Approaches to Reliability

"Reliability" was a slippery word, connoting more than it denoted. Yet as an engineering concept it had basic utility and a recognized place in both aviation and missile technology. The quest for some means of predicting failures and thereby raising the odds toward success began modestly as a conscious effort among STG and McDonnell engineers only in mid-1959, after design and development work on major systems was well under way. Other engineering groups working in support of Project Mercury also began rather late to take special care to stimulate quality control and formal reliability programs for booster and capsule systems. Mercury would never have been undertaken in the first place if the general "state-of-the-art" had not been considered ready, but mathematical analyses of the word "reliability" both clarified its operational meaning and stirred resistance to the statistical approach to quality control.

The fifties had witnessed a remarkable growth in the application of statistical quality control to ensure the reliability of weapon systems and automatic machinery. The science of operations analysis and the art of quality management had emerged by the end of the decade as special vocations. Administrator Glennan himself, as president of Case Institute of Technology, had encouraged the development over the decade of one of the nation's foremost centers for operations [179] research at Case.21 STG executive engineers studied an almost pedestrian example of these new methods for more scientific management of efficiency; it was one given by an automobile executive who compared the reliability of his corporation's product over 32 years before 1959:

If the parts going into the 1959 car were of the same quality level as those that went into the 1927 car, chances would be even that the current model would not run.

This does not mean that the 1927 car was no good. On the contrary, its quality was excellent for that time. But it was a relatively simple product, containing only 232 critical parts. The 1959 car has 688 such parts. The more the critical parts, the higher the quality level of each individual part must be if the end product is to be reliable.22

In view of the fact that estimates showed over 40,000 critical parts in the Atlas and 40,000 more in the capsule, the awesome scale and scope of a reliability program for Mercury made it difficult to decide where to begin.

To organize engineering design information and data on component performance, someone had first to classify, name, or define the "critical parts." To create interrelated systems and to analyze them as separate entities at the same time was difficult. The Space Task Group and McDonnell worked on creation at the expense of analysis through 1959. Gradually NASA Headquarters and Air Force systems engineers steered attention to certain "semantic" problems in the primitive concepts being used for reliability analyses. For instance, what constitutes a "system"? How should one define "failure"? What indices or coefficients best "measure" overall system performance from subsystem data?23

These and other features of reliability prediction were so distasteful to creative engineers that many seriously questioned the validity and even the reliability of reliability predictions. "Reliability engineering," admitted one apologist in this field, "may seem to be more mysticism and black art than it is down-to-earth engineering. In particular, many engineers look on reliability prediction as a kind of space-age astrology in which failure rate tables have been substituted for the zodiac."24 Around STG this skeptical attitude was fairly representative. But at NASA Headquarters, Richard E. Horner, newly arrived in June 1959 as Associate Administrator and third man in command, had brought in a small staff of mathematicians and statisticians. It was led by Nicholas E. Golovin, who transferred from the Air Force to NASA some of the mathematical techniques lending quantitative support to demands for qualitative assurance. Theory-in-Washington versus practice-at-Langley were in conflict for a year until the nature of "reliability" for pilot safety on the one hand and for mission success on the other became more clearly understood by both parties. The pressure exerted by Golovin and NASA Headquarters to get the Task Group and McDonnell to change its approach to raising reliability levels became a significant feature in redesign and reliability testing during 1960.25

Scientists, statisticians, and actuaries, working with large populations of [180] entities or events, had long been able to achieve excellent predicitions by defining reliability as probability, but in so doing they sacrificed any claim to know what would happen in a unique instance. Engineers and managers responsible for a specific mission or project tended to ridicule probability theory and to call it invidiously "the numbers game." Being limited to a small set of events and forced by time to overlap design, development, test, and operations phases, they could not accept the statistical viewpoint. They demanded that reliability be redefined as an ability. The senior statistician at Space Technology Laboratories for the Atlas weapon system, Harry Powell, recognized and elaborated on this distinction while his colleagues became involved with man-rating the Atlas. His remarks indicated the STL and Convair/Astronautics faced the same divergence of opinion that NASA Headquarters and STG confronted:

If reliability is to be truly understood and controlled, then it must be thought of as a device a physical property which behaves in accordance with certain physical laws. In order to insure that a device will have these physical properties it is necessary to consider it first as a design parameter. In other words, reliability is a property of the equipment which must be designed into the equipment by the engineers. Reliability cannot be tested into a device and it cannot be inspected into a device; it can only be achieved if it is first designed into a device. Most design engineers are acutely aware that they are under several obligations - to meet schedules, to design their equipment with certain space and weight limitations, and to create a black box (a subsystem) which will give certain outputs when certain inputs are fed into it. It is imperative that they also be aware of their obligation to design a device which will in fact perform its required function under operation conditions whenever it is called upon to do so.26
There is a rule in probability theory that the reliability of a system is exactly equal to the product of the reliability of each of its subsystems in series. The obvious way to obviate untrustworthy black boxes was to connect two black boxes in parallel to perform the same function. In other words, redundancy was the technique most often used to ensure reliability.

After the cancellation of Mercury-Jupiter, Kuettner and others at ABMA set about a serious effort to develop a parachute system to recover the Redstone booster. They also began to concentrate on the simplifications necessary for the sake of reliability to custom-build a man-rated Redstone. Starting with the advanced, elongated version of the rocket, which had been renamed the "Jupiter-C" in 1956 for the Army's ablation research on reentry test vehicles, Kuettner called upon the expertise of all who could spare time from the Saturn program to help decide how to man-rate their stock. The fundamental change made to the Jupiter-C airframe was the elimination of its staging capability. Other modifications stripped it of its more sophisticated components while permitting it to retain greater performance characteristics than the original single-stage Redstone.27

The designers of the Redstone and Jupiter missile systems proposed an extensive list of basic modifications to adapt the vehicle to the Mercury capsule. [181] The elongated fuel tanks of the Jupiter-C had to be retained for 20 extra seconds of engine burning time, especially since they decided to revert to alcohol for fuel rather than use the more powerful but more toxic hydyne that fueled the Jupiter-C. Another high-pressure nitrogen tank to pressurize the larger fuel tank and an auxiliary hydrogen peroxide fuel tank to power the engine turbopump also had to be added. To increase the reliability of the advanced Redstone, they had to simplify other parts of the Jupiter-C system. Instead of the sophisticated autopilot called ST-80, one of the first inertial guidance systems (the LEV-3 ) was reinstalled as the guidance mechanism. The after unit of the payload on the old Redstone, which had contained a pressurized instrument compartment, became the permanent forebody of the main tank assembly, there being no need to provide terminal guidance for the new payload. A spacecraft adapter ring likewise had to be designed to simplify interface coordination and to ensure clean separation between capsule and booster. At the other end of the launch vehicle it was necessary to use the most recent engine model, the A-7, to avoid a possible shortage of spare parts. Hans G. Paul and William E. Davidson, ABMA propulsion engineers, took the basic responsibility for "manrating" this engine.28

Although STG engineers bought the Redstone in the first place because it was considered an "off-the-shelf" rocket, they gradually learned through Hammack's liaison with Butler that the Mercury-Redstone was in danger of being modified in about 800 particulars, enough to vitiate the record of reliability established by the earlier Redstones and Jupiter-Cs. Too much redesign also meant reopening the Pandora's box of engineering "trade-offs," the compromises between overdesign and underdesign. Von Braun's team tended in the former direction; Gilruth's in the latter. To use Kuettner's distinction, ABMA wanted "positive redundancy" to ensure aborts whenever required, whereas STG wanted more "negative redundancy" to avoid aborts unless absolutely essential.29 This distinction was the crux of the dispute and the essence of the distinction between "pilot safety" and "mission success."

On July 22, 1959, STG engineers received a group of reliability experts from von Braun's Development Operations Division at Huntsville. Three decades of rocket experience had ingrained strongly held views among the 100 or so leaders of this organization about how to ensure successful missions. The ABMA representatives told STG that they did not play the "numbers game" but attacked reliability from an exhaustive engineering test viewpoint. Their experience had proved the adequacy of their own reliability program, carried out by a separate working group on a level with other engineering groups and staffed by persons from all departments in the Development Operations Division of ABMA. In conference with design engineers, ABMA reliability experts normally set up test specifications and environmental requirements for proving equipment compliance. STG felt sympathetic to this approach to reliability, but systems analysts at NASA Headquarters did not.

[182] As for the prime contractor's reliability program, in the first major textbook studied by the astronauts, McDonnell's "Project Mercury Indoctrination" manual, distributed in May 1959, the pilots read these reassuring words:

The problem of attaining a high degree of reliability for Project Mercury has received more attention than has any other previous missile or aircraft system. Reliability has been a primary design parameter since the inception of the project.30
Accompanying reliability diagrams showed over 60 separate redundancies designed into the various capsule systems, allowing alternate pilot actions in the event of equipment malfunctions during an orbital mission.

McDonnell specified three salient features of its reliability program in this preliminary indoctrination manual. First, by making reliability a design requirement and by allowing no more than a permissible number of failures before redesign and retesting were required, reliability was made a conscious goal from the beginning of manufacture. Second, five separate procedures were to implement the development program: evaluations, stress analyses, design reviews, failure reporting, and failure analysis. Third, reliability would be demonstrated finally by both qualification and reliability testing.

These assurances did not seem adequate; STG, as well as NASA-Washington, requested McDonnell to clarify its reliability policy in more detail and to hold a new symposium in mid-August to prove the claim that "reliability is everybody's business at McDonnell." McDonnell responded by changing its "design objective" approach to what may be called a "development objective" approach. The new program, drawn by Walter A. Harman and Eugene A. Kunznick, explicitly set forth mean times to failure and added more exhaustive demonstrations, or "life tests," for certain critical components. More fundamental assumptions were made explicit, such as: "the reliability of the crew is one (1.0)," and "the probability of a catastrophic explosion of the booster, of any of the rockets, of the reaction control system, or of the environmental control system is negligible."31 McDonnell's presentation at this symposium stressed new quality control procedures and effectively satisfied STG for the moment. Golovin and his NASA Headquarters statisticians were pleased to note refinement in sophistication toward reliability prediction in the capsule contractor's figures for the ultimate 28-hour Mercury mission. At the August 1959 reliability symposium, McDonnell assigned impressively high percentage figures as reliability goals for both mission and safety success:

Mission Safety
Boost .7917 .9963
Orbit .9890 .9999
Retrograde .9946 .9946
Reentry .9992 .9992
Overall .7781 .9914
[183] To John C. French, who began the first reliability studies for Gilruth's group, this kind of table represented the "numbers game," mere gambling odds that might deceive the naive into believing that if not the fourth, then the third, decimal place was significant. French was an experienced systems engineer who recognized that numbers like these did mean something: obviously the authors felt the weakest link in the chain of events necessary to achieve mission success was the launch vehicle. McDonnell believed the safety of the astronaut would be ensured by the escape system, but the coefficient ".7917" diluted the confidence in overall mission success to ".7781." McDonnell and STG agreed that the onus was on the Atlas to prove its safety and reliability as a booster for the Mercury mission.

That point was not disputed by the men responsible for the Atlas. They professed even less confidence in their product for this purpose than the capsule contractor had. Not until November 13, 1959, did representatives of the Air Force Ballistic Missile Division and Space Technology Laboratories visit Langley to present in detail their case for a thoroughgoing plan to man-rate the Atlas as a Mercury booster. Harry Powell had prepared a carefully qualified chart that estimated that the reliability of the Mercury booster would reach approximately 75 percent only in mid-1961, and the first upbend (at about 86 percent) on that curve was to occur another year later.32 Such pessimism might have been overwhelming to STG except that no abort-sensing system was yet computed as a factor in this extrapolation. Also STG and STL agreed never to entertain the idea of "random failure" as a viable explanation.

Because aircraft designers and missile experts held different opinions about which systems should be duplicated, redundancy itself was often a subject of dispute. Passenger aircraft were provided with many redundant features, including multiple engines and automatic, semi-automatic, and manual control systems, so that commercial flight safety had been made practically perfect. But in the military missile programs of 1959, redundancy to ensure mission success had been relegated to the duplication of the complete missile, "by making and launching enough to be sure that the required number will reach each target."33 In the age of "overkill," one out of four, for instance, might be considered quite sufficient to accomplish the destructive mission of the ICBM. Both McDonnell and the Task Group placed more faith in quality control procedures and in redundant system development than in mathematical models for reliability prediction during design.

In the course of further symposia and conferences during the autumn, the Space Task Group, working with military systems analysts and industrial quality controllers, learned more than it taught about improving reliability programs. Abe Silverstein, whose Headquarters office was retitled Space Flight Programs (instead of Development) at the end of the year, was especially eager to see STG set up its own reliability program, with procedures for closer monitoring of subcontracts.34

[184] But before STG could presume to teach, it had to learn much more about the mechanics of the Redstone and the Atlas. Mathews had his own mathematicians check the case histories for failures of every Redstone, Jupiter, and Atlas that had ever been launched. A statistical population of over 60 Redstone and about 30 Atlas launches yielded clinical diagnoses for generalizing about the most likely ways these boosters might fail. Gerald W. Brewer, Jack Cohen, and Stanley H. Cohn collected much of this work for STG, and then Mathews, Brandner of ABMA, White of STL, and others formulated some ground rules for the development of the two abort-sensing systems.

All the investigators were pleasantly surprised to find relatively few catastrophic conditions among the failures. Their biggest problem was not what to look for or when to allow the escape rocket to blast away but rather how to avoid "nuisance aborts." Such unnecessary or premature escapes would arise from overemphasis on pilot safety or "positive redundancy" at the expense of mission success. Long arguments ensued over several questions: How simple is safe? How redundant can you get and still have simplicity? How do you design a fail-safe abort-sensing system without overdesigning its sensitivity to situations less than catastrophic?35

Schematic of Mercury Redstone.

Schematic of Mercury Redstone.


Without trying to define every term, Mathews and his associates agreed that only imminent catastrophic failures were to be sensed, that reliability should be biased in favor of pilot protection, and that all signals from abort sensing should be displayed in the spacecraft. Application of these ground rules to the Redstone led to development of an automatic abort-sensing system (AASS) that sensed "downstream" or fairly gross parameters, each of which was representative of many different types of failures. Merely "critical," as opposed to "catastrophic," situations were not allowed to trigger the escape system automatically. Such merely "critical" situations as partial loss of thrust, a fire in the capsule, deviation from flight path, or loss of tank pressure might possibly be corrected or tolerated. But catastrophic situations were defined as existing where there were no seconds of time for intelligent decisions, corrective actions, or manual abort. The abort system for the Mercury-Redstone sensed and was activated by such typical catastrophic situations as excessive attitude deviations or turning rates (leading to high angles of attack during high dynamic pressures and resulting in a structural breakup), as sudden loss of tank or bulkhead differential pressure in pressure-stabilized structures, as loss of electrical power in the control and instrument system, and as loss of thrust immediately after liftoff.36

If any of these situations should arise, the automatic abort-sensing system was supposed to initiate an explosively rapid sequence of events. First, the engine of the Redstone would cut off (except during the initial moments over the launch site). Then the capsule would separate from the booster. And this would be followed by the ignition of the escape rocket, with acceleration up and away from the booster, and finally by the normal sequencing of events in the recovery phase of the launch profile.

[185] During August, September, and October, the Task Group improved its understanding of the interrelated parts and procedures being developed for Mercury. New definitions were formulated in hardware and words. Some old worries - the heatshield, for instance - were abandoned as newer concerns replaced them. The success of Big Joe and the promise of Little Joe shots promoted confidence and sustained enthusiasm. At the end of this period optimistic forecasts were the rule, not only for booster readiness but also for firm operational schedules. The first Mercury-Redstone and Mercury-Atlas qualification flight tests were scheduled for launchings in May 1960. Even the final goal of Project Mercury, the achievement of manned orbital flight around Earth, still appeared possible by March 1961.37

But as autumn blended into winter in 1959, optimism cooled along with the weather. The job of keeping snow clear of its own drive was difficult enough, but heavier equipment than that possessed by the Task Group was necessary to plow aside the drifts that sometimes covered the streets of interagency cooperation. In particular, the Mercury-Redstone schedule began to look progressively more snowbound in the early winter of 1959, largely because the capsule and the Atlas commanded primary attention.

At the end of August, Gilruth had proposed to Major General John B. Medaris, commanding ABMA, that the first attempt at a Mercury-Redstone launch from the Cape be set for February 1, 1960. This proposal represented a slippage of about four months since February 1959, when the initial understanding between ABMA and STG had been reached. But the prospects for rapid accomplishments in the next six months were brighter at Langley than at Huntsville, St. Louis, or the Cape. Plans to use eight Mercury-Redstones for ballistic training flights between February and October 1960 were still in effect, and STG also hoped to complete six manned Redstone flights by March 1961 before launching the first of the manned Mercury-Atlas configurations. Such optimism was not entirely the result of youthful naivete or of underestimates of complexity. In large part, target dates were set deliberately at the nearest edge of possible completion periods to combat Parkinson's Law regarding bureaucratic administration, that work expands to fill the time allotted for its completion.38

Much of the fault for Redstone slippages must revert to STG for having canceled the Mercury-Jupiter series rather precipitously, thereby unceremoniously relegating the 4000 members of von Braun's division at Huntsville almost to "task element" status as far as Mercury was concerned. Although the Jupiter program per se was being phased out at ABMA, its sires, who sparked the entire Army Ordnance team, were sensitive to criticism of their strange love for space travel.39 STG engineers should not have been surprised that the cancellation of the Mercury-Jupiter series would cause a reaction in Huntsville that would reverberate to the Cape and through Washington.40

Although NASA Headquarters had carefully coordinated STG's recommendation in this matter, many other factors contributed to the change in the Mercury [186] program management plans that forecast the slip of MR-1 past MA-1 on the flight test schedule. There were at least three technical reasons for the Mercury-Redstone slippages as well as several other, perhaps more important, psychological and policy-planning reasons for this change in the "progressive buildup of tests" principle.

Foremost among all causes of delay was the fact that the pacing item, McDonnell's production model of the Mercury capsule, took longer to build than anyone supposed it would.4l Because systems integration within the spacecraft was lagging by several months, every other area would be delayed also to some degree. Secondly, the design and development of the abort-sensing systems for the Redstone and Atlas were attacked separately and not cross-fertilized. The basic dispute over safety versus success, or positive versus negative redundancy, could be settled only with actual flight test experience.

A third technical reason for the fact that the Redstone team, with its ready and waiting boosters, failed to lead off the series of qualification flight tests was [187] related to the Teutonic approach to reliability. Long years of experience with rockets, together perhaps with some native cultural concern for meticulous craftsmanship, gave the von Braun group high confidence that most so-called "reliability" problems could be obviated by hard work, more flight tests, and intensive engineering attention to every detail. Elaborate operational checkouts were to be made at Huntsville and the Cape. STG agreed to these procedures in August, but by November time was clearly in contention between Huntsville and Langley. The Task Group wanted to launch its first three Redstones for Mercury during May and June 1960, but if this were possible, it was hardly advisable from ABMA's point of view.42

By then, however, this could be considered a family dispute among stepbrothers within NASA. On October 21, 1959, President Eisenhower announced his decision, pending congressional approval, to transfer the von Braun group and the Saturn project from ABMA to NASA. If this decision solved a morale problem among members of the Development Operations Division at ABMA, it undoubtedly complicated certain institutional and political problems. Jockeying for position probably intensified rather than abated, as plans for the future use of the Saturn launch vehicle overshadowed Mercury for the moment. Another five months were required to complete a transfer plan, and eight months would elapse before the official transfer was completed on July 1, 1960.43

Schematic of Mercury-Atlas D.

Schematic of Mercury-Atlas D.


Although the plans for the escape of a pilot from a malfunctioning Redstone were complex, plans for a similar emergency detection system on the Atlas were several times more complicated. Three engines, rather than one, with an overall range and thrust capability well over three times greater, and with guidance, gimbaling, and structural separation mechanisms far more complex than those to be used on the Redstone - these were some of the factors that put the problem of man-rating the Atlas on a higher plane of difficulty. The Mercury capsule escape system was, of course, the same for both boosters, but the emergency detection systems had to be tailored to the differences between the launching vehicles. The single-stage Redstone was a piece of battlefield artillery that could stand on its own four fins, for example, whereas the fragile "gas-bag" Atlas would crumple if not pressurized. And in flight, the Atlas' outboard engines must stage properly and drop away from the central sustainer engine before the escape tower could be jettisoned.

While Charles Wilson and his crew at Convair in San Diego worked out the detailed design and hardware for ASIS, Richard White led Space Technology Laboratories through more detailed analytical studies and simulation tests at El Segundo. Their concurrent efforts ensured that the airborne emergency detection system for the Mercury-Atlas evolved, as Powell insisted it must, with the steadfast goal of reliability. Inspection and test programs were inaugurated separately by Hohmann, beginning in October, but reliability was designed into the ASIS black box from May onward. Wilson and White soon discovered that their biggest problem concerned the prevention of recontact between booster and capsule after separation. [188] Alan B. Kehlet and Bruce G. Jackson of STG had the primary responsibility to determine the proper thrust offset of the escape rocket and to ensure against recontact, but "Monte Carlo" probability analyses were done by both Convair and the Space Task Group.44

In addition to the ASIS, the Atlas D had to be modified in a number of other ways before it could carry a man. Because the Mercury-Atlas configuration was taller by approximately 20 feet than the Atlas D weapon system, the rate gyro package for the autopilot had to be installed 20 feet higher on the airframe, so it would sense more precisely the rate of change of booster attitude during launch. The Atlas would not need posigrade rockets to assist separation because the Mercury capsule would embody its own posigrade rockets inside its retrorocket package. Because the capsule's posigrade rockets could conceivably burn through the thin skin of the liquid-oxygen dome, a fiber-glass shield covering the entire dome was attached to the mating ring. The two small vernier rocket engines, which on the ICBM had thrust on after sustainer engine cutoff, or "SECO," for last-minute trajectory corrections, were regoverned to delete the "vernier solo" phase of operation, thus saving more weight and complexity. In addition to the use of older, more reliable types of valves and special lightweight telemetry, only one other major booster modification was considered at first. The man-rated Atlas D would use the so-called "wet start" instead of the newer, faster "dry start" method of ignition. A water pulse sent ahead of the fuel into the combustion chambers would effect slower and smoother initial thrust buildup, minimizing structural stress on the engine before liftoff. This change saved approximately 60 pounds, by enabling the use of a thinner skin gauge in the Atlas airframe. But the "thin-skinned" Atlas soon proved to be too thin-skinned, and the weight saved was lost again in 1961, when a thicker skin was found to be essential in the conical tank section just under the capsule. The longer, lighter spacecraft payload proved a cause of additional dynamic loads and buffeting problems, calling for more strength in the Atlas forebody.45

After additional study of the idiosyncracies of the Atlas missile, Mathews, Wilson of Convair, and White decided on the parameters most in need of monitoring for abort indications:

  1. the liquid oxygen tank pressure,
  2. the differential pressure across the intermediate bulkhead,
  3. the booster attitude rates about all three axes,
  4. rocket engine injector manifold pressures,
  5. sustainer hydraulic pressure, and
  6. primary electrical power.
Dual sensors gauging each of these catastrophic possibilities were fairly easily developed. If any one of these conditions should arise or any system should fail, the ASIS would by itself initiate the explosive escape sequence. But any one of four men with their fingers poised over pushbuttons also could abort the mission: the test conductor, the flight director in the control center, the range safety officer, or the astronaut with his left thumb would be able to decide if and when the escape rocket should be ignited. But these manual abort capabilities were only supplements, with built-in time delays, to the automatic abort sensing and implementation system. [189] During the portion of the flight powered by the Atlas, human judgment was to be secondary to a transistorized watchdog autopilot. Their moral obligation to pilot safety made the Atlas redesigners reduce man-control to this minimum. Culbertson later explained, "While it was true that mission success provided pilot safety, provision for pilot safety did not always improve the probability of mission success"46

One of the most important analytical tasks in man-rating the Atlas was the careful and continuous study of the mathematical guidance equations for the launch phase of all the missions. Three men at Space Technology Laboratories shared this responsibility, C. L. Pittman, Robert M. Page, and Duncan McPherson. While Convair was learning that it cost approximately 40 percent more to build a man-rated Mercury-Atlas than a missile system, STL's mathematicians and systems engineers, like Hohmann and Letsch, were working out their differences on how to control quality and augment reliability. By the end of 1959, Hohmann [190] had sold his plans for pilot safety. They were based on applying supercharged aircraft production techniques to industrial practices for military missile production. To live with the Atlas required no less and eventually much more.47


21 Perhaps the classic basic text for the modern revival of efficiency expertise was dedicated, both formally and in a limited sense financially, to Glennan by the authors, all professors in the operations research group at Case Institute of Technology since 1952: C. West Churchman, Russell L. Ackoff, and E. Leonard Arnoff, Introduction to Operations Research (New York, 1957). See also Maurice Sasieni, Arthur Yaspan, and Lawrence Friedman, Operations Research - Methods and Problems (New York, 1957); James H. Batchelor, Operations Research: An Annotated Bibliography (2 ed., St. Louis, 1959-1963), Vols. I, II, III, and IV.

22 S. E. Skinner, Executive Vice Pres., General Motors Corp., "Quality and Reliability Control," speech, first General Motors-wide orientation program, July 23, 1959. For a description of the Atlas reliability problem, see Robert De Roos, "Perspective '64," booklet (General Dynamics/Astronautics, 1964) .

23 See Joan R. Rosenblatt, "On Prediction of System Performance from Information on Component Performance," Proceedings of the Western Joint Computer Conference, Los Angeles, Feb. 1957. Cf. Nicholas E. Golovin, "An Approach to Reliability Prediction Program," American Society for Quality Control, Transactions of 1960 Convention, San Francisco, May 25, 1960.

24 Thomas C. Reeves, "Reliability Prediction - Its Validity and Application as a Design Tool," paper No. 60-MD-1, American Soc. of Mechanical Engineers, Feb. 10, 1960, 8.

25 George M. Low, in comments, Oct. 5, 1965, notes that these discussions "occurred not between Washington and the Field but between the organization responsible for manned space flight both in Washington and the Field and the Reliability people."

26 Harry R. Powell, "The Impact of Reliability on Design," paper No. 60-MD-2, American Soc. of Mechanical Engineers, April 5, 1960.

27 See Wernher von Braun, "The Redstone, Jupiter, and Juno," in Eugene M. Emme, ed., The History of Rocket Technology: Essays on Research, Development, and Utility (Detroit, 1964), 107-121; Kuettner interview. On the little known Redstone booster recovery system development efforts, see R. I. Johnson et al., "The Mercury-Redstone Project," MSFC Saturn/Apollo Systems Office, TMX 53107, June 1964, 6-22, 6-29; letter, Gilruth to von Braun, with enclosures, Dec. 9, 1959; memo, R. M. Barraza for M-DEP-R&D, MSFC, "Summary of Mercury-Redstone Recovery Program," Aug. 1, 1960.

28 For details of Redstone and Jupiter flight failures, see three reports prepared by Chrysler Missile Division for MSFC, "Overall Study and Flight Evaluation of the Redstone Missile Propulsion and Associated Systems," MSFC report No. RP-TR-61-11, April 7, 1961; G. G. McDonald, P. R. Brown, and J. L. Montgomery, Jr., "Jupiter Missile and Juno II Vehicle Malfunction Study," MSFC report No. MTP-M-P&VE-P-2-62, April 26, 1962; and P. S. Sorce, L. Van Camp, R. E. Stevens, et al., "Redstone Vehicle Malfunction Study (Mercury-Redstone Program)," MSFC report No. DSD-TM-12-60, Original Issue, June 15, 1960; Rev. A, Oct. 31, 1960, Rev. B, May 1, 1961 .

29 Joachim P. Kuettner and Emil Bertram, "Mercury-Redstone Launch Vehicle Development and Performance," in Mercury Project Summary, 69. See also Brandner, "Proposal for Abort Sensing System," 4, 5. For STG's first reliability meeting with ABMA, see Purser, log for Gilruth, July 27, 1959. On Chrysler's role, see two brochures, "Redstone," AB 106, Chrysler Missile Division [ca. April 1961], and "Presentation to Manned Spacecraft Center," Chrysler Defense and Space Group, June 20, 1962.

30 "Project Mercury Indoctrination," report No. 6821, McDonnell Aircraft Corp., May 21, 1959, 160.

31 "Reliability Program Status for Project Mercury," report No. 7007, McDonnell Aircraft Corp., Aug. 17, 1959, 1, 11, 12.

32 Tecwyn Roberts, "Minutes of Meeting: Presentation by AFBMD/STL on Safety and Reliability," Nov. 13, 1959, with enclosures. Powell's chart is enclosure 2. Cf. John C. French and Frederick J. Bailey, Jr., "Reliability and Flight Safety," Mercury Project Summary, 105-116, for a static view of the results of these discussions.

33 Ms., F. J. Bailey, Jr., "Reliability and Flight Safety Problems of Manned Spacecraft Flight," April 4, 1962, 5. The crux of the reliability dispute between "statistics," represented by Golovin and NASA Headquarters, and "techniques," represented by STG, McDonnell, and ABMA, was illustrated by the basic commitment among STG engineers to deny the existence of any such thing as "a random failure." Gilruth later expressed this particular attitude toward man-rating machines: "We must regard every malfunction and, in fact, every observed peculiarity in the behavior of a system as an important warning of potential disaster. Only when the cause is thoroughly understood, and a change to eliminate it has been made, can we proceed with the flight program." See Gilruth, "MSC Viewpoints on Reliability and Quality Control," MSC fact sheet No. 93, 1963.

34 See Purser, log for Gilruth, Aug. 5, 1959.

35 Charles W. Mathews, interview, Houston, Feb. 24, 1964. Cf. memo, William M. Bland, Jr., and Kraft to Project Dir., "Meeting with Range Safety People at AFMTC, March 31, 1959," April 3, 1959.

36 Ms., Mathews, "Mercury Abort Sensing and Implementation Systems: History of Development," outline for Project Mercury Technical History Program, July 1, 1963; Kuettner and Bertram, "Mercury-Redstone Launch Vehicle," 72; Kuettner, "Manrating Space Carrier Vehicles," 636.

37 Compare the detail and progress evidenced in "Status Report No. 3 for Period Ending July 31, 1959," Langley/STG, with that shown in "Status Report No. 4 for Period Ending Oct. 31, 1959," Langley/STG.

38 Letter, Gilruth to Commanding Officer, Army Ballistic Missile Agency, "Mercury-Redstone Launch Schedule," Aug. 25, 1959. Cf. memo, Purser to Project Dir., "Project Mercury Meeting on 11 February, 1959, at ABMA," with enclosed bar chart. See C. Northcote Parkinson, Parkinson's Law (New York, 1959).

39 Perhaps the most eloquent defense Wernher von Braun ever made against the inevitable shallow cynicism of critics who could not forget the Second World War was a widely printed article entitled "The Acid Test," which first appeared in Space Journal of the Astro-Sciences, Vol. 1, No. 3 (Summer 1958), 31-36. For background on the following discussion of the von Braun team's cohesive esprit, see Walter R. Dornberger, V-2 (New York, 1954); and Dieter K. Huzel, Peenemünde to Canaveral (Englewood Cliffs, N.J., 1962).

40 For part of the controversy generated by the Mercury-Jupiter cancellation, see letter, John G. Zierdt to NASA Administrator, June 26, 1959; memos, Low to Silverstein, "Cancellation of Mercury-Jupiter Program," July 8 and July 13, 1959; message, Zierdt to Silverstein, July 16, 1959; letters, Silverstein to Medaris, Commanding Officer, Army Ordnance Missile Command, July 21 and July 28, 1959; letter, Herbert F. York to Glennan, Aug. 4, 1959; letter, David H. Newby to Low, Aug. 19, 1959. See also letters, Gilruth to Low, July 1, 1959; Silverstein to Gilruth, July 1, 1959; and Gilruth to Silverstein, July 8, 1959. Memo for files, John A. Powers, "Response to Query on the Subject of Cancellation of Jupiter," Aug. 31, 1959.

41 George Savignac and E. G. Leever, "Project Mercury Engineering Status Report," McDonnell Aircraft Corp., Aug. 1, 1959, 31; Savignac and Leever, "Bi-Monthly Engineering Status Report," McDonnell Aircraft Corp., Oct. 1, 1959, 39.

42 Minutes, "Mercury Panel 3 Meeting, 18-19 August, 1959, at Missile Firing Laboratory, Cape Canaveral, Florida." These minutes record numerous bilateral agreements on flight testing, range safety, etc., concurred in by NASA, McDonnell, and Army Ballistic Missile Agency representatives. See especially Part IV, an appendix on operational checkout procedures. Kuettner, "Minutes and Major Results of Project Mercury Coordination Meeting at ABMA," Nov. 20, 1959. Cf. minutes, Jerome B. Hammack, Redstone systems engineer, STG, "Mercury-Redstone Panel II Meeting: Booster and Capsule Checkout Procedures, at ABMA, Nov. 19, 1959," Dec. 8, 1959; message, M. L. Raines to Commanding General, AOMC, Nov. 3, 1959; reply, PR-092200Z, Nov. 9, 1959.

43 See House Committee on Science and Astronautics, 86 Cong., 2 sess. (1960), Transfer of the Development Operations Division of the Army Ballistic Missile Agency to the National Aeronautics and Space Administration, Hearings, Feb. 3, 1960; Robert L. Rosholt, An Administrative History of NASA, 1950 to 1963; David S. Akens, Paul K. Freiwirth, and Helen T. Wells, History of the George C. Marshall Space Flight Center (Huntsville, Ala., 1960-1962), I, ix.

44 White, "Development of the Mercury-Atlas Pilot Safety Program," Space Technology Laboratories, June 12, 1961, 4. Cf. Hohmann, "General Aspects of the Pilot Safety Program for Project Mercury Atlas Boosters," Space Technology Laboratories, Feb. 8, 1960, passim. Cf. "System Description - Abort Sensing and Implementation System for Project Mercury," Convair/Astronautics report No. AE60-0576, June 6, 1960.

45 See C. L. Gandy and I. B. Hanson, "Mercury-Atlas Launch Vehicle Development and Performance," in Mercury Project Summary, 94. James R. Dempsey, a vice president of General Dynamics and the manager of its Convair division, later called attention to the 25 percent design safety factor commonly used in the ballistic missile business versus the 1.5 safety margin used in the design of aircraft. See his paper "Launch-Vehicle Considerations for Manned Space Flight," in Proceedings of First National Conference on the Peaceful Uses of Space, Tulsa, Oklahoma, May 26-27, 1961 (Washington, 1961), 118.

46 P. E. Culbertson, "Man-Rating the Atlas as a Mercury Booster," American Institute of Aeronautics and Astronautics, paper No. 65252, presented at Dayton, Ohio, April 21-23, 1965, 2, 7.

47 Hohmann interviews and article, "Pilot Safety and Mercury/Atlas," Astronautics and Aerospace Engineering (Feb. 1963), 40-42.


Previous Next Index