NASA STS Recordation
Oral History Project
Edited Oral History Transcript
Stan M. Barauskas
Interviewed by Jennifer Ross-Nazzal
Downey, California – 24 August 2010
Today is August 24th, 2010. This interview is being conducted with
Stan Barauskas in Downey, California, as part of the NASA STS Recordation
Oral History Project. The interviewer is Jennifer Ross-Nazzal, assisted
by Rebecca Wright. We are also joined today by Bob [Robert] Sechrist,
who videotaping the interview for the Aerospace Legacy Foundation.
Thanks again for joining us today, we certainly appreciate all the
effort you put into preparing for the interview. I thought we would
talk briefly about your career with North American Rockwell [Corporation]
and now [The] Boeing [Company].
My career began with North American Aviation [Inc.] in 1963 after
I left General Dynamics Astronautics Company in San Diego [California]
to join the Apollo program. My job in Apollo was working as a propulsion
systems engineer on the rocket engine system for the Service Module.
That activity lasted until about 1972 when that program completed
with the last Apollo flight, Apollo 17.
At that point a new program started, Skylab, and I worked on that
a little bit. The same equipment that was used on Apollo was used
again in Skylab, the only difference being that the time duration
was much longer. Apollo, the vehicle only flew roughly seven days
roundtrip to the Moon and back, where the Skylab had periods of time
of 28, 56 and 84 days in flight. We had to certify all the hardware
that was Apollo hardware now for the Skylab missions.
What followed after that was the Apollo-Soyuz Test Project, ASTP,
where the Command and Service Modules united with the Russian spacecraft,
the Soyuz. That program was completed and the company was bought up
by Rockwell Corporation in 1967 [forming North American Rockwell Corporation].
By the 1970s the [Space] Shuttle program came into being. Lucky for
me, that Rockwell Company was awarded that contract to build the Space
When I moved over from the Skylab and ASTP programs to the Shuttle,
my job continued in propulsion and power systems. My first introduction
to the auxiliary power unit [APU] came about when I started working
on the Shuttle program. My initial desire was to continue working
on propulsion systems, but the job that was available at that time
was on the APU. Today I’m still working on that. [I’ve
been] working 37 years on the Shuttle program, still working the APUs
It’s amazing. You must have an encyclopedic knowledge of the
I say to these new people coming in working the APU, “I forgot
more than you’ll ever know.” Sometimes they ask me questions
about the condition that the APUs were in or the beginning of the
program, what took place, what was development like. Sometimes it’s
really hard to recall that far back. I’m having to think back
37 years, and it’s difficult. But I’m a packrat and I
actually retained a lot of the documentation from back in those days,
so I can always find a reference to back in those years and usually
come up with the answer.
Well let’s start with the easy question. Where are the APUs
located and what’s its purpose?
The APUs, there are three of them. They’re located in the aft
end of the orbiter vehicle and they’re installed on the 1307
bulkhead. That’s the bulkhead that separates the payload compartment
from the engine compartment, [Space] Shuttle main engines. On that
bulkhead are mounted the three APUs, two on the left side and one
on the right side. The function of these APUs is to provide the hydraulic
power that’s needed to control the flight surfaces and the flight
controls of the orbiter during its ascent stage as well as descent.
The APU itself is actually a fairly small unit. It’s only like
100 pounds in weight and it’s maybe three feet tall, about two
feet wide or so. It’s not really huge. But it does operate the
hydraulic pump that drives the hydraulic pressure from roughly 500
psi [pounds per square inch] to 3,000 psi to control flight surfaces.
During ascent it supplies power to the Shuttle main engine valves,
turn them on and off and to throttle them. Sometimes the engines are
throttled down to 67 percent, and sometimes all the way up to 104
percent. That’s done hydraulically, and that power comes from
Once ascent phase is over, the APUs remain dormant. All the fuel and
the water systems are maintained within the very narrow temperature
environment through heater systems that are installed on board. Then
the APUs again are required to operate in the descent phase, where
they power all the elevons and the vertical tail and the speed brake.
And finally upon landing, the landing gear, the nosewheel steering
and the brake system, also hydraulically powered through the operation
of the APU. The APU is very busy during ascent and descent, but then
they’re dormant during the on-orbit phase. Simply remain ready
to support the orbiter for return to Earth.
I’ve heard that calling it the APU is a misnomer.
I have to make a point of that, yes. When I first heard that I’d
be assigned to work on the APU I thought, “Oh, auxiliary power
unit doesn’t sound very important to me.” Auxiliary means
you may need it, you may not, it’s an occasional use type device.
Then the more I learned about it, the more I knew that actually it’s
a misnomer. It should have been called the primary power unit because
it does provide all the power for the orbiter to operate like an aircraft
on landing, and it’s got a critical phase during ascent where
it controls the actuators that move the Shuttle main engines and also
operate the Shuttle main engine valves. Its responsibility is far
greater than what an APU has to do for an aircraft for example. On
an aircraft, typically an APU starts the engines and it does provide
auxiliary power for operating the air conditioning system, lighting,
that kind of thing. But the APU on the orbiter is definitely not auxiliary.
What were the requirements for the APU when you came on board in 1973?
Those requirements were pretty amazing, they demanded quite a bit
of the APU. The total operating hours that were needed in the original
procurement specifications—250 hours of operation with maintenance.
Also the horsepower requirements were quite high, 195 horsepower.
Those are the requirements that went out to the potential bidders
for that contract; the response from the potential suppliers was based
on those. Once the winning company, Sundstrand [Corporation], began
its development phase, we found out fairly quickly that this 250 hours
was not going to be manageable. That was a dream, not going to happen.
The horsepower requirements were reevaluated over time, and [we] found
that the hinge moments which determine the rates that are required
for the elevons to operate at were not as great as originally predicted.
So the requirements for both the life of the unit and the horsepower
peak requirements were reduced quite a bit. The life of the unit was
reduced initially down to 20 hours, and the horsepower peak requirements
went down from 195 to 135. It was quite a drop, and that was determined
to be very adequate.
I understand that at the beginning of the program everyone was monitoring
components. What were some of the components you were monitoring for
Of course when you speak of the APU you really are speaking of the
APUS [APU system]. The APU system is composed of the APU unit itself,
which is supplied by the Sundstrand Corporation, and the rest of the
system that supports the APU is the fuel system and the water system.
There are multiple other components, like the fuel tank, the control
valve, filters, servicing QDs [quick disconnects]. All of those come
from other suppliers to make up the entire subsystem.
My responsibility was not to concentrate on any particular component
of the APU system, I was responsible for the entire subsystem as a
whole. When it came to certifying it, putting it through its qualification
test phases, I was responsible for the APU as a component, as well
as a participant within the entire subsystem to certify it for both
the Approach and Landing Test [ALT] phase and also the orbital flight
Quite a big task for one person. Tell me about the design phase. I
understand for instance at one point there were supposed to be four
Yes. As a matter of fact, the original plywood mockup that was built
as a device that engineering would use for installation purposes—you
could look at it even today and you’ll see four APUs installed
on the aft 1307 bulkhead. That was the proposal that was made to NASA
originally. Matter of fact, I worked on that particular proposal where
we evaluated 14 different APU system designs. Some of them included
interconnecting fuel tanks and a whole variety of different kinds
Ultimately we decided on the configuration that we thought served
the needs of the orbiter the best, three normally operating APUs and
one APU in a standby mode as a backup. It was deemed that three APUs
were more than adequate to satisfy all the requirements for the orbiter
for its flight, and that we needed one other APU as a backup. In case
one of the three went down for some reason, failed to operate, then
the other one would be brought online. That standby unit was ready
to be put online within a period of a few milliseconds, and would
be tied into the fuel system of the other APUs and would take over
the function of the one that failed.
This is the proposal that went in to NASA. NASA accepted it, they
approved it, they gave us contract go-ahead with the four-APU system.
Within a short time, maybe five to six months after that, NASA had
a change of heart. They reevaluated their needs and they said that
the weight is too great, we can save ourselves quite a bit of weight,
over 100 some odd pounds, if we eliminated the standby unit and just
go with the three units and operate what is called a fail-safe system.
The previous system would be considered fail operational/fail safe,
meaning that you could actually take on say two failures and still
have a safe landing. Now NASA decided that they may well do with a
single system failure, which is a fail-safe system. Have one APU fail,
then the other two APUs remain operating and allow the vehicle to
land safely, bring the crew home. They decided to accept an additional
One thing was a curiosity though. The way NASA stated [the requirement]
in their contract led to some confusion early in the program. The
confusion stayed in the program throughout its entire 30 some odd
years and was never completely resolved. NASA wanted to know the capability
of a single APU. In other words they hinted that they’d really
like to have one APU ability to land the vehicle safely, but they
never came straight out and said that.
The way they did it is that they’d like to know what was the
capability of a single APU. Is it positive or negative, how much margin
did the APU have if two APUs failed? Well, that was never put to the
test. There were some simulations done later when it became clear
that under really nominal landing conditions, where the wind velocity
was acceptable and there was no storm going on and everything was
fairly benign, that a landing could be made with a single APU. But
it had to be under really perfect weather conditions. Luckily for
us we never experienced two APU failures, so we never had that fully
Looking back, do you think it was a good decision on NASA’s
part to go from four to three for weight reduction?
Yes. I think the weight savings was well worthwhile. I think that
sufficient redundancy was built into each of the three strings of
the APU system. Only maybe one instance that I can recall where one
APU did go down and we had to make a landing with two fully operational
APUs. We were concerned that maybe a second one might fail but that
never happened. I think the redundancies that we built into the program
really served us well. That was a good decision on their part to eliminate
that additional APU and reduce the weight, with that benefit.
Tell me about some of the technological challenges that you faced
while developing the APU.
There were quite a number. One problem that the APU had was its heat
soakback. That was one of the conditions that were very evident we
had to overcome. The APU reaches steady-state temperatures at roughly
ten minutes of operation. If the APUs were to be shut down after that
and needed to be restarted, they couldn’t be restarted safely.
We found out through development testing the system had to be allowed
to cool down to acceptable restart temperatures.
I’ll give you an example. The gas generator operates at well
over 1,000 degrees [Fahrenheit]. Once it shuts down it begins immediately
to cool, but what happens is that the temperatures soak back into
the rest of the APU hardware, specifically into the valve and the
fuel pump, and those components reach fairly high temperatures. We
found out through development testing that if you attempt to start
the APU at the elevated temperatures, the fuel is so explosive and
contains such high energy that explosions actually occur.
We knew we had a temperature problem that had to be overcome. The
way we did it was introduce a water spray system so that immediately
after APU shutdown, the fuel pump and the valves would have a spray—as
well as the injector. We had three different water cooling systems.
Each of those would be cooling the components to a point at which
they could be quickly restarted if an emergency arose without any
damage to the hardware.
Another problem that had to be overcome was the seal design. The fuel
pump seal design was a common seal between the fuel and the oil systems.
We found out that was quite an error in the design, because depending
on the pressure balance between the two, sometimes the fuel side of
that seal was higher pressure than the oil side, allowing some small
seepage of the fuel into the oil. Those two are completely incompatible.
The fuel would go into the oil and form a wax-like substance, and
we came to find out the chemical name of that is pentaerythritol.
Depending on the ratio of the fuel and the oil mixing, that waxy substance
could be as fluid as molasses, kind of milky, or could be as hard
as candle wax. It would even fracture. If you were to hit it with
a hammer it’d fall apart in granules.
That’s the material that would go into the oil system to plug
it up and prevent proper cooling of the high speed bearings within
the gearbox. That was a critical thing. It was overcome with a redesign
of the seal to separate the seals completely, and also have backup
seals, which are called lip seals, that prevent leakage. So we had
completely separate sealing between the oil and the fuel. That problem
never occurred again after that design feature was introduced. Those
are two major ones.
The other one I could say briefly, the original gas generator valve
module, the GGVM, that was produced had very hard material, tungsten
carbide. It was very good because it would seal very well and prevent
leakage. But it has a tendency to fracture, that’s the problem.
Because it had to cycle so frequently, about two to three cycles per
second, the seal and the seat would beat against each other to the
point sometimes where the seat would fracture and we’d lose
pulse control of the APU. The APU typically shuts down when that event
We had a spectacular case of that happening during the very famous
Hubble [Space] Telescope launch. I’ll never forget, it was STS-31.
There the APU started up like normally, and continued operating for
less than a minute when this fracture occurred in one of the pulse
control valves. In that event the APU automatically goes into what
they call a secondary speed control mode. That’s detectable
by the data that you see. All the pressures, the chamber pressure
and the speed control, move into a different range. You could spot
that very quickly.
The crew was immediately notified of that event, and they very quickly—it’s
amazing how quickly they reacted, they were well trained—shut
down that APU. That APU had to be removed and replaced because of
the seat fracture, so that Hubble Telescope launch was delayed by
several days. Of course subsequent to that the APU went ahead and
worked fine, and we have the Hubble Telescope today still in orbit.
Another major problem that occurred was a fracture of the injector
tube within the gas generator. The gas generator is the heart of the
APU. That’s where fuel is directed, and that’s where the
catalyst bed is. The fuel goes in and is sprayed onto the catalyst
bed, and immediately on contact of the catalyst the pressure reaches
as high as 1,400 psi and the temperatures reach about 1,200 degrees
or so. That happens in seconds. The hot gases then are directed to
the turbine to speed it up from standstill, from zero up to 72,000
rpm [revolutions per minute] in about three and a half seconds. It’s
a really high powered unit, those fuel tubes are sensing pressures
of 1,000 psi or so.
On one particular occasion, STS-9, fuel tubes in two APUs cracked
and it caused a leakage of that fuel into the hot portions of the
APU and resulted in an explosion where the two APUs actually blew
up. It did not become widely known within all the news agencies because
the explosions happened post-landing, after rollout and after wheel
stop. Lucky for us it didn’t happen just before landing. If
that actually occurred even a minute before touchdown that would have
been catastrophic. The vehicle would have lost total control and it
would probably have totally demolished the orbiter and potentially
killed the astronauts. It was really that close. That was something
that we were very concerned about, and there was quite a bit of effort
made to redesign the injector tube to eliminate that problem in the
Pretty significant challenges that you faced. I also understand you
were working under pretty severe time constraints, that the APU had
to be ready for the Approach and Landing Tests. What impact did that
have on the design, development and testing of the APU?
We were in a rush, like you say. Many subsystems did not have to be
operational for the ALT. As the title indicates, Approach and Landing
Test, it’s a test of the orbiter’s ability to perform
a controlled landing. The orbiter would be lifted up on the back of
a 747 [aircraft] as high as between 20,000 and 23,000 feet and then
released and allowed to land on its own to illustrate its flight control
abilities. Of course the APU played an important role, because the
APU provided the hydraulic power to allow the orbiter to fly like
The other systems like the SSMEs, the [Space] Shuttle main engines,
were not needed. The RCS [reaction control systems] were not needed.
A lot of the environmental control systems were not needed because
everything happened just relatively a short period of time, just from
20,000 feet down. The orbiter drops at a rate of 10,000 feet a minute,
so you can see the total flight time was like two, three minutes long,
that’s it. All of these other subsystems did not have to be
functional, but the APU did. So there was a rush to make sure that
the APU was certified to support the Approach and Landing Testing.
I had a role to play in that. We had the integrated test article,
the ITA, and we made use of two test cells within Sundstrand Corporation
in Rockford, Illinois, to test the capability of the APU system to
support the ALT. This ITA is quite a huge, massive test fixture because
it actually had a portion of the aft bulkhead. We didn’t have
to simulate that ALT operation with all three APUs; one was sufficient
because they’re all very similar, so we reproduced a system
number one on the aft bulkhead. We routed the fuel lines, we had the
heat exchanger for the oil cooling, we had the water systems, fuel
tank, the QDs, everything exactly the dimensions that they would be
inside the orbiter.
All of that was installed in cells 11 and 12 at Sundstrand, and there
we had the capability to do temperature control. We had liquid nitrogen
systems, could drop the temperatures to equate what the temperatures
were at a 20,000-foot level. We did environmental control tests, and
we did mission duty cycles to simulate the mission of the APUs from
the time that they would separate from the 747 to the time it would
land. All of that was done in quite a hurry, but everything was done
very properly and certification came through fine.
We demonstrated the full capability of the APU. The APU operated very
well throughout the entire ALT program. The landings were very successful
and the orbiter was in full control. Not to say we did not have failures.
We had gone through different kinds of failures, that were not the
kind though that prevented a safe landing each time the orbiter was
separated from the 747.
I understand you spent time out there for every mission. Would you
tell us about your involvement there?
Yes. Because of the proximity of Dryden Flight Research Center [DFRC]
within Edwards [Air Force Base, California], it was relatively close
to Downey where I worked. My assignment was to be at DFRC to support
all the activities that preceded the flights. Typically it would be
oil servicing, fuel servicing, functional checkout—make sure
all the valving operated properly and the APU operated properly—all
We had tests that are called captive-inactive and captive-active,
meaning that the orbiter would be attached to the 747 and fly and
not be released. We had multiple flights like that where the systems
would be simply dormant and not operated, then we had the active portion
where the APUs would operate. Again, the 747 would still have the
orbiter attached. Then we had five more flights where the orbiter
would be released and actually landed. For every one of those tests
I was at DFRC. I enjoyed that.
Matter of fact, one highlight of my whole visit there was to be able
to meet with Deke [Donald K.] Slayton, one of the original Mercury
astronauts. He was assigned the position as chief of all the astronauts
involved in the program. I had an opportunity to meet him in the cafeteria
one morning, and we had a really wonderful discussion, about 45 minutes
or an hour, while having a leisurely breakfast. He was getting ready
for his T-38 [aircraft] flight. I knew later that astronauts all take
these proficiency flights they would do periodically. He was getting
ready for his flight, and he spotted me in the cafeteria and invited
me to have breakfast with him, and it was a wonderful meeting. That
was a very enjoyable part of that whole experience.
Did you work closely with the pilots who were still astronauts in
Yes, I got to know quite a number of them. More so during the orbital
flight experience, because the ALT there were only like five flights.
I didn’t get to know them except maybe Deke Slayton on a person-to-person
basis. Some of them really interesting to get to know.
One person was Bill [William F.] Readdy, who ultimately became Associate
Administrator for the Office of Space Flight for NASA. He was the
second in command below the Administrator. He flew three missions.
Every astronaut had a certain responsibility, and he was assigned
to follow various contractors around the country. Bill Readdy had
the APU assignment, so I got to meet him at meetings, and had meals
together with him. Every time I would do mission support I would go
to Building 4 and go to his office, and we’d have really lengthy
discussions about the state of the space program and just things happening
in the world.
Another one was Eileen [M.] Collins. I met her a short time after
she was graduated from astronaut training, and before she even had
her first flight. I got to know her very well because of her visits
to Sundstrand in Rockford. We got to be on such a friendly basis that
at one point she actually helped my daughter with her high school
project. She was really wonderful, and [one of the] friendliest people.
Very knowledgeable, really expert. Of course she was the first woman
pilot in the history of manned spaceflight and the first woman commander.
When it came time to continue the flight program after the Columbia
[STS-107] accident, they had to pick the best astronaut they had in
the program, because they had new requirements imposed on them they
never had before. They picked one astronaut out of all 105 or how
many they had, and it was Eileen Collins that they picked to be commander.
I thought that was a great statement that NASA made about how much
they depended on her expertise to do that mission. So she was commander
of STS-114 [return to flight]. She was really wonderful person to
She seems like a very wonderful person. Were there any changes made
to the APU as a result of the ALT program?
I mentioned before that the ALT program was very very successful.
Everything went well, the APUs operated like they were supposed to.
But let me say this also, that not a single component on the APU unit
was left standing. Every piece of the APU hardware was revised, redesigned.
The valves, the fuel pump, the gearbox, the exhaust housing—everything
was all redesigned. Primarily to provide the APU with the added life
that was needed for the orbital flight test program. The ALT was very
successful, but that APU that flew for those missions would not have
lasted very long in the orbital flight test program or the orbital
flight program, which was supposed to be 100 missions for each vehicle,
so massive redesigns were put in place.
It still remained what we call the baseline APU. But subsequent to
that we realized we had other problems that needed attention, and
so Sundstrand proposed an APU that we began to call the improved APU.
The original baseline APU was already improved, but this one had that
title officially, improved APU. That program was begun through NASA
contracting directly to Sundstrand, which is an unusual way to do
it. NASA had a separate individual contract with the company directly,
not through Rockwell.
Although Rockwell had responsibility over Sundstrand with the baseline
APU, NASA had full responsibility for the improved APU program. When
the development was completed and the company was going to go into
its qualification phase, that’s when NASA invited Rockwell to
participate. We came into play only [when] the APU was ready for its
certification. That’s where I came into the picture and began
to work with Sundstrand on the improved APU.
The improved APU features—one of the main features, the problem
I mentioned before about the fuel and oil mixing. The improved APU
program was where the two seals were actually separated, where there’s
a total separation between the oil and the fuel. The other thing was
the fuel pump design was revised. Its gears, other aspects of the
seals in the fuel pump, to increase its longevity. The exhaust housing
went from a Udimet [metal alloy] to a Stellite [metal alloy] I believe.
Another major thing that actually saved quite a bit of weight was
the water system. I mentioned before we had to install a water system
to cool the gas generator valve module and the fuel pump down to temperatures
to where they could be restarted safely. Sundstrand devised a passive
cooling system where they put additional fins and standoffs and isolators,
that kind of thing. That helped to reduce the peak temperatures on
the pump and the valves to a point where the water system was no longer
needed. So the primary and secondary water tanks were removed and
all the valving that went with it. All that totally was removed from
the aft bulkhead and it was a tremendous weight savings.
The thing that they retained was the injector cooling. That was still
considered critical. The injector cooling tank was a fairly small
tank. It only contained about nine pounds of water, as opposed to
20 pounds of each of the other tanks, so that was considered a small
weight penalty. That was retained only as an emergency in case the
APU had to be restarted within seconds or minutes of its shutdown.
Which, by the way, never happened. We never needed to restart the
APU in an emergency. The system was operated, but only accidentally.
The crew sometimes flipped the wrong switch and there was water spray,
but there was no damage done with that. It never was needed to use
in an emergency mode.
When was the improved APU design started?
The actual design was started fairly early, in 1985, ’86. It
wasn’t until three or four years later they had developed it
to the point where Rockwell was brought in to do the qualification
and certification of that new improved APU. There was one other very
important thing. NASA always wanted and desired a life extension of
the gas generator. The gas generator in the baseline APU was only
good for like 20 hours, and there were plans made to increase its
life up to 40 hours with some redesigns, some minor things. But NASA
still was not content, they wanted additional life.
We worked closely with the gas generator producer, which was Rocket
Research Corporation. Later I think it became known as Aerojet. That
company came up with a design that would substantially increase the
life of the gas generator and we proposed to NASA that we would make
it a 75-hour gas generator, almost doubling the previous 40 hours.
The way end of life is measured is the roughness of the chamber pressure,
the roughness meaning the hash that you see at the peak of the trace.
It has quite a bit of peaks and valleys, and if it measures to as
much as 300 psi from peak to peak that’s considered end of life
for the gas generator. Normally it’s a fairly smooth curve and
the roughness is only maybe 20 psi, 30 psi. When it reaches about
300 it could potentially begin spiking, meaning the pressure could
rise up to 1,900 or 2,000 psi, potentially causing great damage to
the gas generator and could totally destroy the APU. That was the
criteria that was used.
To my knowledge, to this day no operational APU has ever reached that
300 psi criteria, mainly because many of the APUs are nowhere near
that 75-hour life limit. Right now I think the highest one could be
as much as 35 to 40 hours. Even nearing the end of the program, the
APUs still have a great deal of life left in them today.
Let’s go back to the baseline APU. I wonder if you could tell
us about some of the more interesting qualification or certification
tests that were done really all across the country—at Sundstrand
and White Sands, at JSC [Johnson Space Center, Houston, Texas], in
That’s a good point. The testing was spread out quite a bit.
Sundstrand of course was the supplier and manufacturer of the APU.
It had its own test facility, but that facility had its shortcomings.
The altitude capability is very limited. Only maybe between 40,000
to 50,000 feet altitude equivalent. They attached an exhaust device
onto the exhaust duct itself, and it created a vacuum to simulate
the altitude environment internal to the APU, not to the exterior.
That was a drawback.
The Thermochemical Test Area, TTA, at JSC offered a really large vacuum
facility. A big, about 23-foot diameter sphere that could actually
create a high altitude environment around the entire APU unit itself,
not just the internal portion of it. So that became the test bed place
where a lot of the qualification and certification testing was done.
We made an agreement with NASA JSC at that time to make use of that
facility and be able to demonstrate all the qualification requirements.
The [NASA] White Sands Test Facility [White Sands, New Mexico] also
came into being, initially only as a test bed for heater testing of
the APU unit itself. It had a really high altitude facility but it
could not handle the exhaust products and still maintain a vacuum.
They could go as high as 300,000 feet or so equivalent space vacuum
and it was considered a very very good test of the heater system.
Later on, years later, TTA finally could not do hot fire testing anymore
of any kind. They had some safety restrictions imposed on them, and
they could not do any more hot fire testing or anything to do with
really hot gases.
That was the point at which White Sands came into being. A test facility
was provided where APU could do hot fire testing there. They could
create a really high vacuum around the exterior of the APU as well
as the exhaust, but they had limitations. I think the highest equivalent
altitude was roughly 200,000 feet. But anything over 45,000 to 50,000
feet is considered adequate vacuum simulation for the APU to be equivalent
to space environment. The last few molecules between 40,000 feet and
200,000 feet, they’re relatively really few, so there would
be no thermal considerations that are critical at all at that altitude.
The other facilities around the country, Saugus/Newhall [California]
and another facility in Virginia, had the capability to install the
APU in their test facility and do hot fires while the APU was vibrated.
That was not a vacuum, it was not a thermal environment. It was simply
a vibration environment, allow it to hot fire while it’s being
shaken at the vibration levels that the orbiter would see. That was
done in two places, and that program was very successful.
Matter of fact, it was so successful that NASA decided that the improved
APU, even though it had undergone quite a number of design changes,
the vibration test was no longer needed. The vibration testing done
on the baseline APU would be completely satisfactory, and that test
was never repeated. There were quite a number of facilities across
the country that were involved in the certification, and I was involved
in most of them.
How long did the tests last? Were you running the APUs as the test
occurred? Obviously the vibration test might only last eight and a
half minutes [duration of SSME operation], but were they lasting 90
minutes in other places?
Typically, as you mentioned, the mission duty cycle for the APU is
90 minutes long. It’s composed of the ascent phase—which
in the APU case starts prior to T zero. Most other systems begin to
operate at T zero, but the APU is required to turn on at T-minus five
minutes. It operates for five minutes and throughout the entire ascent.
It’s about eight minutes until the main engine cutoff takes
place. The APU continues to operate for about five more minutes to
purge all the lines of the main engines, and then the valves are shut
off. That whole activity there is roughly 20 minutes long during the
Then the APU remains dormant in orbit. The heater systems are operating
to maintain the water systems and the fuel systems to prevent them
from freezing. They’re not allowed to decrease below 45 degrees
so APUs would be ready to start. Only at one point in time the APUs
are required to operate in orbit. That is when they do the flight
control systems checkout roughly 24 hours before entry. That’s
a way to check out all the flight control systems and make sure that
everything is operational, the elevons and the vertical tail—all
the systems are functioning normally before the orbiter commits to
The commit to entry happens a day later. One APU out of the three
is required to turn on at T-minus five minutes, before the deorbit
burn of the OMS [orbital maneuvering system] engine takes place. One
APU is turned on to make sure that at least one APU is fully functional
before they commit to deorbit burn. Roughly at entry interface minus
13 minutes, EI-minus 13, the other two APUs are turned on. All three
continue operating well past wheel stop. That’s fairly unusual.
Most of the subsystems in the orbiter, they’re pretty quickly
shut down after wheel stop upon landing.
When you’re in the Mission Control Room in Houston [at JSC],
you’ll see the various engineers at their consoles get up and
leave shortly after the orbiter’s wheels stop. But the APU engineers
are intently watching their data for another 15, 18 minutes or so,
because the APUs continue running after wheel stop for quite some
time. That’s to allow the systems to be reconfigured into what
is called a rain drain configuration, meaning the body flap has to
be allowed to go down to allow the engines to go down. The reason
they call it “rain drain” is in case rain does happen
on the runway, the rain does not enter into the injectors of the main
The crew is busy doing other things to safe the systems. They have
to safe the OMS system, the RCS—all of that is going on while
the APUs are operating. The APUs continue to operate because they’re
needed to operate the hydraulic systems for the actuators for the
main engines and body flap. They’re shut down 15 to 18 minutes
after wheel stop.
You were testing them at that length to ensure that they would operate
safely in orbit and for launch and entry.
Right, exactly. All this activity that I mentioned, the entry and
the postlanding—90 minutes became our standard for the mission
duty cycle. The testing would be a whole series of these 90-minute
tests. Sometimes though we’d throw in an AOA, abort once around.
We had to demonstrate the APU would be capable of continuous operation
of the APU without shutdown for at least 128 minutes. That’s
about the longest mission that we have because the vehicle lifts off
and it comes back and lands without reaching orbit. Of course that
was never done, because every flight so far the orbiter has reached
Any memorable tests that stand out in your mind that were dramatic
or just didn’t turn out quite the way you’d hoped?
The mission duty cycle tests were mostly uneventful. There were some
tests at the system level which were a little too exciting for my
taste. In the system test we were getting ready for the Approach and
Landing Test program. The fuel tank isolation valve that we had installed
in the system blew up. It exploded one time for no apparent reason.
We couldn’t tell what happened, but the failure investigation
The valve itself had a design which is called a bellows design. It
would be able to move horizontally, it had convolutes. It was a design
such that the surge pressures that were generated by the gas generator
valve module while it was operating in a pulse mode—the valves
actually close and open about three times a second. When they did
that they generated a high peak pressure wave, roughly 300 or so psi
above tank pressure. So if the tank pressure was say 400 psi, which
it was at the beginning, the peak pressures that would be generated
would be on the order of 700 psi or so.
On the failure analysis we found that the tank isolation valve had
been experiencing pressure surges in excess of 700 psi, and many thousands
of them during a typical mission. As a result, the bellows suffered
a fatigue stress fracture. This fracture allowed fuel flow into the
valve’s electrical system. As a result, the reaction with the
wiring system within the valve created such a high pressure that the
valve finally exploded and blew off the electrical components from
the valve itself. Luckily when that happened, there was no one inside
the test cell.
There was some attempt made to recover from that accident by introducing
an accumulator into the system that would dampen these peak pressures.
That worked very well. The accumulator reduced the pressures down
to 10 percent of their peak, down to 30 psi instead of 300. That was
really very acceptable, but it meant an introduction of another component
within the fuel system. It created paths for additional leakage, and
we had to have additional sensors to make sure that we had provided
sufficient gas pressure within the accumulator. So it became much
too complex a system at that point, and the decision was made to remove
the isolation valve and seek out another valve that didn’t have
We put out bids for valve suppliers. The Consolidated Controls Company
[Inc.] valve was removed in favor of a Hydraulics Research [Division
of Textron, Valencia, CA] valve because it did not have the particular
design feature. That valve stayed in the system for quite a long time—until
we began to have trouble with that valve, it had its shortcomings.
It had a microswitch that indicated its open or closed condition,
and the microswitch malfunctioned such that it gave erroneous data
to the systems. We tried to activate the valve and the microswitch
would indicate the valve was closed when it was open. Sometimes the
valve would close and it would indicate it was continuously open.
The valve also was very sluggish over time. It began to operate outside
its response requirements. It didn’t have the bellows design
any longer, but it did have a system where there was a very thin separation,
15/1,000 or so thickness wall separating the fuel and the electrical
system. If a leak occurred there it was considered a Criticality 1,
meaning that if that failure happened the valve would explode and
maybe take down the whole orbiter.
That was considered unacceptable, and we proposed to NASA another
redesign, a brand-new valve. We went to another supplier called Moog
[Inc.] in Buffalo, New York. That valve was considered a much better
design. It didn’t have that thin wall, and we paid a penalty
of a little over a pound additional weight for every string of the
APU system. By paying that penalty we made the valve much more reliable
and much safer. NASA accepted that and we qualified it, and it continues
to fly today. Excellent performer, has never given us any trouble.
When was that valve replaced?
The most recent one was in the 1992 timeframe.
Were there any other changes made to the APU as a result of the original
testing program? Any significant changes, or they were just minor
The baseline APU was subjected to numerous changes, and that’s
how the improved APU came about. The exhaust housing, the fuel pump
design, the gas generator valve module, and quite a bit of the components
were changed out within the APU unit itself. Beyond that, there are
other components within the system. Specifically the servicing QDs.
Those things were relatively benign, you would think.
The servicing QDs were unpowered, they didn’t have any electrical
equipment internally, they had no solenoid valves. Everything was
completely just a mate and demate device, and it should have given
us no trouble. But it did. Pre-launch, a number of times it would
leak liquid fuel, and sometimes it would leak GN2 [gaseous nitrogen].
It became such a problem. We traced it to the ground system itself,
the ground QDs that service the flight hardware. The filters within
the ground QDs were corroding and the mesh was deteriorating, allowing
large particulates into the fuel system, into the QD system.
After many many years of headaches, we proposed to NASA to eliminate
that design. We had other servicing QDs that were used by a neighboring
system, the RCS. It had shown a history of excellent performance,
very little, if any, leakage. The requirements for the RCS were different
in a couple of areas, in the temperature area and maybe vibration,
so we had to do a very minimal number of tests in order to certify
those QDs for use in the APU system. Every one of those were changed
for every vehicle. They’ve been performing very well ever since,
and that’s over six, seven, eight years ago.
Looking back over the original design, development and test effort,
it was very compressed. Do you think there’s anything that NASA
could have done to improve that period?
Yes, that’s a good point. The time compression hurt us in the
end. NASA’s interest was to complete the qualification and certification
program as quickly as possible, because of cost and to demonstrate
the APU readiness to support flights. There was an urgency, and time
was an important component within the qual [qualification] test program.
What we didn’t realize at the time was that downtime between
flights was a critical factor in the APU’s operation. The exhaust
gases actually created a very very harsh environment for the APU internally
within the injector system. There were chemicals like carbazic acid
played a role in that. Also, any slight leakage from the GGVMs into
the gas generator created these gases as well. They may be very minor
amounts but over long periods of time, like months in between, they
came to be so corrosive that they would actually attack some of the
materials within the APU itself.
Notably where that was felt was the injector tube, as I mentioned
before. Ultimately the combination of that particular attack by these
gases, as well as the installation procedure that was used, created
a highly stressful environment for the tubes. Over time that’s
where the crack occurred in that STS-9 mission and caused severe damage
post-landing. There were two APUs found to have these cracks and that
resulted in both of these APUs exploding. That was traced to these
chemicals that are in the vicinity of the APU at that time.
After we discovered that, any future qualification test program included
a time component where the APU would be hot fired, and then it would
not be hot fired again for four months to make it similar to the time
period between the orbiter’s flights. Like if the Columbia were
to fly in a given month, January, it wouldn’t fly again until
maybe April or May. That downtime period was then duplicated within
the test environment. I think we got much better performance out of
our APUs once we evaluated that time factor.
Over time we took operational APUs out of the vehicles just to examine
the injector tubes to see how much degradation they had suffered over
that time period where they were down. We took samples out on occasion
and confirmed our life limit for the APUs. That was very successful
and we still do that even today. We do maintenance on these APUs when
these are inspected on a periodic level. Every four years APUs are
completely removed from the vehicle and returned to Sundstrand for
When were the baseline APUs finally certified for the first flight?
It was in March of 1980. That was fairly early in the program, years
before the improved APU program was begun in the mid ’80s. That
baseline APU flew for quite a number of missions all the way through
the early ’90s. The baseline APU performed very well over that
entire length of time. Then once we had the improved APUs in place,
we could extend the life of the APU such that we didn’t need
to replace them as frequently as we had to with the baseline. With
the 75-hour certification period, none of our improved APUs have approached
even near our life limit for the APU.
What role did you play in the testing and checkout of the APUs on
board Columbia [OV-102] before it flew?
The Columbia was of course the first vehicle to be processed through
all the testing. I was involved in the certification of the APU for
the first orbital flight. Matter of fact, very heavy report [demonstrates
It’s what, about four inches?
This is the certification that we submitted to NASA to demonstrate
that we are ready for orbital flight. This is my report, I authored
this completely myself. And I oversaw all the testing involved in
that activity. We demonstrated that we could certify the APU for orbital
flight. The Columbia was the first one to receive the certified APUs.
I made frequent trips to Palmdale during the testing phase, post-installation.
Other people had design support that supported the manufacturing personnel
to make sure that the installation was done properly; that was not
Once the installation was completed, testing was done under the requirements
of the TRSD, test requirements and specifications document. That document
controlled all the pass/fail criteria for every test that we did as
far as the valve responses, the leakage allowable, and all the APU
heater operations. All of those were documented within that TRSD document.
I was there for every one of the tests that were conducted before
the orbiter was flown again on the back of the 747 to Florida [NASA’s
Once the Columbia arrived in Florida, those tests were—100 percent,
all of them—repeated again. You’d think it was unnecessary,
but it was really very very thoroughly tested. The idea being that
what happens during its transit from Palmdale to Florida might have
done something to the integrity of the system—maybe it created
leakage or knocked insulation off or caused damage to the heater system.
That’s why KSC [Kennedy Space Center] imposed on it all the
testing that Palmdale did all over again.
Before that, it was my responsibility to go to KSC in the late ’70s
and help create something called the OMRSD, the orbiter maintenance
requirements and specifications document, the counterpart of the TRSD.
The TRSD was the Palmdale version and the OMRSD was the Kennedy Space
Center version. From the OMRSD they prepared actual procedures called
OMIs, orbiter maintenance instructions. OMIs controlled all the checkout,
the fuel servicing, the oil servicing, the water servicing, all of
that. I helped to write many of those.
At KSC I was one of the what’s called D squares [D2]. That was
the name given to design designees. These are people who were the
design representatives for each of the subsystems. That was my role
in processing the orbiter Columbia through all of its checkout and
all of its activities in the VAB [Vehicle Assembly Building] all the
way out to the [launch] pad.
I really felt—how should I say—very good about having
the ability to be at Kennedy Space Center for the first launch of
the Shuttle. I was in the Launch Control Center at the APU console
in Firing Room 1 among the guys who actually gave the final go for
launch. I was very very honored to be in that spot. I could see the
orbiter out on the launch pad. Of course we had to be focused on the
screen in front of us watching the data very carefully, because we
had to make sure all the systems were operating normally. Otherwise
we’d have to call a hold to the launch count before T zero ignition.
Immediately after T zero all the eyes focused on the window to see
the actual liftoff. Everybody was cheering, that was a great experience.
Having worked on Apollo for almost ten years and never having been
at the Cape [Canaveral] to see my hardware be launched into space,
that was a great thing for me to be there and actually see my APUs
working on their way to orbit.
I can imagine, I’m sure it was quite a feeling. Did you go then
to Houston at the MER [Mission Evaluation Room] for the rest of the
flight for STS-1?
Yes, I did launch support. I was part of the launch support team for
the entire orbital flight test program, which was four flights, and
beyond that. I witnessed as many as nine flights from Kennedy Space
Center. Once I completed that, I was assigned to go to the MER in
Houston to support all the launches and the rest of the mission from
the Mission Evaluation Room. I did that for a number of missions,
maybe nine or ten.
After that I no longer traveled to Houston and I would be in the Mission
Support Room at Downey. We left the Downey facility in the year 2000
and moved over to Huntington Beach [California]. Then I was assigned
the Engineering Mission Support Room at Huntington Beach for all the
Shuttle flights until I think STS-108.
I think after that all the responsibility for the launch support reverted
back to Houston, so the Mission Support Room in Huntington Beach was
shut down, was never used again. We did support from our desks. We’re
just on standby in case there was a need from our Boeing counterparts
in MER to call on us for any assistance. We’re available, but
we do not have direct responsibility for any of the launch support
or mission support or landing.
On STS-2 you played a particularly important role. There were some
delays caused by the APU and you ended up having a conversation with
the [NASA] Administrator [James M. Beggs] about that problem. Can
you tell me about that?
That was memorable. Of all my work on spacecraft, all the way back
to Apollo and all the way up through all of the Shuttle program, I
think those were the most difficult ten days of my entire career when
STS-2 occurred. STS-1—as typical of a new system there were
some problems along the way, and it finally got off the ground and
went through its few orbits. Everything was fine, the landing took
place and everyone was happy. Getting ready for STS-2, we expected
a similar uneventful launch. I was there at my station waiting for
the countdown, and the countdown went smoothly all the way down to
T-minus five minutes. The APUs were started and I was watching the
Apparently there was some concern for the PRSD [power reactant storage
and distribution]. The cryogenic tank pressures were below normal
limits, and the engineers were asked if they should hold the launch
based on the violation of the launch commit criteria for the cryogenic
tanks. The engineer I heard say that it was okay, that even though
there’s a violation it’s not significant enough to warrant
a launch hold. So he advised the engineering staff at NASA to continue
on with the launch.
The integration console has responsibility to mask those limits if
they’re considered okay to be violated. They right away punched
into the computer, tried to mask that limit, and they ran out of time.
When they reached the T-minus 31 second automatic hold point, the
ground launch sequencer system noted the violation and automatically
stopped the count. They were too late to mask that limit. Then there
was a lot of conversation on the net, “At what point do we recycle?
Do we go back to the T-minus 20 minutes, or when?” In the meantime
people had taken a hard look at some of the APU data.
At that point I was in what they called the RPS, the record and playback
station. This is where we looked at strip charts showing the performance
of the APUs, specifically chamber pressure. That was our critical
parameter demonstrating how well the APU was performing. I noticed
there was some slight violations of our lower limit. It was dropping
about 20, 25 psi below—on occasion, not continuously. But I
knew the reason for it, and I knew that it was all right for the APU
to do that and I thought it would operate normally throughout the
rest of the mission. So I gave my go-ahead to my counterpart at the
APU console in Firing Room 1, there’s no problem to continue
with the launch count. We did so, and then we stopped automatically
at T-minus 31 seconds because of the PRSD problem.
Then people started looking more critically at the rest of the APU
data, which I didn’t have at my strip charts. We’re not
looking at the oil pressure—some people noticed that the oil
pressure was increasing to near the unacceptable limits of over 100
psi. So somebody said, “Well, it looks like it’s hovering
around our limit. We better not take a chance, we need to make sure
everything is okay. We should just go ahead and replace those APUs
rather than continue with the launch because of this high oil pressure.”
Ultimately the failure analysis showed that it was the problem I mentioned
before, where the oil and the fuel mixed and the fuel got into the
oil system and created pentaerythritol and it was clogging up the
filtration system. It was causing restriction in the oil flow and
causing the higher pressure to appear. They decided at that point
in time to replace those two APUs. It happened on two APUs, which
is incredible. The third APU was fine.
During that time it was decided if the APUs were suffering this contamination,
what about the rest of the oil system within the orbiter, the rest
of the lines that supply the oil. It came to me to come up with a
procedure to clean all the rest of the oil system before we installed
the new APUs. We didn’t want those new ones to be contaminated
again with the bad oil. After consulting with Sundstrand, I ended
up writing the procedure to flush out and clean the oil system and
reinstall the new APUs. We got all that done. It took us about ten
days to recycle and install the new APUs, do all the checkouts, all
the servicing. There’s quite a bit involved in doing that.
We were under constant pressure to get that turnaround done. As part
of that pressure—I didn’t expect it to come from the NASA
Administrator himself. He actually called for a conference call at
the Cape. He wanted to have firsthand knowledge so that he could answer
questions being posed to him by various news agencies, AP [Associated
Press], UPI [United Press International]. Even the President himself
[Ronald W. Reagan] was giving him phone calls asking the status of
the launch. He sent his Deputy Administrator [Hans M. Mark] down to
KSC to provide him that knowledge directly of all the activity that’s
going to turn the vehicle around.
Christopher [C.] Kraft, who was the director of the Johnson Space
Center, had made a trip to the Cape. We had presidents of a variety
of companies that were contractors who were there to witness the launch.
I was invited into the meeting as the APU representative because the
APU was giving the problem, not allowing this launch to continue.
James Beggs, Administrator, had me on a conference call with him,
answering his questions about what happened, what are we doing about
resolving the issue, how soon can we begin the count again. It was
unrelenting. He was a powerful man. He let loose with quite a few
cuss words, matter of fact. He was really upset. He said he’s
got these people on his back and he wants this resolution right away
and he wants this thing turned around.
He was really upset with everyone at the meeting, to such a degree
that after he got off the phone Christopher Kraft actually had to—I
swear this is true—apologize for Beggs’s language to all
the attendees that were there. Because we had some mighty powerful
people, presidents of a variety of companies. The Rockwell president,
the Grumman [Aerospace Corporation] president. All these people there.
It was a pretty elite society and they were all, every single one
of them were being cussed out by the boss. It was really hard to take.
So I’m glad never to relive that experience. It was once in
We turned around the vehicle in ten days and the APU flew fine. It
was my responsibility to call the hold because of the chamber pressure
problem, but I knew that was okay. The systems were demonstrating
an infusion of bubbles into the fuel system, and I knew what the source
of that was. The bubbles artificially depressed the chamber pressure
value in our launch commit criteria. I knew these bubbles were temporary
and they would go away over time and everything would be fine, so
I decided not to call a hold.
One of the APUs that had that problem with the high oil pressure was
returned to Sundstrand and installed in a test facility, and the bad
oil was removed from the vehicle. That oil was removed from the system
and was introduced into the test system at Sundstrand. Again this
high pressure repeated itself. It continued on well past the T zero
point and for about five or six more minutes until the temperature
of the oil system became at its peak stabilized. And once the temperature
stabilized, the oil pressures dropped off.
What we learned later through our failure analysis is that that material,
the pentaerythritol, even though it’s a waxy substance, would
actually melt again at a high temperature. It was formed at the ambient
temperature, 65, 75, 80 degrees. Then when it reached normal operating
temperature of the oil, roughly 200 degrees, it would melt off and
the filters would unclog and the system would operate normally. I
felt relieved when I found out, I was vindicated that the oil system
would not have caused the two APUs to malfunction. That would have
been a major disaster if the APUs could not operate for entry.
It’s left quite an impression on you all these years.
Yes. Like I say, it’s the worst experience of my entire working
life, those ten days.
Were you a little nervous at the console, at the next launch attempt?
Yes. I was hoping that my procedure that I introduced flushed out
the oil system adequately, that it wouldn’t plug up again because
I didn’t want a repeat of that. But everything went smoothly.
Those ten days—as a matter of fact it was so bad, my director
at that time, who was doing support of the mission in Houston, hopped
on a plane and came and joined me at the Cape at the Kennedy Space
Center. He and I would spend time together creating these procedures
and working towards installing the new APUs. Our typical workday began
between 6:00 and 6:30 in the morning and ended about 10:00 p.m. that
night. Typically we would not even have time for lunch, just an exhausting
period of time.
On the next flight, STS-3, one of the APUs registered some overheating.
Was that something that you investigated while the crew was on orbit?
Yes, that was another case. I think the failure analysis concluded
that an underfill of the oil in the APU system experienced that high
temperature. The lube oil temperature and the bearing temperatures
as a result were increasing to near the limit that is designated within
the flight rules for an APU to be shut down. If it reached beyond
a certain temperature, the bearings would actually seize and discontinue
operating. They would not function anymore, and the APU would have
to be shut down. It was approaching those limits. It never reached
that limit and continued to operate. I believe that the nitrogen-powered
backup system that would control the main engine valves was used at
that point rather than depend on the hydraulic system for main engine
That’s something that I think the Shuttle main engine people
did not like to do, use the backup system. They were very very intent
on having us review our limits to find out how realistic they were.
So we consulted with our supplier Sundstrand and we did extensive
analysis and some tests to find out how high a temperature could the
bearings get to and still operate normally without causing an APU
shutdown and therefore cause the engine valves to shut down.
The way the APU and the engine valves were configured is that each
APU was in control of valves of each individual engine. One APU shutdown
means that the valves on that particular engine would also—not
necessarily shut down, they would actually remain in the position
they were in last. So there would be no throttle control, there would
be no valve control at all. They could be shut down by a nitrogen
backup system, but they could not be throttled either to the low thrust,
67 percent, or the high thrust, 104 percent. That event never occurred,
so I think the valves then were shut down by the backup nitrogen system.
Once the studies were made about how high a temperature we could go
to with the bearings and still allow the APU to operate normally,
we found out we could increase the temperatures quite high and still
have good operation of the bearings and of the gearbox. Since that
point in time, when the temperatures were raised up we never even
came close to violating those limits. That was a good thing that we
did, otherwise we would have had a near panic every time because the
temperatures were typically fairly high, in the 300-to-350-degree
Did you have any concerns about reentry for STS-3? Or you had already
performed the analysis and weren’t too concerned?
There was a big scramble going on to see how high a temperature we
could allow the APU to go. There was some concern about entry. Sometimes
when we have a troublesome APU we delay its start until the very last
phase, the approach and landing. Roughly 70,000 feet before landing,
the APU would be turned on if there’s a potential problem. We
may have done that [on STS-3], but I don’t think we ever experienced
that high temperature again. And everything was fine for the landing.
Did you take out that APU after that issue?
That APU had to be removed. It was totally torn down and the bearings
were closely inspected. New parts were installed because we were not
comfortable with the high temperature that it had experienced. It
was a good thing to replace, put in new hardware.
You had already talked about the problem on STS-9 where you had the
explosion with the two APUs. Can you tell us about the investigation
that went on following that flight?
I was actually in the Downey Mission Support Room when that happened.
My job was to watch the strip charts where we record chamber pressure,
the APU speed and other parameters—the temperature, bearing
temperatures, oil temperatures. I was watching very intently. The
orbiter had completed its mission, already completed its rollout and
it’s at a standstill. Of course, the APUs continue to operate
15 to 18 minutes beyond that. I see this unusual indication that APUs
1 and 2—suddenly chamber pressures go down to zero. I said,
“What the heck happened?” So sudden, in a split second.
First one, and then a short time later the second one goes down.
I said, “Oh my gosh, this TDRSS [Tracking and Data Relay Satellite
System] is acting up.” This satellite system was supposed to
replace the microwave relay systems, to allow downloading of all the
orbiter systems data without depending on microwave relay stations
around the world. This was the first usage of this satellite. I figured,
“Ah, that thing is malfunctioning, it’s causing us to
lose data.” But I looked at APU 3 and it’s operating normally.
That can’t be the TDRSS, because how could one APU be receiving
good data and the other two malfunctioning data transmittal? That
can’t be. We figured out a second later that there’s got
to be some kind of problem with APUs 1 and 2 both.
We decided to investigate what was going on with those APUs by sending
someone up to Edwards Air Force Base where the landing took place,
and see what happened. I was assigned that job. Luckily one of the
Sundstrand engineers, [Gary Mionski], was with me at the Mission Support
Room. We had an agreement with our supplier that they would provide
us with an engineer to support some of the earlier missions, so he
was on hand. He and I both made a trip up to Edwards that night and
came upon the vehicle maybe 9:00 or 10:00 p.m. at night. While we
were driving up, the personnel there made temporary provisions for
platforms inside the APUs. They took off the 50-1 door on the right
side of the vehicle and we could enter into the aft section and climb
up to take a look at the condition of the APUs.
I was astonished, I couldn’t believe what I saw. The fuel pump
on APU 1 is totally blown to pieces. These are pretty heavy-duty walls,
three-quarter-inch thick walls. They were totally broken, and parts
were just all around. The valve covers had blown off, there was instrumentation
cables that had burned off completely, there was evidence of fire
all around the area around the APU 1.
Then I climbed up a little bit higher to take a look at the condition
of APU 2, and the same thing all over again. The fuel pump had totally
blown to smithereens. Quite a few pieces lying around, blown through
some of the insulation. The exhaust duct indicated it had had an impact.
One of the pieces, as it blew up, had put a substantial dent in the
duct. The piece was flying at pretty high velocity that caused that
to happen. There was quite a bit of damage. There was fire all around
the APU, and I knew some major catastrophe had occurred.
I climbed back down from the orbiter. We went back to the office there
and reported that to everybody around the country who was on pins
and needles waiting for our report. Some of them were well late into
the night, 3:00, 4:00 in the morning when they were listening to our
report. They were just astonished to hear what we found. It was really
amazing. The thing that really threw me, astonishing to me, was no
evidence of hydrazine in the aft.
We had a safety guy go in ahead of me and [Mionski] in protective
clothing. He took samples of the air around the APUs and he had no
indication of any hydrazine there. To me it’s amazing because
the fuel pump that contained all the hydrazine was totally open to
the atmosphere. It was broken, it was totally smashed. The body was
shattered completely. There was no evidence of any hydrazine; when
it came time to drain the hydrazine from the fuel systems, both of
them had plenty of hydrazine in the feed line and also in the fuel
Later the chemists explained that possibly because of the air exposure,
a thin film was created on the surface of the hydrazine that prevented
the gases from escaping. Lucky for me, because I was not in any protective
gear. Those APUs had to be very carefully removed and they were returned
back to Sundstrand, the vendor. They were carefully inspected, and
finally after extensive failure analysis come to find out that it
was the tubing. The gas generator injector tube had cracked in each
of the two APUs.
At first the thought was that one APU failure had somehow caused failure
of the adjacent APU. The two APUs were fairly close proximity, but
that wasn’t the case at all. Some people even recommended afterwards
that we should create a shield of some kind in case of a much more
catastrophic failure of the APU. Maybe the turbine wheel might disintegrate
and cause an explosion and cause damage to an adjacent APU. There
were proposals made to do that but they never won any support. Instead
we relied on the speed control redundancy to prevent that from happening.
The failure was found to be the cracking of the injector tube, and
several improvements were made. There was a chromizing that was done,
which introduced a protective layer in the internal part of the tube.
A procedure was initiated that controlled very carefully the installation
of the injector tube into the valve. They added very thin strain gauges
at several locations around the injector tube and measured how much
strain was being introduced into the tube as it was being assembled
into the valve. They had to have special mechanical devices that inserted
very carefully that tube into the valve to prevent these high stresses
from being created, so it was under a stress-free environment from
that point on.
There was some attempt also to eliminate the gases that would be created
after the shutdown of the APUs within the exhaust duct. I worked on
that and I certified that system to introduce a low flow of nitrogen
gas interior to the APU to be supplied by K-bottles pressurized at
2,000 psi. It would have a slow dribble of GN2 throughout its entire
processing, from the OPF [Orbiter Processing Facility] all the way
through the VAB back to the pad prior to launch. But that system was
determined to be too cumbersome and had its own faults. It couldn’t
be maintained, and so that was never introduced. Although one vehicle
had provided an access QD into the tubing that would allow this GN2
purge to take place. I think Columbia was the only one that had that
little tube inserted in it, but it never got in the rest of the vehicles.
That particular problem with the injector tube remains with us today,
in that life of the APU is completely dependent on the integrity of
that injector tube. There was a program that was put in place that
would occasionally remove an APU from service and dissect, do a destructive
inspection of, these injector tubes to see if the chromizing layer
was intact and see how much potential there is for that injector tube
to suffer any more stress cracks. So far we never found any.
I read on the next mission, STS 41-B, you went in and took all the
APUs out of Challenger.
I don’t recall that experience at all. There were steps taken
to guarantee for the next launch we didn’t have that leak. We
had installed in that vehicle small tubing with sensors to sniff any
potential fuel leakage at certain critical points within the APU.
I was actually a party to that. We had to direct the people, the technicians
installing the tubing, to have the tubing placed in critical areas
of the APU where there might be indication of fuel leak. We actually
did a hot fire of all three APUs before that next launch to guarantee
there was no indication of any excessive fuel leak in any of the critical
joints. That was done, but I don’t recall that we actually replaced
all—we may have done that, but I don’t know the reason
why that would have been done. I do recall putting in those sensors
and doing the hot fire test.
Tell us about your time in the Mission Evaluation Room [JSC]. How
does it differ from working at the Launch Control Center [KSC] and
the Mission Support Room [Downey]?
The Launch Control Center was unique in that its responsibility was
throughout the entire countdown. The public, I think, is totally unaware
that the countdown actually starts days before T zero. The public
always hears, “Ten, nine, eight, seven, six, five—”
but the actual countdown is many hours, as many as maybe 100 hours
or so before T zero. The launch countdown book, the actual document
itself, is five volumes large and consists of 5,300 pages. This is
how complete, how critical that countdown is. When I’m there
at KSC for the launch support, we’re very intent on the last
few stages of the countdown period down to where the APUs start at
T-minus five minutes. Your other activities, like the heaters powered
on and checkout of the speed control unit and caution and warning
system, are some hours before T zero.
I think once the vehicle clears the tower, which takes about seven
seconds, then all the people at the Launch Control Center can leave
their consoles. Their job is done. Not true of the Mission Support
Room. There they watch. They have the same data that the people at
the Kennedy Space Center watch, it’s the same exact information.
They’re intently watching their screens at the MER as well as
the Mission Support Room at Downey. We have all these people watching
the same data to make sure somebody doesn’t overlook something
They continue watching after the Shuttle launches into orbit, and
throughout the entire mission. There’s somebody keeping an eye
on the status of the system throughout its operational orbital phase.
The Cape is only concerned about the launches, and they go away and
they get ready for the next launch. The mission support is totally
different in that respect, that somebody has to be watching that screen
all the time, 24 hours a day. Sometimes I would get the first shift
or second shift. We have three shifts a day watching continuously
every day of the mission.
Later on in the missions our system, the APU system, was so benign
and under really good control with the heater systems, that pretty
soon even the Mission Evaluation Room and all the various Mission
Support Rooms did not support continuously—except for maybe
entry, maybe the flight control checkout period. That’s when
the APUs are active. There was no need anymore to support throughout
the entire mission because the heaters are typically operating normally.
Other people watch the heater systems to make sure they operate normally.
If there’s any problem with the way they operate they would
report to the APU guys and they would show up and take care of the
problem. But in the later missions we got to be pretty confident in
how well the heater systems are operating, so there’s no need
to do three shifts a day support.
The difference between the MER and the MSR is significant, from my
point of view, in that the MER was much more sophisticated. They had
more screens available that could focus in on some of the data more
quickly. They had access to more features than the Mission Support
Room either in Downey or in Huntington Beach. There’s quite
an awakening to show up at the MER and find out what capability they
have compared to the MSR in Downey and the EMSR in Huntington Beach.
It was substantial, it was a great improvement.
Of course I expect Houston to have the ultimate, because the MER is
working very closely with the MCC [Mission Control Center], which
is just one floor below them. They constantly communicate, so their
data must be very similar to what the MCC is looking at. In Huntington
Beach or Downey we never quite duplicated what the MCC looks at. They
have capability to call up data faster—to review data, go back
to previous data, go forward, look at the data parameters real time
as they’re being created. The MSR in Downey and Huntington Beach
can only recall data that’s minutes old; they could not watch
the data real time.
Was there ever a time when you were in the MER where you were called
on to handle something real time with the APUs?
One thing that comes to mind right away. The APU system depends very
much on a water spray boiler, which is a component of the hydraulic
system. It does not belong to the APU system, but we depend on it
because the oil cooling is done through a system that’s contained
within the water spray boiler [WSB]. There are cooling tubes within
the WSB that control the cooling of the oil. Sometimes the water spray
boiler malfunctions such that it doesn’t cool the oil lines
adequately, so the temperature rises to levels above where we feel
comfortable. That event happened at least on one occasion when the
water spray boiler malfunctioned.
Then we would have to program a test on return. We didn’t do
anything on orbit except for the flight control systems checkout.
We would test that system, allow it to operate a lot longer than the
normal five minutes that checkout requires. We’d run it for
maybe ten or longer just to see that the cooling is adequate. The
APU system requires anywhere from eight to ten minutes to reach stabilized
high temperature, so have to run it that long to see if the water
spray boiler is operating normally or is still malfunctioning.
If it’s still not operating correctly of course that APU then
is delayed from starting until the very last stage of the flight.
That APU is left inoperable until approach and landing phase, which
is roughly 70,000 to 80,000 feet before landing. That happened on
more than one occasion, that’s one that stands out.
When Challenger [STS 51-L accident] happened [January 1986], were
there any questions about was it the APU system? At that point was
there some discussion or study into that?
Yes. When that happened, I was actually at Vandenberg Air Force Base
[California]. I was in the midst of demonstrating the APU fuel servicing
ground system to the Air Force, and turning over control of that to
the Air Force and to Lockheed [Corporation]. Lockheed was going to
be the company that operated the Vandenberg site, as well as the Kennedy
As soon as I learned of the Challenger failure, I immediately called
my boss at Downey to see what I should be doing and whether there
was any indication APU played a role in that. My concern was the APU
is a very dangerous component because it operates at such high speed
and has such volatile and toxic and highly dangerous fuel. I thought,
“Oh my gosh, what if the APU blew up and caused damage to the
aft section and destroyed the orbiter?”
I had those visions in my mind. I was not doing flight support or
launch support because I was at Vandenberg demonstrating the fuel
servicing system. I was not party or privy to the data they were looking
at, so when I heard from my counterparts in Downey that the APU data
looked normal right up to the point of the explosion, I felt relieved.
“This is really good, the APU didn’t play a role in that.”
I was very sad for that whole event to happen and it was quite a setback
to the whole Shuttle program, but I’m glad that APU didn’t
play a role in causing that accident.
During that downtime you were working on the improved APU? Was that
The improved APU development was well on its way. The development
contract was just between NASA and Sundstrand, so I wasn’t party
to that. That was already in place, it was already going on.
But what happened as a result of that was interesting. All the various
engineering personnel were on a downturn at that point in the Shuttle
flights, even though we were far away from the 100th mission. The
systems were designed to operate for 100 missions, and we were far
away from that with STS 51-L. Still the layoffs were actually coming
on the horizon. We were actually following something called the “Beggs
line.” This was a line drawn that showed the total engineering
population at a certain point high up on the curve, and a line you
draw at a certain angle down like this. Down here you’d see
the years [demonstrates].
There was a gradual decline in engineering manpower all the way through
to the end of the program. The decline was at a rate of roughly 500
engineers per year, that’s how fast there was going to be a
decrease in engineering population at Downey. Everybody was very concerned
about these upcoming layoffs. Shortly after we learned about that
Beggs line, the Challenger explosion happened and right away that
whole curve swung the other way. We started adding on people. We went
from maybe eight or nine people in the APU group up to 19 in a fairly
short amount of time.
The reason for that is that NASA initiated a recovery program where
they wanted to reevaluate all the Shuttle systems. Not only the orbiter,
but the external tank and the SRBs [solid rocket boosters] and the
main engines. All those had to undergo a complete certification review
from the bottom up. Meaning everybody had to identify all their Crit
1 areas, the highest criticality, had to identify all the specification
requirements, identify all the verification, all the OMRSDs. Every
document that had any kind of requirement, we had to show where we
satisfied that requirement in writing. Everything that we did had
to be redone all over again. All the documentation search was going
on, and that took over two years to do. We needed to increase the
manpower to accomplish all that. Our failure mode and effects analysis,
hazard analysis were all updated, all of that.
NASA was looking for any potential, anyplace else in the whole Shuttle
system, that such an incident could once again occur. They wanted
to prevent that from happening in the rest of the history of the program.
We did a very thorough job in relooking at all the requirements, make
sure they were satisfied by some test or analysis or similarity. That
was a pretty intense period of time, those two and a half years before
we resumed launches with STS 26-R.
For Discovery [OV-103], those APUs had been sitting for quite some
time. Did you change them out or inspect them for the return to flight?
At that point we knew that the APUs could withstand long term installation
within the orbiter. We had an every four year requirement to remove
them for inspection and do some maintenance on the APUs, but as far
as remaining installed it was acceptable. Much later after Challenger,
even after Columbia, we discovered that there’s a time factor
with respect to APUs’ performance from the valve operation standpoint.
The valves, if they’re not operated, became sluggish in the
opening response. The valve had such critical time associated with
it, it had to open—they’re completely up to speed within
about three seconds. They go from standby up to 72,000 rpm in three
seconds. If the APU takes longer than ten seconds to reach that speed
then the APUs go to underspeed shutdown. In other words there is a
criteria that says that they must meet that level before ten seconds
There was an APU that were left standing installed in the vehicle
longer than a year, and that APU was started. It took about seven
seconds to reach normal speed, where normally it takes about three
and a half. So it doubled the amount of time that it took to reach
that point. We were very concerned and we imposed a time limit, that
if the APU stood unoperated for nine months it would have to undergo
a hot fire test on the pad before it would be allowed to fly on the
mission. That requirement was imposed on all the APUs just a relatively
short time ago, maybe five, six years ago. That was the only concern
we had about downtime for the APUs. I think there was some need to
drop the tank pressures, that kind of thing, to avoid leakage. But
the APUs didn’t have to be removed and changed out after a long
You went back to the Cape to support some of the activities following
return to flight. Any of those missions stand out?
I was back there again for at least three flights—STS-26, 27
and 29. 28 was later, they changed them around. Those three missions
I returned to the Cape to do launch support to make sure everything
was okay. Those APUs worked fine, they had no difficulty at all. So
back to normal again, until of course STS-107, Columbia.
Did you have any concerns about the APU with that accident?
Well, Columbia was totally different. Once again I was not at my station
looking at data for that particular flight, I was actually on vacation.
That happened on a Saturday morning [February 1, 2003] when entry
was taking place, and I was at a ski resort in Mammoth Mountain [California].
I heard about it on the TV, and I called in to work to see if there’s
anything I could do, maybe cut my vacation short, to come back. Actually,
Saturday was the first day of my vacation, but I’d be glad to
come back if I could be of any help.
It turns out that they immediately concluded that the APUs were working
fine. There was no problem with the APUs, it’s all a matter
of hydraulic system, actually the wing section, that was responsible
for all the entry failures at that point. Ultimately they found that
it was that foam material that impacted the wing that caused the gap,
allowed the temperatures of the wing to exceed its normal limits.
I think someone mentioned it could have been above melting point of
steel. So it destroyed all the aluminum structure in the wing, and
the vehicle broke apart. The APU, again, played no role in that particular
We did go back again and once again review all the data. The one thing
that was astonishing to many people, including myself, is that come
to find out in all the failure analysis, the foam impact was a routine
event that took place over many many missions, and it was actually
recorded and reported over time. There were numerous dings in the
tile material underneath the wing and on the surface of the wing.
All of this was thought of as being incidental and not critical and
just a maintenance problem rather than a serious design defect.
They actually fired a piece of foam that’s estimated to be the
size of the one that impacted the [Columbia] at a test wing, and it
created a gap about one foot in diameter. They were astonished at
how such a light piece of foam like that could do such damage to that
strong wing. But it’s a matter of the velocity, the speed at
which that foam was traveling, combined with the fact that the foam
maybe had internally in it some ice from the condensation from the
cold surface of the external tank. That could have been part of the
cause, that it was actually heavier than they previously estimated.
It astonished everybody, especially I think Ron [Ronald D.] Dittemore,
who was the program manager of the Shuttle program at that time. He
couldn’t believe it.
That foam was captured on film, and people recognized that the foam
looked like it had flown off the external tank and potentially was
in the vicinity of the wing, but not much was done with that information.
I don’t know how much they really could have done, because probably
there was no potential for rescue. It was a shame that it actually
did happen. There was a lot done of course to prevent that from reoccurring,
with new design foam installation and heater systems in that pod where
the foam actually came off and inspection techniques that they now
use. Also some preparations for repair in case that was needed in
orbit, started bringing repair kits into orbit with them each time
they go. They got that problem under control. Hopefully that’s
true for the rest of the two, three flights we have coming up.
Hope so. What impact did the President’s [George W. Bush’s]
Vision for Space Exploration have on any improvements you might have
had planned for the APU?
Major impact, yes. Before the President’s announcement [in]
January 2004, we were actually well on our way towards recommending
to NASA significant improvements to the APU system. We thought because
of the toxic fuels and highly flammable and critical fuels that it
would be a great idea to have some protection against leakage, some
with detection techniques. We had none at the time. Other safety features
for our fuel tank that we could have introduced would be much greater
protection for the fuel tank, other features in the electrical circuitry.
A single short would cause a total failure, a Criticality 1 short
in the system that could be prevented by redesign.
There were a number of items that could improve the safety and reliability,
and in some cases the performance. The performance was the least significant
factor in our proposal. It’s always oriented primarily at safety
and reliability. We proposed all of these to NASA as a way to improve
the system to allow it to operate up to 2020 or even beyond that.
NASA was really looking for inputs like that, and they were going
to introduce those into various subsystems across the orbiter.
We were looking forward to incorporating those changes, and all of
a sudden we had this vision for spaceflight from President Bush that
really canceled all of these proposals, because many of them were
of a kind that would be very costly and would take quite a good deal
of time to introduce. With the short period of time remaining in the
flights, up to 2010, NASA considered it ineffective—cost-effective—to
introduce that into the APU system.
They did go along with some other minor changes that were introduced.
One of them being a heater system we introduced into the QDs where
there was some indication of leakage from the fuel tank, which was
a critical concern to us because if gas had leaked out of the fuel
tank it would make that system inoperable. We had heaters on the fuel
because that could freeze, but the gas obviously would not freeze
so we didn’t need heaters there. Come to find out that the QD
itself would allow some small leakage of the gas from the fuel tank
because of the seals. They would harden under very cold conditions
so we introduced heaters there to prevent that leak from happening.
There was another heater concern that we had in the gas generator
valve module where there was a heater introduced.
Those were all fixes that were roughly $1 million, a few months type
of impact to the program. So NASA welcomed that and they introduced
that into the design. They were fairly easy to implement and very
quick and very low cost, but all the others that were $5 million and
greater and took about a year, two years to introduce, they were just
discarded and not considered. It dampened our activity quite a bit
and we didn’t have an opportunity to deal with the safety features
anymore after that.
Was part of that plan the Advanced Hydraulic Power System?
The electric APU system?
Yes, that was a proposal that was made some years back. In 1973 when
I first started working on the APU system, I was introduced to a project
that just had begun a few months before, the introduction of the electrical
mechanical system as a replacement for the hydraulics APU system.
I said, “What did I get into?” Here’s this brand-new
APU system, and the second week I’m in the group I’m already
talking about replacing it with a completely different battery mechanical
system, eliminating all the hydraulics and all the fuel.
I said, “My career is going to be very short in the Shuttle
program.” Then, that new system they wanted to introduce was
much heavier in weight and somewhat more complex than the fuel system,
and there was very little aircraft experience with that kind of system.
On the other hand, hydraulics in aircraft they had tons of experience,
thousands of hours. A variety of aircraft had experienced the use
of the hydraulic system.
The hydrazine-powered APU had very limited use. It was used in the
supersonic transport (SST) and the Concorde [aircraft], so there was
some experience in airplanes with the hydrazine APU, but really zero
with the electromechanical battery-operated systems at that point
in time. It was considered not something that NASA wanted to pursue
even after it was proposed, and the studies determined that it was
going to be much heavier in weight and more complex so they set it
aside. That was 1973. It came back again in the 1980s and reintroduced
and reevaluated once again. Again it was considered to be too heavy
and not able to be introduced.
The last time, the most recent time, was in the year 2000. This time
the hydraulic system was left intact. Only the power behind the hydraulics,
the APU, was considered as a good potential for replacement with the
battery-powered system. The battery now operates completely electronic
APU that would not depend on any of the hydrazine fuels, which are
very very, extremely toxic. Personnel have to take special care—it
was very volatile and extremely dangerous, explosive, a lot of factors
against it. NASA wanted to do away with it so they initiated this
study of the electric APU.
We consulted with a company in Japan, Mitsubishi [Heavy Industries,
Ltd.]. It had created a battery that had sufficient power for our
needs, but the question was always about the weight. The weight of
the battery was just something that could not be reduced enough to
satisfy NASA’s needs. Matter of fact, NASA went to the extent
that they would accept a weight penalty of 2,000 pounds, the weight
in excess of the APU system’s weight to be able to incorporate
the electric APU. The electric APU could not reduce its weight down
below 2,500 pounds. That was one major factor.
The other factor of course was the cost. The initial cost estimated
for the introduction of the electric APU in all the orbiters was roughly
$350 million to $375 million. By the time development had progressed
so many years downstream, the cost zoomed up to in excess of $650
million. NASA were looking towards maybe seeing that number even escalate
up to $1 billion level, and they decided to cut it off before they
reached that level and not continue with development of the electrical
system. So two things knocked it down, the excessive cost and the
really heavy weight. They didn’t want to pay a 2,500-pound weight
penalty to introduce the electrical system.
My role in that primarily was to produce once again the certification
plan for electric APU. I was looking forward to actually implementing
the plan with great anticipation, but the plan is collecting dust
someplace. It never got implemented, but I was ready for it.
One of your colleagues asked me to ask you about how the APU development
advanced state-of-the-art hydrazine turbine.
Quite a bit. Early in the development program it was recognized that
the APU turbine wheel, which was really a very very critical design,
had experienced some blade tip cracks. At the very tip there were
some incipient cracks, and also at the root where the blade emanated
from the central hub there were some slight cracks. There was some
concern about that turbine, particularly because it’s accelerating
at such high speed that in case the blade may be partially fractured
it could release very fast flying particulate that could cause damage
to the housing and maybe penetrate the housing and cause damage to
the vehicle internally, and maybe destroy the aft section.
There was a design requirement within the procurement spec [specification]
that the turbine wheel should be totally contained in case of its
complete breakup. In other words if it separated and maybe tips or
the entire blade broke off that all that damage would be self-contained
within the APU, not cause damage to the surrounding hardware. Sundstrand
promised, “Cross my heart, yes I’ll do that.”
When it came to demonstrate they’d actually succeeded, they
could not. A couple of times it accidentally occurred and one time
there was actually a planned tri-hub burst. They created cracks intentionally
within the turbine to make sure that it failed at high speed, like
150 percent speed. Normally operates at roughly 102 percent speed,
but at 150 percent speed it would let loose. When the wheel came apart
it caused so much damage. It destroyed the housing and the pieces
flew apart and caused some damage to the test cell. They were astonished.
Their containment never contained anything, it didn’t work.
There was at least one other event where the speed control system
malfunctioned, allowed the APU to spin at too high a speed, and the
wheel broke apart. Once again it destroyed the housing, it didn’t
contain the wheel at all. So NASA got very concerned. Instead of providing
for a stronger containment, they decided to introduce more and more
redundancies in their speed control device to prevent that from happening.
They had like quadruple redundancies in the controller to prevent
that from overspeeding. That was a good thing to do.
They looked at the turbine wheel itself and found these initial cracks
happening at the tip and also at the root, and they went into a massive
redesign of that wheel. They beefed up the root area and made it a
different shape turbine wheel blade such that it wouldn’t experience
these cracks, and put it to the test. Put 75 hours on a number of
these turbine wheels. Spun them up in different APUs, inspected them
at intervals, and did what they call a wheel mapping where they have
identified exactly any imperfections in every blade of the wheel.
They had like 180 blades. They’d map every one of them, make
sure they knew exactly what these blades looked like. After like 25
hours, they’d take it out of the APU, inspect it again, map
it all over again, see if any cracks had developed. They did that
about three times after every 25-hour period on about three different
They found out that their design now would not create any cracks that
were excessive. On occasion, whenever there was cause for the APU
to be disassembled when it’s removed from the vehicle, they
would do a wheel mapping again. But that was not introduced as a regular
part of the maintenance plan. Only if the housing of the wheel had
to be disassembled for another reason they’d have a chance to
look at the wheel. They never took it apart just to inspect the wheel
because it’s considered to be such a good redesign. So yes,
that wheel was a breakthrough in design for turbine wheels for any
hydrazine systems of the future.
Looking back over the development and design phase of the APU, do
you think there’s anything that NASA or Rockwell or Sundstrand
should have done differently, or could have done?
In the early phases of the program, they could have identified the
problem much earlier and maybe would not have had this explosion that
took place in STS-9. But they didn’t know that downtime played
a role. That’s something that was recognized much later in the
program, and they paid the penalty for that because of the downtime
and damage that was caused and the lingering problem with the injector
tube even today.
Hindsight is 20/20. We didn’t know that downtime had even played
a role in there. But it did. Matter of fact, most people say the best
kind of operation for that APU would be if you connected it up to
a huge fuel tank and turned on the APU and let it run for 75 hours
without stopping. That would be the most benign condition for that
The problem, it has to stop and start again on a regular basis. The
stopping and the starting is what deteriorates the APU much faster
than normal operation. They recognized that later in the program.
That aspect also was recognized late because of the heat transfer
I mentioned before. The heat soakback coming back from the gas generator
caused excessive temperatures in the fuel pump and the valve. At one
point actually the valve did blow up because they had excessive temperatures.
That’s something they didn’t know.
The function of development is exactly that, it’s to find out
these problems so you don’t have them in an operational APU.
The only time we did have an operational APU go bad is when that injector
tube cracked and caused the two APUs to explode post-landing. Those
problems were recognized much later in the program, and we paid the
penalty for that but we recovered from it.
Do you think the APU should be considered for use in future spacecraft?
Absolutely. I don’t think there are any more major problems
remaining in the APU. All of those were sorted out in all these different
test phases and flight phases, we’ve covered every aspect of
APU operation. Just to tell you how good the APU is, the APU is now
certified for 75 hours, but demonstrated operation well over 100 hours.
There was some thought that maybe we could certify the APU to 100
hours or more, but we decided against it. We decided to call the additional
25 hours of operation as margin over the certified number. We don’t
want to exceed the 75 hours because it’s a procurement specification
requirement of the supplier, the vendor.
If you increase that, that means that we have to document their ability
to demonstrate the 75 hours, and they could not do that contractually
speaking. It’s a major contract change. They don’t mind
demonstrating the APU can operate above 75 hours, but they’re
not contractually liable for that. All these extra hours that we have
demonstrated—just like you carry in your hip pocket kind of
thing for emergencies. For example, if you approach 75 hours’
operating time on an APU, and there’s a potential for adding
on another three or four hours or replace the APU with a spare, we’d
have no problem allowing that APU to continue and operate for one
[or two more] additional flights without any concern. That was the
way that additional hours were used.
Did the Marshall [SRB] HPU [hydraulic power unit] have any impact
on the APU program?
The opposite I think is more true. On occasion when the HPU had its
problems in acceptance test and operationally, the orbiter APU would
learn about that and see if it had any kind of comparable problems
to contend with. Typically we did not. The HPU mission is substantially
different from the orbiter APU mission. The HPU, operating time is
much shorter. It starts pre-launch, 15 to 20 seconds. It operates
throughout the ascent flight through SRB burn, which is two minutes
and six seconds or so.
It has an oil system, but it doesn’t have any heat exchanger
to cool the oil because it never gets hot enough. It has to operate
ten minutes to get hot, so in two minutes of operation it doesn’t
need any heat exchanger. Doesn’t need any heaters because it
never reaches orbit. All its requirements are much much less. Its
controller is much simpler because it doesn’t have all the operation
requirements the orbiter APU has.
The HPU guys were invited to participate in all the program review
meetings of the orbiter APU, because they would learn about problems
that the orbiter has to see if it has any bearing on their operation.
It’s more like they would learn from the orbiter APU, and we
would provide inputs to them. For example the turbine wheel, they
were the beneficiary of that. Because their operating time is so much
shorter they wouldn’t really have a problem with their turbine
wheel. They wouldn’t experience the high temperatures and the
high speed long enough to create these cracks that we had in the orbiter
APU. Some fuel pump design changes that we had incorporated earlier,
they incorporated in their HPU.
The one thing that we didn’t have to contend with that they
did is the orbiter APU never saw the ocean, but the SRB HPU got dumped
in the ocean every flight. It comes back to Sundstrand and has to
be completely refurbished, completely torn down, a lot of new seals
put in. Anything that had been exposed to seawater had to be renovated,
refurbished, recleaned. [The HPUs were not] tossed away. They were
reused over and over many times. After a while the seawater impact
would have some corrosive effect and the HPU no longer would be usable,
but they did a lot of refurbishment that the orbiter APU never had
to do. They came back for maintenance every flight, whereas the APU
came back for maintenance once every four years.
In order for the APU to be successful you had to have a successful
partnership with North American Rockwell, Boeing, JSC and Sundstrand.
Would you talk about that a little bit?
Yes, that partnership worked out really very well. There were some
minor hiccups along the way which we took care of to some degree,
never completely. We came very close, and that was a relationship
among all these factions when it came time for testing. Specifically
the certification or qualification testing that I was involved in.
In development testing the responsibility was solely Sundstrand’s
for the APU because they had total control and they were responsible
for the development.
Once it came time to do certification, the certification test [often]
had to be done in a facility outside of Sundstrand because of the
vacuum capability that JSC had at the Thermochemical Test Area, TTA.
Also White Sands Test Facility had the vacuum chambers that were needed
to demonstrate high altitude operation and thermal control, low temperature
environment and high temperature environment. Sundstrand did not have
that, so we had to make a great deal of use of those facilities.
The question became who’s in charge. Rockwell is responsible
for the ultimate certification. But Sundstrand was responsible for
the unit as well, so they had to direct technicians as to what to
do. The technicians were actually employees of NASA TTA, NASA had
its own managers and supervisors operating the test facility. So Rockwell
was here directing Sundstrand, Sundstrand was here directing technicians
and NASA guys were boss over the technician. Do we pay attention to
the NASA guy, the Rockwell guy or the Sundstrand guy?
We had to write what’s called a memorandum of understanding
in a number of instances. We tried to follow that, but it was really
difficult. It was rarely followed to the tee, because oftentimes Rockwell,
the contractor, had to bow to the customer. Customer is always right,
whatever NASA wants we must do. So we had to compromise all the time.
If you were to do some testing and you want to maybe apply an instrument
in a certain location, and NASA said, “No, we’d rather
have it here.”
“Well, no, we’d rather have it here.”
“Okay, you win NASA, you’ll have it over there.”
We have to pacify the customer at the same time we are responsible
for the APU for its ultimate certification. We have to direct the
supplier to make sure they do their job, and the supplier has to have
some control over technicians who actually report to the test agency,
NASA. How does a supplier control the technicians? He doesn’t
really, he has to depend on the NASA supervisor.
The way it worked is that Rockwell gave the requirements to Sundstrand,
and the Sundstrand engineering supervisor had to negotiate with the
NASA supervisors who were in charge of the test facility, and the
NASA guy would direct the technicians as to what to do. It was cumbersome.
It was really difficult to work sometimes because we all had to be
consulted. Rockwell can’t independently tell the technician,
“Hey Joe, make that temperature different.” We have to
clear it with the NASA guy in charge, and the NASA guy has to have
an okay from the Sundstrand guy who also has the same responsibility.
The responsibilities were everyone’s, so it was really difficult
sometimes to work closely together because we all had different ideas
as to what had to be done. But I think in most cases NASA won out,
because the customer is always right.
I just had two more questions for you. What do you think was your
most significant accomplishment while working on the APU?
Wow, that’s 37 years. It could be a comprehensive one actually.
I think the word I would use is certification. I’ve been involved
in many different aspects of the APU activity, including working on
the failure mode and effects analysis, the hazard analysis, launch
commit criteria, the flight rules, working on the vehicle end item
specification. Many different documents—creating the subsystem
certification plan, the development plan, working all aspects of it.
Being in testing, being in mission support, flight support. But the
thing that stands out in my mind was the actual certification of the
unit for whatever mission it was required to do.
Initially the Approach and Landing Test program, the APU had to demonstrate
that it could support all the missions: the captive inactive and active,
the free flight program. The APU [had to] perform its function completely
and safely and reliably each time. Then it came time for the APU to
demonstrate ability to perform all the orbital operations, beginning
with ascent, through orbit, and all the way through landing. All that
had to be certified and identified to NASA, the customer, that we
could actually perform all the specification requirements fully, to
all the extremes of the spec requirements. I think all of those things
stand out in my mind as my biggest contribution, certification of
that system we call the orbiter APU subsystem that is flying today.
What do you think was your biggest challenge?
I think the biggest challenge occurred after the aftermath of the
STS-9 where the two APUs exploded. That was a major major catastrophe
from the viewpoint of the APU supplier and NASA and everyone. We thought
that we were at the end of our rope. The fact that these APUs could
explode caused a lot of people great concern, because if this could
happen on the ground this could also potentially happen in flight.
That would be a disaster that would not only destroy the vehicle but
kill all the astronauts participating in that mission.
We had to make sure that we understood the problem and resolved it
completely satisfactorily, because if we didn’t we could have
another major disaster on our hands. We certainly didn’t want
to be responsible for creating such a catastrophe that occurred in
Challenger and also Columbia. We didn’t want to be a party to
that, and we devoted a lot of time and effort to prevent that from
happening. So far I think we’ve succeeded very well. We’re
continuing to operate the APUs very safely and reliably for the remaining
Anything that we haven’t covered about the APU?
One last thing. The last stages of my career in APU, working as I
do now short term part-time, my assignment currently is to go through
all the documentation that was ever created in the entire APU program
and pick and choose what documents are the most important to leave
to posterity. That’s a pretty heavy-duty decision to make as
I go through all the documents that we’ve collected over 37
years of the program. I’m glad to do it, but sometimes it’s
sad that I have to dispose of some documentation, some notes that
my friends had made over the years. I’ve gotten to know so many
people that worked on the program that were experts in their field,
and the tendency is to keep everything that they ever created.
I have to make a decision what’s important to retain for posterity,
and that’s something that I enjoy doing. I think we’ll
succeed in keeping a great deal of the documentation which identifies
all the problems we had and lessons we learned so that the future
generation doesn’t have to repeat the problems that we had and
can create a much safer and more reliable and much better spacecraft
for humankind in the far future. So I’m glad to be doing that
job in the last stages of my career.
That’s important. As a historian I can tell you that’s
the most important thing. Thank you very much for your time today.