Thomas L. Moser
Interviewed by Rebecca Wright
The Woodlands, Texas – 9 April 2010

The referenced photographs were provided by the NASA JSC Imagery Repository and Tom Moser. [Photo Gallery]

Wright: Today is April 9th, 2010. This oral history interview with Thomas Moser is being conducted for the NASA Johnson Space Center Oral History Project in The Woodlands, Texas. Interviewer is Rebecca Wright, assisted by Sandra Johnson. We want to thank you again for taking time out of your schedule today to visit with us. We’d like for you to start by sharing with us how you first became employed with the Manned Spacecraft Center in 1963.

Moser: In 1963, I—a native Houstonian—[went] to New Jersey to work for RCA Missile and Surface Radar Division, believe it or not, kind of like Aaron Cohen. Aaron Cohen and I followed along the same paths to a large extent. He worked for RCA also. When I saw the manned spacecraft program coming to Houston, I thought boy, that’s a good opportunity to get back to Texas [in a career that should last for a long time;] so I applied and came down to Houston when there was nothing but cow pastures and [a few] other things [in Clear Lake (NASA-area suburb of Houston)]. In 1963 I was there as a mechanical design engineer.

Wright: Talk to us about some of the first tasks that you had and how that then evolved, because we know at a later point you became [director of engineering]. So share with us how your job progressed into that and all the things that you were able to learn to apply to your job.

Moser: Let me just give you a 10,000-foot overview. Started off as a mechanical design engineer out at Ellington Air Force Base [Texas], where we were positioned at that time, on the Apollo Program. [One] of the first things that I worked on was a launch escape system [for] the Apollo [Command Module]. I’ll talk in detail about that, but let me just say in my career path being a mechanical design engineer and then getting into the structures area—let me back up. On the Apollo Program, I was a subsystem manager for the Apollo Command Module structure and launch escape system. Stayed on that and later became head of structural design in the Structures and Mechanics Division that was the beginning of the Space Shuttle.

Stayed on the Space Shuttle from sketchpad to launch pad. Then had the opportunity to be Chris [Christopher C.] Kraft’s horseholder, so that led to a lot of good experiences. Then became the director of engineering. From the director of engineering, I went to Washington, DC as the Deputy Associate Administrator for the Office of Space Flight, [and later became the deputy Associate Administrator. And program director for the Space Station]. Stayed there until I retired and went into the private sector. That’s the 10,000-foot view of my career path at NASA.

Wright: Just sounds so easy, didn’t it?

Moser: That was over a 25-year period.

Wright: Quite a bit of change in spacecraft development during those 25 years. If you could take us back to those days when you were helping to develop the structures for and those early thermal protection systems within the Apollo Program, and then how that helped you as you moved into the Shuttle Program.

Moser: In the Apollo Program, that was a unique spacecraft in itself. There was a lot of things that we were doing in mechanical systems design, in structural analysis. From determining the landing characteristics of the Lunar Module, of which I was involved in a one-tenth-scale drop test out in Building 13, where we were learning the dynamics and stability of the Lunar Module. That helped us determine the landing loads and the characteristics that had to be designed into the Lunar Module landing gear itself.

In the Apollo Command Module, the drop test in the water helped us determine what the impact loads were. We sank a few Command Modules in doing that, because that’s a rather complex loading environment.

Then there was another thing early in Apollo that was very interesting. We found that in a dynamic sense, [during] an abort, the Command Module would come back with the nose of the Command Module toward Earth. It would not turn around. The parachutes were in the [nose of the] Command Module. The parachutes could not be deployed, so the Command Module had to be turned around so the heat shield was coming back toward Earth first as opposed to the nose cone, if I’m making myself clear to you.

Wright: Yes you are.

Moser: Be sure and interrupt me if I’m not being clear. When the launch escape system pulls the Command Module away from [a malfunctioning or] exploding rocket, we had to flip the Command Module around. A little known fact is that there’s something on the launch escape system called canards. Let me show you a sketch of that if I may. This may be more detail than you want. There’s one particular thing I’m looking for in here, and I don’t see it.

Wright: Here it is right here. Is that it?

Moser: Yes, still not quite it. Here’s an old picture showing the launch escape tower pulling the Command Module away from the rocket. This is it prior to launch. [Shows photo] Once it comes out, the canards, which is a set of wings on the end of the launch escape tower, causes the Command Module to flip over and then you jettison the launch escape tower.

What was interesting about this early on, is we said, “We’ve got this stability problem; we’ve got to figure out how to fix it.” We in the mechanical design group came up with this idea of splitting the forward end of the launch escape tower [skin] to make [a set of] wings, and when the wings came out it caused the whole thing to flip over. The prime contractor, Rockwell—North American at that time—said, “It’s going to cost a kazillion dollars to do that.” Max [Maxime A.] Faget said, “I’ll do it in my garage.”

His garage was our facility. We built this set of canards. Here’s the forward end of the launch escape tower. [Shows photo] This splits. The skin splits, opens up like this photograph. I’ll give these photographs to you. That causes the wings to come out, and flips the whole thing around.

The message here was we were doing it hands-on. NASA in its history is proven to be a really smart buyer [because we did a lot of hands-on engineering]. We could do the engineering and things that we needed to do in house. We didn’t have the production capability to build a production spacecraft, but we could build the prototypes and we could build the development articles. The story of this launch escape tower and the canards were we could do it in house. We did it in house.

My first job was working on this mechanical design with a couple of other engineers, Clarence Wesselski being one of them. He was a mechanical designer also. The first Thanksgiving I worked for NASA Johnson Space Center, Manned Spacecraft Center at that time, I spent Thanksgiving at Langley Research Center [Hampton, Virginia] in the 16-foot tunnel doing a deployment [test of a full-scale set of canards].

Wright: That must have been a great experience.

Moser: It was a great experience. It was, “We can do it.” That was the attitude. We did it, and we proved it. Well, after that, then it was time to turn it over to the prime contractor. They said, “Voila, it’s really not going to cost quite as much as you said. We understand it.” It was that attitude, that philosophy, that ability to design it, and build it in house ourselves, which I think is so important in the whole NASA philosophy and the way that they work.

Some of that has been lost. I think it’s coming back now though. That was the perfect example of, “We can do it.” Then we’d hand it over to the prime contractor, then they made it into flight hardware. [The canards were never needed] in the Apollo Program [because the launch escape system was not needed]. We tested it at White Sands [Test Facility, Las Cruces, New Mexico]. We proved that it could be done off a Little Joe rocket. That was one of my first experiences in that.

That got me started. That got my appetite going. “Voila, this is going to be really good. It’s not only doing hands-on work, mechanical systems and design, it’s real part of the program. It’s making a real impact on this thing.” Junior engineers, like I was at that time, could have and did have a big impact.

Wright: I was looking at the date on the Roundup and maybe this is like within a year you’re there. So you were busy during that first [year].

Moser: Right. From five months of when I got there, I was in the wind tunnels at Langley Research Center with a full-scale model and four or five other engineers from JSC. We designed and built that thing.

You want me to just stay on Apollo? Or do we want to discuss Shuttle?

Wright: Whatever you feel comfortable. If you want to do them as a parallel to help explain the contrast and the comparing, you can, and if we repeat somewhere down the line that’s okay. It’ll be reinforcement.

Moser: Let’s just stay on Apollo. We’ll do it chronologically. Another interesting area of my experience in Apollo was in the docking system between the Command Module and the Lunar Module. It was a docking system that was a probe and a drogue, voila, like this. [Shows image] The Command Module puts the probe into the cone of the Lunar Module, and it had to accommodate misalignments, relative velocities between the two vehicles as they’re rendezvousing and docking in space. What we had to do was not only design that system, along with North American, but we had to prove on Earth that it worked in space. We didn’t have a capability to have a six degree of freedom simulator.

We started with saying, “Let’s figure out how we can make these docking systems work.” We did it on an ice rink in the south part of Houston. We had air bearings on the ice. We slid around so that was giving us the two-dimensional characteristics of this docking system.

Then we went and said, “We’ve got to have all six degrees of freedom. We have to move horizontally both directions in and out; we have to rotate about all three axes. So that’s six degrees of freedom. How are we going to do that?”

We made a simulator in Building 13. The only computer that could handle this was over in mission control area, so we had to run hard wires between Building 13 where our simulator was, our six degree of freedom simulator with the probe and the drogue attached to it, over to the Mission Control Center, the computers over there. The way it worked is that we had sensors [that detected the load], as we brought the probe and the drogue together on moving axes. As soon as they touched, [the computer would determine the motion of the CM [Command Module] and LM [Lunar Module] and drive the simulator accordingly]. The probe and drogue were the real flight hardware. The probe and drogue thought that it was connected to a Command Module, and to a Lunar Module, but it was really being simulated by virtue of the analysis in the computer and the motion device [of the simulator].

We were [testing] late one Friday evening, I remember. It was probably midnight or something like that. We could not get [a good] signal to go between Building 13 and mission control. Somebody was running a vacuum cleaner in [the test area and generating electric noise]. This showed how antiquated we were—running hard lines through the tunnels underneath between buildings at the Johnson Space Center and doing this simulation.

We finally got it to work though. We certified that hardware [probe and drogue] for space in Building 13, all degrees of freedom. Said, “Voila, that will take care of it.” Again, a hands-on kind of thing that we were able to do at NASA then [as] young engineers that was very important.

Wright: Again exemplifying the “We-can-do-it attitude.” You just found a way to make it work.

Moser: We did. Yes, we found a way to make that work. There was something else I was going to talk about in Apollo. Let me tell you one other thing about the Apollo Program, a personal experience. I’ve written it up for you here. It’s the history of the first flag on the Moon. I was sitting at my desk, and the division chief came in to me, shortly before the first lunar landing, Apollo 11.

He said, “I’m going to give you an assignment, but you can’t talk to anybody about it. Congress has said we’re putting a United States flag on the Moon. It is against United Nations treaties to do that but we’re going to do it. Congress wants us to do it so you have to work with Tech Services to design a flag. It cannot go in the Command Module. There’s no room for it. It cannot go in the Lunar Module. There’s no room for it. It has to go to the lunar surface. The astronauts have to be able to get to it very easily. Figure out where it goes, how the astronauts can get to it, and tell them how far away from the Lunar Module to put it so that it doesn’t burn up during liftoff and it doesn’t blow over during liftoff [from the lunar surface]. You have to tell them how far to stick it into the [lunar] surface.”

I said, “Yea verily we can do that.” In a matter of a couple weeks, we designed the flag so it telescoped. We attached it on the Lunar Module ladder, so when Neil [A.] Armstrong and Buzz Aldrin came down they could very easily reach over and grab the stowed flag and deploy it. There was a point of my life that almost caused me to have a heart attack. That was when—let me see if I can find this real quickly for you. Should have gotten all these organized. There was the picture I was looking for earlier.

Wright: The story of my life.

Moser: Not being allowed to talk with anybody about this, I did all the stress analysis, did the testing, and said we’re going to attach it on the side of the ladder. I did this analysis, said it was safe for the flag to be attached to the landing gear, and it wouldn’t break the ladder. No one looked at my analysis, which deviated from [standard procedures]. That couldn’t happen today at all.

Neil Armstrong comes down the ladder, and you don’t know, but I do. When he got to the last rung on the ladder, he jumped off. What went through my mind was the ladder broke, the sharp edge got his space suit, put a hole in the space suit, and the whole lunar program was over. That could have literally happened, but it didn’t. We all know that it came out okay. That was episode number one.

Episode number two was when they got ready to deploy the flag, the telescoping rod that holds the flag out at the top wouldn’t release all the way. The shop had put the wrong coating on the telescoping rod. Something caused it to bind or to gall and therefore the flag wouldn’t extend all the way. Therefore it looks like the flag is waving in the breeze. An error—no one knows that we did that. We put the wrong coating on [so] it didn’t extend all the way. What we did on all subsequent flights, [was] we made that rod shorter so that all flags would look the same as the Apollo 11 flag. So when people say, “Yes, this is all a farce, because we know there’s no atmosphere on the Moon. The flag appears to be waving. Therefore you guys at NASA are just lying to us, you did all this in a laboratory [or] somewhere in a hangar.” That is the story of [the waving flag]. Here’s a young engineer who [was told], “Here go design this [looking at a photo], stick it on there, put it in a T-38, fly it to the Cape [Canaveral, Florida], show the astronauts where it’s going to attach, and how to deploy it.” Lo and behold, they did it.

Wright: Must have been an interesting analysis for you to figure out how far away from the spacecraft, all of those things that had never been done before. You’re working with pure theory.

Moser: What we did was figure it out as best we could, or I did. Nobody else saw the analysis. Put a little red piece of tape around far from the bottom of the flagstaff, and says, “Put it in the lunar soil this deep; no deeper than that.” We had two little red [pieces of tape] on there. You go to the Smithsonian [Air and Space Museum, Washington, DC] you can see the same little pieces of tape on the bottom of the mast that show the same thing. I’ve documented this for you. I’ll give it to you. There’s part of it I’m going to tear off because there’s some [information on] artifacts there that I’d as soon not [share].

Wright: Where were you when Neil Armstrong came down that ladder?

Moser: With my family. I was not in mission control. I was watching it with my family.

Wright: Did you tell them then what you had done?

Moser: Yes I did. I told them immediately, because I was about to pass out. There’s the flag. [Shows photo] We did a vibration test on the flag. Here we are packing the flag over in Tech Services. [Shows photo] That’s the Apollo 11 flag. There it is on the Moon. [Shows photo] This is the way it looked when we bundled it up and put it in. It also had to be protected during the heat from the Lunar Module engines during landing so that it could not overheat. We had to put a thermal protection system around the flag when we hung it on the ladder.

Wright: It not only worked here, it worked for the rest of the flights as well.

Moser: It worked for the rest of the flights too.

Wright: Were there any changes made to your design?

Moser: No. Just we shortened that one tube so that they would all look like they were waving in the breeze.

Wright: Wow. What a great legacy.

Moser: Well, it was kind of fun.

Wright: You mentioned a couple of areas that you worked with. First you had escape launch. Were there other areas on the structure and/or the thermal systems that you worked with as well that you’d like to share with us?

Moser: Well, let’s see. When I got on it [Apollo Program], the Command Module was pretty well designed. I think the biggest thing was after the fire on the pad. They had to completely redesign the Command Module. That’s captured in your history I’m sure. How fast that that was done and getting back to flight [was amazing]. That was such a short period and was such an intense period of completely redesigning the interior of the spacecraft, eliminating a lot of materials, changing the hatch so it opened outward rather than inward. A huge effort. That was something that was done [quickly as well].

It couldn’t be done today. You could not do that kind of redesign without having so many checks and balances in the system. It would take years to do it. I think we did it, what, in eight months or something like that, from complete redesign to flying again. That was, I think, indicative of [the] “can do, will do, and allowed to-do” environment that existed then.

Wright: You were working toward that goal of putting a man on the Moon and safely returning him home before the end of the decade. Was there a lot of pressure to move [quickly and], everyone moving toward that?

Moser: A tremendous pressure. That’s the difference. I’m going to deviate a little bit now. It’s the difference between Apollo and Shuttle and Space Station and Constellation. In Apollo, it was go there, get it done, schedule is essential, and is the primary objective. Safety, of course, was the first thing. Make it work and make it safe, but do it quickly. With time being of the essence, money was not that big an issue for us. Political support was not an issue at all. I developed something called the “conservation of complexity.”

Wright: I like that.

Moser: Apollo Program was very very complex technically. Now let’s move forward to the next program. Let’s move to the Space Shuttle Program. Let me just even put Skylab aside for a second; let’s just move to the Shuttle. The Shuttle was technically complex: the thermal protection system, the advanced materials, the guidance and control system, and the propulsion system. Those were major technologies that had to be [advanced]. They weren’t nearly as large as the Apollo Program, but the political system was more complex. The Shuttle Program was almost canceled like about 1975 or so, because there wasn’t the strong support from the White House. There wasn’t the strong support from Congress. We weren’t [making] a lot of [visible] progress, so the public didn’t have the [enthusiasm].

All of a sudden we now have a less complex technical program, but we have a more complex political program. All of a sudden we have still the same [combined] level of complexity between technical and political. Now let’s go one step further, let’s go to Space Station Program.

Technically the Space Station Program is not complex at all. The assembly, the operations is very complex, but there’s no technology developed for the Space Station Program. The political complexity is huge, therefore we have our conservation of complexity program: technically simple, politically extremely difficult.

Constellation Program, now we’re getting a little bit more into a few technical problems, not really. A lot of it is the same thing, redoing some of Apollo using some advanced tools. Political complexity [is] gigantic. The lack of support by the White House for the Constellation Program, “Let’s cancel it.” You can see how this whole thing has evolved from full support, huge technical complexity, to no technical complexity but no political support.

When I talk to young NASA managers, [as] part of the mentor program, I try to say, “Look, this is the real world. You’re going to have to deal with that, figure out how to deal with it. We had to replan the Shuttle Program almost every single year because the budget was never there.” I’ll give you some specifics, what we had to do to accommodate and to make that Shuttle Program work.

I was the first program director on the Space Station Program for design and development. Hugely complex [politically] but I was of the bent that I wasn’t going to change the configuration. I stayed on the program for a couple years, then I retired from NASA. It changed hugely after that. The Russians were not part of it when I was there. The Russians came on, completely changed the objectives of some of the [missions] that were there and how it was to be performed. It’s just a fluid environment. It’s a much much much tougher environment for NASA engineers and for the industry to accomplish a program today than it was even during Apollo. Not technically, but frustratingwise; frustration level is much more complex.

Wright: Thank you for that.

Moser: Let’s, if I may, move into the Shuttle Program now.

Wright: When did you first hear about the concept of the Shuttle Program?

Moser: Let’s see. I started working on the Shuttle Program in 1969. We were doing a sketch a day of what the configuration should look like.

Wright: Were you part of Max Faget’s [group]?

Moser: I was not in the building where the team was, but I was back over in Building 13 doing the work there. I think Tom [C. Thomas] Modlin was the guy that we had over there. He was [one] of the structures guys. I was not part of Max’s team over there but still involved. It’s like mission control. There’s all kinds of people in the background supporting it. I was back over in Building 13 supporting that effort.

The way I summarize my experience in the Shuttle Program is “sketchpad to launch pad.” It was a fantastic experience of being able to see something through every phase of the program, from start to finish. That is so important for the nation, so important for any engineer, so important for any aerospace professional, or any professional, to see something from beginning to the end, because every single phase is different. The last few years of the Shuttle Program, I didn’t tell anybody, but I would have worked on it for free, because I was going to see it to completion.

Wright: You don’t want them to give your salary back, right? Hang on to that.

Moser: I had to feed my family, so probably really wouldn’t have done that. I started off in the Shuttle Program when I was a subsystem manager for the Orbiter structure. I had the full responsibility for all of the structural integrity of the Orbiter and then later became head of structural design. Now I was wearing two hats, I had my organizational hat of being the section head and my program responsibility for the development of the Shuttle—the Orbiter structure. That was a challenge, a lot.

The way we had it organized, when I was the head of structural design, I had a person that was the subsystem manager for the forward fuselage and crew module, then another person for the wings and the tail, and another person for the mid fuselage and aft fuselage. That’s the way we organizationally broke it up.

The Shuttle, as I mentioned before, was technically challenging because the thermal protection system was something that had to be developed. The main propulsion system was brand-new. The avionics was brand-new. We didn’t have those technologies at the start of the program. In the Orbiter, we knew we were going to have a weight issue, because all aircraft and any spacecraft, as it evolves, has a weight problem so you have to start with a fairly large margin in your hip pocket. Like 20 percent at the very beginning of the program is what you’d like to have in a weight margin, and we didn’t have it. We knew that we had a problem.

The first thing we did is we established a design criteria, and we deviated from what [is done for] an aircraft. Let me talk in the factor of safety: that is whatever the maximum expected loads you can see on an aircraft, it [must] withstand 50 percent more load before it fails. [The structure] has to be able to demonstrate that. We said, “Let’s back off instead of having a 1.5 factor of safety let’s back it off to 1.4 factor of safety.” That was our first thing we deviated from what was normal in the industry at that time.

We said, “Also in lots of aircraft they have a factor on when the material begins to yield. Let’s think about that. We don’t really care if the material yields a little bit, as long as it doesn’t preclude the operation of a mechanism or something of that sort, [or] causes some interference. We can inspect it. If it yields a little bit but doesn’t fail and it’s okay to fly, let’s don’t artificially put a factor of safety on yield,” which typically puts about a 10 percent factor on any aircraft, says we don’t want it to yield. So we said, “No, we’re going to be a little bit more bold than that. We’re going to say no factor on yield. All we want it to do was to be strong enough.”

Then we realized that there was something that we learned in Apollo, and that was fracture mechanics. Let me just say there’s multiple ways a piece of structure can fail. If you just pull on a piece of metal, first thing it does is it yields. We said, “We don’t care about that as long as it doesn’t preclude operation.” The next thing it can do is it can rupture because you just exceed the ultimate strength capability of it. Or instead of doing that, you can put a cyclic load on it, and it can fail during fatigue. We had to have a factor on fatigue.

We didn’t think fatigue was an issue with the Shuttle because it didn’t have that many flights. Each one of [the Orbiters] was designed to fly 100 times, so we said, “That’s probably not going to be an issue. We’re not going to let that drive the weight. We’ll check it and make sure it’s okay, but we’re not going to let that be a criteria by which we add weight to the vehicle.”

The other thing was fracture mechanics. That’s the fourth way something can fail is that if a crack occurs and, depending on the type of material, it can reach a crack length where it just lets go, and it grows very rapidly. We had to consider what fracture mechanics meant to us. We had to check all of those things, but we made them as minimum margin as we could and know that we were safe.

We were evaluated by the aerospace industry, by engineers from Boeing and Lockheed and other aircraft [manufacturers]. The Chief Engineer at NASA, Walt Williams, said, “I’m going to have you guys checked out here, make sure you really know what you’re doing.” Lo and behold, we got past that. They said, “We think you’re stretching a little bit but that’s okay.”

That was the design criteria. We said we’re going to be bold and aggressive on this thing, so we were. It worked out for us.

Wright: Let me ask you, if you don’t mind, could you provide a little more background. They said you were stretching it but it was okay, but why was it okay? What was your main reason to move it back?

Moser: Well, the main reason to move it back is for weight. Let me back up one. In the design of a structure you design it to what you think is the maximum reasonable load the structure will see, and that’s called limit load: that you can literally anticipate seeing that in a flight. You probably won’t, but you could. You have to say, “I’m going to withstand that.” Now let’s say that that takes a tenth of an inch of material to withstand the limit load. Say, “Well, I want to be safe, so I’m going to put a factor of safety on top of that.” If it’s a one and a half factor of safety instead of being a tenth of an inch it’d be 0.15 inches. We said, “We’re not going to do that; we’re going to make it 0.14 inches.” Well, that’s weight so therefore when you take it over this entire vehicle that’s a lot of weight. We said, “We’re going to take the risk. We think we understand what this is. We don’t think fatigue is an issue; we don’t have to have a lot of material in there for cyclical load. We think we’re okay.”

We came under a lot of criticism and a lot of scrutiny for doing it. We didn’t get to just do it because we wanted to, but we were doing it for weight. I want to add something right there. John [F.] Yardley was the Associate Administrator all during the Shuttle development. John Yardley, when he was a young engineer, was a stress engineer. John Yardley later became the program manager at McDonnell Douglas of the F-4 aircraft. As a program manager, he knew that he was going to have a weight issue with the F-4 aircraft so he made all of the stress engineers design so that it would not reach the ultimate load.

He said, “I want you to show me, by analysis, it’s going to fail 10 percent before you reach that ultimate load.” He knew that they would probably be conservative, but he had a test article which he was going to prove that he was right. If he was wrong, then it cost him his job, and it cost the company a lot of money. Well, lo and behold, it was right so John Yardley supported us in what we were doing. It was absolutely fantastic to have a person at the very top of the program that could relate to what we were doing in the structural design, so we took that same attitude. We’re going to do it that same way. We’re going to stretch it. Lo and behold, it paid off, but we had to prove it with ground test. I’ll get into the ground test a little bit in a minute.

Let me talk a little bit more about the design criteria on the structure. Most systems in the Orbiter and the whole Shuttle Program, they have a criteria by which they’re designed. First failure, it’s still operational. Second failure, it’s still operational. Third failure, it’s still safe. An analogy is there are three computers. Lose one computer, keep on operating, lose two computers, you keep on operating. Then you’re down to fail safe. You come home, but you stop after you lose the first computer, that’s the flight rules.

In the structure that’s not the case. There’s no fail operational/fail operational/fail safe. It is a safe-life design. It means if you have a piece of structure that has to carry the load and that structure fails, the structure fails. It doesn’t have an alternate load path. Now some aircraft are designed so that you can have multiple load paths, but that added weight so we said, “We’re not going to do that. We’re going to have a safe-life design.” That’s exactly the way we did it so that we were not adding any weight in the beginning, because once you add weight to a vehicle it’s very very expensive and difficult to get it out. We took the hit right at the beginning. We’re going to be less conservative than that.

So that’s in a simple explanation our philosophy, and our criteria for designing the structure. Then we looked at this thing called an Orbiter. We said, “Wow! Thermal conditions are going to be big on this.” The vehicle goes from an ambient condition, [while] it’s sitting on the launch pad, it heats up a little bit during ascent, it heats up on orbit, one side is hot, one side is cold. We had to take that into consideration. Coming back in it gets really hot in various places.

It’s not so much the maximum temperature we had to account for. We had to account for temperature differential. Let me give you an example. When we were looking at thermal protection systems in the Shuttle, we looked at a metallic system. We had something that’s called Haynes 188 that could withstand 1,800 degrees [Fahrenheit]. We said, “Let’s test that.” We tested it, and we heated the panel to 1,800 degrees in the middle, but where the panel was attached around the edge so it could move in a frame, it was 40 degrees cooler, because the heat was sinking into the attached structure. It was 1,800 degrees, so it was 1,760 degrees on the edge. That difference where the metal was trying to expand to 1,800 degrees versus 1,760 degrees caused it to buckle. When it buckled, in a plasma test, it let the hot gases flow [into] this little buckle. [This would have been catastrophic.] My point is thermal gradients were a huge issue for us.

We had to pay a lot of attention even though we didn’t use those panels. I just used it as an example. We said, “What are we going to do in Orbiter design to accommodate for temperature differentials?” There may not be any load at all on the structure, but all of this trying to expand and contract and hold it together induces huge stresses. We said, “Let’s get smart in what we’re doing in the Shuttle design. Let’s talk to the people that designed and built the SR-71, the ‘Blackbird.’” That is an airplane that was all titanium. A couple of us went out to the [Lockheed] Skunk Works, and we spent the day out there. We said, “Look, we’ve got these thermal gradient concerns. What did you guys do, and how did you do that?”

What they did was they designed the wing structure, for example, so that when the wing bends the skin doesn’t carry the load. It’s all of the beams, the spars, if you will, in the wing, carrying the wing bending loads, because they didn’t want to deal with that expansion and contraction and the thermal stress in the wing, because they said “We don’t know how to do that.” They probably didn’t when they designed and built the SR-71 so they let all the skin float. We said, “Okay we got it; we understand what you did.”

We put that in our database. Then we went and talked to the people that designed and built the Concorde, the supersonic aircraft. Went over to England and talked to them. Said, “What did you guys do,” because they didn’t have a real high temperature, but they had again a thermal gradient issue, which was causing large stress in parts of the aircraft. It was because of the way they were having to move fuel around, cold fuel being moved from one section to the other. All of a sudden the skin or the structure is hot. Now you bring the cold fuel in, and that part of the structure wants to shrink and can’t, so that’s inducing a lot of stress. They said, “What we did is we designed it so that we had stress relief. We built in cracks if you will, expansion joints. Every place we built in an expansion joint we created a problem.” We says, “Got you.”

What we decided to do, after talking to the SR-71 people, after talking to the Concorde people, we said, “To hell with it.” We’re going to just take this thermal stress head on. We’re going to have to understand the temperature distribution. We’re going to have to combine that thermally induced stress with whatever the flight load stress is on the vehicle, whether it’s launch, landing, whatever. We have to superimpose those. We took it head on, and we did that.

The other challenge that we had was when we were doing our analysis, the analytical tools we had at the time were called finite element models. It’s the way you idealize the structure with mathematical simulation of the structure. We could put the mechanical load on our finite element models, but we couldn’t with the same model put the temperature gradients. The computing capability didn’t exist.

We had to do this, complement the two. We said, “Okay, we can do that.” We did it, representative all over the vehicle. We thought that we had it designed safely to do that. Then that gets us into okay, we’ve got the vehicle designed and built, now we’re going to have to test it.

I’m going to back up for just a second now. When we started the Shuttle Program money was an issue but it wasn’t as big an issue as it became later in the program. When we started the Shuttle Program for structural integrity of the Orbiter, we had two fully dedicated airframes, which is the same way that the industry did, the large jet airplane industry. They have one for static test where they applied the maximum expected load plus 50 percent more, showed that the airframe would take it. That’s called a static test article. They had another one called the fatigue test article. That’s where you let the wings flap and the landing [loads] impact the body of the fuselage, etc. That was a fatigue test article. We said, “We’re going to need that in the Shuttle program,” so when we started the program we had two airframes, [one for] the static test and [one for the] fatigue test.

We got into the program, and within about the first year or two the program had a $100 million problem. So we said, “What can we do differently.” What we did differently was we said, “We don’t need the fatigue test article, because we don’t think we can accurately simulate that, and we don’t think it’s an issue anyway.” That had been gotten rid of. We had the static test article. We said, “What we can do,” even though we’ve taken our design criteria and made it as minimum as we think we feel comfortable with, “we can go one step further.” We think that what we can do is we can load the test article, the entire Orbiter, we can load it to 110 percent of the maximum load, and we will prepredict what we think it’s going to do. We had strain gauges all over the vehicle.

We said, “We will prepredict with the mechanical load what the strain response is going to be. If we do that accurately then we can extrapolate to 140 percent and show that it won’t fail.” [The NASA Chief Engineers Office] said, “You guys are crazy as hell. We’re not going to accept that.” We said, “No, we’re okay. We’re not going to do anything that’s going to cause a failure.” Now we have an outside group come in. They [took] us through the wringer. They check every single logic, description, and everything that we had. Called the wide-body group; had guys from Boeing and Lockheed and the other companies that were making large body jets. They finally says, “Okay we agree with you.”

So what we did; let me find a picture. Voila. We took the Challenger Orbiter [STA-099], and we rolled it over to Palmdale [California] test facilities at Lockheed. We tested that vehicle exactly the way I just described. We tested it to [120] percent. There it is going over to Lockheed. [Shows photo] There it is when it got into the test facilities. [Shows photo] We tested that thing and it worked. We saved the Orbiter Project $100 million one year, because when I got back to the consistent level of complexity that I talked about, here we were having to back off because of having a lack of political support because they kept cutting our budget. Well, we said, “No, we can be innovative.”

Wright: So you changed from crazy to innovative, right?

Moser: Yes, right, but we said, “We can be creative, and we can be innovative.” We did that. A lot of times when you have your back against the wall, “necessity is the mother of invention.” We thought outside the box to do this, and it panned out. Had we had the money that we set the program out with, we wouldn’t have done this, but we did not compromise safety at all. As a result, I think we’ve even changed the way industry looks at [the testing of] some of their aircraft now. They’ve said, “Hey, we don’t really have to test these things to destruction.” Now some companies still do it, but in light of the way we did it, we created a new path to save a lot of money. So that was something that we felt pretty darn good about.

Let me talk a little bit about some unique things about the structural design. I’ve talked about the criteria and the way we tested some stuff, but we realized that there were some things that were going to be critical in the Orbiter that we weren’t going to have enough knowledge on to feel safe about, operationally. Let me give you an example of that. The payload bay doors, the big old doors that open on orbit. During Apollo and every other space program there’s always been problems with mechanical systems. Things not working [in space] exactly the way you think it should.

So we said, “If we get those payload bay doors open,” which they have to be in space, if you’re there for any period of time. That’s the way it radiates part of the heat from the Orbiter out into space through the radiators there in the payload bay doors, plus you got to get the payload out if that’s what you went there to deliver. If we can’t close those payload bay doors then there’s no way you can survive reentry. It just will not take it.

We said, “In the structural design we’re going to do something to alleviate that issue. What we’re going to do is make the payload bay doors very flexible so that once they start to close on orbit you can zip them closed. Start at the hinge line. Start zipping around the edge. Start zipping it down the middle. You can zip it closed through the latches.”

But what you do is you give up that part of the structure. Think about the structure of the Orbiter [fuselage as] just being a big tube. If you take a tube and you bend it, it’s pretty stiff, but if you cut half of it away and you bend it it’s not very stiff at all. We said, “We’re going to do that. We’re going to let those payload bay doors be like that they’re not part of the fuselage structure, so that we can make sure that they’re flexible enough to close on orbit, but we’re going to add weight to the vehicle when we do that.” We did that. We designed that Orbiter so that those payload bay doors are theoretically not there during entry. Probably not many people know that.

Wright: Yes, it’s an interesting concept.

Moser: We said, “We’re going to do that.” Okay, so we did it. The next step on the payload bay doors were another weight issue. We had to get more weight out of the vehicle. I think we were looking to save 600 pounds of weight in the payload bay doors. Payload bay doors were made like the Command Module was. It was an aluminum honeycomb. Aluminum honeycomb is just a face sheet with what looks like honeycomb in between. It’s an integrated panel that’s very stiff. We said “Okay, aluminum honeycomb is the way to go with that, but there’s this new thing called graphite epoxy that’s a composite material that’s much stiffer and much stronger than aluminum. We think we can make those payload bay doors out of graphite epoxy and we could save some weight.” Lo and behold, we did the analysis, and we thought we could save 600 pounds of weight in the vehicle doing that.

One Saturday morning, Aaron Cohen, myself, Phil [Philip C.] Glynn, Tom Modlin, and a few other people over in the Structures and Mechanics Division Building 13 sat in the conference room there. We looked at it and Aaron said, “Do you guys really think you can do it? Are you comfortable with it?” Don’t forget we’ve led him down this path of minimum criteria, all this kind of stuff. We said, “We can do it, Aaron.” He said, “I trust you.” Made the decision, went with it. Gotta to think how far I want to carry that [in] today’s environment. Let me just not go there right now. It was that authority that the project manager had and the trust that he had in the guys that had been working with him for three or four years at that point, a couple years anyway. He said, “I trust you.”

We went with the design. North American, Rockwell at that time, was on board, and they agreed with it. Going from the design into the implementation and manufacturing—the largest composite structure that had ever been flown. Now fast forward to today, the aircraft industry today uses composites to the maximum extent possible, because it typically saves about 25 percent of weight over an aluminum design. We flew the biggest composite structure ever flown, and we made that decision in probably 1973. We started building our payload bay doors in Tulsa, Oklahoma.

We built the first set of doors, [which were] very process and people-dependent. The guys in the shop had to learn how to do it. NASA couldn’t do that. That’s where the prime contractor has to do it. They learned how to do it. Hit a budget hiccup, not as much money the next year. So what do we do? Laid off all the technicians that built the first set of payload bay doors. Said, “Go away for a year because we don’t have enough money to build the second set.” So we did it. Probably cost us some time and some overall expense to do that, but another frustrating element of this “conservation of complexity.” Anyway, that was the payload bay door story. We characterized that material because we had to to be able to know that it was strong enough and it would carry all the loads.

A few years later we got a call from Learjet. They wanted to build an all-composite fuselage. They said, “We don’t have any of the material allowable. Will you give us what you have?” We said, “Sure, we’ll do that.” We gave it to them so that started the industry. Lear, I think, was the first one to build a composite fuselage. It was us leading the way. A few of us sitting there saying, “We can build these payload bay doors out of graphite epoxy” that started the industry down the path. We gave them what we had, and they built on it from there. We passed it on to the industry.

Another thing on the design in the mid fuselage region—Marshall [Space Flight Center, Huntsville, Alabama] had the responsibility for the payloads that were going to go in the Shuttle, so it was time for us to design the mid-fuselage. We had to know the characteristics of the payload that was going to go in that mid-fuselage. We had to know how big it was, what it weighed, where the center of gravity was, how many payloads there were going to be, where they were going to be attached, how stiff they were and all, because we were going to bolt it in. If you take two things together and bolt them together, they become one in the same.

We said, “Marshall, you have to give us the requirements on the payload.” We waited, and we waited. We said, “That’s stupid, they don’t have any idea. Nobody does. We don’t know. This vehicle may fly all the way to the year 2010.” We didn’t say that, but that’s where we are today. No one knew what was going to fly then. We said, “We have to design the way we attach the payloads into the Orbiter so that the Orbiter doesn’t care how many payloads there are, where the center of gravity is, and how much it weighs.” What we did is we looked at multiple types of payloads, different orientations, different centers of gravity, different positions, different weights, everything else. There were 10 million combinations of all these things we had to consider.

There’s a mathematical program called a Monte Carlo analysis. We throw all of those 10 million cases in there, and we crunch it around. We designed the mid fuselage to accommodate 10 million types of payloads. The Orbiter has never had a problem accommodating any payload so again we had to be creative in what we were doing.

There was one other creative part that we did. What I just talked about was the [payload] mass and where it was, how many, and where it was located in the payload bay. To avoid having a very stiff payload and having it bolted all the way into the fuselage we said, “We’re not going to do that. We’re going to put on attachments so that they slide.” In a technical sense, we made it statically determinate. The Orbiter didn’t care how stiff the payload was, and the payload didn’t care how flexible the Orbiter was. The payload can [be designed independently of the orbiter and vice versa]. We isolated; we decoupled that design by making it a statically determinate system.

We put bridge fittings in there so now you can attach it anywhere along the whole part of the structure, the longeron of the structure, in different places. In the same way in the bottom of the [mid-fuselage we provided a keel attachment]. I never will forget Max Faget said, “You’re not putting those bridge fittings in the Orbiter.” Well, Max, bless his heart, he was a conceptual designer, the best in the entire world, but when it came time to implementing a program he was usually about a year late. Max would laugh if he were here today. I said, “Yes, Max, we’re going to go ahead with bridge fittings.” “No you’re not.” He says, “I’ll bet you don’t.” I said, “Okay, I bet you a duck hunt, Max.” So he and Caldwell [C.] Johnson bet me. We put the bridge fittings in there, and they never did give me my duck hunt.

What it did is it enabled the Orbiter to be [independent of the payload stiffness. It gave us the flexibility. Now we got the flexible payload bay doors opening and closing in space and being a structural part of the Orbiter. We have the accommodation of the payloads. Those are things that I think a lot of people don’t realize really went into the design of the Orbiter.

Another part was we looked at the crew module. We said the best way to do this is to make it just like an airplane, so that there’s not a separate pressure vessel, if you will, for the crew. We’ll just make it all part of the same [fuselage structure]. The problem with that is, if you’re in space and you have something that causes a structural opening, maybe not a failure, but a rivet or something causes a crack, then you got a problem.

We looked at that very carefully, and we said what we’re going to do is we’re going to make the crew module a pressure vessel, and we’re just going to sit it in the fuselage. We’re going to attach it at discrete points. Now we have a crew module that is designed only by pressure, and it’s got the crew in it so you’d like to have that pressure vessel [as] simple as you can. We made this pressure vessel with the crew in it, and we attached it to the fuselage at some hard points. That simplified the heck out of a very very critical part of the Orbiter.

To make sure that we had something we clearly knew every aspect load so now it’s only designed by pressure. It’s not designed by twisting and bending of the Orbiter during ascent. Those loads don’t get into the crew module, just the mass of the crew module and the pressure makes it very very simple. If, during the pressure cycles and the inertial loads on the Orbiter, we create a crack in the pressure vessel, we designed it such that crack would grow but it could not reach critical length and grow catastrophically. We would detect a leak in there. If we had to come home we’d come home. We designed the pressurization system with the environmental control system, so it could accommodate a leak of the size that we thought would be maximum we could stand and get home safely. Again we simplified the design, but we made it conservative enough we knew that we were safe.

To this day there’s never been a problem with any Orbiter structural element, period, as far as safety of flight or anything. We pushed the envelope on that, and it worked for us.

Wright: How much were you able to apply what you had learned from the Apollo era to these early phases of what you were doing? Did you throw the book out and make all new rules or were you able to bring some?

Moser: No. We learned about criteria. When I talked about the structural design criteria, we brought some of that from Apollo into the Shuttle design, so we learned from that. The analytical tools were much more sophisticated in Shuttle than they were in Apollo, so we were able to take advantage of that, but if I think about the Orbiter being comparable to the Command Module, there wasn’t a lot of similarity. They’re a totally different type of structure altogether, but if I look at the Lunar Module—we weren’t able to use a lot of that technology either, because the Lunar Module was the only true spacecraft ever built for humans. It never had to see the atmosphere of Earth. Once it got into space it was purely a space environment. The structural skin of the Lunar Module was so thin you could poke your finger through it. It was a pressure vessel. That’s all it was, and some landing loads and so forth. We were able to take some of that and bring it into the Orbiter.

It was evolving, but I wouldn’t say that there was a huge amount of capability from the Apollo Program structural designwise that went into the Shuttle, completely different thing. The Orbiter had these damn wings on it. I say damn wings. You really wanted them during entry, when it was an airplane.

Let’s talk about the Apollo Program. Let’s just talk about the Command Module for instance. It was a module which really didn’t have to experience the launch. It was not part of the launch vehicle. It was housing the astronauts. It was a spacecraft on orbit, but that’s not usually critical for design. Thermal stress wasn’t really an issue there. It was pretty bulky. Thermal gradients didn’t design anything significantly. During entry it was important, but from a structural standpoint really wasn’t significant either. Water impact was significant. The Command Module was pretty isolated.

The Orbiter—it’s a launch vehicle. It’s a spacecraft. It’s a space laboratory. It’s a reentry vehicle to withstand the temperatures of reentry, and it’s an airplane. So, it’s five things. You can see how this passive Command Module, if you will, and how all of a sudden now you’ve taken something that’s dynamic, it’s a living breathing thing during all flight regimes. It’s withstanding every environment that there is. There’s not a lot of application just from a structural design standpoint that the Apollo Program carried over into the Shuttle Program. We learned a lot, but not as a structural engineer you didn’t a whole lot.

Something else on the Orbiter—I mentioned the payload bay doors being the largest composite structure ever flown, the graphite epoxy. As we progressed into the vehicle, probably in the mid ’70s, we still had weight issues. We were having to scrub the weight out. Now all of a sudden it’s getting more and more expensive to get the weight out, but we did some other things. We decided that some of the supporting structure in the mid-fuselage and the wing were tubes supporting part of the support structure. We came up with something that was a composite called boron-aluminum. We saved a lot of weight in the vehicle. I don’t remember how much weight that was, but there’s a section of a boron-aluminum tube. It has aluminum and then it has a boron material inside of it and then aluminum on the outside again. We said, “Okay we can do that.” We led the way in boron-aluminum technology in the Orbiter.

Then in the thrust structure we said, “Okay we got to do something there,” so we did two things. We built it out of titanium, because we needed the stiffness where you had 1.5 million pounds of thrust from the main engine of the Orbiter going into the frame of the Orbiter, supporting the payloads. That had to be a very stiff structure for control purposes and also for strength and all, so we made the thrust structure out of something called diffusion-bonded titanium. That had never been done on a flight vehicle like that. What it did is we would take two pieces of titanium that were going to go together. Instead of welding them, we put them in high temperature in a vacuum and pushed them together until they bonded. Just molecularly they became one and the same.

If you get the light right, this is one piece of structure; this is another piece of structure. Just push them together like this. That was part of the diffusion-bonded titanium. I won’t go into a lot of detail of those, but that’s still not stiff enough, so what we want to do is we want to take some of this [borox] epoxy and want to bond it on this diffusion-bonded titanium structure. They came back and said, “You guys are crazy,” again, but we can save weight. I think we saved 1,200 pounds of weight or something like that in the aft end of the vehicle by putting [boron] epoxy, just gluing it onto the titanium structure.

We said, “If it fails we want to be able to withstand the maximum expected load, but without a factor of safety on it.” We know we’re going to be safe if we lose the bonding of the [boron] epoxy. The bottom line on that is the Orbiter started being designed in 1972. In the mid ’80s, and even today, it is one of the most advanced spacecraft designed in composite advanced materials that exist. That became very important in 1986 after the Challenger accident, when I became a deputy Associate Administrator and I went to Washington [DC, NASA Headquarters]. In December of ’86, there was a big push by other federal agencies to kill the Shuttle. They said, “It’s antiquated; it’s obsolete. Start all over.” It was other agencies wanting NASA’s money. It goes on to this day in all federal agencies.

Over Christmas holidays, I wrote a summary of why the Orbiter was still advanced state-of-the-art in design. I got it over to the White House. I don’t know how much that helped but I think it helped. By us pushing this envelope and being creative in the way we designed the Orbiter and the way we brought composites into it helped us to say we didn’t just build some obsolete spacecraft and aircraft, we built a state-of-the-art thing. In 1986 it was still state-of-the-art. Don’t throw stones at this thing, it’s advanced to this day. I think that that was not planned. That was not planned. I had to defend it, but it was something that we had in our hip pocket that we could defend it.

Let me move beyond just the Orbiter structure now into the Orbiter structure and thermal protection system. When we went to the Skunk Works and we talked to the Kelly Johnson folks about the SR-71, they made it out of titanium so it could withstand 600 degrees. They didn’t need to have any thermal protection system on it, Concorde didn’t need any, didn’t get that hot, just had the thermal gradients. We were left with the challenge of “What do we make this Orbiter structure out of. Do we make it out of aluminum? Or do we make it out of titanium? Or do we make it out of other materials which can even withstand even higher temperatures?” There was some experience and data from military programs where they built high-temperature entry vehicles that didn’t have an all-metallic design. We looked at that, and we found some things very interesting.

When we looked at aluminum and the amount of thermal protection system that was required to protect the aluminum to 350 degrees, and we looked at titanium, which you could work up to 600 degrees, less thermal protection system, and we said, “Well, it looks like titanium is going to be the better thing.” Had a lot of merit, but when we considered the heat absorption, the heat sink to be specific, with the aluminum, aluminum has a better heat sink than titanium does. Now all of a sudden, we’ve got the weight of the structure, the weight of the TPS [Thermal Protection System], and the heat absorption of the material. We says, “It’s about the same between titanium and the thermal protection system and aluminum and the thermal protection system.” As we finished our tour at the Skunk Works with these guys that had been through titanium, says, “Okay, guys. If you were us would you build out of aluminum or titanium? We’d just like your opinion.” They said, “Aluminum,” because titanium was so difficult to work with. It was extremely difficult to manufacture.

What we did is we went with a classical aluminum design where you didn’t have to train a bunch of people differently. They were already in the business of making aircraft out of aluminum, so we said, “We’re going to do that.” I told you about the composite [payload bay doors], how we had to screw that up [by] laying everybody off. We made that trade from a truly systems engineering standpoint. We looked at the whole thing and made that decision. It was a big diddy to do that, but again we had established the relationship and the confidence [of management]. They trusted us and what we were doing. The relationship between the project management, the subsystem engineers, and the engineers was very good. That was the way we made that decision.

Wright: If I can ask you at this point, you sought out industry standards or what they had been doing. You went to the Concorde. You went to the Skunk Works. I find it interesting that they readily opened the doors to you to find out what they were doing. Was that commonplace at that time? Or is it because it was NASA that they said, “Come talk to us, we’ll be glad to share with you what we’re doing.” Were they very open with that information?

Moser: They were extremely open. We weren’t competitors. I think when we were talking to Lockheed they knew that it was a national pride and a national program. Lockheed had bid on the Orbiter. They had a different design on the Orbiter than the one that won so they were really familiar with the Shuttle Program and in particular with the Orbiter. The Concorde, even though it was a foreign entity, England, it wasn’t that foreign, but they were also part of the program, because they were going to build something that’s called the Spacelab that was going to be carried in the Orbiter. They were part of the program to some extent. Elements of it were part of the people that designed the Concorde in England.

They were very open with us. Had they been competitors, they wouldn’t have shown us anything. Now, we didn’t worry about international trade agreements like we do now with all the ITAR [International Traffic in Arms Regulations] restrictions so we were able to share information probably a little bit more readily than you can today. As I said earlier, once these constraints start coming in, they just keep getting more constraining rather than less constraining, but good question.

Wright: Thank you.

Moser: I think I’ve covered all of the Orbiter structural integrity questions that you had. I’ve added some stuff to that.

Let me go into the thermal protection system a little bit. First of all, I took on the responsibility for the thermal protection system in about 1978. I was not the person responsible for the thermal performance of the tiles. I was supporting the guys that were doing that, but it was primarily the guys that had to determine what heat protection was required and the materials guys looking at various materials to withstand those temperatures. It was the insulation characteristics of the material in the thermal design that I was not part of.

The guys that were more involved in that and that you want to talk to on the thermal performance—talk to Dottie [Dorothy B.] Lee, and she can lead you to other people. As far as the materials talk to Glenn [M.] Ecord and Cal [Calvin] Schomburg; both those guys are still around. I’ll let those guys tell you the details of the materials and the types of materials and the mullites and silicas.

We had the silica material for the tiles, and it had a glass coating on it. It was about the density of balsa wood. It was very fragile. [The coating is] like an eggshell. The glass coating on the outside was a few thousandths of an inch thick, and you could break it very easily. [The silica buoy] had an ultimate strength of less than ten pounds per square inch. Early on in the program we said, “Well, we’re just going to bond this stuff to the aluminum, but we know since it’s an aluminum structure it’s going to expand and contract a lot because of the extremes in the temperature going from minus a couple hundred degrees in space to a couple hundred degrees coming back in. It’s going to expand. These fragile tiles, we’re going to have to isolate it so it can “float” on the structure. We put a felt material between the aluminum and the tiles. We called a strain isolation pad or SIP, you’ve got to have an acronym. We says, “Voila that’s good.” In hindsight we thought we had everything pretty well covered. We were down to the point where we were putting tiles on the vehicle, but we were still trying to understand a bit more about this very low-strength fragile material, because we knew that if we lost a tile in the wrong place you lose the [entire] vehicle. Twenty-five thousand tiles, you lose one and you can lose the vehicle.

I don’t want to throw stones, but I remember Rockwell was under budget pressure, and we were. They said, “We’re not analyzing those damn tiles like a piece of structure.” We said, “Well, we got to. We’ve got to assure the integrity for [all of the tiles].”

We had a disconnect between ourselves and the prime contractor. We were doing some of our own work in house, and we decided we need to understand better what these aerodynamic loads are on the tiles. You have aluminum, you put an adhesive down, you put the felt down, you put adhesive down, put the tile on it, and it sticks. So that’s it: aluminum, glue, adhesive, felt, adhesive, tile. We put it on a T-38 aircraft on the speed brake. We said, “We want to get some high dynamic pressure on this thing.”

We worked up the test program where the tiles were on the speed brake, and then we’d have the aircraft pilot deploy the speed brakes and put this really high aerodynamic load on these tiles. We said, “That’ll give us some characteristics that we predicted what it’d be.” Voila, they came off the speed brake. Any time anything comes off an aircraft in flight, then you have to write an incident report. Something falls off, it’s a big deal. There was a lot of hubbub about that. We started analyzing the systems. Why in the world did they come off? They were not glued properly, blah blah blah. We found out that the strain isolation pad [the loosely woven felt material], to give it a little bit of integrity, it had some stitching in it. Everyplace that there was one of these little stitches, when the tile tried to pull away from the structure, it was a little stiff spot so that was a stress concentration.

You get a stress concentration in a low-strength material, and it fails right where that little stress concentration is. Once it fails in a brittle material, then it propagates. All of a sudden we didn’t have nearly the strength that we thought we did. Let’s just make up a number. Let’s say 100 pounds before it would fail. Lo and behold, it was failing about 60 pounds. What was happening, it started to fail, and it just would let go. It was like glass cracking.

We’d already started bonding tiles on the vehicle so this was the showstopper for the program. John Yardley, the guy I mentioned earlier, the old stress guy, he called Max Faget and he said, “Max, I want somebody in charge of the tiles.” Max says, “Well, I’ll do it.” Yardley said, “No you can’t do it, you got too many other things.” I got tapped for that job, being the guy responsible for the integrity of the tiles.

That led into a lot of problems that we had. We started to understand all of the load environments that we had on the tiles, but the first thing we had to address was the lack of strength that we had. Had we understood this strength deficiency early in the program—we had stronger tiles that had more strength but they were a lot heavier. What we’d have probably done is we would have probably bonded those stronger tiles all over the vehicle, and we’d increase the weight by a whole lot. We’d probably doubled the weight of the thermal protection system.

We had our back against the wall so we said we’ve got to figure out how to distribute this little stress concentration in the bottom of the tile where the SIP is imposing this stiff spot. We thought, “Well, we’ll put a metal plate underneath there.” Long story short, Glenn Ecord, one of the materials guys, one weekend was playing around with tiles trying to figure out how to strengthen the bottom of the tile. He came up with a way of taking really fine powder like talcum powder, which was just ground up silica, and he put it in water. He just spread it with the water all over the bottom of the tile. The tile is like a bunch of fibers. That little talcum powder, the silica powder, packed itself into all the fibers. When the water evaporated, it left this little densified bottom of the tile.

That doubled the strength of the tile with this packed in silica material. It added practically no weight to the tiles. Doubled the strength where it was attached to the SIP. Again “necessity is the mother of invention.” We were able to then take the tiles, not change any of the process for the materials, not add any weight, take the tiles off we’d put on in some areas, densify it—got you an example here. Lo and behold, that’s what doubled the strength.

Now we’ll talk about all the design work. Here’s the tile. [Shows original tile] See where it’s chipped there. That’s what it is like when you just put the SIP to that and bond with it. You can feel that, how the material feels really soft. Here’s the densified tile. [Shows densified tile] Just put your finger on that and feel that.

Glenn Ecord gets all the credit for figuring out how to densify those tiles, or else we would have had to start over. This was a huge impact on us because now we had to design—let me take a tile and show you. From the strength integrity, don’t forget it just has a few pounds per square inch strength capability. Here’s a tile that’s got some mass. It’s sitting on the Orbiter, the engines light off, and all of a sudden it starts shaking. It has to withstand the vibration loads.

Then the vehicle lifts off from that, now it’s got acceleration. Now it’s shaking plus it’s being pulled down by the acceleration, then the aerodynamic pressure comes over it. Now you’ve got airloads on the tile. It’s shaking, being loaded with inertia, you got airloads on it. When the shock wave comes across it, there’s a pressure differential because of the shock wave going across it. Oh, by the way, when you started, this tile was sitting at sea level. All this little air in the tile, all of a sudden you’re going up, it has to escape. Now you have a pressure internal to the tile trying to escape.

Now you’ve got this aluminum it’s bonded to. Let’s say it’s on the bottom side of the fuselage of the Orbiter. The Orbiter starts being twisted. The wings are getting loaded by the aerodynamic and the deflection in the structure. One sixteenth of an inch of deflection of the Orbiter aluminum underneath its tile will cause it to fail. Now you have to put all these combined loads on this little low-strength tile, 25,000 of them, and say, “We’re safe to fly,” because you lose some of them, you lose the entire vehicle.

That was our dilemma in 1978. We were the pacing item for the whole program. We had to rapidly analyze all 25,000 tiles. We had to do wind tunnel tests. We had to understand exactly what this pressure differential was. We had to understand what the structural deformation was. We had a ton of work to do in three years before the first flight. We did it. We convinced ourselves, with all 25,000 tiles, that we knew if it was bonded properly the way it was supposed to be done, and the tiles were made the way they were supposed to be, we were good to fly. But, we had to make sure, since bonding is a process-dependent thing and is a people-dependent thing. If the temperature is not right, the humidity is not right, the bonding pressure is not right, you don’t know that it’s [safe to fly]; by design you can say it but you don’t know it’s really good.

We said, “Okay what we have to do is we have to go up and pull on the tiles.” We said, “Well that shouldn’t be a big deal.” We designed a contraption: suction cups to go up and hook onto a tile and pull on it with a load that we thought was sufficient to prove that we had a good bond on the tile. John Yardley says, “I got a question for you guys. When you pull on that tile how do you know you didn’t decrease the strength, and you damaged it more so it’s not going to be as strong now as it was before you pulled on it?”

Said, “Good question.” We developed a way to put microphones on the tile when we pulled on them. We did a bunch of tests one weekend. We found out how much noise a tile could make when you pulled on it to know that it was okay. If it made too much noise when you pulled on it, it meant you were causing too many failures. We developed this criterion and we proof loaded tiles where we had to. Other tiles, [that we did not proof load], we could say, “Even if it only has half the bonding strength, we’re okay [for re-entry].”

We had to go through a combination of pull tests and analysis over all 25,000 tiles at the flight readiness review. I stood up [at the STS-1 flight readiness review] there, and went through the logic of why all the tiles were okay. Lo and behold, they were okay. We lost seven tiles on the first flight. It was in a noncritical area, it was on the OMS [Orbital Maneuvering System] pod. I was at the Cape on the first flight. When we got on orbit, we saw those tiles were off. I got in a Learjet and came back to Houston, and we analyzed it. We said, “We’re okay.” It was okay.

We expected to take off and remove a lot of tiles around each flight. I don’t think to this day they remove very many at all. They’re extremely fragile material. The tiles are a good system; they have the required integrity. I’ve said here are all the environments it’s good for: airloads, vibration, all this kind of thing. The thing the tiles are not designed for, then or to this day, is any kind of impact on the tiles. You can’t fly the vehicle through rain. It’ll penetrate and go right into the tile. It won’t make it come off, but it’ll ruin the glass coating on it. It cannot withstand foam coming off the tank.

What we had to do, between ’78 and ’81, we had to prove the integrity of all those tiles, that they would stay on the vehicle. I’m not throwing stones, but I am going to throw stones a little bit. The external tank, to this day, can’t ensure the integrity of the thermal protection system on it. The tile is not designed and cannot accommodate, was not designed for [foam loss]. Now what the program has done, it’s done a great job. It understands where the critical areas are. They beefed up the external tank insulation thermal protection system so that they know it’s stronger in critical areas. They also know that the tiles can withstand an impact of a certain size. It breaks the coating. There’s been enough analysis done to say, “You may hurt the structure a little bit but you’re not going to lose the tile. You’re not going to let plasma blow through the vehicle.”

It’s having to go along on crutches on every flight. Looking and inspecting the vehicle to really make sure that this flight debris from the external tank and anything else is not impacting the tiles. The tiles in themselves were designed to exactly what they’re doing. They’ve performed well. That was a huge huge challenge for us to be able to pull that off in the last few years.

Wright: We were talking, wanted to get you to clarify for us. When you did the testing on the tiles with the suction cup contraption as you mentioned, each one of those 25,000, you tested every tile that was on there?

Moser: No. No. We checked most of them. The critical ones we checked. Some of them we convinced ourselves that even without the full bond integrity we were okay for flight. We didn’t proof load every single tile. Others we analyzed, if there was a problem that they would crack. Others we analyzed, if we lost a tile we wouldn’t lose the vehicle, that we may damage the structure. Some of them you just like couldn’t get the proof test device on. We didn’t proof load every 25,000. We proof loaded a lot of them.

Wright: Did you do the test again after STS-1? Was every it mission?

Moser: We did random testing after that. We would select different areas of the vehicle and we would just proof load them to see. Some of them we’d even pull tiles off and look at them and check them. To this day they don’t proof test anymore. I think they’ve gained enough confidence and all in the process that the process is reliable. There was a question about reliability of the process. Since we had to remove so many tiles and put them back on, and it was a new process, we just didn’t have the learning curve to have the confidence.

Johnson: Those ones that you determined you didn’t need to do the tests on, was that because of the position on the vehicle itself?

Moser: Yes. Right. It was in an area where the temperature was not that critical if we lost a tile like we did on the first flight. We lost some tiles on the front edge of the OMS pod. It didn’t cause any damage whatsoever. In those areas we convinced ourselves that we were okay. It could have been a reusability issue. We may have had to repair some structure if that happened, but we weren’t going to lose the vehicle so we said we’re okay for first flight.

Let me add something to that. [I] talked about the conservation of complexity. In the Shuttle Program it was, as I think said earlier about ’75, the program was threatened to be canceled. [Richard M.] Nixon was the President. He was not very supportive of the program, so we were having to scurry and we were having to replan the schedule every year. We were having to replan testing. We wouldn’t compromise safety. We had to replan. A lot of the testing I talked about that we changed was because of that. Until we had the Approach and Landing Test off the back of the 747, which was in ’[77], the public got to see it, the Congress got to see it, and they said, “Wow, this is an impressive machine!” We visibly could see something so that all of a sudden, now the deal was—I’ll say it like John Yardley said. “Get the son of a bitch in space. Get that thing in space, or we’re going to lose the program.”

We did things rapidly. We didn’t compromise safety, but we didn’t have time to proof load all the tiles, didn’t necessarily have to, but we knew we could maybe cause a little bit of structural damage but [it was] not a safety issue. We did that to expedite getting the vehicle in space. Once we got it in space then we reached another visible milestone that had some awe associated with it.

Fast forward to the Space Station, one of the problems with the Space Station, we didn’t have any awe events. Apollo—look at all the Apollo events that we had: rockets lifting off frequently, a lot of flights, a lot of test flights. The public could see a lot of things. There could be a lot of accomplishments. If you don’t have the awe events in a government program you’re going to lose it.

Wright: I guess Hubble [Space Telescope] would be a good example of that as well.

Moser: Right. Exactly. Exactly. The Constellation program, that’s a problem that it has. It’s not going to have the awe. If the Constellation program continues and returns people to the Moon, it’s not going to have the same awe. We’ll never have that awe again, period. It’s gone. Our lifetimes, we’re not going to see another awe like that. Even if we land on Mars, it’s not going to be like the same awe as landing on the Moon, but you have to have those. It’s part of the PR [Public Relations]. It’s part of the selling. You got to continuously sell to keep a government program alive like that. The government is the only thing that can afford to have a program like that. Stockholders aren’t going to do this. There’s not money.

Wright: Speaking of the Approach and Landing Test, were you able to be there for those tests?

Moser: I was. I was at the Approach and Landing Tests and the first flight.

Wright: Got to see your structure in action.

Moser: [I] did. It wasn’t much of a structural load for us, but it was a demonstration. Let me add one other thing about the Shuttle Program, and then I’ll get off of that. The challenges that I talked about, there was innovative, the creativity, and things like that that made it successful, but the thing that made it happen was we had the same team on the program from start to finish.

Wright: Wow, that’s remarkable.

Moser: That says a lot. All of the key people were in the program from day one all the way through. The Bob Thompsons, the Aaron Cohens, the John Yardleys, the J. R. Thompsons, Bob Rieds. All the guys stayed on that program from start to finish. It was that relationship that everybody had and the knowledge and the confidence that everybody had in one another that enabled it to happen.

This is a picture of something called the ham and eggs society. This is Alan [M.] Lovelace right here. [Shows photo] He was the Deputy Administrator at the time. He said, “There’s an old story about what makes the successful breakfast is ham and eggs. The chicken participates by providing the egg. The pig commits. You guys committed to this program in personal sacrifice and a lot of other things so I’m forming this ham and eggs society.” That’s a picture of us at the Cape after the first launch down on the beach. We tried to have a reunion last year of the ham and eggs society, and it didn’t happen because the flight got canceled. We may try and do it on the last Shuttle launch.

Wright: That’d be great.

Moser: Some of the guys are no longer there. They’ve gone. Some of them can’t travel. I’m not getting old, but some of the other guys are.

Wright: That’s good to know that you know that.

Moser: We’re able to stay in touch. We contacted everybody there except one person. We never could find one person that was there. Another thing that was not having anything to do, but that was the personal experience. That ham and eggs society was critical.

Wright: What a great name for that.

[Break in audio]

Moser: Joe [Joseph P.] Allen is the only [person] that has that. [Shows photo]

Wright: Have that special photo?

Moser: Have that special graphic.

Wright: Knowing Joe, he probably got a kick out of that.

Moser: Oh, there’s some of the artists. Some of the early sketches, saying, “Well what do you want us to do?” That capped off my Shuttle experience until I was sitting in mission control, sitting right up between Chris Kraft and Aaron Cohen when Challenger [STS 51-L] happened. Within a day, we knew what it was. We had enough evidence that we knew it was the solid rocket motors that had caused the problem. I led the internal investigation of it for the first week or so, and then it got out of hand and got into the politics and got outside people involved. It took us two years or something like that to fly again. Back to the Apollo fire, completely redesigned the spacecraft and was flying in eight months. Conservation of complexity.

Wright: Would you like to try to stop here at this point so that we pick up at [another time].

Moser: I’m just looking at my notes. I need to think about some other things.

Wright: Okay.

Moser: Okay. Would this be a good place?

Wright: I think so. I think so.

[End of interview]

Follow this link to view all the photos in Thomas L. Moser's photo gallery.

Return to JSC Oral History Website

Curator: JSC Web Team | Responsible NASA Official: Lynnette Madison | Updated 7/16/2010
Privacy Policy and Important Notices