980s when he was a propulsion engineer at the Johnson Space Center. And he admitted when we were talking about that earlier today that that's still his deep love. And he is still a working engineer. And he is very much interested in the engineering aspects of all these very complex systems that he is responsible for.

In fact, the title of the talk that we use as a working title for a long time is "The Transition From the Space Shuttle to the Constellation System." And he'll have a few words to say about that at the end.

And we'll certainly answer a lot of questions about it, but, in fact, one of the critical aspects of the transition from the space shuttle to the constellation system is the continued safe operation of the space shuttle itself, which is no easy task. You're all aware that the space shuttle is extremely capable, but it's very complex. It's getting old. And over the years, we've had a lot of problems, which have had to be addressed.

And as an example of the sort of continuing engineering problem that has to be dealt with in the safe operation of the shuttle, Bill is going to talk about a recent systems engineering problem which had to be solved. So I think this is a really nice talk here at MIT that you're going to hear, really, about a systems engineering problem of operational importance for the space shuttle. So with that, I'm going to plug you in, Bill, and invite you to come up for your talk.

GERSTENMAIER: Thank you. All right. So, again, thanks, Jeff. And thanks to everybody that took time to come here. I'll keep this kind of informal.

And I'll talk a little bit about a systems engineering problem, as Jeff talked about. And I'll answer any questions on transition and other things, but I think it's good that you get a chance to maybe hear kind of behind the scenes how we solve problems with the space shuttle, and how we fly in space, and what things are there.

So I'll take this example. This is the flow control valve issue. I jokingly call this my senior design project. I'll start out with kind of a chronological order of how this unfolded. And I won't do it in hindsight. I'm going to do it as it occurred to us in the engineering community and the shuttle and station programs on a day-to-day basis.

So I could go to the end. And then you would get the Reader's Digest version-- and we fixed the valves, we flew them, and everything was okay. But that's not the way it really happened.

So now you get a chance to see how it unfolded. And then you'll get a chance to see how we use system engineering tools, how we use the team, how we used expertise, how I used folks in Mississippi, people in Cleveland, people out in California, all together as a coherent team to go solve this problem.

So with that, you ought to get an understanding of kind of where we are overall. And I'll answer any kind of questions at the end.

HOFFMAN: So it's the one closer to you that makes it--

GERSTENMAIER: Yep. All right. Other way? Oops. Other way. Here we go.

HOFFMAN: Yeah, because here's--

GERSTENMAIER: Here we go. Okay.

HOFFMAN: That's the laser if you need it. And the middle one is forward.

GERSTENMAIER: Okay. So this is a schematic of the shuttle. This is that big orange tank you see out on the outside of the shuttle in simplified schematic. It has an oxygen tank and a big hydrogen tank.

The system that we had the problem in is in the hydrogen system. And the way that the shuttle works is we have the three main engines. And each one of the main engines, we tap off the hydrogen that cooled the outer jacket here. We tap that off, and we run it through a little thing called a flow control valve.

And this valve, this tiny little valve, controls all the pressure that goes into that tank. And I should have brought that-- I had the valve with me in my briefcase, but I forgot it, so we didn't bring the valve.

But it's a little small valve about the size of this device. And there's three of them in there. And they control all the pressurization of that tank, and so they're obviously a very critical component.

So if you take a look at where they live, there's three of them. They live in the aft compartment of the space shuttle. They're in these three locations. They're latch valves 56, 58, and 57. They sit in those three locations in the aft compartment of the shuttle.

So the main engines-- the plumbing goes from there, up to these valves. Then it runs up the entire length of the tank, about 170-foot run of pipe. Goes back down in and drops into the top of the external tank. And their purpose is to keep the tank pressurized and at the proper operating pressure.

So if you take a look at them, this is what they look like in real life. They're about this size, the size of this pointer. They're made up of shims. They sit-- oops-- and this picture kind of shows a little more detail of where they are.

Let me just go back one. They have shims on them. I don't think there's anything else.

Here's a solenoid that keeps them in place. They're here. This is the way that the flow comes down, comes out of the main engines, goes in here, then flows to this little area, then flows out, in and out that 170-foot run to the tank. You'll notice that the entire poppet stroke is 170/1,000 of an inch. So it hardly moves. It also never goes fully closed.

It's always open at some point to keep the tank there, because, if you think about it, the pressurant that's coming in is coming from the main engines that pressurizes the tank that is then feeding the same main engines. So it's a closed loop. So therefore, it never actually has to ever fully close.

And so when this solenoid is activated-- or energized, it pulls this valve in, 170/1,000, slows down that flow, keeps the tank pressurized. And then when it's turned off, it goes to the high-flow state. So with that, you know everything about flow control valves. So you can check that off on your resume somewhere.

Now, this is what we saw in-flight. So what we saw in-flight was this is one valve, operated fine. This is the outlet pressure-- looked okay. This is the center valve, latch valve 57.

It went to essentially high flow and stayed at high flow until we got main engine shut off. This third valve, it shut down when this one went to high flow, because all three of them tee together, and they flow into the tank.

So when this one failed to open, this one compensated by dropping down. Everything was fine, absolutely no change, performed exactly the way it should. Totally nominal engine performance. Everything looked good. The system did exactly what it should do.

We looked at this in-flight after the first eight minutes. We saw it right away. We assumed, ah-ha, the electrical system broke. The solenoid didn't work. The valve went open. We'll fix the wires. We'll go fly again the next day. No big deal.

And you will note that that was November 15, 2008. And again, not in hindsight-- this is as it occurred. So we looked at this. No big deal. Easy. Must be a loose connector, loose wire. The valve didn't fully close, so life was okay.

Now, December 19, we go into the aft compartment. We X-ray into that all that plumbing you saw there. We stick a couple of X-ray plates underneath there. We put a radiation source on the outside. We shine the X-rays through there, and we get this picture.

Now, if you look at this picture, to the trained eye, you can't really tell what you're looking at. But instead of seeing a full, round circle here, you can see there's, like, a piece missing. So if you look over here on this picture, there's a full, round, like, quarter-sized piece. And there's this chunk missing.

And what we see in the X-rays, we saw this chunk missing. So that's what gave us a clue is, hey, there's something wrong here. There's a piece missing to this valve. It looked like it failed. We pulled it out, and this is what we found.

So just a little tiny piece. And if I had it with me-- it's really small. It broke off. And then that allowed it, essentially, to mimic high flow.

And then the other valves shut down. So the failure was this little piece broke off, and now our problem was-- from December 19-- is to figure out what caused that little piece to break off.

So the first thing we did is we said well, we'll go look upstream. See if there's anything upstream that could have flowed down into the valve. So we looked upstream, and lo and behold, there's this big chunk of braise here.

And if you look here, this is the outside of the tube where it's braised in place. There was a hot spot when it got braised. So the person that braised it braised it and overheated it. It put some anomalous gold blob on the inside.

It looked like a piece that separated off of here. We call that the separation gap. It looked like a piece of this had broken off. So our hypothesis on December 23rd, four days later, was that a piece of this material broke off, went down, hit the valve, broke the valve, and therefore the piece came off.

So that was the theory on December 23rd. We'll find out that this was a red herring and didn't have anything to do with the problem. But it was an interesting thought at the time.

So then we further looked upstream. And again, what this is is this is the flow control valve. This is the flow in. Then it goes here. It hits this 90 degree corner which is essentially a block of metal. Then it goes around another 90 degree corner. Then all three of them T in this manifold. And then they go up that 170 foot line up to the external tank.

So we took a borescope and went in there and we looked. And lo and behold, here's two little ding marks right where the particle hit. So it came in, hit this corner, bounced off, hit this corner here, and then went up here. It made no marks on this area. Made no marks on any of this tubing. But yet, down in this area, it took this little chunk of metal out down in this area.

Now the reason this is important was there is a concern that first of all, if this piece breaks off, can it overpressurize a tank? That would be one failure. The other concern was that it turns out that the flow out of this piece-- and I'll show you some CFD plots in a minute-- but the flow out of here is about 1,000 feet per second.

So even though this particle weighs just a couple grams, it's just like a rifle bullet going down this tube. And it didn't do much damage. But could it actually damage the tube here? And that's a question we're going to have to answer later.

Could it then come up here, damage a tube? Could it ricochet here? It's still traveling 700 feet per second here at this point. It's 700 or so feet per second even out here. And then it's about 600 feet per second all the way up that 170-foot line into the tank.

So that kind of velocity could potentially penetrate this tubing. So now we've got to be careful. If another one of these breaks off, could it then rupture a piece of tubing and cause a hydrogen leak? Which wouldn't be a good deal.

So then the next thing we did is we started taking a look at our valves to see if we could see anything. So we go to a scanning electron microscope and we take a look at our valves. And this is what we see on the surface.

And when the shuttle was designed, we really didn't have the capability to do scanning electron microscope inspections like we do today. So we look at this. And this is pretty much that machine surface.

So if you look at where that valve comes together, it's just like the quarter pieces up here. And then it comes together in this little radius where that little quarter piece sits. So this is a 2000 times x-ray in that little radius.

So what you're seeing here is just basically the machining marks of how that little poppet is machined around there. So we didn't see anything here that we thought was too anomalous or too big a deal. But you can tell that there's a lot of machining marks in here that could mask some things if you do the typical kind of inspections that we do.

And at this time, all we used to do is we would put dye on the material and we would shine a fluorescent scope on there and we would look for cracks or imperfections. It's not a very sophisticated technique, but it's good to find little cracks and little imperfections. And this was on January 14th when we did this test.

So then we started looking at it from a structural dynamics standpoint. And we started looking at the flow. And as I described to you, the flow across here is about 1,000 feet per second. It goes through a very small orifice.

And it turns out that potentially, that flow can couple into this lip. And this thing can vibrate at a high cycle, maybe 100,000 Hertz, and it could actually break off.

So we had this theory at this point that maybe the failure was associated with this extremely resonant condition that could occur periodically. We had not changed these valves from the beginning of the shuttle program back in 1981. So intuitively, we didn't think it could be a problem.

But maybe there's some coupling that can occur that this thing can couple into that natural frequency and just break off a piece. It would be essentially an uncontrolled breakup as that occurs.

So this was the first kind of analysis we had back on January 21st that started making us get a little bit concerned that maybe there's something going on here more than we had really thought.

So then we went back and we looked at our failure history, and our failure history was kind of sordid. We didn't have many failures. We had two failures that occurred at acceptance test programs.

So these valves had not flown anywhere. They just went into the test rig. We were doing acceptance tests to make sure that they were ready, and they failed. And the crack size was-- whoops-- the crack size was 57 degrees, or that little arc was a 57 degree arc.

And in this case, it was a 72 degree arc. And then the failure that we saw in flight, this was an 87 degree arc and it had flown 11 times. And then this one, we went back in our inventory and we looked, and we could see a crack.

And it was a fairly large crack in there. About 270,000th, 0.27. Almost a quarter of an inch crack that was very visible even with our dive penetrate activities. We had pulled this valve out for an anomaly back on STS-97. We hadn't looked at the valve. We pulled it out now and looked at it and lo and behold, there was a crack there.

So we had this data, and this is all the data we had. And what we were struggling with was, were these initial failures here with 0 flights-- was that this resonant thing that I just showed you on a previous page or was it something else going on with these valves?

Or were these outliers? Were these manufacturing defects that we essentially screened out with this acceptance test procedure? And we didn't really know at this time. So what we're trying to do here is we're trying to look back at past history and relate to what we to see if we can tease out what the root cause is, or what the root cause of the failure is.

So again, now what we're trying to do is we're trying to data mine. So it was unique to this valve engine position. So we plot the three engine positions. We plot where these valves have flown. We're essentially data mining to see if this natural frequency shows up in only one engine location.

Does it show up in others? Is it a function of the inlet/outlet diameters? It a function of the valve housing? We're just looking at raw data to try to understand if we can find any correlations. And we spent a ton of time with this and we couldn't find anything.

We then kind of kept looking a little bit. We pulled back the acceptance test procedure failures. And these occurred back in 1990. And if you look at them a little bit in these pictures, you could see that there's initiation site, and then they pretty much just break in a high-cycle fatigue kind of thumbnail. This is very much what a crack looks like in a thumbnail section.

This one over here, this is the one from flight. And you can see in it, it evidences a couple of different zones. You see a zone 2, zone-- excuse me. A zone 1, a zone 2, and then a zone 3. And the zone 3 is the actual failure.

So when we look at this, it's another view of the same thing. You can see the various thumbnails going. This is very typical of a high-cycle fatigue. So this isn't a one time kind of failure. This doesn't occur immediately.

This is telltale evidence that it occurred over a large number of cycles. So this appears to us to be some kind of high-cycle fatigue issue, but not an immediate failure. But our ATP cases-- those all clearly look like they just immediately failed in the first application of loads. You put a load on it and it failed.

So we use this data to kind of say that well, maybe these are just outliers. We'll throw that data out. We've got some kind of high-cycle fatigue problem. We're probably okay to fly as long as we screen for cracks is kind of what we thought at this time.

Now I will tell you that is what I thought. I have a large team that supports me. And part of my team carries the title safety, so they have to think the opposite way I do no matter what I say.

And they're thinking, it doesn't matter. This is just nice pictures. You're crazy. It's the same failure. It can happen anytime. We're grounding the fleet. So then we're having wonderful discussions about all this. But that's life. And that's actually good.

So then we said, okay. Now if they're going to tell me it can happen on any flight, I'll go look at the consequent side. So what I did now is I went down to-- a team went down to New Orleans down to the Space Flight Center, and we essentially mocked up the 79 feet of tubing. So we actually put 79 feet of tubing exactly the same size there.

We put an orifice in a line. We put a couple of camera ports in. We put some laser measurement ports in so we can get the velocity right. And we built a little system to drop particles into this system. And we were firing particles at 700 feet per second down this tube.

And so we fired about 200 or 300 particles down this tube. And you can see here, this is what it looked like in the worst bend, which was this first elbow here. Just little scuff marks. No big dings. No big hardware.

And you can see here if you look really hard, we actually bowed the metal out a little bit with one of the shots. So it's a kind of a probabilistic game of if they fly exactly the right way and they hit flat edge on, they're just going to scrape. But if they go knife edge on, they can really cause some damage. So even though this is pretty compelling test data, it still wasn't good enough necessarily for my analysts.

So then at this time we said, okay. Can we do a better job of inspecting? So what you see up here is-- whoops. What you see up here is we figured out a way to take that little edge where that little metal is and we actually polish it with diamond dust.

So where you saw all those little machine marks before, if we put diamond dust on a little small piece of cloth and we put a toothpick on there, we can actually shine that piece up. So then we do the scanning electron microscope, it's not hidden by the machining marks and we can look for cracks. So this was a brand new technique that we kind of developed on the fly to go do this diamond polishing to not destroy it.

Now the other problem I had was I couldn't remove a significant amount of metal here or I would invalidate my flight hardware. Because the shuttle program's ending, I took away the flow-balancing rig that allows me to set the solenoid strength with the flow through the valve to the proper current so it moves in the right direction.

So I didn't have a way, once I removed metal from these, to ever fly these valves again. So once I actually even did this little bit of polishing, the valve was no longer certified for flight. So I couldn't go look at all my flight valves with this technique or I would invalidate it and it wouldn't be a piece of flight hardware.

Now I'm in the process now, and the flow rig is up now and it's available today. But we would've missed that launch window. We would've been after the Soviets. We would probably be trying to launch about this time now with the shuttle mission if we would've destroyed our flight assets.

So I'm now constrained. So this is a different problem than you'd like to have as an engineer. I would like to go take my best inspection technique and use it, but I can't because if I use that best inspection technique, I've lost the ability to go fly that piece of hardware. So that's another consideration that we face in the engineering world that sometimes you don't face in the outside world.

So then we took a look at our older valves, which we could easily do. These are the-- or excuse me, these are the newer valves. And because I didn't have the new inspection technique, I'm looking at these with dye penetrate and I'm seeing no cracks.

There's no cracks in any of my new valves that I'm flying. The only crack I've ever had was this one that actually broke on flight on STS-126. So now I'm starting to build rationale that maybe there's something between my old valves and my new valves that are there.

But I'm really blinded here because I have a very bad inspection technique. I just had this dye pen inspection technique. I don't have a way to really look for the very, very small cracks.

And so then what we're doing here is that now we can actually start to see some of these cracks in these older valves. And this gives you a feel for how small we're looking for. The big back line up here is 2/1000ths of an inch.

This crack width down here is about thousandth of an inch . And these are really small. And so if you think about it, I do this diamond dust on the lathe. I polish it up. And then I take 4,000 images around the top of the valve.

And then I have someone manually inspect all 4,000 of those images looking for cracks on the order of 1/1000th of an inch to maybe 1/10,000th of an inch in length.

And so at first I go to my guys, why is it taking you, like, two days to inspect my valves? You should be able to get these pictures and get them back. And then they showed me the 4,000 images and they asked me if I would like to go through those 4,000 images in the next half hour and give them an answer. And I said okay, I understand.

So then we went back again. And this is what we saw with this technique in the older valves. We saw lots of cracks. I mean, they were everywhere. Now the other thing that's important is these valves have flown since the first shuttle flight, so there has been no change from the first shuttle flight.

So we are flying with the same risk whether we realized it or not since STS-1 back in 1981 until today. And because we didn't have a good inspection technique, we thought everything was okay.

But in reality, here's what we were flying with. And this is the one that we found later. This is a big crack. A quarter of an inch long. We even saw that with a dye pen. The other ones we couldn't see.

But we had a significant amount of cracks in our valves, which means potentially we could be losing a lot of these if they couple into this flow. So there's definitely something on here we need to be looking at. This is a serious problem. We've got to really understand this before we can go back flying.

So again, this is before polishing. So you can see all the machine marks here. Then down here, you can see it after polishing. And then you can see, this is what the crack looks like. And then I blew it up over here. So again, you can see the crack over here on this side.

So this is a very good technique. This really gives us a great way to go look at these valves. The problem is that it invalidates the valve as a flight valve. So this is the technique I really want to use but I can't use. So again, just another picture of the crack again.

Now we're again back looking at some of these. So when we found these cracks, we've now got the ability to now load the edge of the valve. So now I put it in an Instron machine which you guys are familiar with, and I tack on a little strut on the end. And now I'm going to pull on the valve until it fails.

And so what I'm doing is I'm pulling on the valve with 250 pounds, 12,000 cycles, and I get a failure like this. I pull on the valve 175 pounds for 3,000 cycles, I get failures like this. And so what I'm doing here is I'm trying to understand, is this high-cycle fatigue where we get the three zones of fracture? Is that real?

And you can start to see in these pictures, it shows the various failure zones just like we saw before. So this looks like a very promising failure mode. So this I'm going to try to use with my engineering team to say, I'm ready to go fly.

What I'm going to try to tell them is if I dye penned, I didn't see any cracks. I didn't have-- I've got maybe 12 flights on these valves. Nowhere near these number of cycles. I'm a long way away from a failure. That's good enough to go fly. Let's go fly.

So this is the rationale I'm about ready to go try with my team. And you'll see at the end the timeline of where I failed with this rationale. But at least I tried.

So again, this is just the same thing. You can see this is the part that actually failed. The three zones we talked about-- the four zones. And then down here, I did another overload. And here what I did is to get it to fail, I notched a little piece. So I notched the two corners, and then I overloaded it and it popped.

And why this is important is the crack ran, and it would have ran further except it ran it into the notch that we put in to make it fail. So the problem here was I had to also limit the size of the failure.

Because if I lost a big enough piece, the particle testing where we're shooting particles down the tube showed that I could penetrate a piece of tube and cause a hydrogen leak which we thought at the time was a big deal. So I was again trapped.

And I had to bound the size. I had to show that enough life in these parts would [INAUDIBLE] and I could go fly. And that's the rough flight rationale we were trying to get together.

And then my wonderful dynamicists, the CFD guys, came along. And they did this plot. And what they found here was that as the engines throttle up and down, the valve position moves a little bit. And it turns out that depending on where we are in the throttling case and the material, you can either couple into one of these dynamic modes or not couple in this dynamic mode.

So going back to the original theory where I showed you that you could get the single event that fails, they're now giving me a population why it doesn't occur very often. It only occurs when I'm in certain throttling conditions, and I have to stay in that throttling condition long enough for it to fail.

So then we went and we said, well, okay. We'll try to fire some bigger particles. So we fired them into that elbow. And you can see right here, I shot a hole through the elbow, which wasn't such a good thing.

I actually got so good at sending these things down, I could actually get them to stick in the elbow, which was not a good thing. But my test team was exceptionally proud of this. They calculated ahead of time what velocity they needed to get it to stick into the elbow. And then they beat me $5 that it would stick in the elbow. And it stuck in the elbow and I paid them $5.


But I didn't feel so good about that. So we had good analysis, but it showed that, hey. This is really a potential problem. And you can see the same thing here. We also put holes. And this is what the elbow looks like in itself. We manufactured a bunch of these. And in Cleveland, we actually shot these particles at them to see what would happen.

So then finally, this is kind of coming to the end, is that what happened was we had these assets. And then luckily, my team kept working on another inspection technique, and I'll show you some pictures of it in a minute. It's eddy current.

And they were able to use eddy current to define cracks. So these are my old valves. These are the ones where we saw the cracks before. We had previously not seen any cracks here. But now I can get eddy current indications that show that there are cracks even in my flight valves.

So I got a new inspection technique that allowed me to now determine that there were very small cracks present in some of these valves. So now I had a method to go hand-select valves to show that there were no cracks with any detectable method of inspection. And that's eventually how we got to go to flight.

Again, this just shows the various NDE techniques. Polishing and etching, mag particle, eddy current, and then scanning electron microscope. They're kind of all different techniques, but probably the scanning electron microscope is the definitive one if you can look at the images. Eddy current turned out to be very, very good, and I'll show you a picture of that in a minute.

But again, I didn't have that technique until the very end-- until the March timeframe, just before flight. And what happened was I didn't even know that this existed. I was about ready to throw in the towel. I told my team we're not going to fly unless we can inspect.

So therefore, we're going to have to fix the flow-balancing rig. We're going stand down. We're not going to fly for a couple months. And they go, well, we've got this new technique we've been working on. We haven't told you about it. It's called eddy current.

We'd like to try it on these valves. If we can and it works, would you accept that as flight rationale? And I said, well, okay. So then they went ahead and did that.

And what they did is they went out and they bought a bolt tester. And they had done this at Christmas, so maybe this is a Christmas gift. They bought this bolt tester, and it has a very nice little probe on it that fits right-- this is the poppet-- it fits right into the area of problem.

And then the valve scans around. And in about 20 minutes, they get a trace of the entire interface. And it looks for imperfections in there by looking at the eddy current changes and it can detect the failures. And it turned out to be very reliable.

And this is an actual screen sample of the picture. And even I can find the cracks that are here. And then they repeat down here again because they actually rotate the part around twice to confirm them.

But this is very good. It no damage to the part. And it's 100%-- it's actually better in some ways than the scanning electron microscope because it doesn't need the human to go find It. So with this tool, I had the way to go select valves. And this was the way we ultimately ended up going to flight.

At the same time, when I punched a hole in the corner-- we never give up at NASA, right? So we had designed this. And this is a doubler. So we built this little device that we could install in the orbiter out at the pad and actually go fly with. It carries a little O-ring in here, so when I punched a hole in the corner it seals itself and will not leak.

So I had these built. They're certified. They're ready to go fly. We chose not to fly, but they're available if we want to go fly them. So if you can't fix the problem itself, can you then put some kind of splint or Band-Aid on the outside that makes the consequences less for you? And that was the intent of this device, but we ended up not having to use that.

So then basically where we ended up with what we think is going on is hydrogen-assisted, high-cycle fatigue. So the fact that it's in a hydrogen environment, it's embrittling that interface. So when a small crack starts, it hardens in that interface, and then cycles, and then hardens a little more and cycles and hardens a little more, and it finally relieves itself.

So we're pretty confident that we can fly valves without cracks, we have a good flight rationale. And that's going to be our rationale for probably the remaining number of flights on the shuttle.

We do PRA. So we looked at the probability of the poppet breaking, the probability of the size being big enough to cause damage, the probability of an impact, and the probability of actually causing some kind of damage. And in this is loss of crew and vehicle. So we're looking at probably with the wear-out case, we think we have about a 1 in 450 risk of flying with this design.

So again, I'm going to go through this, but this is basically the chronology of what I just talked to you about. But what you see through here is-- oops. Again, I tried to get the flight rationale here. We do a big flight readiness review.

There was no way I was going to get the resolution here. We waited until-- the next chart-- we waited till here on February 20th. I thought I had good enough rationale there. That didn't work.

And then we finally got eddy current here, and then that was the thing that actually allowed us to go fly down here or at least attempt to fly on March 11th. And then we ended up scrubbing on that flight for an unrelated hydrogen leak.

But the thing you ought to take out of this in terms of messages-- you didn't hear about any of this in the press. All you hear about in the press is the shuttle didn't fly. Some aging hardware problem, right?

And it wasn't an aging hardware problem. It was a design problem. The design problem was there from the beginning of the program. We were exposed to the same risk all along.

We had seen this a couple times in other failures but we didn't pursue it to this level. And now that we finally pursued it to this level, I think we understand this problem and we know where we are.

Now the story that's not up here is we flew successfully. We got back, we eddy currented the valves. They were fine. They were crack-free. I then got my flow bouncing facility up. I put one of the valves in the flow balancing facility. And after the flow bouncing facility, a crack showed up.

So this implies to me that there's still this loading phenomena going on. The flow-balancing facility uses nitrogen, it uses higher pressures and higher flow rates, so it can definitely stress these valves. So we're still going to use the same rationale to scan no crack-free and then go fly. We're also looking at alternate material to go change.

So hopefully through all this, you kind of got an idea of what it takes to actually get a shuttle to launch and what my life is as a program manager or AA at headquarters. Now as AA, I'm not supposed to do any of this stuff, as Jeff said.

I'm not supposed to understand anything technically. I'm supposed to be a politician that goes and talks to all the White House staffers and the Executive Office of the President and all those folks.

But that isn't my passion. My passion is this stuff. They've momentarily got me stuck in DC. So rather than talking about shuttle phase out, transition, politics, and those kind of things, I'd rather talk about engineering.

So hopefully out of all this, you learned something about how we do systems engineering. This is a huge effort. The team is probably about 1,000 people supporting this. They're in Cleveland. They're in Louisiana. They were in California. They were in Marshall Space Flight Center.

I've got fluid dynamics guys. I got materials guys. I got NDE guys working on this, and gals. I mean, it's an amazing team of pulling all this effort together to go essentially from this problem we saw really in December until flight in March, which is a pretty phenomenal amount of work in three months.

I probably fired over maybe 1,000 particles at tubes. Computer Cray runs on the order of probably a couple hours out at Ames, looking at the CFD stuff. So the amount of effort and work that went into this is phenomenal. The amount of weekends, the amount of holiday time that the team's put in is just unbelievable.

So you don't see any of that. But then when this flies, I can tell you, I was not looking out the window in Florida at the shuttle launch. I was looking at the data of the flow control valves and watching those pressures at the outlets to see how the valves were doing.

And I didn't really care about looking out the window. I knew what I needed to go look at in terms of data. So again, that engineer tendency comes through.

So with that, I'll conclude and open it up to any kind of questions you have. Anything you want to talk about just feel free to ask, and I'll talk to you about any subject that you'd like. So thanks.



AUDIENCE: Are you going to expand this validation method of using the bolt tester to test other components on the shuttle you might have similar worries about?

GERSTENMAIER: Yep. We sure are. It turns out-- we looked at the oxygen valves. I didn't show you, but there's a very similar system on the oxygen side that pressurizes the oxygen system. We also tap the oxygen off and feed it in the oxygen tank. We're doing exactly the same thing with those valves. And the technique works really well.

So this bolt tester was actually designed by a company I think in the oilfield industry to look at bolts-- to look at bolt heads. So this tool is designed very nice. It has two little, tiny probes that sit right on the edge. It makes it just perfect for doing this task for this design.

So that's another huge lesson learned, is you don't need to go out and invent your new technique or your new concept. See what other folks are doing in a totally different industry, and can you then adapt it to the problem that you've got?

These guys didn't know, but we gave them I think, $20,000 to go by this bolt tester and it ended up saving a shuttle flight by probably six months of effort.

So we will definitely do that. We're going to stay-- I call it staying hungry. You just need to keep looking at all these things. So when you get a little anomaly or a little problem, that's a gift.

So then you got to take that gift and expand it as far as you can to understand what it's really trying to teach you. And don't just say, that's a one-of-a-kind failure and blow it off, because later I guarantee you it ll come back.

Because typically when a major failure occurs, you've seen indications of it coming along the way and you've ignored those for a variety of reasons. And I think you guys see that probably in your own testing in your own labs.


AUDIENCE: Bill, how concerned were you that the team becomes myopically focused on this one problem and that other problems that need attention in the same reviews don't get the same amount of attention?

GERSTENMAIER: Extremely concerned. And so they get lectures from me. It's called kids soccer lecture. And in kids soccer, wherever the ball goes, the little pack of kids moves to the ball, right?

So I tell them that that's not how you win soccer games. You win soccer games by being strategically placed across the field. And the ball may be nowhere near you, but you need to be there so when the ball gets there, you're ready.

So it's the same thing here. okay, you guys focus on the flow control valve. This other broader team, you better be positioned across that soccer field and be ready for that next problem that's coming.

Because I get very concerned that you get this tunnel vision that you're working so hard on this one problem, that's all we talk about. And we don't worry about all the other 100,000 things on this shuttle that could be a problem, too. So that's a very good point. Yep.

AUDIENCE: At what point where you convinced that this thing would fly?

GERSTENMAIER: Well, I was convinced probably at the second flight readiness review. So the first flight readiness review, I was not ready yet because there was still enough uncertainty.

But then by the second one, I had enough of an indication that I was relying on flight history, I was using it smartly, that we weren't seeing this all the time. I couldn't believe that we could couple into this every time. And I thought our dye pen penetration measurement was probably good enough to go fly.

So I was convinced. At that point, I was pretty much ready to go fly. But my team at that point convinced me that I wasn't ready to go flying. So I acquiesced to the team and we decided to stand down.

And it turned out that one of those three valves we were going to try to fly did have a crack in it when we looked at it with the eddy current. But it also surprised us that one of the very low flight rate valves, one of the four flight valves, actually also had a crack in it.

So you really have got to do this inspection. So it's the hydrogen assist that's causing those cracks to form at a non-uniform rate. So I was a little bit ahead of the team I think in terms of where I was ready to go, but the broader team wasn't there. Yep.

AUDIENCE: Was it ever considered as a possible solution to try to avoid the throttle regime that was coupling through the oscillator?

GERSTENMAIER: We look at that. But it turns out we're throttling because the load on the outside of the vehicles is around high Q or the highest dynamic pressure on the outside of the shuttle. We have to throttle back or the loads get exceeded where the shuttle attaches to the external tank.

So there's really not much choice there. And that's all automated in software. So those throttle buckets are going to occur. They're based on winds of the day. They're based on what the atmospheric conditions are.

So I can't even predict them, and I can't bucket them out in software. So they're going to happen. So they're going to be there and they're going to couple in. And they're random when they occur. So there was no way to defense against that. Yep.

AUDIENCE: You kind of touched on this a little bit, but I was wondering how in general the end of the shuttle program-- does that affect the way you guys approach problems like this?

GERSTENMAIER: I try to not let it affect the way we're flying. You know, I'm supposed to fly all the remaining shuttle flights. There's nine. There's really eight, but we're going to get another one added to fly in AMS. So there'll be nine shuttle flights.

We have to get those done by December 31st, 2010 is the schedule but I don't really let that drive us. We're going to work these things. And when we're ready to go fly, we're going to go fly.

So I think you need to be, at my words, you need to be schedule-aware. There was a Soyuz launch after this. So if I missed this first window, then I got to go on the other side of the Soyuz launch. My whole rest of my manifest ripples a little bit.

So then I moved from the last flight being in September to the last flight being in October. Eh, that's not a big deal. We'll do the right thing. So I think I'm aware of where the schedule sits. But I'm surely not going to do anything or push anything that makes us fly when we're not ready to go flying.

And you could see that in the team. I mean, when I sat there and I discussed with the team-- you know, you asked me when I was ready to go fly. I was definitely ready to go fly. When the team wouldn't let me go fly-- they tape all these things, so someday somebody will play this back.

And I have this politically incorrect moment where I explain to them all the other risks that were getting pushed on the space station side, and the assembly flights, and all the other activities on board station that were dependent upon this flight occurring. And that even though we thought we were doing a conservative thing, we may have been pushing risk in other areas unbeknownst to us.

Now I should not say that, and I feel really bad because I've listened. Now, I was in the shuttle program for both Challenger and for Columbia. So that's tough. I mean, that's really hard in our business. Because I worked with all the astronauts very closely their. Kids went to school with my kids.

And that's a huge failure. So I'm not going to do that knowingly and I'm not going to push hard. But I wanted them to know that there are other risks out there and it wasn't quite as easy as they wanted to make it.

So I exposed them a little bit to my world. And I got a lot of weird looks from them when I did that because they were not really thinking about all those other risks that were getting pushed out.

But then I felt kind of bad about that because I didn't want to put overpressure on them to start focusing on schedule. So it's that kind of, as a manager, you've got to know when to push the team and when to pull back from the team.

There's that performance curve, and where you want to operate is you want to operate right at that peak at the performance curve. If you're overloaded and you got too much work, you're on that other side, bad things happen. It just doesn't work.

If you're on the other side, you push a little bit harder, you get more performance so you as a manager got to figure out where your team is or where your project is. Are you on that left side where if I push them a little bit harder they can work a little bit harder on weekends and they can do some extra work and it won't be a degradation of my project?

Or are they right at that peak? And if I push them a little bit harder, then they're overloaded and then the whole team dynamic falls apart and we stop? So as a manager, you've got to make that kind of value judgment of when to push and when not to push. Yep.

AUDIENCE: I had a question not quite like this, but if you're trying to [INAUDIBLE] flow or control the flow of a saturated liquid and--


AUDIENCE: In this case, sure. But other times. Are you dealing with [INAUDIBLE] problems at all where you get some non-linear effects? And do you have any tricks that you use to deal with that?

GERSTENMAIER: Yeah, that was our big problem was that the CFD for this particular thing-- when it flows through there, it's like a converging, diverging nozzle. It's sonic at that minimum area.

But then it opens back up and it actually goes supersonic downstream. So then the question is when this little piece breaks off and now the flow increases, how does that dynamically change and can that accelerate the particle maybe even 2000 feet per second?

So we ran all these Cray supercomputer CFD runs to look at this. And man, is it complicated. And man, was there a huge debate. So then we finally said, okay. We'll take the worst case and that's what we're going to fire particles at. Because we didn't know what else to do.

But there's definitely a research area to go look at that. I mean, it is very complicated flow and it's not symmetric. We can now look at it. Because if you think about it, it's flowing in the top. Then it flows around the valve. And then it flows out. So it's not symmetric. It actually vibrates back and forth. It is a very complicated flow regime when you get there.

Now the other thing that's very interesting is when they did all those original shuttle design, they had no CFD. So they had no capability to do what we're able to do now.

And now I look at it, and I don't have the time to study it for a lifetime. So we're trying to determine what is the right bounding conditions to figure out the flow particles? And it was very, very difficult.

But we looked at that and we struggled with that. And we had the best, I would say we had some of the best CFD folks in the country working on this problem. Yep.

AUDIENCE: Sir, Is there any way to compare, say, the complexity of the center launch system versus the space shuttle system? And then you say, we'll take each collection of complications and see which is the most reliable to get the volume and weight and the orbit for station assembly. Is it worth the risk to use this thing versus what we had in the Saturn system?

GERSTENMAIER: I think that's a very good question. The shuttle's a tremendously capable vehicle. I mean, there's no vehicle that can carry-- you know, this flight carried up the solar array that goes on the outside of the space station. That was a 40-foot-long solar array. Weighed about 20,000 pounds. Took the full cargo capability.

There's no vehicle that could carry that including the Saturn. So it was truly unique, truly needed the shuttle. So there was no other way that piece could get there. But that's one piece.

But because of that, the shuttle is unbelievably complicated. It has a heat shield on the outside, which is not a good thing. It's cantilevered off the external tank, which is not a good thing. I've got all these pyro events that have to occur when we do separation.

It has a hole in the heat shield where the hydrogen and oxygen umbilical is attached to the bottom of the orbiter and they flow through 17-inch pipes up into the main engines that are attached in the shuttle through that. That's not a good thing.

It's got two doors that have to close after you get to orbit to make sure the heat shield is attached. So you're launching with a failed heat shield to begin with. Then you have to close two doors to get it there. That's not necessarily a good design.

So it's a very complicated, integrated system. And you saw here, I had to look in the orbiter half. I had to look at the 79-feet of pipe on the outside. I had to look at all those systems to make sure that they could work and be used. So it's very complicated.

So the Saturn is much more for a single vehicle And that's where we're headed with the new Ares Orion design. We're going to separate crew and cargo. So we're going to fly cargo on a separate vehicle, fly crew on another vehicle, and I think we can cut down on some of those interactions and some of the complexities between the two.

So I think we need to be headed to the system that more matches what our needs are. These flights are needed because there's no other vehicle than the shuttle that can fly these remaining flights. All the hardware is uniquely geared to them.

We take the risk for these nine flights, and then that's about the right time to retire the shuttle and then go on to the new system that's more geared to what we need to go do. Yep. You can follow up.

AUDIENCE: In that vein, though, has China's secured an advantage in its advance in its space program because they look at this and say, listen. We're going to skip the shuttle business. We're not going to shuttle. We're not going to do [INAUDIBLE]. We're just doing pop bottle rockets.

GERSTENMAIER: What's interesting is if you look at the new Russian design, which they haven't showed you yet but you'll see it in about a year, they're going back to the shuttle a little bit. They're going to go to a lifting body, and they don't think a single-flight vehicle is the way to go.

So the shuttle is the one extreme. Totally recyclable. Everything's reusable except for the external tank. The Soyuz-- nothing is reusable. It's a one shot, one deal.

Russians look at that. They want to try to fly 10 times with a lifting body and they want to minimize their braking thrusters and some other stuff on their vehicle. So they're heading back towards the shuttle.

So it's interesting. We've swung now all the way to totally expendable. The Russians are coming back towards some recyclable.

And then the Chinese-- they effectively have copied what the Russians had. And they Chinese-engineered it, in my terms. They got all the problem reports for the Soyuz and they fixed everything that showed up in the problem reports. They put a new modern avionics on it, but it's basically a Soyuz system.

So they, the Chinese, are trapped back in the Soyuz vintage. The Russians are going to be going towards us. And we're going back towards where the Russians are.


And that'll show up on some web somewhere and then I'll be in big trouble, but it's okay.


All right. Yeah.

AUDIENCE: Is there any talk about having China visit the station? Maybe not the next flight, but [INAUDIBLE]?

GERSTENMAIER: I don't know. We don't even know if they're docking system is compatible with the docking system on station. So we have not had any dialogue with them. We've had no discussions with them.

So the first thing, again, kind of from the technical standpoint, is are their systems even compatible with ours? They supposedly use the Russian system, but I don't know if they used it. Is it truly compatible or not? They may have changed the diameter. They may have changed some of the latching mechanisms. They may not be compatible.

So the first question is we got to have somebody kind of politically tell us we want to go do this. And if they do, then we got to go back and look at it. And you're seeing some people talk about it, but I don't know.

At this point, I look at it as an engineering problem. First of all, I got to look at compatibility and then we'll figure out the timetable to go do whatever we want to go do. Yep.

AUDIENCE: It seems a team with a shuttle being retired, that the variety of vehicles that would actually now go to station with ATV, HTV, COTS, and things like that. What are the challenges you're facing with thinking of all these different vehicles having to be accommodated at the station?

GERSTENMAIER: Yeah, I think what's really interesting, back to your point-- everybody thinks a shuttle is really tough. Well, not only do I do space shuttle and space station, I also do expendable launch vehicles. So I even have more headaches.

But I'm learning that there's something about space that is really about our engineering capability. So I don't know if you've watched the ELV world, but I'm also scrubbing ELV flights all the time for, you know, leaks in this system.

We just had the Atlas V. Their oxygen system Just had a massive leak in one of their oxygen pumps on a second stage. They tore it apart. They looked at the inlet. It was full of crud from insulation that somebody had sprayed in upstream and it all got sucked into the inlet filter.

So you tend to think our systems are all easy and they're not there. But if you really do the engineering and you peel behind the press reports and you look, we're really working state-of-the-art in a lot of areas.

And I think it's hard even in the expendable world. So that's a challenge to us, because I think people think it's easy. We're working with the orbital space corporation that they're going to build a new rocket for us. They're going to use Russian engines and a Russian design tank. They're in the process of qualifying that.

There's Elon Musk and SpaceX who's had one successful Falcon 1 launch and three failures. He likes to talk about his one success and not his three failures. I look at him as a package. It's good that he's learning.

He also has a lot of trouble launching-- he's supposed to launch here in five days I think, on April 20th with his first payload. That'll be pretty exciting to see how that goes. So we're following all that.

The ATV was a miraculous docking. I mean, all that software was done in the first time we came up and dock this vehicle to station, this huge vehicle to the back.

We did extensive ground testing. It took us 14 days from launch to dock. And the reason it took 14 days is orbital mechanics. We could be there in 2, but we spent the other 12 days checking systems out.

We would fly within 100 meters. We would back out. We would fly within 20 meters. We'd back out. We'd check attitude control system. We check crew displays to make sure all that work. So then by the time we finally came in for the dock, it was a fully checked-out vehicle.

So we did essentially a protoflight flight on that flight. So we had cargo that we needed, but it wasn't absolutely critical. And then we did essentially, the test program all the way to dock.

We're going to do the same thing this September with a Japanese vehicle. It's the HTV. It's going to fly up underneath space station and stop and then get picked up by the SSRMS, the Space Station Robotic system. And then berthed at the bottom of the station.

So that brings a whole new series of challenge with us. We've been working that program for 15 years. So when that thing actually flies, it will have 15 years of hard engineering sitting behind it before it goes and flies. And we'll do the same kind of, probably-- I think it's a 16-day profile to come up and do the HTV demo and test.

So again, yeah, it's a tremendous challenge. It's a lot of different vehicles. So now we have to learn a lot of different systems. But again, that's what's kind of neat as an engineer is you get to see how the Japanese solve a problem, how the Russians solve a problem, how the Europeans solve a problem, how the Russians solve a problem.

It's the same physical engineering problem. And each one of them takes a slightly different engineering approach to it. And when I get to see, because I get to see them all. And then I get to kind of internalize which one might be a little bit better in this application and which one might not be. So it's a great program. Yep.

AUDIENCE: You mentioned an estimated failure probability of 1 in 450. That seems really high for this problem. Is that for the launch system overall, or is that if you haven't worked the problem for this particular problem, if you hadn't noticed it, for example? So that's what you were dealing with before. Do you have an overall acceptable failure probability level?

GERSTENMAIER: For each shuttle launch, our failure probability is about 1 in 77. And the primary driver for that is micrometeoroid debris damage on orbit. So again, our heat shield is fully exposed. So there's some things that can occur to our heat shield that we inspect two days before we land, but we don't inspect any time after that.

So in those final two days, we could pick up some damage that's undetectable or we didn't know about that could be a heat shield problem. And that's the predominant risk during entry, and that's what drives the 1 in 77.

This problem would have been-- who knows what it would have been before, but this 1 in 450 was this specific problem with all the techniques that I described. So I did essentially a distribution about all the particles that I fired down the tubes. I did a distribution about how likely this thing is to break between 10 degrees and 180 degrees. All those were in there, and that's just a mathematical sum.

AUDIENCE: And it's always catastrophic?

GERSTENMAIER: Well, we assumed it was catastrophic. We later did analysis and we determined we could actually tolerate that leak. The leak I showed you in the corner, that little hole. We could actually tolerate that hydrogen leak in the aft compartment.

So it wouldn't affect the tank pressurization. We would have leaked a little bit. And only if that hydrogen were to combine with oxygen and drifted over to one of my APUs that sits at 1,000 degrees Fahrenheit could be a potential detonation. I think that's very unlikely.

But to just be worst case, we assumed that that was possible and was a catastrophic failure. So I would be very careful with our PRA stuff. It's just a math model. The absolute values do not mean anything.

The PRA is very good if you're trying to compare systems. So if I'm going to make a systems design change and I'm using the same math model, then I can look and see which system design gives me more reliability than another one.

But to try to use this PRA and compare it to, say, Soyuz, or compare it to HTV, or to compare it to Saturn or other vehicles, you cannot do that. The models behind them are so different that it's not tractable.

So I look at it as a tool, but do not ever use this tool for any critical decisions other than maybe looking at two specific designs in the same system. And I have a lot of trouble with my friends in Washington who don't really understand statistics explaining that.

The other thing that's very important is-- we always talk about the mean. We should really talk about the 95 percentile and the 5 percentile. And you'll see me, you'll see in all my plots-- and the shuttle team has never done this until the past three years, but I'm making them show the 5s and 95s. And now we're doing statistical significance. Even though the mean is different, is it really statistically different between the two?

The other thing we're playing with is now can I contract the variance? In other words, can I understand the problem now so the variance is smaller, than I understand the problem better? That's just as good sometimes as it is changing the mean.

And man, does that not sell well in Washington. When I try to explain to lawyers, here's mean. Here's one sigma. Here's 1-sigma. Here's why I'm trying to control the mean and here's why I'm trying to control the 1-sigma variation. They look like I'm from some other planet.


But that's part of my job is to convey in English terms what we're trying to do. And you guys need to think about that as you talk to folks, too. Yep.

AUDIENCE: What do you think, looking at your crystal ball, the station's going to look like in 2016? What will the US role be? And what's the outlook for getting some pressurized down mass?

GERSTENMAIER: Well, if the commercial cargo guys come through, there's going to be some pressurized down mass. We'll get about a metric ton, maybe 2 metric tons per year out of the commercial guys. So we'll get some down.

I'm really dependent upon the commercial guys coming through. So this is an awkward situation. Before we've had always had a NASA backup and we didn't count on the commercial sector to develop a rocket or bring capability up.

And then what happens is they run into problems, we default to the NASA solution, and we kill a commercial industry. Well this time, they didn't give me enough money to do that. So this time, I am 100% dependent upon those folks.

And I am more than proud to tell them every time I am dependent upon them. So if they come through, we will have a good research program. if they do not come through, it will be a mess because we'll be very limited in up mass and down mass.

I need about 40 metric tons of cargo per year from the commercial sector. So ATV and HTV and Progress can keep my crew on orbit, but I can't do any research and I can do very limited maintenance. To do anything worthwhile with station, I need this commercial cargo stuff.

It's supposed to come first flight in 2010 and in 2011, so it'll be very important to see that. If they don't come on precisely those dates, that's okay. I'm a program manager. I got some margin in the dates. They're not required on absolutely that date.

But within a couple of years, they need to be there. So the answer to your question is that the commercial sector comes about, we're there. Yep.

AUDIENCE: With all the work you've been doing, how close are you to recertification of the shuttle recommended by the Columbia Accident Investigation Board? And what do you still have to do if you're told to keep flying beyond 2010?

GERSTENMAIER: Well, what's interesting is I argue that I have effectively recertified to the intent. If you look at my external tanks, they look exactly the same as the tank I flew and returned to flight. It's not the same tank.

I changed out all the lithium aluminum up in the dome section back to just plain old aluminum because it's easier to manufacture. So when I did that, I had to do an entire recertification of the external tank. All the finite element analysis, all the structural analysis, all the breakup analysis, and all that.

So nobody counts that. But I would say in a sense I've recertified the external tank. When I had some main engine problems, I essentially went back and clean-sheeted all the main engine stuff again.

So I have done bits and pieces of all the stuff that I think is needed to keep this vehicle flying for the remaining flights. So I think I've satisfied the intent of what the CAIB was asking me for in that recertification activity.

Now I do have some inspection requirements on the orbiters that they can fly I think five years or so many flights. And then we take them down, we do a major corrosion inspection.

Some of these orbiters will be due for major corrosion inspection if I try to fly beyond 2010. We'll have to take those orbiters out of the fleet, do that corrosion inspection, and do that work. And that'll be costly and it's not effective.

I also plan on retiring these vehicles sequentially. So when I retire whatever vehicle first, the first thing I'm going to go do is my hydraulic actuators-- they've been in the vehicle since 1980 and they've never been removed.

We're going to go pull those hydraulic actuators out we're going to dissect them and we're going to go look in there and see. Because nobody has ever had a hydraulic actuator installed in an application for how many ever years it is. 20-some years, 28 years.

So we're going to go in and we're going to actually go look at that stuff. So I'm going to dismantle one of my orbiters in the Stay Hungry mode and I call it of looking for problems that haven't shown up yet to see if there's anything else out there that we've missed.

So I'm going to destructively start evaluating and testing some of my vehicles as I take them offline. But I don't think I need to do a full-up certification if I do that kind of investigation. Yep.

AUDIENCE: From the recertification that you did do on the external tanks and the main engines, did you run into any major design problems that you thought needed to be reworked or something like that? And from the testing that you did do, from the analysis that you did do, how confident would you be in extending the shuttle for several years after when it's currently scheduled to come offline?

GERSTENMAIER: Again, the things we kind of discovered was we have a lot of new tools we didn't have when we did the original work. So we did the full finite element models of the tank and we never had those before.

I also have a better understanding of the environment I'm flying in than I did before. So with a combination of better finite element and better environment, I think I got a much better design. And I did find some areas of the tank where some of the pressure lines attach to the outside of the tank that were less than the factor of safety we wanted for materials.

So we had to beef some areas up when we did that work. So there were some minor changes. But nothing major stuck out as it is a big kind of hiccup or a big problem.

But the neat thing was to go back with the new tools and to go look at them, and then pull out the old analysis and then realize how much we had missed with the old analysis that we didn't even know about that was covered in a blanket factor of safety or was covered in a blanket assumption.

A handwritten note that this is okay, and it's got the handwritten calculation underneath it. I now got a full 1,000-element, finite element analysis of that individual part, and it looks a lot different. So it was a very instructive situation.

In terms of continuing to fly, I think it's okay to fly, but it goes back to the point back here. We're getting to a point where the need of the shuttle is not there. The uniqueness to carry these things up and to get the big down mass isn't there.

And if I can get to the next generation of vehicle that has less of an integrated and complex problem, that's a much better way of going. So I don't think from a safety standpoint I'm worried. But from a practical standpoint, we need to retire the shuttle when it's done these complex missions and then get that next generation of vehicle that's going to have-- it will have problems .

I guarantee it will have problems. It will have problems, especially at startup. You know, the typical bathtub curve lives. You find a lot of problems in a very new system. You find a lot of problems in a very old system. In the middle, you're in the sweet spot.

So when the new systems start flying, they'll find lots of problems but that's okay. You're still working those out, working the bugs out. But that system, because the heat shield's predicted, it has an abort system on top-- it will be inherently more safe than what the shuttle is just by its basic design. Yep.

AUDIENCE: Sir, I think when Columbia broke up over Texas, one of the astronauts lost was Israeli. Are we holding a slot open for them? And if we were doing that, would we put an Iranian in with him so that something would kick off for President Obama's talks with Iran?

GERSTENMAIER: I don't know. That's probably for some alter ego other than me. So some policy person could talk to you about that. The Russians are very good at flying anybody and everybody. So if you've got--


If you've got a $35-- that's where I'm going. If you have a $35 million dollar spare change to fly, that's the new price and you can be a tourist on board space station. So what I should have done in my career-- I shouldn't have went to work for NASA. I should have went to some entrepreneurial company, made $35 million, and then could be an astronaut.

So I ruined my career by going to work for NASA. No, I'm not supposed to say that. So you're supposed to continue to ruin your careers by working for NASA and working for local government stuff. And don't make that money, because then all you can do is go fly in space as a tourist. Anything else? Yeah. Maybe one more after this.

AUDIENCE: Did you have any input into picking the flagship mission? I think it's Saturn or it's Jupiter instead of Saturn again.

GERSTENMAIER: No, the science mission director, they have a whole bunch of committees that go look at what scientific investigations need to be done out there. And I just focus really on the human spaceflight side of things.

Except for I provide the launch vehicles for the scientific missions. But that's all. So anyway, hopefully you learned something today. Yeah.

AUDIENCE: Do you think you could just, because there's a lot of aerospace engineers in training here, talk a little bit about the current economic situation at NASA? Hiring possibilities and things like that.

GERSTENMAIER: Okay. We internal to NASA, we looked at it our age profile. And we're aging. And so's the aerospace industry in general. So we think we need to bring in some more new hires.

So we're going to try to make a concentrated effort to bring in some fresh outs in our next series of hiring. So we think some hiring windows are opening up. So from our standpoint, we want to bring some new ideas, some new, fresh blood in.

It wasn't happening because if you've got a crunch project like the new Orion and Ares stuff, what's typically happened is the program manager will go pick somebody from industry who's familiar with it that's fairly seasoned and bring them in.

So we're not going to force some mixture of some new fresh outs to come in, because we think we need to reinvigorate new ways of doing business and new tools and new processes in our system. So you're going to see kind of a push for us to start looking at that.

So I think this is a very good time in spaceflight, in a sense. It's sad in a way that the shuttle's retiring. But I think the shuttle is retiring just because we can't afford to do shuttle and any other thing. And really, we need to do probably some kind of upgrades to the shuttle to some extent. Maybe some kind of real escape system or something if we continue to fly.

So the shuttle's got to wind down. But the station is there. The station is a truly unique research facility. We're about done assembling. So then how can we use it?

And we talk about using it for medical and biological and all those things. But we also ought to think about it as an engineering test bed. You know, I've got pumps up there that have been running for multiple . years.

I've got ammonia systems that have been operating well. I've got heat exchanges that are doing good. I've got QDs that I would never fly in any vehicle again if I ever had a chance. So we're never going to fly those.

But we've learned all this stuff. And the idea is, now, how can I pass that on to the next generation? Or can we do some actual testing of these systems to see, do they make sense?

Because we're going to have the same kind of systems on the moon. We're going to have some kind of cooling system, some kind of power generation system. So can we test some of those systems and components on Space Station?

Can we test software on Space Station? Can we use TimeLiner to go control simple functions that are controlled in code or they're done by crews on the ground?

I want to do a day without commands to Space Station. Typically today, we send 1,000 commands to Space Station a day. So I've challenged the team, when you're going to Mars and you're there, you're not going to be able to send commands up. I want to give you a challenge. We're going to send no commands for one day.

After they achieve that-- they don't know this-- then they're going to get decreed a no commands for a week. And then after they achieve that, they're going to get no commands for a month. So you can't tell them that, but they'll see it on the web if they watch. Hopefully they're busy doing software design and not watching it.

But the idea is to push, and how can we demonstrate stuff that might be appropriate? I told the crews that I was going to take away all their windows so they couldn't look at the Earth so they could simulate the journey to Mars for six months. And then we would return them.

The crews told me that there was no way they would ever do that. If they were going to Mars, they would do without the view of the Earth. But if they're this close to the Earth and they're spending six months in space, they're looking out the window. And they were not going to participate in that.

But you could help me think of what kind of things can we do with Space Station that demonstrates its use and expiration? Because it's a tremendous research facility. So again, back to what the future is, shuttle's ramping down. Station is a great research facility. How do we use it?

I'm invigorating a new commercial spaceflight industry, which is exciting. They're doing things a different way than NASA does. They're not doing the traditional way. They're doing more entrepreneurial engineering, which is a great way of doing business.

I've got the new vehicles being designed. We haven't designed new vehicles for a long time. The intent is to use the Ares vehicles not only for the moon but also for Mars. So they have that future design capability in there.

So this is a great time to come out and get involved in this industry and do things. So I think, again, the hiring in aerospace is always up and down. It's a pretty dynamic field.

I went into aerospace because I thought I would get out of school and I wouldn't be able to go to work anywhere, and then I would use that as an excuse to tour the world for a year. It didn't work out well. I got out of school and it was on the peak hiring. And so then I went right to work, and that was the beginning of the end. So I've not yet toured the world.

But again, you just have to put up with that in aerospace. But I think it's a great profession. I don't think there's any better team than I have in Shuttle Station, Expendable Launch Vehicles, and Space Communications. I mean, they understand the mission. They understand what has to be done.

They're tremendously disciplined. They're inventive, as I saw here. You know, I didn't tell them to go buy a bolt tester. They went out on their own. They had no idea it was going to work. But they thought, heck, it's worth a try.

They don't even know if it would even be worthwhile. They didn't even think we needed to do it, but they did it anyway. So what a great work environment, to have folks that are that dedicated, that creative, that know they have to work together as a team.

It's almost like being in college again being on a project team working for that final project to get it done, except it's a little more intense and it lasts longer than a semester. All right. Well, thanks.