NASA STS Recordation
Oral History Project
Edited Oral History Transcript
Frances A. Ferris
Interviewed by Rebecca Wright
Downey, California – 24 August 2010
Wright: Today is August 24th, 2010.
This interview is being conducted with Frances Ferris in Downey, California
as part of the NASA STS Recordation Oral History Project. Interviewer
is Rebecca Wright. Thank you so much for coming in this afternoon.
I’d like you to start by telling us briefly about your career
with Rockwell [International Corporation] and [The] Boeing [Company].
Ferris: When I got out of college, I
had two job offers. One was to work on a boiling water nuclear reactor,
and one was to work on the Space Shuttle. It was an obvious choice
for me to accept the offer from Rockwell and work on the Space Shuttle
program. I came into a group called the purge, vent and drain group,
PV&D for short. The easiest way to explain what PV&D did is
environmental control of unpressurized compartments, the parts of
the vehicle that were not the crew module.
Part of PV&D was purging the vehicle with nitrogen on the [launch]
pad to dilute any hazardous gases. There’s a system that detects
hazardous gases in the vehicle to determine if we have a leak before
launch; a drain system, which just allowed water to drain out; and
venting. When you have a vehicle on the ground and you’re at
one atmosphere and you go into space where there’s no atmosphere,
all that gas leaves the vehicle. The orbiter is in different structural
compartments and you have to make sure that as the gas vents out of
each compartment it does so at a rate that you don’t get excessive
delta pressures across pieces of the structure. The system controls
that to limit the structural loads.
Wright: You have simplified that well.
It’s an extensive engineering complex system.
Ferris: It was interesting to me in
part because the hardware goes from nose to tail, so I got to interface
with people who worked all over the vehicle in all kinds of systems
as opposed to being isolated to one part of the vehicle.
Wright: Share with us a few more details
of how all these systems work together but can impact each other,
and how you were able to ensure that all were running. You did an
analysis on a lot of those systems to make sure they were at their
peak performance. Can you give us a few more details on how that worked?
Ferris: The PV&D systems are mostly
ground-based systems. You have ground equipment that interfaces with
the flight vehicle, and you’re getting data on pressures and
temperatures or for the haz [hazardous] gas system on concentrations
of oxygen and hydrogen. All that data goes into the firing rooms.
In many cases we have launch commit criteria which are constraints.
If you get above or below a certain limit you either call a hold or
you scrub for the day.
The vent system is the one that’s active during flight. The
vent doors are closed on the pad, and right before launch they open
up and allow the nitrogen in the compartments to escape. They stay
open while we’re on orbit and they close before deorbit, because
as you’re coming in on a hot entry you don’t want to ingest
hot gases. Then at a certain altitude, between 70 to 80,000 feet,
they open up again. That’s when you start hitting the atmosphere
and you allow repressurization of the orbiter.
Wright: It’s an amazing technological
structure. You worked with that system for about 11 years. Were there
a lot of changes or evolution to the system while you were involved
Ferris: I actually hired in in 1980,
so [OV-]102 Columbia was already at [NASA] Kennedy Space Center [Florida].
The bulk of the design had already been completed. I worked on mostly
certification of systems for flight. But as we flew the vehicles we
found that there would be efficiencies for processing the vehicle
or safety improvements. Then there were changes.
We also had some cases where we had difficulty with the hardware performing
to specifications. We had a unit called the wing vent relief door,
and it allowed venting of the wing through the mid-body if the wing
external vent door did not open. It was a large panel that was supposed
to open at a certain differential pressure. The cracking pressure
range was very narrow, and there’s a lot of vibration in that
We had a lot of issues with the door either opening too soon—mostly
too soon, which is not really a hazardous situation. Too late would
create too much pressure. We looked at the environment to see if we
were overtesting, and ended up finally making a recommendation that
we could delete the door and just vent the wing with the mid-body
compartment. That saved us a considerable amount of weight, it saved
software space, it eliminated some critical failure modes. All in
all it turned out to be a good change.
There were many mods [modifications] that came on as a result of large
projects that PV&D was a small part of. One was the addition of
the drag parachute system and the crew escape system. Things like
that always involved the PV&D group.
Wright: Were those part of the modifications
after the [Space Shuttle] Challenger accident [STS 51-L]?
Ferris: After the Challenger accident,
Wright: Were you part of the work that
resulted in the development of replacing the ducting with Kevlar [para-aramid
synthetic fiber] and epoxy [polyepoxide]?
Ferris: No, I think that was before
my time. It was always Kevlar-epoxy.
Wright: You also worked during that
time period on the thermal control system.
Ferris: Yes. The thermal control system,
or TCS, are the internal blankets. When you see video of the vehicle
and the doors are open and you see nothing but white, those are the
TCS blankets. They’re to control temperatures of the structure
and the other hardware systems when you’re on orbit, because
going from sunshine to night you’re ranging from +150 degrees
to -150 degrees [Fahrenheit]. That design was pretty much done. It
was a small group of people and they needed a supervisor, so I just
inherited them along with my PV&D group.
The interesting thing about that system is almost any change someplace
else affected the blankets. If you changed the structure you had to
adjust and adapt, if you ran new lines you needed penetrations. The
difficult part was that the blanket design always got done at the
end. Once everybody finished and finalized their design, then we came
at the end and accommodated everybody else—as long as they remembered
to tell us.
Sometimes at the Palmdale [location in California] they’d go
to install a blanket and they’d say, “We can’t install
this blanket because there’s this tube that needs to go through
the blanket and there’s no penetration.” We’d have
to scramble at the last minute and get those kinds of things changed.
Wright: Did that happen a lot where
you were having to scramble at the end?
Ferris: It depended how many mods were
being done. If there was a lot of rerouting of hardware—we’d
do our best to do the coordination up front, but sometimes people
are in a rush and they hurry and they forget to hand off that information.
Wright: While you were there we lost
Challenger. Talk about the impact on the areas that you worked in,
and how the loss of that orbiter impacted the changes that were made
for the future.
Ferris: I started supporting the mission
activities about STS-3. We had gotten to a point where systems like
PV&D that were not considered critical didn’t do the real-time
launch support anymore, so I was actually in my office when the accident
happened and heard about it secondhand. Then of course everybody got
involved in the investigation, because there was no clue as to what
had caused the problem.
I got started on the investigation team. It became clear fairly early
on that the problem was the booster and not the orbiter, and certainly
not any of the systems that I worked on. After that, NASA went through
a very rigorous recertification and reverification of the entire Shuttle
program. We had all our orbiter requirements in the OVEI, the orbital
vehicle end item specification.
We went through a DCR [design certification review] where we examined
every requirement and how we met it and whether the analysis and testing
we did to meet the requirement was adequate and the validation was
adequate. And [we] made a recommendation whether or not we needed
to do more work or adjust the requirement in some cases or to just
document areas where maybe we fell short a little bit but still had
adequate safety margins. That whole process took a couple of years.
Then of course a lot of safety mods came out of the accident. Two
we talked about a minute ago, the crew escape system and the drag
[para]chute system. There were quite a few design changes after the
Wright: Did your work take you outside
of the facility? Were you working on teams and meetings throughout
Ferris: I was primarily in Downey. As
vehicles were being built I was doing testing up at Palmdale. Earlier
in my career I traveled quite a bit to Kennedy because I would do
a lot of [support] testing out there. It seemed like I was always
going to Florida and never going to Houston [Texas, Johnson Space
Center]. Then once I started going to Houston I almost never went
to Florida again.
Part of the closure of actions associated with the review after the
Challenger accident was the one time I actually went to NASA Headquarters
[Washington, DC] because we were briefing a program manager on the
impact of a broken window on ascent. That was the only time I ever
went to Washington, DC, for work.
Wright: When you refer to testing at
the Cape [Canaveral, Florida], can you give us an example of what
Ferris: Mostly what I supported was
structural leakage testing. I mentioned that we had the vent system.
There was typically a ratio of the area of the vent to the volume
of the compartment. But when you build a vehicle like that, just like
your car, everything’s not sealed up; you have little gaps and
little holes. So one of the things we would do is pressurize the different
compartments of the vehicle and literally walk around and feel for
where air was blowing out and try to quantify how much air was blowing
The analytical folks that did the venting analysis put this data in
their program. There are different pressure coefficients on different
parts of the vehicle, so it was critical to really know where the
leakages were. There was a lot of work done early on baselining the
structural leakage on every vehicle. It took us several flights to
understand that that number was very stable.
Wright: There are a number of orbiters.
Did you find a lot of differences or were the orbiters the same?
Ferris: There were differences. Some
would leak a lot more around door perimeters. I think it’s the
buildup. You have different tolerances on your parts, so if one side
is on the thinner side and the other side is also thinner you might
get a little bit more of a gap.
Then the structure design did change over years. It didn’t vary
greatly, but we ended up having to build a different set of pass-fail
requirements for each vehicle because they were different enough.
That’s what we were really looking for, not what the number
was but how much did something change. Because if something changed,
it could be indicative of some type of failure that you’d want
to go investigate further before you flew.
Wright: In the ’90s the Shuttle
fleet was grounded due to hydrogen leaks. You were involved with the
effort to return the fleet back. Can you talk about that event and
how you were involved and how you determined the resolution of the
Ferris: That was mostly due to the fact
that part of the PV&D system was the hazardous gas detection system.
We sampled the effluent out of the mid-fuselage, the cargo bay and
the aft. The aft is where the engines are and you’ve got lots
of hydrogen and oxygen going through those systems. We would pull
a sample of gas continuously, the gas would go in the mass spectrometer,
and it would yield the percentage of hydrogen and oxygen detected;
also helium, because there’s a background of helium.
The haz gas system was the system that detected unacceptable levels
of hydrogen. Before the first flight of every vehicle they did what
they called a flight readiness firing. On the pad they load the propellant
and the oxidizer in the tank, go through a normal launch countdown,
light the engines for a short period of time, and then shut the engines
down. That was enough time for the main propulsion system and the
engines to pressurize and you would see an increase in hydrogen in
the aft compartment at that time. Based on the slope of the increase
of the hydrogen and the peak and the way it decreased, you could determine
how much the whole propulsion system was leaking. We determined launch
commit criteria based on that data.
Mostly what I did was in support of the main propulsion system folks.
When Challenger went through its FRF [flight readiness firing] we
saw the huge, huge hydrogen leak, something that was not acceptable
to fly, and took a very, very long time to try to find the source
of that leak. They were looking for leakage in all the ordinary places,
in joints where parts connected to each other where you might have
a little gap or a seal that had a crack in it, and they never found
They actually found the leak by accident. In the parent metal of the
main combustion chamber of the engine there had been a weld that had
not been done properly and started a crack. We actually did a second
firing to try to find it because we weren’t sure where it was.
The propulsion team developed what they called a helium signature
test where they bagged the propulsion system as much as possible,
pressurized and measured the helium, and that gave them an indication
of whether they would have a hydrogen leak during flight. It doesn’t
take much of a hydrogen leak to get a combustible mixture in the aft
In 1990, I believe what happened was we had a leak that was in the
disconnect area between the orbiter and the ET, the external tank.
It took quite a bit of time just to pinpoint the area, and then there
was a lot of discussion as to how would we ever know if we had a leak
in this area? My team did several studies on whether there was any
type of instrumentation we could install in this gap to determine
if we had a leak. The gap was less than a half an inch thick.
We put helium in that gap because you didn’t want a leak [to]
build up and become pure oxygen or pure hydrogen, so you have to keep
diluting and mixing and moving the gases out. We came in and made
some recommendations about whether or not you could put a unique haz
gas sensor there or if the best way to detect leakage was to put a
pressure measurement there. The program also had hydrogen detection
measurements external to the vehicle which they’d pull down
right before they’d light the engines.
That was a long summer, and I was pregnant that summer too. So I was
tired, very tired.
Wright: Were you in residence for the
Ferris: No, I went back and forth. I
actually never spent much time out there. The Challenger FRF was probably
the worst trip I had because I had planned to go for four or five
days, and I ended up there for about two and a half weeks. You only
take enough clothes with you for the time you think you’re going
to be there.
Wright: You mentioned the propulsion
guys. Were you working with people from [NASA] Marshall [Space Flight
Center, Huntsville, Alabama] as well or were you a separate team?
Ferris: No, the orbiter propulsion guys
were the ones I worked with. They worked really closely with the Marshall
Wright: I find these projects very interesting
because they’re all little standalone ones—the drag chute
panel [on STS-95].
Ferris: The door fell off [during launch],
Wright: Tell us about when you learned
about that event and how your team helped resolve that issue.
Ferris: We had a Mission Support Room
here in Downey at the time. We were there and everything seemed fine,
the mission was going great. Then folks that were reviewing video
said, “Something fell off.” It was hard for me to see
at first—I’m not very good at that type of thing—but
once they refined the video, yes, something fell off. The word was
going around it was the drag chute door. “How could that fall
off? It’s fastened on there pretty well, and it’s big.
That’s not going to happen.” It turned out it did.
That was John [H.] Glenn’s mission when he flew as a senator,
so it was very high profile, lots of media attention. We had a couple
of things going on. It became clear right away that the investigation
was going to go in dozens of different directions. I ended up being
the person on the Rockwell side [Rockwell sold aerospace divisions
to Boeing in 1996 – Boeing North American subsidiary formed]
who was coordinating all the action items and making sure that Rockwell
had the right team of people working on that action item.
We had two big telecons a day to talk about the progress. You sit
in these meetings and it becomes hard to get any work done because
you’re reporting on what’s going on. This failure was
interesting because we had to figure out why the door fell off, and
we had a vehicle on orbit that didn’t have a door. So we had
the root cause investigation and another set of investigations about
what do we do when we land, is it safe to land?
We managed to get some video that showed the aft end of the vehicle.
There was some browning and maybe a little charring of straps, but
pretty much the drag chute compartment looked intact. We had very
limited instrumentation and the data that we had wasn’t downlinked,
I don’t think you got it until you got back on the ground. The
video results pretty much matched what our thermal analysis said,
so we knew we had a fairly intact system.
The next set of analysis was what happens when we go through a reentry
and we don’t have that protective door with the TPS [thermal
protection system]. Luckily the temperatures in that area are more
severe during ascent than descent. The determination was made that
we’d survive the entry, that there wouldn’t be any issue.
There was concern if you got damage and then you tried to deploy the
chute, would it hang up and do more harm than good? There was a lot
of discussion about if we deploy the chute are we going to destroy
some evidence that would help us determine what happened and why it
happened and what corrective action we needed to take. That was very
very fast-paced, because decisions needed to be made pretty quickly.
We ended up deciding to not deploy the chute. We had a safe landing,
the chute looked pretty much just like it did on orbit. They were
able to retrieve that and as we were going through the hardware investigation,
we went through the original design and what are the environments.
The engines burn hydrogen-rich. During launch there are sparklers
that set off the free hydrogen in the area so when the engines ignite
you don’t have a detonation of hydrogen.
It turns out that there are some pockets that don’t really burn
off, so there is a main engine ignition pressure environment that
was not accounted for originally. When we did our original analysis
and testing we didn’t account for this little poof of pressure
on the back end. We analyzed our design against that environment and
we still were not finding a problem. We looked at the way the door
was installed, we looked at the materials we used. We were examining
this from every angle we could think of.
It took months to find out that the problem was the pin that went
in the hinge that held the door in place. If you got a pin that was
on the low end of the material property strength, it could break with
the engine ignition environment. We had never had that situation where
we had the low margin pin and the high pressure environment at the
same time. I believe we actually flew again before we discovered that
that was the root cause, and we made a decision to lock the door in
place because we didn’t want to take a chance on having a door
fall off again.
The drag chute system helps shorten the rollout after landing and
it takes some of the load off the braking system, but it’s called
a Criticality 3/3 system, which means it’s not mandatory for
safety. There was a lot of discussion about should we still use it,
should we take the chance? We did end up, like I said, pinning the
door for at least one flight before we figured out what the problem
was and we put in stronger pins.
Wright: Easy solution to a hard problem.
Ferris: Yes. I remember going through
this and being so frustrated because we had looked at everything,
we thought, and we couldn’t find anything to point to as the
failure cause. I remember one of the stress analysts who had been
with Rockwell for ages, who was our premier expert in this area, telling
me, “Frances, there’s a reason, and we will find it.”
We finally did, but it was a long time coming. It was a very interesting
problem, and it was fun to be in the middle of the heat of the action
Wright: Did you have a specific area
that you kept going after? Was there one that you thought might be
Ferris: I was skeptical of the engine
ignition environment, but it turned out to be real. A lot of people
were looking at video trying to draw conclusions from the color of
the plume and the burning. It turned out to be like most problems
we’ve had on the Shuttle Program. It’s not one thing,
it’s usually a combination of several things that come to bite
us. The obvious individual things we understand and we plan for and
we design for, but sometimes the combination of things are a little
bit more difficult to predict.
Wright: A couple years later you led
the Boeing team to resolve the ET separation bolt protrusion problem
right before STS-92.
Ferris: There was some ET video, and
somebody noticed as they were looking at video from STS-106 [the preceding
flight]—we got out of sync in the numbering of the STS missions.
There are bolts that hold the tank to the orbiter, and after the engines
are shut down there are pyros [pyrotechnic fasteners] that separate
this bolt and then the vehicles come apart. This bolt is huge. Somebody
noticed on the ET side that after separation the bolt appeared to
go into the tank and then come back out and then go back in. We had
never intended for that bolt to have that bounceback effect. Then
folks started to look at past video, and it had been there before
but never the degree of protrusion that we saw on STS-106.
In some cases it was more of when you looked in this hole that the
bolt went into, you would see a shadow and then the thickness of that
shadow would decrease. The bolt maybe didn’t come out of the
plane. So we started to look at what would happen if that bolt hit
the orbiter? Things have to be very very balanced when the two vehicles
separate or you impart a load on the orbiter or a different load on
the tank. Then you can have twisting, and there is the possibility
that you have re-contact because the vehicle is going up and the tank
starts to tumble and rolls over. You don’t want that to happen.
There was a lot of investigation on that, mostly analysis. We were
looking at the loads, at the trajectories and the GN&C [Guidance
Navigation & Control], and an awful lot of analysis on the strength
of the bolt. We ended up analytically showing that there was no way
to re-contact the vehicle, and cleared it. But as happens very often,
these kinds of discoveries happen close to launch so you’re
under a lot of pressure to get that done. This is another case where
I didn’t do the work but I was helping the team get organized
and focused, making sure all the actions got worked and the story
pulled together. This was another one of those things where it was
not just an orbiter problem; it was an orbiter and tank problem, so
it was an integrated action.
Wright: Are there others that came to
mind that you worked on, some situations or activities during those
years when you were up close and personal with the orbiter?
Ferris: I talked a little bit about
the wing vent relief door. That was one of the first things I worked
on when I was out of college and it took years to get to the point
where we deleted it. One of the other things I worked on was on the
window system. Not very many people know it, but when you see a window
on the orbiter there’s actually three pieces of glass. The inside
is a pressure pane, the outside is a thermal pane and the middle one
is called a redundant pane. It can take the heat load and the pressure
The cavities in between go from one atmosphere, 14.7 psi on the ground,
to zero. That inner pane has the crew module, which is one atmosphere,
and zero on the other side, so you have to vent those cavities. We
had a system called the window cavity conditioning system. You have
to keep those cavities very clean because you don’t want lint
or condensation that blocks the crew’s view, especially on landing.
They also do photography out of those windows.
We had a desiccant canister that had desiccant beads in it. When air
reentered it would go through this canister and the moisture would
be drawn out by these beads so that you wouldn’t get any window
fogging. In case that canister got clogged we had little check valves.
When the delta pressure got too high [the valves] would open up and
you would take the risk of the contamination, because it was a backup
system. On turnaround those valves tended to stick. If you had just
lubricated them they’d be fine, but if they sat for too long
Again we had very tight margins on operation, so we ended up getting
rid of those valves and putting in two desiccant canisters. You usually
like to have redundancy that’s of a different design so that
if you had a generic problem you would not have the same problem in
both redundant paths. But we had a great deal of test data that said
no matter how much you shake those beads they don’t turn into
powder and block the filter and clog up. Those beads are changed every
now and then because they will saturate with water. That was a mod
[modification] that was a long time coming. It was not safety-critical,
so it would get bumped to the bottom of the priority list but as time
went by we actually did implement that.
Wright: Did you find when the fleet
was grounded you were able to do some of those mods?
Ferris: A lot of those things that were
not a priority then floated to the top. Of course after the [Space
Shuttle] Columbia accident [STS-107] there were quite a few changes
that were made during that time period. Changes in the way we flew
and gathered in-flight data, especially on the TPS, and lots of mods
in detection systems. As you mentioned, a lot of mods that folks always
wanted to do but could never really get enough priority on got the
attention that we wanted, and we were able to implement a lot of improvements
during that time.
Wright: One of the major things that
you’ve done is sustaining engineering and logistics support.
Explain that and your role in that program.
Ferris: Sustaining engineering is really
supporting the vehicle once it’s been delivered. It’s
out of our hands as the original equipment manufacturer, the OEM.
The people who process it and fly it have the vehicle. The importance
of sustaining engineering is we’re the people that designed
the vehicle, developed in the systems. We know the testing we did,
the analysis we did to qualify and certify the design of the vehicle.
We know how it was intended to operate. So part of the role in sustaining
engineering is if a problem or a failure occurs on the vehicle, “Do
I have to fix it, do I have to replace it or is it acceptable?”
Does it meet the original design intent, that’s what sustaining
With logistics we were largely supporting the spares and repairs of
hardware. Defining spares requirements, supporting repair of hardware
that we designed and built. We had the original contracts with the
vendors who delivered components. It was working with the OEMs of
those parts to make sure that they refurbished and repaired hardware
and delivered good spares to the program.
Wright: You referred to something that
involved a design, test and hardware pedigree. I thought that was
a very interesting term.
Ferris: I think I did that in problem
investigation. One of the things that the Shuttle Program is very
rigorous about is understanding the hardware pedigree. For all our
hardware and materials, we have lot numbers, lot date codes—we
have the build paper so you know from the beginning to the end the
history of that hardware. We’ve solved many problems by looking
A failure, if you determine it’s a material issue, can you pin
it down to just this one lot of material? And if you can, what other
hardware is indicted and where is that hardware? There’s a very
strict configuration management system that tells you by serial number
where everything is, when it went in, if it ever came out, did it
get reinstalled again, did it go get refurbished, did it go to the
vendor, etc., etc. That’s very important to solving problems.
Wright: Have the tracking systems changed
since you’ve been here on how to follow that pedigree?
Ferris: They’ve gotten better.
Having more things that are available by desktop computer or Web-based,
it’s gotten even better. One of the big improvements we had
is what we call TIPS [tile information processing system], our thermal
protection system information. That system tracks all the tile and
blankets, the external insulation on the vehicle. In the beginning
most of what it tracked was configuration and installations.
As time has gone by they’ve expanded it to track failures and
repairs and all other kinds of occurrences with the hardware. They’re
able to deliver maps for each vehicle; it’s a wealth of information
in that system. It started off as basic, and as people discovered
it would really be nice if I could put my fingers on this information
easily, the program has gone back and expanded it.
Wright: You came in 1980 and you’re
still working, so you’ve seen quite an evolution in just the
software systems to track the Shuttle.
Ferris: Yes, absolutely. We didn’t
have personal computers when I hired in. That’s been an issue
too, because all our original records are on paper, some on microfiche
or tape. So we have many data systems that are incomplete in that
regard because they pick up at a certain point. Some areas they’ve
been able to go back and scan data and get them into the databases,
but some you just have it past a certain point in time. In some cases
you’re just relying on people’s personal files, keeping
track of things.
Wright: You served as the deputy associate
program director where your team had more than 60 hardware systems.
How were you involved in overseeing what all these systems were doing?
Ferris: The associate program director
and I had a team of project managers that were focused in certain
technical discipline areas. We had somebody in charge of avionics
systems, somebody in charge of fluid and propulsion, somebody in charge
of structures. They were doing the more day-to-day involvement in
what these individual teams of 60 subsystems were doing. Then we would
get the reports. If anybody had a problem we’d know what it
was, and we’d hear the stories and we’d get involved and
give direction to the team that was working the problem.
As we were getting ready to roll out or to launch, the teams would
come forward with their rationale that said that they were ready to
fly. We put together packages for NASA for every rollout and flight
to say these are the mods we’ve incorporated on this flight
and this is how we certified, these are the in-flight anomalies we
experienced on the last mission, and this is how we’ve resolved
it for this coming flight. Requirements changes, change paper, critical
process changes, all of that. You can’t be intimately involved
with 60 groups of people, so you have to rely on a good team of folks
to bubble things up and keep track of things.
Wright: Unfortunately you went through
both of the [Shuttle] accidents. Tell me about your involvement with
the Columbia accident investigation.
Ferris: The orbiter team started to
narrow it down fairly quickly. Not as quickly as they did on Challenger,
but the NASA orbiter formed 16 subteams to investigate different areas.
I ended up being the leader of one of the teams, the corrective action
record team. A corrective action record, or a CAR, is the process
and the paper we use when we have a functional failure. If something
broke or leaked or didn’t turn off or didn’t turn on or
didn’t move as fast as it was supposed to, you called it a CAR.
That team’s job was to look at all the CARs from early on in
the program and see if there was anything there that might have pointed
to the situation we had with Columbia that maybe we missed. Did we
not recognize something, did we recommend a corrective action that
didn’t get implemented, did we not make the right recommendation
for corrective action?
That was a bit of a tedious task, but important. I had a great group
of people in Houston and Florida and out in Huntington Beach [California],
and we just plowed through the paper. I would say it was one of the
teams whose job was easiest because we weren’t breaking new
ground, we were reviewing old paper. One of the things I was most
proud of was because we were the first team to finish, we designed
our final report and that outline was the outline that Ralph [R.]
Roe [Jr.], who was the head of SSVEO [Space Shuttle Vehicle Engineering
Office], imposed on all the other teams to use.
I also supported the debris team, which was a bit similar. We were
not looking at sources of debris but at past missions where we had
experienced damage due to debris. Again we were looking at when we
found damage, how did we identify the source of the debris, how did
we identify any corrective action that needed to be made, any design
changes? You would see debris impacts that would repeat in certain
areas. We did go through decisions where we said, “We’re
seeing a lot of pitting here and so maybe we ought to have a higher
density tile in this area to protect us,” and we would make
that recommendation. Again, was there anything that we recognized
in the past that should have clued us in that we had a systemic problem
or something that needed attention before we flew again? It was a
very very difficult time.
Wright: You were here, as you mentioned,
for the builds of the orbiters. You also mentioned that you had chosen
this job over your other [offer]. Can you spend a few minutes talking
about what that was like for you to come join an aerospace industry,
and being a female [when] there weren’t a lot of female engineers?
Share some of those first days and what it was like becoming part
of this very exciting team of people.
Ferris: It was an interesting time because
Rockwell was hiring a lot of new college graduates. They went through
the post-Apollo era where they were downsizing significantly, and
then they started the Shuttle orbiter development and design. They
didn’t hire people for a long time, and they were starting to
get a really huge age gap. It was a fun time, because there were a
lot of young people that were hired in at the same time as I was.
You had this little community of folks, and everybody doing different
Like you said, not a lot of women. I went to a small college that
focused on engineering and science, so there weren’t a lot of
women there but the percentages there were higher than they were at
work. I found it unsettling not to have other women to talk to, women
that did the same sort of thing that I did. That really pushed me
into getting active with Society of Women Engineers. That was my opportunity
to really get to know a lot of other women that were in similar situations
as I was at work.
As time has progressed and I’ve moved up the management chain,
I’ve become one of those people that the younger women look
at and look for advice. That’s interesting. One thing I will
say is that it can be an advantage and a disadvantage. You compound
that—being young and a woman at a time when you’re dealing
with a lot of older guys. But the benefit was if I did something well,
they all remembered my name, whereas if it was one of the men, it’s
just another one of the young guys. It was hard to forget me because
I was the one woman in the room.
It became pretty important to me early on to really be prepared. It
affected me in that I started wearing a skirt to work every day because
I never knew if I was going to end up in the vice president’s
office. If I was going to end up in the vice president’s office,
I was going to look the part of an engineer who knew what she was
talking about. As opposed to some of the other younger guys who still
came to work in jeans and T-shirts.
It was fun. It’s really a nice thing when people ask you what
do you do and you say, “I work on the Space Shuttle,”
to see their reaction and have that something that you can really
be proud of. I tell this story a lot. My older boy was in the second
grade with this little boy who just adored space. I was always bringing
him things from work, little souvenir kinds of things. The kids were
having a snack after a Little League [youth baseball] game and I was
sitting on the bleachers next to this little boy. He must have been
seven or eight years old, and he looks at me says, “You have
the best job in the whole world.”
I said, “Why do you say that?”
He said, “Because you get to climb in rockets and things.”
I looked at him and I said, “You know what? You’re right,
I have the best job in the whole wide world.” It just touches
your heart. You feel, “I’m doing something important and
it’s worthwhile,” and it’s a good feeling.
Wright: You basically grew up in your
career [with] the Shuttle program. That had to be very rewarding that
you were part of those changes.
Ferris: Yes. Like I said, the vehicle
was already designed and the first one was delivered, but being there
from STS-1 all the way through now—hopefully through the last
flight. It’s interesting too, because I worked with many people
that from the time they were children knew they wanted to work in
space. They had this fascination and this desire. I had no idea what
I wanted to work on, but once I came to Rockwell and I got a chance
to work in an area where I got to see the whole vehicle and lots of
different people and get exposure to different areas and growth in
responsibility—I never saw a reason to leave.
It’s been really good for me. I just hit my 30th anniversary
in June. I never thought I’d get there, but yes, 30 years. And
now I’m one of the old guys.
Wright: You have been through very many
missions and modifications. What was it like to see [the orbiter]
completed and on its way? Can you share with us an experience?
Ferris: It’s pretty exciting.
I did a lot of work on Challenger up at Palmdale. STS-4 landed at
Edwards [Air Force Base, California]—because they were all landing
at Edwards at that time—July 4th. Columbia landed and Challenger
took off that same day to go to Florida. That was really something
for me, because I’d never seen a landing before. I would have
thought it’s just like an airplane coming in, but it was amazing
because the vehicle falls so fast. Then to see the [Boeing] 747 [aircraft]
take off with Challenger that I had crawled inside the wing and all
parts of the vehicle was really gratifying.
Wright: You had to standardize an orbiter
problem resolution process. Why is that so important for the safety
of the orbiter to have a standardized process?
Ferris: One of the things that Rockwell—and
Boeing—is really good at is solving hardware problems. We just
go into attack mode. But sometimes you’re reinventing the wheel
every time you do it. You can have these folks that have very active
hardware and they’re solving problems a lot. Then you have a
failure in another system that is pretty benign and they haven’t
had a failure in five years. It’s like restarting the process
and figuring out what do I do, where do I start.
We went through an exercise where we said, “Okay, there are
certain things you do when you investigate a problem when you’re
looking to solve the problem.” If you look at the presentations
that we make during rollout reviews and flight readiness reviews,
there are standard sections: description of the system, how does it
operate, how did we certify it, hardware pedigree, the software. What
we did was just describe each one of those steps that need to be assessed.
Not every step needs to be assessed for every problem. We created
a checklist and then a description of what’s involved in each
of those steps so that it made it easy for the hardware team to remember
everything that they had to do, assign the action items to different
people. Then they could track it and all that data naturally folded
into a presentation that we would make to the customer to explain
what happened, what are the consequences if it happens again, what’s
the criticality, the redundancy, and if it’s okay to fly without
taking action first.
Wright: Did you find yourself in a position
through these last 30 years of being the odd man out saying wait or
go? Were you a lone voice at some point?
Ferris: I wouldn’t say so much
a lone voice. We’re working a big problem right now where we
had a thruster failure at [NASA] White Sands [Test Facility, New Mexico],
and it’s a very big failure. The subsystem manager who’s
leading this failure investigation, I contacted him and said, “I’m
going to send you this process. I know you know how to do this but
this checklist will just be a reminder to make sure that nothing falls
through the cracks.”
I’m not known for keeping my mouth shut. I’m not a very
quiet person, so if I think something needs to be done I can find
a way directly or indirectly to influence something. If I can’t
get the hardware guys to listen sometimes I’ll go backdoor to
the safety community, and if they bring it up it’ll get taken
We have gone to the customer many times. I try to encourage the SSMs
[subsystem managers] and the other people who are doing the investigation
work. Somebody gives you a deadline and you can’t meet it, it’s
unreasonable, you need to stand up and say so, because it’s
too important not to do a good job. What we’ve found is if we
say I can’t do that tomorrow but I’ll have it in three
days, they’re pretty receptive to that. Sometimes management
pushes just to see what they can get out of us, but I’ve never
really had a situation where I felt like I wasn’t listened to.
Wright: Having processes in place helps
you have that standardization to fall back on. It’s not your
idea, it’s accepted behavior.
Ferris: Right. I try to couch it to
people like, “I’m trying to help. I’m not telling
you what to do, I’m trying to give you an asset that’ll
Wright: Sounds like good management.
I’m sure you’ve learned a lot of good lessons along the
way. Did you have some mentors or some individuals that helped you
hone your skills?
Ferris: Yes. I’ve had a number
of people, official and unofficial. It ranged from the first secretary
in my group who taught me some lessons that I keep with me. I try
to teach my kids some of these lessons because they’re life
lessons, not just work lessons.
When I was made the supervisor of the PV&D group I was the youngest
person in the group. The group had a design section and an analytical
section and I was in the analysis side. That was the side that they
typically chose the management from. I had a couple of very experienced
designers who really helped me understand. They’d bring me something
to sign. They’d go through it, and they’d explain the
whole thing, teach me what was going on.
I’ve had examples of good managers and bad managers. I’ve
had a lot of management direct supervision that have been very open
to just talking. Very early in my career, especially as a new supervisor,
I’d go in and I’d say this is the situation, what do I
do? I think that kind of thing helped quite a bit. Then you have the
people that are role models. I think as I’ve gotten older my
temperament has evened out. I was much more excitable when I was younger
and got more emotional. Now it’s easier to keep it below the
surface. I’ve had people tell me, “You’re demanding
but you’re fair.”
Wright: Sounds like a compliment. I’m
sure they’ve seen you give a lot so that helps when you demand
a lot. Do you want to share any of those life lessons from that secretary
Ferris: Don’t upset your secretary,
she’s one of the most important people in your lives. They really
know what the bosses want. They’re good people to befriend and
they can help quite a bit.
Wright: Your job duties moved physically.
Talk a few minutes about the impact of closing the facility and having
to move to a different location [when the aerospace company acquisitions
and mergers occurred].
Ferris: We were in Downey. It’s
hard because when you’re in engineering and in aerospace you
figure out where you’re going to work first, and then you figure
out where you’re going to live. Whereas I think if you have
a career that is more widespread as far as job opportunities, you
figure out where you’re going to live and then you try to find
a job near where you live.
We were in Downey and the aerospace and defense part of Rockwell had
been bought by Boeing. Then Boeing merged with McDonnell Douglas [Corporation]
and had this property in Huntington Beach. They decided to shut down
our Downey work and move us to Huntington Beach. My commute went from
22 miles to 33 miles along stretches of freeway that were much less
amenable to getting to and from work quickly.
Wright: What year was that?
Ferris: I think it was October of ’99.
The good thing about it was that Boeing made a capital investment
to build a state-of-the-art Mission Support Room in Huntington Beach.
What we had in Downey were conference tables that had computers on
top of them. It was really an old conference room that had been adapted
for use. We then designed a state-of-the-art room with large screens,
with real consoles, with printers at the workstations so that people
didn’t have to get up to get their print jobs. That was a very
big project. The room was amazing and was really the envy of some
of the NASA folks too.
For me personally it was about the work. I figured if I have to drive
farther for 15 years or however long I’m going to be working
in order to keep working on this program, that’s what I was
going to do. Southern California real estate being what it is, the
idea of moving wasn’t feasible. It would cost a lot of money
to move and I wouldn’t have gotten the kind of property I have.
So you complain, get it out of your system and move on.
Wright: In the mid ’90s NASA consolidated
the contracts. Was your work impacted by the SFOC [Space Flight Operations]
Contract? You were involved in the transition, is that correct?
Ferris: Yes. I actually worked on the
proposal to go from being the prime contractor to NASA to being the
subcontractor to USA [United Space Alliance]. I worked on the determination
of what work had we done that now USA would do, and the org [organization]
structure that we would have and the relationships that we would have
with our new direct customer. It took quite a bit of getting used
We were used to going directly to the NASA folks and now you have
this intermediate organization. They were a brand-new organization,
and it took them quite a bit of time to hire some people and get the
skills. There were areas where we continued to do work that they were
taking on until they could hire the personnel and train the personnel
and take it over. It was just growing pains. What I told people was
the job gets done because the people on the floor who do the real
work are still doing the same job they did the day before. They get
the work done and they get the right answers, and it’s all us
management folks that are churning.
Wright: What do you feel has been the
most significant challenge that you’ve had to deal with since
you’ve been in this business? You can think about it. What do
you feel like you’ve accomplished when you look back on your
career? What are some of the proudest things?
Ferris: For me a lot of it is the people.
Obviously the vehicle and the system and the performance is amazing,
but some of the most rewarding parts are dealing with the people and
pulling teams together and getting them to work together in common
cause and come to a solution. It’s also the most frustrating
Wright: It can’t be easy when
you have lots of experts sitting at the table.
Ferris: Yes, and lots of personalities.
But working on something that’s so visible is great. When you
know how complicated the vehicle is and we have so few problems. There’s
a million things that could go wrong, and they don’t. It’s
kind of discouraging that we’re going to stop flying, because
I feel like we’re just hitting our stride. The number of problems
we have on the ground has gone down significantly, and the number
of problems and the severity of the problems that we see on orbit
has gone down significantly. People really know their stuff, and now
we’re going to stop. That’s sad. I’d say the technical
stuff is not the hard part. It is challenging and it pushes you, but
the most challenging thing right now is facing stopping and all the
people who are going to be out of work.
Wright: Are you involved in the transition
toward retirement at all?
Ferris: Some of that work is being done
by folks in my department, in my project office. I’m involved
in setting what the reduced budgets are going to be and in defining
the areas that are going to go down and to what level and what timing.
Wright: That has to be difficult after
30 years of building it up. I guess it’s like you’re both
ending your career at the same time. Have you thought about the most
challenging aspect of your life in the Shuttle program?
Ferris: I think it’s been working
after the two accidents, because there’s just the despair and
loss of direction. But everybody jumps in, and there’s so much
to do and the pace is so fast that you don’t have time to think
about that aspect of it. Columbia seemed much worse to me than Challenger.
I’m not really sure why, but it just felt more personal. Maybe
it’s because of the fact that the debris fell on the ground,
and we saw that for months and months of activity. I did have a chance
to go to Florida where they had put all the recovered pieces of the
vehicle and laid it out. That was very sobering.
Wright: Have you had an opportunity
to go to a launch?
Ferris: I have seen two launches. I’ve
been in Florida for launches where I’ve been in a little room
with no window watching a computer screen countdown and a black-and-white
TV monitor. But I saw the first flight of [OV-] 105 [Endeavour, STS-49].
I managed to get outside in the last few minutes and see that launch.
Then the very next launch I was in Orlando [Florida], and I drove
and I got to be on the causeway to see it. It’s indescribable.
I was very lucky this last April I was able to get my brother-in-law,
sister-in-law, my niece and nephew in the VIP area [for STS-131].
I was pretty proud of myself for getting them so close. They were
My nephew especially has been very, very into the space program for
a long time. I can’t remember what flight it was, but we had
a number of astronauts that came to Downey. My nephew was maybe eight
at the time. He was very into space. I had a crew picture, and we
had maybe four crew members visiting so I was trying to get autographs
on the picture so that I could frame it and send it to him. I’d
gone up to the pilot and I told him, “This is for my nephew.”
He says, “I tell you what. I’m going to do better than
just signing this picture.” He reached into his pocket and he
pulled out one of their crew patches. He said, “This is a flight-flown
patch. We flew this on our mission, and I want your nephew to have
it.” That was just so amazing. He was so young I wasn’t
sure he would understand how special that was.
My husband made this great framed thing. It had the crew picture in
the middle, double-matted. It had the patch on there. It was a mission
to the [International] Space Station so I had an ISS pin and a Shuttle
program pin cut out in the mat. Then on the back it had the names
of the crew members and what the mission was. We took it up to Minnesota
and he was speechless when we handed it to him. He was just speechless.
It turned out the pilot was Rick [D.] Husband who had given me that
patch. I think that’s part of the personal connection I felt
when we lost Columbia.
Wright: He’s probably thinking
his aunt does have the coolest job in the world.
Ferris: Yes. He’s 15 now and he
still has it in his bedroom. I’m the cool aunt, I get them neat
Wright: As our time starts to close,
were there other areas that you want to talk about?
Ferris: The one area that I thought
was important was the transition of subsystem managers from NASA to
Boeing. Subsystem managers are the experts for a certain system. NASA
had always held that role, whether it was an element of the structure,
an analytical area like thermal or stress or the hydraulic system
or main propulsion mechanisms. That had been the government’s
responsibility. When NASA created SFOC they wanted NASA personnel
to get more out of the day-to-day work and do a more surveillance
role, and a determination was made that the subsystem manager position
would go from NASA to Boeing. Not everybody was very fond of that
We formed a team with a USA rep [representative], me as the Boeing
rep, and a NASA rep. We defined requirements, we defined a process,
we determined what criteria the Boeing subsystem manager had to meet
to demonstrate that they could indeed take on this role and responsibility.
This is a position that the orbiter program has created, and you’re
saying you are the expert and you are the spokesperson for this system.
We created the process. It was supposed to be a two-year project and
we finished in 18 months. It went through a series of reviews all
the way up to the NASA orbiter program manager. It was something I
was going to do on a part-time basis, and I ended up having to step
out of my day-to-day job because it was just overwhelming. I did that
75 to 80 percent of my time. But it was really good to see the whole
community recognize our people as being worthy of being declared the
When jobs moved out of California to Houston and Florida, many of
our subsystem managers did not relocate. We did a similar process
to shift that to another Boeing person, and we’re still following
Wright: When all of the transition started,
did you see a lot of difference in how tasks were handled now that
the expertise had been shifted over from NASA to Boeing?
Ferris: No, really not. There were some
areas where it was hard for some people to let go and they were maybe
more involved than they needed to be. There were some people, because
of personalities on the Boeing side, that maybe weren’t forceful
enough and didn’t step up from a take charge leadership role.
It’s not just about the technical know-how, it’s about
taking on the leadership for that system.
We had been so intimately involved with the NASA personnel that it
was just a matter of who was speaking up and who was making the presentations.
The work was the same. Very often we were very key in doing the work,
turning it over to NASA. It wasn’t that big a change. The process
was a big deal, doing it afterwards was not.
I think you covered pretty much my whole career. It was a big transition
for us when we moved out of California, because my job moved to Houston
and I was not in a position to relocate.