NASA Johnson Space Center
Oral History Project
Edited Oral History Transcript
Interviewed by Rebecca Wright
The Woodlands, Texas – 9 April 2010
photographs were provided by the NASA JSC Imagery Repository and Tom
Moser. [Photo Gallery]
Today is April 9th, 2010. This oral history interview with Thomas Moser
is being conducted for the NASA Johnson Space Center Oral History Project
in The Woodlands, Texas. Interviewer is Rebecca Wright, assisted by
Sandra Johnson. We want to thank you again for taking time out of your
schedule today to visit with us. We’d like for you to start by
sharing with us how you first became employed with the Manned Spacecraft
Center in 1963.
Moser: In 1963,
I—a native Houstonian—[went] to New Jersey to work for RCA
Missile and Surface Radar Division, believe it or not, kind of like
Aaron Cohen. Aaron Cohen and I followed along the same paths to a large
extent. He worked for RCA also. When I saw the manned spacecraft program
coming to Houston, I thought boy, that’s a good opportunity to
get back to Texas [in a career that should last for a long time;] so
I applied and came down to Houston when there was nothing but cow pastures
and [a few] other things [in Clear Lake (NASA-area suburb of Houston)].
In 1963 I was there as a mechanical design engineer.
Wright: Talk to
us about some of the first tasks that you had and how that then evolved,
because we know at a later point you became [director of engineering].
So share with us how your job progressed into that and all the things
that you were able to learn to apply to your job.
Let me just give you a 10,000-foot overview. Started off as a mechanical
design engineer out at Ellington Air Force Base [Texas], where we were
positioned at that time, on the Apollo Program. [One] of the first things
that I worked on was a launch escape system [for] the Apollo [Command
Module]. I’ll talk in detail about that, but let me just say in
my career path being a mechanical design engineer and then getting into
the structures area—let me back up. On the Apollo Program, I was
a subsystem manager for the Apollo Command Module structure and launch
escape system. Stayed on that and later became head of structural design
in the Structures and Mechanics Division that was the beginning of the
Stayed on the Space Shuttle from sketchpad to launch pad. Then had the
opportunity to be Chris [Christopher C.] Kraft’s horseholder,
so that led to a lot of good experiences. Then became the director of
engineering. From the director of engineering, I went to Washington,
DC as the Deputy Associate Administrator for the Office of Space Flight,
[and later became the deputy Associate Administrator. And program director
for the Space Station]. Stayed there until I retired and went into the
private sector. That’s the 10,000-foot view of my career path
Wright: Just sounds
so easy, didn’t it?
Moser: That was
over a 25-year period.
Wright: Quite a
bit of change in spacecraft development during those 25 years. If you
could take us back to those days when you were helping to develop the
structures for and those early thermal protection systems within the
Apollo Program, and then how that helped you as you moved into the Shuttle
Moser: In the Apollo
Program, that was a unique spacecraft in itself. There was a lot of
things that we were doing in mechanical systems design, in structural
analysis. From determining the landing characteristics of the Lunar Module, of which I was involved in a one-tenth-scale drop test out in
Building 13, where we were learning the dynamics and stability of the
Lunar Module. That helped us determine the landing loads and the characteristics
that had to be designed into the Lunar Module landing gear itself.
In the Apollo Command Module, the drop test in the water helped us determine
what the impact loads were. We sank a few Command Modules in doing that,
because that’s a rather complex loading environment.
Then there was another thing early in Apollo that was very interesting.
We found that in a dynamic sense, [during] an abort, the Command Module
would come back with the nose of the Command Module toward Earth. It
would not turn around. The parachutes were in the [nose of the] Command Module. The parachutes could not be deployed, so the Command Module
had to be turned around so the heat shield was coming back toward Earth
first as opposed to the nose cone, if I’m making myself clear
Wright: Yes you
Moser: Be sure
and interrupt me if I’m not being clear. When the launch escape
system pulls the Command Module away from [a malfunctioning or] exploding
rocket, we had to flip the Command Module around. A little known fact
is that there’s something on the launch escape system called canards.
Let me show you a sketch of that if I may. This may be more detail than
you want. There’s one particular thing I’m looking for in
here, and I don’t see it.
Wright: Here it
is right here. Is that it?
Yes, still not quite it. Here’s an old picture showing the launch
escape tower pulling the Command Module away from the rocket. This is
it prior to launch. [Shows photo] Once
it comes out, the canards, which is a set of wings on the end of the
launch escape tower, causes the Command Module to flip over and then
you jettison the launch escape tower.
What was interesting about this early on, is we said, “We’ve
got this stability problem; we’ve got to figure out how to fix
it.” We in the mechanical design group came up with this idea
of splitting the forward end of the launch escape tower [skin] to make
[a set of] wings, and when the wings came out it caused the whole thing
to flip over. The prime contractor, Rockwell—North American at
that time—said, “It’s going to cost a kazillion dollars
to do that.” Max [Maxime A.] Faget said, “I’ll do
it in my garage.”
His garage was our facility. We built this set of canards. Here’s
the forward end of the launch escape tower. [Shows
photo] This splits. The skin splits, opens up like this photograph.
I’ll give these photographs to you. That causes the wings to come
out, and flips the whole thing around.
The message here was we were doing it hands-on. NASA in its history
is proven to be a really smart buyer [because we did a lot of hands-on
engineering]. We could do the engineering and things that we needed
to do in house. We didn’t have the production capability to build
a production spacecraft, but we could build the prototypes and we could
build the development articles. The story of this launch escape tower
and the canards were we could do it in house. We did it in house.
My first job was working on this mechanical design with a couple of
other engineers, Clarence Wesselski being one of them. He was a mechanical
designer also. The first Thanksgiving I worked for NASA Johnson Space
Center, Manned Spacecraft Center at that time, I spent Thanksgiving
at Langley Research Center [Hampton, Virginia] in the 16-foot tunnel
doing a deployment [test of a full-scale set of canards].
Wright: That must
have been a great experience.
Moser: It was a
great experience. It was, “We can do it.” That was the attitude.
We did it, and we proved it. Well, after that, then it was time to turn
it over to the prime contractor. They said, “Voila, it’s
really not going to cost quite as much as you said. We understand it.”
It was that attitude, that philosophy, that ability to design it, and
build it in house ourselves, which I think is so important in the whole
NASA philosophy and the way that they work.
Some of that has been lost. I think it’s coming back now though.
That was the perfect example of, “We can do it.” Then we’d
hand it over to the prime contractor, then they made it into flight
hardware. [The canards were never needed] in the Apollo Program [because
the launch escape system was not needed]. We tested it at White Sands
[Test Facility, Las Cruces, New Mexico]. We proved that it could be
done off a Little Joe rocket. That was one of my first experiences in
That got me started. That got my appetite going. “Voila, this
is going to be really good. It’s not only doing hands-on work,
mechanical systems and design, it’s real part of the program.
It’s making a real impact on this thing.” Junior engineers,
like I was at that time, could have and did have a big impact.
Wright: I was looking
at the date on the Roundup and maybe this is like within a year you’re
there. So you were busy during that first [year].
Moser: Right. From
five months of when I got there, I was in the wind tunnels at Langley
Research Center with a full-scale model and four or five other engineers
from JSC. We designed and built that thing.
You want me to just stay on Apollo? Or do we want to discuss Shuttle?
you feel comfortable. If you want to do them as a parallel to help explain
the contrast and the comparing, you can, and if we repeat somewhere
down the line that’s okay. It’ll be reinforcement.
Let’s just stay on Apollo. We’ll do it chronologically.
Another interesting area of my experience in Apollo was in the docking
system between the Command Module and the Lunar Module. It was a docking
system that was a probe and a drogue, voila, like this. [Shows
image] The Command Module puts the probe into the cone of the Lunar Module, and it had to accommodate misalignments, relative velocities
between the two vehicles as they’re rendezvousing and docking
in space. What we had to do was not only design that system, along with
North American, but we had to prove on Earth that it worked in space.
We didn’t have a capability to have a six degree of freedom simulator.
We started with saying, “Let’s figure out how we can make
these docking systems work.” We did it on an ice rink in the south
part of Houston. We had air bearings on the ice. We slid around so that
was giving us the two-dimensional characteristics of this docking system.
Then we went and said, “We’ve got to have all six degrees
of freedom. We have to move horizontally both directions in and out;
we have to rotate about all three axes. So that’s six degrees
of freedom. How are we going to do that?”
We made a simulator in Building 13. The only computer that could handle
this was over in mission control area, so we had to run hard wires between
Building 13 where our simulator was, our six degree of freedom simulator
with the probe and the drogue attached to it, over to the Mission Control
Center, the computers over there. The way it worked is that we had sensors
[that detected the load], as we brought the probe and the drogue together
on moving axes. As soon as they touched, [the computer would determine
the motion of the CM [Command Module] and LM [Lunar Module] and drive
the simulator accordingly]. The probe and drogue were the real flight
hardware. The probe and drogue thought that it was connected to a Command
Module, and to a Lunar Module, but it was really being simulated by
virtue of the analysis in the computer and the motion device [of the
We were [testing] late one Friday evening, I remember. It was probably
midnight or something like that. We could not get [a good] signal to
go between Building 13 and mission control. Somebody was running a vacuum
cleaner in [the test area and generating electric noise]. This showed
how antiquated we were—running hard lines through the tunnels
underneath between buildings at the Johnson Space Center and doing this
We finally got it to work though. We certified that hardware [probe
and drogue] for space in Building 13, all degrees of freedom. Said,
“Voila, that will take care of it.” Again, a hands-on kind
of thing that we were able to do at NASA then [as] young engineers that
was very important.
Wright: Again exemplifying
the “We-can-do-it attitude.” You just found a way to make
Moser: We did.
Yes, we found a way to make that work. There was something else I was
going to talk about in Apollo. Let me tell you one other thing about
the Apollo Program, a personal experience. I’ve written it up
for you here. It’s the history of the first flag on the Moon.
I was sitting at my desk, and the division chief came in to me, shortly
before the first lunar landing, Apollo 11.
He said, “I’m going to give you an assignment, but you can’t
talk to anybody about it. Congress has said we’re putting a United
States flag on the Moon. It is against United Nations treaties to do
that but we’re going to do it. Congress wants us to do it so you
have to work with Tech Services to design a flag. It cannot go in the
Command Module. There’s no room for it. It cannot go in the Lunar Module. There’s no room for it. It has to go to the lunar surface.
The astronauts have to be able to get to it very easily. Figure out
where it goes, how the astronauts can get to it, and tell them how far
away from the Lunar Module to put it so that it doesn’t burn up
during liftoff and it doesn’t blow over during liftoff [from the
lunar surface]. You have to tell them how far to stick it into the [lunar]
I said, “Yea verily we can do that.” In a matter of a couple
weeks, we designed the flag so it telescoped. We attached it on the
Lunar Module ladder, so when Neil [A.] Armstrong and Buzz Aldrin came
down they could very easily reach over and grab the stowed flag and
deploy it. There was a point of my life that almost caused me to have
a heart attack. That was when—let me see if I can find this real
quickly for you. Should have gotten all these organized. There was the
picture I was looking for earlier.
Wright: The story
of my life.
Moser: Not being
allowed to talk with anybody about this, I did all the stress analysis,
did the testing, and said we’re going to attach it on the side
of the ladder. I did this analysis, said it was safe for the flag to
be attached to the landing gear, and it wouldn’t break the ladder.
No one looked at my analysis, which deviated from [standard procedures].
That couldn’t happen today at all.
Neil Armstrong comes down the ladder, and you don’t know, but
I do. When he got to the last rung on the ladder, he jumped off. What
went through my mind was the ladder broke, the sharp edge got his space
suit, put a hole in the space suit, and the whole lunar program was
over. That could have literally happened, but it didn’t. We all
know that it came out okay. That was episode number one.
Episode number two was when they got ready to deploy the flag, the telescoping
rod that holds the flag out at the top wouldn’t release all the
way. The shop had put the wrong coating on the telescoping rod. Something
caused it to bind or to gall and therefore the flag wouldn’t extend
all the way. Therefore it looks like the flag is waving in the breeze.
An error—no one knows that we did that. We put the wrong coating
on [so] it didn’t extend all the way. What we did on all subsequent
flights, [was] we made that rod shorter so that all flags would look
the same as the Apollo 11 flag. So when people say, “Yes, this
is all a farce, because we know there’s no atmosphere on the Moon.
The flag appears to be waving. Therefore you guys at NASA are just lying
to us, you did all this in a laboratory [or] somewhere in a hangar.”
That is the story of [the waving flag]. Here’s a young engineer
who [was told], “Here go design this [looking
at a photo], stick it on there, put it in a T-38, fly it to the
Cape [Canaveral, Florida], show the astronauts where it’s going
to attach, and how to deploy it.” Lo and behold, they did it.
Wright: Must have
been an interesting analysis for you to figure out how far away from
the spacecraft, all of those things that had never been done before.
You’re working with pure theory.
Moser: What we
did was figure it out as best we could, or I did. Nobody else saw the
analysis. Put a little red piece of tape around far from the bottom
of the flagstaff, and says, “Put it in the lunar soil this deep;
no deeper than that.” We had two little red [pieces of tape] on
there. You go to the Smithsonian [Air and Space Museum, Washington,
DC] you can see the same little pieces of tape on the bottom of the
mast that show the same thing. I’ve documented this for you. I’ll
give it to you. There’s part of it I’m going to tear off
because there’s some [information on] artifacts there that I’d
as soon not [share].
Wright: Where were
you when Neil Armstrong came down that ladder?
Moser: With my
family. I was not in mission control. I was watching it with my family.
Wright: Did you
tell them then what you had done?
Yes I did. I told them immediately, because I was about to pass out.
There’s the flag. [Shows photo] We did a vibration test on the
flag. Here we are packing the flag over in Tech Services. [Shows photo]
That’s the Apollo 11 flag. There it is on the Moon. [Shows
photo] This is the way it looked when we bundled it up and put it
in. It also had to be protected during the heat from the Lunar Module
engines during landing so that it could not overheat. We had to put
a thermal protection system around the flag when we hung it on the ladder.
Wright: It not
only worked here, it worked for the rest of the flights as well.
Moser: It worked
for the rest of the flights too.
Wright: Were there
any changes made to your design?
Moser: No. Just
we shortened that one tube so that they would all look like they were
waving in the breeze.
Wright: Wow. What
a great legacy.
Moser: Well, it
was kind of fun.
Wright: You mentioned
a couple of areas that you worked with. First you had escape launch.
Were there other areas on the structure and/or the thermal systems that
you worked with as well that you’d like to share with us?
Moser: Well, let’s
see. When I got on it [Apollo Program], the Command Module was pretty
well designed. I think the biggest thing was after the fire on the pad.
They had to completely redesign the Command Module. That’s captured
in your history I’m sure. How fast that that was done and getting
back to flight [was amazing]. That was such a short period and was such
an intense period of completely redesigning the interior of the spacecraft,
eliminating a lot of materials, changing the hatch so it opened outward
rather than inward. A huge effort. That was something that was done
[quickly as well].
It couldn’t be done today. You could not do that kind of redesign
without having so many checks and balances in the system. It would take
years to do it. I think we did it, what, in eight months or something
like that, from complete redesign to flying again. That was, I think,
indicative of [the] “can do, will do, and allowed to-do”
environment that existed then.
Wright: You were
working toward that goal of putting a man on the Moon and safely returning
him home before the end of the decade. Was there a lot of pressure to
move [quickly and], everyone moving toward that?
Moser: A tremendous
pressure. That’s the difference. I’m going to deviate a
little bit now. It’s the difference between Apollo and Shuttle
and Space Station and Constellation. In Apollo, it was go there, get
it done, schedule is essential, and is the primary objective. Safety,
of course, was the first thing. Make it work and make it safe, but do
it quickly. With time being of the essence, money was not that big an
issue for us. Political support was not an issue at all. I developed
something called the “conservation of complexity.”
Wright: I like
Moser: Apollo Program
was very very complex technically. Now let’s move forward to the
next program. Let’s move to the Space Shuttle Program. Let me
just even put Skylab aside for a second; let’s just move to the
Shuttle. The Shuttle was technically complex: the thermal protection
system, the advanced materials, the guidance and control system, and
the propulsion system. Those were major technologies that had to be
[advanced]. They weren’t nearly as large as the Apollo Program,
but the political system was more complex. The Shuttle Program was almost
canceled like about 1975 or so, because there wasn’t the strong
support from the White House. There wasn’t the strong support
from Congress. We weren’t [making] a lot of [visible] progress,
so the public didn’t have the [enthusiasm].
All of a sudden we now have a less complex technical program, but we
have a more complex political program. All of a sudden we have still
the same [combined] level of complexity between technical and political.
Now let’s go one step further, let’s go to Space Station
Technically the Space Station Program is not complex at all. The assembly,
the operations is very complex, but there’s no technology developed
for the Space Station Program. The political complexity is huge, therefore
we have our conservation of complexity program: technically simple,
politically extremely difficult.
Constellation Program, now we’re getting a little bit more into
a few technical problems, not really. A lot of it is the same thing,
redoing some of Apollo using some advanced tools. Political complexity
[is] gigantic. The lack of support by the White House for the Constellation
Program, “Let’s cancel it.” You can see how this whole
thing has evolved from full support, huge technical complexity, to no
technical complexity but no political support.
When I talk to young NASA managers, [as] part of the mentor program,
I try to say, “Look, this is the real world. You’re going
to have to deal with that, figure out how to deal with it. We had to
replan the Shuttle Program almost every single year because the budget
was never there.” I’ll give you some specifics, what we
had to do to accommodate and to make that Shuttle Program work.
I was the first program director on the Space Station Program for design
and development. Hugely complex [politically] but I was of the bent
that I wasn’t going to change the configuration. I stayed on the
program for a couple years, then I retired from NASA. It changed hugely
after that. The Russians were not part of it when I was there. The Russians
came on, completely changed the objectives of some of the [missions]
that were there and how it was to be performed. It’s just a fluid
environment. It’s a much much much tougher environment for NASA
engineers and for the industry to accomplish a program today than it
was even during Apollo. Not technically, but frustratingwise; frustration
level is much more complex.
Wright: Thank you
if I may, move into the Shuttle Program now.
Wright: When did
you first hear about the concept of the Shuttle Program?
see. I started working on the Shuttle Program in 1969. We were doing
a sketch a day of what the configuration should look like.
Wright: Were you
part of Max Faget’s [group]?
Moser: I was not
in the building where the team was, but I was back over in Building
13 doing the work there. I think Tom [C. Thomas] Modlin was the guy
that we had over there. He was [one] of the structures guys. I was not
part of Max’s team over there but still involved. It’s like
mission control. There’s all kinds of people in the background
supporting it. I was back over in Building 13 supporting that effort.
The way I summarize my experience in the Shuttle Program is “sketchpad
to launch pad.” It was a fantastic experience of being able to
see something through every phase of the program, from start to finish.
That is so important for the nation, so important for any engineer,
so important for any aerospace professional, or any professional, to
see something from beginning to the end, because every single phase
is different. The last few years of the Shuttle Program, I didn’t
tell anybody, but I would have worked on it for free, because I was
going to see it to completion.
Wright: You don’t
want them to give your salary back, right? Hang on to that.
Moser: I had to
feed my family, so probably really wouldn’t have done that. I
started off in the Shuttle Program when I was a subsystem manager for
the Orbiter structure. I had the full responsibility for all of the
structural integrity of the Orbiter and then later became head of structural
design. Now I was wearing two hats, I had my organizational hat of being
the section head and my program responsibility for the development of
the Shuttle—the Orbiter structure. That was a challenge, a lot.
The way we had it organized, when I was the head of structural design,
I had a person that was the subsystem manager for the forward fuselage
and crew module, then another person for the wings and the tail, and
another person for the mid fuselage and aft fuselage. That’s the
way we organizationally broke it up.
The Shuttle, as I mentioned before, was technically challenging because
the thermal protection system was something that had to be developed.
The main propulsion system was brand-new. The avionics was brand-new.
We didn’t have those technologies at the start of the program.
In the Orbiter, we knew we were going to have a weight issue, because
all aircraft and any spacecraft, as it evolves, has a weight problem
so you have to start with a fairly large margin in your hip pocket.
Like 20 percent at the very beginning of the program is what you’d like
to have in a weight margin, and we didn’t have it. We knew that
we had a problem.
The first thing we did is we established a design criteria, and we deviated
from what [is done for] an aircraft. Let me talk in the factor of safety:
that is whatever the maximum expected loads you can see on an aircraft,
it [must] withstand 50 percent more load before it fails. [The structure] has
to be able to demonstrate that. We said, “Let’s back off
instead of having a 1.5 factor of safety let’s back it off to
1.4 factor of safety.” That was our first thing we deviated from
what was normal in the industry at that time.
We said, “Also in lots of aircraft they have a factor on when
the material begins to yield. Let’s think about that. We don’t
really care if the material yields a little bit, as long as it doesn’t
preclude the operation of a mechanism or something of that sort, [or]
causes some interference. We can inspect it. If it yields a little bit
but doesn’t fail and it’s okay to fly, let’s don’t
artificially put a factor of safety on yield,” which typically
puts about a 10 percent factor on any aircraft, says we don’t want it
to yield. So we said, “No, we’re going to be a little bit
more bold than that. We’re going to say no factor on yield. All
we want it to do was to be strong enough.”
Then we realized that there was something that we learned in Apollo,
and that was fracture mechanics. Let me just say there’s multiple
ways a piece of structure can fail. If you just pull on a piece of metal,
first thing it does is it yields. We said, “We don’t care
about that as long as it doesn’t preclude operation.” The
next thing it can do is it can rupture because you just exceed the ultimate
strength capability of it. Or instead of doing that, you can put a cyclic
load on it, and it can fail during fatigue. We had to have a factor
We didn’t think fatigue was an issue with the Shuttle because
it didn’t have that many flights. Each one of [the Orbiters] was
designed to fly 100 times, so we said, “That’s probably
not going to be an issue. We’re not going to let that drive the
weight. We’ll check it and make sure it’s okay, but we’re
not going to let that be a criteria by which we add weight to the vehicle.”
The other thing was fracture mechanics. That’s the fourth way
something can fail is that if a crack occurs and, depending on the type
of material, it can reach a crack length where it just lets go, and
it grows very rapidly. We had to consider what fracture mechanics meant
to us. We had to check all of those things, but we made them as minimum
margin as we could and know that we were safe.
We were evaluated by the aerospace industry, by engineers from Boeing
and Lockheed and other aircraft [manufacturers]. The Chief Engineer
at NASA, Walt Williams, said, “I’m going to have you guys
checked out here, make sure you really know what you’re doing.”
Lo and behold, we got past that. They said, “We think you’re
stretching a little bit but that’s okay.”
That was the design criteria. We said we’re going to be bold and
aggressive on this thing, so we were. It worked out for us.
Wright: Let me
ask you, if you don’t mind, could you provide a little more background.
They said you were stretching it but it was okay, but why was it okay?
What was your main reason to move it back?
Moser: Well, the
main reason to move it back is for weight. Let me back up one. In the
design of a structure you design it to what you think is the maximum
reasonable load the structure will see, and that’s called limit
load: that you can literally anticipate seeing that in a flight. You
probably won’t, but you could. You have to say, “I’m
going to withstand that.” Now let’s say that that takes
a tenth of an inch of material to withstand the limit load. Say, “Well,
I want to be safe, so I’m going to put a factor of safety on top
of that.” If it’s a one and a half factor of safety instead
of being a tenth of an inch it’d be 0.15 inches. We said, “We’re
not going to do that; we’re going to make it 0.14 inches.”
Well, that’s weight so therefore when you take it over this entire
vehicle that’s a lot of weight. We said, “We’re going
to take the risk. We think we understand what this is. We don’t
think fatigue is an issue; we don’t have to have a lot of material
in there for cyclical load. We think we’re okay.”
We came under a lot of criticism and a lot of scrutiny for doing it.
We didn’t get to just do it because we wanted to, but we were
doing it for weight. I want to add something right there. John [F.]
Yardley was the Associate Administrator all during the Shuttle development.
John Yardley, when he was a young engineer, was a stress engineer. John
Yardley later became the program manager at McDonnell Douglas of the
F-4 aircraft. As a program manager, he knew that he was going to have
a weight issue with the F-4 aircraft so he made all of the stress engineers
design so that it would not reach the ultimate load.
He said, “I want you to show me, by analysis, it’s going
to fail 10 percent before you reach that ultimate load.” He knew that
they would probably be conservative, but he had a test article which
he was going to prove that he was right. If he was wrong, then it cost
him his job, and it cost the company a lot of money. Well, lo and behold,
it was right so John Yardley supported us in what we were doing. It
was absolutely fantastic to have a person at the very top of the program
that could relate to what we were doing in the structural design, so
we took that same attitude. We’re going to do it that same way.
We’re going to stretch it. Lo and behold, it paid off, but we
had to prove it with ground test. I’ll get into the ground test
a little bit in a minute.
Let me talk a little bit more about the design criteria on the structure.
Most systems in the Orbiter and the whole Shuttle Program, they have
a criteria by which they’re designed. First failure, it’s
still operational. Second failure, it’s still operational. Third
failure, it’s still safe. An analogy is there are three computers.
Lose one computer, keep on operating, lose two computers, you keep on
operating. Then you’re down to fail safe. You come home, but you
stop after you lose the first computer, that’s the flight rules.
In the structure that’s not the case. There’s no fail operational/fail
operational/fail safe. It is a safe-life design. It means if you have
a piece of structure that has to carry the load and that structure fails,
the structure fails. It doesn’t have an alternate load path. Now
some aircraft are designed so that you can have multiple load paths,
but that added weight so we said, “We’re not going to do
that. We’re going to have a safe-life design.” That’s
exactly the way we did it so that we were not adding any weight in the
beginning, because once you add weight to a vehicle it’s very
very expensive and difficult to get it out. We took the hit right at
the beginning. We’re going to be less conservative than that.
So that’s in a simple explanation our philosophy, and our criteria
for designing the structure. Then we looked at this thing called an
Orbiter. We said, “Wow! Thermal conditions are going to be big
on this.” The vehicle goes from an ambient condition, [while]
it’s sitting on the launch pad, it heats up a little bit during
ascent, it heats up on orbit, one side is hot, one side is cold. We
had to take that into consideration. Coming back in it gets really hot
in various places.
It’s not so much the maximum temperature we had to account for.
We had to account for temperature differential. Let me give you an example.
When we were looking at thermal protection systems in the Shuttle, we
looked at a metallic system. We had something that’s called Haynes
188 that could withstand 1,800 degrees [Fahrenheit]. We said, “Let’s
test that.” We tested it, and we heated the panel to 1,800 degrees
in the middle, but where the panel was attached around the edge so it
could move in a frame, it was 40 degrees cooler, because the heat was
sinking into the attached structure. It was 1,800 degrees, so it was
1,760 degrees on the edge. That difference where the metal was trying
to expand to 1,800 degrees versus 1,760 degrees caused it to buckle.
When it buckled, in a plasma test, it let the hot gases flow [into]
this little buckle. [This would have been catastrophic.] My point is
thermal gradients were a huge issue for us.
We had to pay a lot of attention even though we didn’t use those
panels. I just used it as an example. We said, “What are we going
to do in Orbiter design to accommodate for temperature differentials?”
There may not be any load at all on the structure, but all of this trying
to expand and contract and hold it together induces huge stresses. We
said, “Let’s get smart in what we’re doing in the
Shuttle design. Let’s talk to the people that designed and built
the SR-71, the ‘Blackbird.’” That is an airplane that
was all titanium. A couple of us went out to the [Lockheed] Skunk Works,
and we spent the day out there. We said, “Look, we’ve got
these thermal gradient concerns. What did you guys do, and how did you
What they did was they designed the wing structure, for example, so
that when the wing bends the skin doesn’t carry the load. It’s
all of the beams, the spars, if you will, in the wing, carrying the
wing bending loads, because they didn’t want to deal with that
expansion and contraction and the thermal stress in the wing, because
they said “We don’t know how to do that.” They probably
didn’t when they designed and built the SR-71 so they let all
the skin float. We said, “Okay we got it; we understand what you
We put that in our database. Then we went and talked to the people that
designed and built the Concorde, the supersonic aircraft. Went over
to England and talked to them. Said, “What did you guys do,”
because they didn’t have a real high temperature, but they had
again a thermal gradient issue, which was causing large stress in parts
of the aircraft. It was because of the way they were having to move
fuel around, cold fuel being moved from one section to the other. All
of a sudden the skin or the structure is hot. Now you bring the cold
fuel in, and that part of the structure wants to shrink and can’t,
so that’s inducing a lot of stress. They said, “What we
did is we designed it so that we had stress relief. We built in cracks
if you will, expansion joints. Every place we built in an expansion
joint we created a problem.” We says, “Got you.”
What we decided to do, after talking to the SR-71 people, after talking
to the Concorde people, we said, “To hell with it.” We’re
going to just take this thermal stress head on. We’re going to
have to understand the temperature distribution. We’re going to
have to combine that thermally induced stress with whatever the flight
load stress is on the vehicle, whether it’s launch, landing, whatever.
We have to superimpose those. We took it head on, and we did that.
The other challenge that we had was when we were doing our analysis,
the analytical tools we had at the time were called finite element models.
It’s the way you idealize the structure with mathematical simulation
of the structure. We could put the mechanical load on our finite element
models, but we couldn’t with the same model put the temperature
gradients. The computing capability didn’t exist.
We had to do this, complement the two. We said, “Okay, we can
do that.” We did it, representative all over the vehicle. We thought
that we had it designed safely to do that. Then that gets us into okay,
we’ve got the vehicle designed and built, now we’re going
to have to test it.
I’m going to back up for just a second now. When we started the
Shuttle Program money was an issue but it wasn’t as big an issue
as it became later in the program. When we started the Shuttle Program
for structural integrity of the Orbiter, we had two fully dedicated
airframes, which is the same way that the industry did, the large jet
airplane industry. They have one for static test where they applied
the maximum expected load plus 50 percent more, showed that the airframe would
take it. That’s called a static test article. They had another
one called the fatigue test article. That’s where you let the
wings flap and the landing [loads] impact the body of the fuselage,
etc. That was a fatigue test article. We said, “We’re going
to need that in the Shuttle program,” so when we started the program
we had two airframes, [one for] the static test and [one for the] fatigue
We got into the program, and within about the first year or two the
program had a $100 million problem. So we said, “What can we do
differently.” What we did differently was we said, “We don’t
need the fatigue test article, because we don’t think we can accurately
simulate that, and we don’t think it’s an issue anyway.”
That had been gotten rid of. We had the static test article. We said,
“What we can do,” even though we’ve taken our design
criteria and made it as minimum as we think we feel comfortable with,
“we can go one step further.” We think that what we can
do is we can load the test article, the entire Orbiter, we can load
it to 110 percent of the maximum load, and we will prepredict what we think
it’s going to do. We had strain gauges all over the vehicle.
We said, “We will prepredict with the mechanical load what the
strain response is going to be. If we do that accurately then we can
extrapolate to 140 percent and show that it won’t fail.” [The NASA
Chief Engineers Office] said, “You guys are crazy as hell. We’re
not going to accept that.” We said, “No, we’re okay.
We’re not going to do anything that’s going to cause a failure.”
Now we have an outside group come in. They [took] us through the wringer.
They check every single logic, description, and everything that we had.
Called the wide-body group; had guys from Boeing and Lockheed and the
other companies that were making large body jets. They finally says,
“Okay we agree with you.”
So what we did; let me find a picture. Voila. We took the Challenger
Orbiter [STA-099], and we rolled it over to Palmdale [California] test
facilities at Lockheed. We tested that vehicle exactly the way I just
described. We tested it to  percent. There it is going over to
Lockheed. [Shows photo] There
it is when it got into the test facilities. [Shows
photo] We tested that thing and it worked. We saved the Orbiter
Project $100 million one year, because when I got back to the consistent
level of complexity that I talked about, here we were having to back
off because of having a lack of political support because they kept
cutting our budget. Well, we said, “No, we can be innovative.”
Wright: So you
changed from crazy to innovative, right?
Moser: Yes, right,
but we said, “We can be creative, and we can be innovative.”
We did that. A lot of times when you have your back against the wall,
“necessity is the mother of invention.” We thought outside
the box to do this, and it panned out. Had we had the money that we
set the program out with, we wouldn’t have done this, but we did
not compromise safety at all. As a result, I think we’ve even
changed the way industry looks at [the testing of] some of their aircraft
now. They’ve said, “Hey, we don’t really have to test
these things to destruction.” Now some companies still do it,
but in light of the way we did it, we created a new path to save a lot
of money. So that was something that we felt pretty darn good about.
Let me talk a little bit about some unique things about the structural
design. I’ve talked about the criteria and the way we tested some
stuff, but we realized that there were some things that were going to
be critical in the Orbiter that we weren’t going to have enough
knowledge on to feel safe about, operationally. Let me give you an example
of that. The payload bay doors, the big old doors that open on orbit.
During Apollo and every other space program there’s always been
problems with mechanical systems. Things not working [in space] exactly
the way you think it should.
So we said, “If we get those payload bay doors open,” which
they have to be in space, if you’re there for any period of time.
That’s the way it radiates part of the heat from the Orbiter out
into space through the radiators there in the payload bay doors, plus
you got to get the payload out if that’s what you went there to
deliver. If we can’t close those payload bay doors then there’s
no way you can survive reentry. It just will not take it.
We said, “In the structural design we’re going to do something
to alleviate that issue. What we’re going to do is make the payload
bay doors very flexible so that once they start to close on orbit you
can zip them closed. Start at the hinge line. Start zipping around the
edge. Start zipping it down the middle. You can zip it closed through
But what you do is you give up that part of the structure. Think about
the structure of the Orbiter [fuselage as] just being a big tube. If
you take a tube and you bend it, it’s pretty stiff, but if you
cut half of it away and you bend it it’s not very stiff at all.
We said, “We’re going to do that. We’re going to let
those payload bay doors be like that they’re not part of the fuselage
structure, so that we can make sure that they’re flexible enough
to close on orbit, but we’re going to add weight to the vehicle
when we do that.” We did that. We designed that Orbiter so that
those payload bay doors are theoretically not there during entry. Probably
not many people know that.
Wright: Yes, it’s
an interesting concept.
Moser: We said,
“We’re going to do that.” Okay, so we did it. The
next step on the payload bay doors were another weight issue. We had
to get more weight out of the vehicle. I think we were looking to save
600 pounds of weight in the payload bay doors. Payload bay doors were
made like the Command Module was. It was an aluminum honeycomb. Aluminum
honeycomb is just a face sheet with what looks like honeycomb in between.
It’s an integrated panel that’s very stiff. We said “Okay,
aluminum honeycomb is the way to go with that, but there’s this
new thing called graphite epoxy that’s a composite material that’s
much stiffer and much stronger than aluminum. We think we can make those
payload bay doors out of graphite epoxy and we could save some weight.”
Lo and behold, we did the analysis, and we thought we could save 600
pounds of weight in the vehicle doing that.
One Saturday morning, Aaron Cohen, myself, Phil [Philip C.] Glynn, Tom
Modlin, and a few other people over in the Structures and Mechanics
Division Building 13 sat in the conference room there. We looked at
it and Aaron said, “Do you guys really think you can do it? Are
you comfortable with it?” Don’t forget we’ve led him
down this path of minimum criteria, all this kind of stuff. We said,
“We can do it, Aaron.” He said, “I trust you.”
Made the decision, went with it. Gotta to think how far I want to carry
that [in] today’s environment. Let me just not go there right
now. It was that authority that the project manager had and the trust
that he had in the guys that had been working with him for three or
four years at that point, a couple years anyway. He said, “I trust
We went with the design. North American, Rockwell at that time, was
on board, and they agreed with it. Going from the design into the implementation
and manufacturing—the largest composite structure that had ever
been flown. Now fast forward to today, the aircraft industry today uses
composites to the maximum extent possible, because it typically saves
about 25 percent of weight over an aluminum design. We flew the biggest composite
structure ever flown, and we made that decision in probably 1973. We
started building our payload bay doors in Tulsa, Oklahoma.
We built the first set of doors, [which were] very process and people-dependent.
The guys in the shop had to learn how to do it. NASA couldn’t
do that. That’s where the prime contractor has to do it. They
learned how to do it. Hit a budget hiccup, not as much money the next
year. So what do we do? Laid off all the technicians that built the
first set of payload bay doors. Said, “Go away for a year because
we don’t have enough money to build the second set.” So
we did it. Probably cost us some time and some overall expense to do
that, but another frustrating element of this “conservation of
complexity.” Anyway, that was the payload bay door story. We characterized
that material because we had to to be able to know that it was strong
enough and it would carry all the loads.
A few years later we got a call from Learjet. They wanted to build an
all-composite fuselage. They said, “We don’t have any of
the material allowable. Will you give us what you have?” We said,
“Sure, we’ll do that.” We gave it to them so that
started the industry. Lear, I think, was the first one to build a composite
fuselage. It was us leading the way. A few of us sitting there saying,
“We can build these payload bay doors out of graphite epoxy”
that started the industry down the path. We gave them what we had, and
they built on it from there. We passed it on to the industry.
Another thing on the design in the mid fuselage region—Marshall
[Space Flight Center, Huntsville, Alabama] had the responsibility for
the payloads that were going to go in the Shuttle, so it was time for
us to design the mid-fuselage. We had to know the characteristics of
the payload that was going to go in that mid-fuselage. We had to know
how big it was, what it weighed, where the center of gravity was, how
many payloads there were going to be, where they were going to be attached,
how stiff they were and all, because we were going to bolt it in. If
you take two things together and bolt them together, they become one
in the same.
We said, “Marshall, you have to give us the requirements on the
payload.” We waited, and we waited. We said, “That’s
stupid, they don’t have any idea. Nobody does. We don’t
know. This vehicle may fly all the way to the year 2010.” We didn’t
say that, but that’s where we are today. No one knew what was
going to fly then. We said, “We have to design the way we attach
the payloads into the Orbiter so that the Orbiter doesn’t care
how many payloads there are, where the center of gravity is, and how
much it weighs.” What we did is we looked at multiple types of
payloads, different orientations, different centers of gravity, different
positions, different weights, everything else. There were 10 million
combinations of all these things we had to consider.
There’s a mathematical program called a Monte Carlo analysis.
We throw all of those 10 million cases in there, and we crunch it around.
We designed the mid fuselage to accommodate 10 million types of payloads.
The Orbiter has never had a problem accommodating any payload so again
we had to be creative in what we were doing.
There was one other creative part that we did. What I just talked about
was the [payload] mass and where it was, how many, and where it was
located in the payload bay. To avoid having a very stiff payload and
having it bolted all the way into the fuselage we said, “We’re
not going to do that. We’re going to put on attachments so that
they slide.” In a technical sense, we made it statically determinate.
The Orbiter didn’t care how stiff the payload was, and the payload
didn’t care how flexible the Orbiter was. The payload can [be
designed independently of the orbiter and vice versa]. We isolated;
we decoupled that design by making it a statically determinate system.
We put bridge fittings in there so now you can attach it anywhere along
the whole part of the structure, the longeron of the structure, in different
places. In the same way in the bottom of the [mid-fuselage we provided
a keel attachment]. I never will forget Max Faget said, “You’re
not putting those bridge fittings in the Orbiter.” Well, Max,
bless his heart, he was a conceptual designer, the best in the entire
world, but when it came time to implementing a program he was usually
about a year late. Max would laugh if he were here today. I said, “Yes,
Max, we’re going to go ahead with bridge fittings.” “No
you’re not.” He says, “I’ll bet you don’t.”
I said, “Okay, I bet you a duck hunt, Max.” So he and Caldwell
[C.] Johnson bet me. We put the bridge fittings in there, and they never
did give me my duck hunt.
What it did is it enabled the Orbiter to be [independent of the payload
stiffness. It gave us the flexibility. Now we got the flexible payload
bay doors opening and closing in space and being a structural part of
the Orbiter. We have the accommodation of the payloads. Those are things
that I think a lot of people don’t realize really went into the
design of the Orbiter.
Another part was we looked at the crew module. We said the best way
to do this is to make it just like an airplane, so that there’s
not a separate pressure vessel, if you will, for the crew. We’ll
just make it all part of the same [fuselage structure]. The problem
with that is, if you’re in space and you have something that causes
a structural opening, maybe not a failure, but a rivet or something
causes a crack, then you got a problem.
We looked at that very carefully, and we said what we’re going
to do is we’re going to make the crew module a pressure vessel,
and we’re just going to sit it in the fuselage. We’re going
to attach it at discrete points. Now we have a crew module that is designed
only by pressure, and it’s got the crew in it so you’d like
to have that pressure vessel [as] simple as you can. We made this pressure
vessel with the crew in it, and we attached it to the fuselage at some
hard points. That simplified the heck out of a very very critical part
of the Orbiter.
To make sure that we had something we clearly knew every aspect load
so now it’s only designed by pressure. It’s not designed
by twisting and bending of the Orbiter during ascent. Those loads don’t
get into the crew module, just the mass of the crew module and the pressure
makes it very very simple. If, during the pressure cycles and the inertial
loads on the Orbiter, we create a crack in the pressure vessel, we designed
it such that crack would grow but it could not reach critical length
and grow catastrophically. We would detect a leak in there. If we had
to come home we’d come home. We designed the pressurization system
with the environmental control system, so it could accommodate a leak
of the size that we thought would be maximum we could stand and get
home safely. Again we simplified the design, but we made it conservative
enough we knew that we were safe.
To this day there’s never been a problem with any Orbiter structural
element, period, as far as safety of flight or anything. We pushed the
envelope on that, and it worked for us.
Wright: How much
were you able to apply what you had learned from the Apollo era to these
early phases of what you were doing? Did you throw the book out and
make all new rules or were you able to bring some?
Moser: No. We learned
about criteria. When I talked about the structural design criteria,
we brought some of that from Apollo into the Shuttle design, so we learned
from that. The analytical tools were much more sophisticated in Shuttle
than they were in Apollo, so we were able to take advantage of that,
but if I think about the Orbiter being comparable to the Command Module,
there wasn’t a lot of similarity. They’re a totally different
type of structure altogether, but if I look at the Lunar Module—we
weren’t able to use a lot of that technology either, because the
Lunar Module was the only true spacecraft ever built for humans. It
never had to see the atmosphere of Earth. Once it got into space it
was purely a space environment. The structural skin of the Lunar Module
was so thin you could poke your finger through it. It was a pressure
vessel. That’s all it was, and some landing loads and so forth.
We were able to take some of that and bring it into the Orbiter.
It was evolving, but I wouldn’t say that there was a huge amount
of capability from the Apollo Program structural designwise that went
into the Shuttle, completely different thing. The Orbiter had these
damn wings on it. I say damn wings. You really wanted them during entry,
when it was an airplane.
Let’s talk about the Apollo Program. Let’s just talk about
the Command Module for instance. It was a module which really didn’t
have to experience the launch. It was not part of the launch vehicle.
It was housing the astronauts. It was a spacecraft on orbit, but that’s
not usually critical for design. Thermal stress wasn’t really
an issue there. It was pretty bulky. Thermal gradients didn’t
design anything significantly. During entry it was important, but from
a structural standpoint really wasn’t significant either. Water
impact was significant. The Command Module was pretty isolated.
The Orbiter—it’s a launch vehicle. It’s a spacecraft.
It’s a space laboratory. It’s a reentry vehicle to withstand
the temperatures of reentry, and it’s an airplane. So, it’s
five things. You can see how this passive Command Module, if you will,
and how all of a sudden now you’ve taken something that’s
dynamic, it’s a living breathing thing during all flight regimes.
It’s withstanding every environment that there is. There’s
not a lot of application just from a structural design standpoint that
the Apollo Program carried over into the Shuttle Program. We learned
a lot, but not as a structural engineer you didn’t a whole lot.
Something else on the Orbiter—I mentioned the payload bay doors
being the largest composite structure ever flown, the graphite epoxy.
As we progressed into the vehicle, probably in the mid ’70s, we
still had weight issues. We were having to scrub the weight out. Now
all of a sudden it’s getting more and more expensive to get the
weight out, but we did some other things. We decided that some of the
supporting structure in the mid-fuselage and the wing were tubes supporting
part of the support structure. We came up with something that was a
composite called boron-aluminum. We saved a lot of weight in the vehicle.
I don’t remember how much weight that was, but there’s a
section of a boron-aluminum tube. It has aluminum and then it has a
boron material inside of it and then aluminum on the outside again.
We said, “Okay we can do that.” We led the way in boron-aluminum
technology in the Orbiter.
Then in the thrust structure we said, “Okay we got to do something
there,” so we did two things. We built it out of titanium, because
we needed the stiffness where you had 1.5 million pounds of thrust from
the main engine of the Orbiter going into the frame of the Orbiter,
supporting the payloads. That had to be a very stiff structure for control
purposes and also for strength and all, so we made the thrust structure
out of something called diffusion-bonded titanium. That had never been
done on a flight vehicle like that. What it did is we would take two
pieces of titanium that were going to go together. Instead of welding
them, we put them in high temperature in a vacuum and pushed them together
until they bonded. Just molecularly they became one and the same.
If you get the light right, this is one piece of structure; this is
another piece of structure. Just push them together like this. That
was part of the diffusion-bonded titanium. I won’t go into a lot
of detail of those, but that’s still not stiff enough, so what
we want to do is we want to take some of this [borox] epoxy and want
to bond it on this diffusion-bonded titanium structure. They came back
and said, “You guys are crazy,” again, but we can save weight.
I think we saved 1,200 pounds of weight or something like that in the
aft end of the vehicle by putting [boron] epoxy, just gluing it onto
the titanium structure.
We said, “If it fails we want to be able to withstand the maximum
expected load, but without a factor of safety on it.” We know
we’re going to be safe if we lose the bonding of the [boron] epoxy.
The bottom line on that is the Orbiter started being designed in 1972.
In the mid ’80s, and even today, it is one of the most advanced
spacecraft designed in composite advanced materials that exist. That
became very important in 1986 after the Challenger accident, when I
became a deputy Associate Administrator and I went to Washington [DC,
NASA Headquarters]. In December of ’86, there was a big push by
other federal agencies to kill the Shuttle. They said, “It’s
antiquated; it’s obsolete. Start all over.” It was other
agencies wanting NASA’s money. It goes on to this day in all federal
Over Christmas holidays, I wrote a summary of why the Orbiter was still
advanced state-of-the-art in design. I got it over to the White House.
I don’t know how much that helped but I think it helped. By us
pushing this envelope and being creative in the way we designed the
Orbiter and the way we brought composites into it helped us to say we
didn’t just build some obsolete spacecraft and aircraft, we built
a state-of-the-art thing. In 1986 it was still state-of-the-art. Don’t
throw stones at this thing, it’s advanced to this day. I think
that that was not planned. That was not planned. I had to defend it,
but it was something that we had in our hip pocket that we could defend
Let me move beyond just the Orbiter structure now into the Orbiter structure
and thermal protection system. When we went to the Skunk Works and we
talked to the Kelly Johnson folks about the SR-71, they made it out
of titanium so it could withstand 600 degrees. They didn’t need
to have any thermal protection system on it, Concorde didn’t need
any, didn’t get that hot, just had the thermal gradients. We were
left with the challenge of “What do we make this Orbiter structure
out of. Do we make it out of aluminum? Or do we make it out of titanium?
Or do we make it out of other materials which can even withstand even
higher temperatures?” There was some experience and data from
military programs where they built high-temperature entry vehicles that
didn’t have an all-metallic design. We looked at that, and we
found some things very interesting.
When we looked at aluminum and the amount of thermal protection system
that was required to protect the aluminum to 350 degrees, and we looked
at titanium, which you could work up to 600 degrees, less thermal protection
system, and we said, “Well, it looks like titanium is going to
be the better thing.” Had a lot of merit, but when we considered
the heat absorption, the heat sink to be specific, with the aluminum,
aluminum has a better heat sink than titanium does. Now all of a sudden,
we’ve got the weight of the structure, the weight of the TPS [Thermal
Protection System], and the heat absorption of the material. We says,
“It’s about the same between titanium and the thermal protection
system and aluminum and the thermal protection system.” As we
finished our tour at the Skunk Works with these guys that had been through
titanium, says, “Okay, guys. If you were us would you build out
of aluminum or titanium? We’d just like your opinion.” They
said, “Aluminum,” because titanium was so difficult to work
with. It was extremely difficult to manufacture.
What we did is we went with a classical aluminum design where you didn’t
have to train a bunch of people differently. They were already in the
business of making aircraft out of aluminum, so we said, “We’re
going to do that.” I told you about the composite [payload bay
doors], how we had to screw that up [by] laying everybody off. We made
that trade from a truly systems engineering standpoint. We looked at
the whole thing and made that decision. It was a big diddy to do that,
but again we had established the relationship and the confidence [of
management]. They trusted us and what we were doing. The relationship
between the project management, the subsystem engineers, and the engineers
was very good. That was the way we made that decision.
Wright: If I can
ask you at this point, you sought out industry standards or what they
had been doing. You went to the Concorde. You went to the Skunk Works.
I find it interesting that they readily opened the doors to you to find
out what they were doing. Was that commonplace at that time? Or is it
because it was NASA that they said, “Come talk to us, we’ll
be glad to share with you what we’re doing.” Were they very
open with that information?
Moser: They were
extremely open. We weren’t competitors. I think when we were talking
to Lockheed they knew that it was a national pride and a national program.
Lockheed had bid on the Orbiter. They had a different design on the
Orbiter than the one that won so they were really familiar with the
Shuttle Program and in particular with the Orbiter. The Concorde, even
though it was a foreign entity, England, it wasn’t that foreign,
but they were also part of the program, because they were going to build
something that’s called the Spacelab that was going to be carried
in the Orbiter. They were part of the program to some extent. Elements
of it were part of the people that designed the Concorde in England.
They were very open with us. Had they been competitors, they wouldn’t
have shown us anything. Now, we didn’t worry about international
trade agreements like we do now with all the ITAR [International Traffic
in Arms Regulations] restrictions so we were able to share information
probably a little bit more readily than you can today. As I said earlier,
once these constraints start coming in, they just keep getting more
constraining rather than less constraining, but good question.
Wright: Thank you.
Moser: I think
I’ve covered all of the Orbiter structural integrity questions
that you had. I’ve added some stuff to that.
Let me go into the thermal protection system a little bit. First of
all, I took on the responsibility for the thermal protection system
in about 1978. I was not the person responsible for the thermal performance
of the tiles. I was supporting the guys that were doing that, but it
was primarily the guys that had to determine what heat protection was
required and the materials guys looking at various materials to withstand
those temperatures. It was the insulation characteristics of the material
in the thermal design that I was not part of.
The guys that were more involved in that and that you want to talk to
on the thermal performance—talk to Dottie [Dorothy B.] Lee, and
she can lead you to other people. As far as the materials talk to Glenn
[M.] Ecord and Cal [Calvin] Schomburg; both those guys are still around.
I’ll let those guys tell you the details of the materials and
the types of materials and the mullites and silicas.
We had the silica material for the tiles, and it had a glass coating
on it. It was about the density of balsa wood. It was very fragile.
[The coating is] like an eggshell. The glass coating on the outside
was a few thousandths of an inch thick, and you could break it very
easily. [The silica buoy] had an ultimate strength of less than ten
pounds per square inch. Early on in the program we said, “Well,
we’re just going to bond this stuff to the aluminum, but we know
since it’s an aluminum structure it’s going to expand and
contract a lot because of the extremes in the temperature going from
minus a couple hundred degrees in space to a couple hundred degrees
coming back in. It’s going to expand. These fragile tiles, we’re
going to have to isolate it so it can “float” on the structure.
We put a felt material between the aluminum and the tiles. We called
a strain isolation pad or SIP, you’ve got to have an acronym.
We says, “Voila that’s good.” In hindsight we thought
we had everything pretty well covered. We were down to the point where
we were putting tiles on the vehicle, but we were still trying to understand
a bit more about this very low-strength fragile material, because we
knew that if we lost a tile in the wrong place you lose the [entire]
vehicle. Twenty-five thousand tiles, you lose one and you can lose the
I don’t want to throw stones, but I remember Rockwell was under
budget pressure, and we were. They said, “We’re not analyzing
those damn tiles like a piece of structure.” We said, “Well,
we got to. We’ve got to assure the integrity for [all of the tiles].”
We had a disconnect between ourselves and the prime contractor. We were
doing some of our own work in house, and we decided we need to understand
better what these aerodynamic loads are on the tiles. You have aluminum,
you put an adhesive down, you put the felt down, you put adhesive down,
put the tile on it, and it sticks. So that’s it: aluminum, glue,
adhesive, felt, adhesive, tile. We put it on a T-38 aircraft on the
speed brake. We said, “We want to get some high dynamic pressure
on this thing.”
We worked up the test program where the tiles were on the speed brake,
and then we’d have the aircraft pilot deploy the speed brakes
and put this really high aerodynamic load on these tiles. We said, “That’ll
give us some characteristics that we predicted what it’d be.”
Voila, they came off the speed brake. Any time anything comes off an
aircraft in flight, then you have to write an incident report. Something
falls off, it’s a big deal. There was a lot of hubbub about that.
We started analyzing the systems. Why in the world did they come off?
They were not glued properly, blah blah blah. We found out that the
strain isolation pad [the loosely woven felt material], to give it a
little bit of integrity, it had some stitching in it. Everyplace that
there was one of these little stitches, when the tile tried to pull
away from the structure, it was a little stiff spot so that was a stress
You get a stress concentration in a low-strength material, and it fails
right where that little stress concentration is. Once it fails in a
brittle material, then it propagates. All of a sudden we didn’t
have nearly the strength that we thought we did. Let’s just make
up a number. Let’s say 100 pounds before it would fail. Lo and
behold, it was failing about 60 pounds. What was happening, it started
to fail, and it just would let go. It was like glass cracking.
We’d already started bonding tiles on the vehicle so this was
the showstopper for the program. John Yardley, the guy I mentioned earlier,
the old stress guy, he called Max Faget and he said, “Max, I want
somebody in charge of the tiles.” Max says, “Well, I’ll
do it.” Yardley said, “No you can’t do it, you got
too many other things.” I got tapped for that job, being the guy
responsible for the integrity of the tiles.
That led into a lot of problems that we had. We started to understand
all of the load environments that we had on the tiles, but the first
thing we had to address was the lack of strength that we had. Had we
understood this strength deficiency early in the program—we had
stronger tiles that had more strength but they were a lot heavier. What
we’d have probably done is we would have probably bonded those
stronger tiles all over the vehicle, and we’d increase the weight
by a whole lot. We’d probably doubled the weight of the thermal
We had our back against the wall so we said we’ve got to figure
out how to distribute this little stress concentration in the bottom
of the tile where the SIP is imposing this stiff spot. We thought, “Well,
we’ll put a metal plate underneath there.” Long story short,
Glenn Ecord, one of the materials guys, one weekend was playing around
with tiles trying to figure out how to strengthen the bottom of the
tile. He came up with a way of taking really fine powder like talcum
powder, which was just ground up silica, and he put it in water. He
just spread it with the water all over the bottom of the tile. The tile
is like a bunch of fibers. That little talcum powder, the silica powder,
packed itself into all the fibers. When the water evaporated, it left
this little densified bottom of the tile.
That doubled the strength of the tile with this packed in silica material.
It added practically no weight to the tiles. Doubled the strength where
it was attached to the SIP. Again “necessity is the mother of
invention.” We were able to then take the tiles, not change any
of the process for the materials, not add any weight, take the tiles
off we’d put on in some areas, densify it—got you an example
here. Lo and behold, that’s what doubled the strength.
Now we’ll talk about all the design work. Here’s the tile.
[Shows original tile] See where it’s chipped there. That’s
what it is like when you just put the SIP to that and bond with it.
You can feel that, how the material feels really soft. Here’s
the densified tile. [Shows densified tile] Just put your finger on that
and feel that.
Glenn Ecord gets all the credit for figuring out how to densify those
tiles, or else we would have had to start over. This was a huge impact
on us because now we had to design—let me take a tile and show
you. From the strength integrity, don’t forget it just has a few
pounds per square inch strength capability. Here’s a tile that’s
got some mass. It’s sitting on the Orbiter, the engines light
off, and all of a sudden it starts shaking. It has to withstand the
Then the vehicle lifts off from that, now it’s got acceleration.
Now it’s shaking plus it’s being pulled down by the acceleration,
then the aerodynamic pressure comes over it. Now you’ve got airloads
on the tile. It’s shaking, being loaded with inertia, you got
airloads on it. When the shock wave comes across it, there’s a
pressure differential because of the shock wave going across it. Oh,
by the way, when you started, this tile was sitting at sea level. All
this little air in the tile, all of a sudden you’re going up,
it has to escape. Now you have a pressure internal to the tile trying
Now you’ve got this aluminum it’s bonded to. Let’s
say it’s on the bottom side of the fuselage of the Orbiter. The
Orbiter starts being twisted. The wings are getting loaded by the aerodynamic
and the deflection in the structure. One sixteenth of an inch of deflection
of the Orbiter aluminum underneath its tile will cause it to fail. Now
you have to put all these combined loads on this little low-strength
tile, 25,000 of them, and say, “We’re safe to fly,”
because you lose some of them, you lose the entire vehicle.
That was our dilemma in 1978. We were the pacing item for the whole
program. We had to rapidly analyze all 25,000 tiles. We had to do wind
tunnel tests. We had to understand exactly what this pressure differential
was. We had to understand what the structural deformation was. We had
a ton of work to do in three years before the first flight. We did it.
We convinced ourselves, with all 25,000 tiles, that we knew if it was
bonded properly the way it was supposed to be done, and the tiles were
made the way they were supposed to be, we were good to fly. But, we
had to make sure, since bonding is a process-dependent thing and is
a people-dependent thing. If the temperature is not right, the humidity
is not right, the bonding pressure is not right, you don’t know
that it’s [safe to fly]; by design you can say it but you don’t
know it’s really good.
We said, “Okay what we have to do is we have to go up and pull
on the tiles.” We said, “Well that shouldn’t be a
big deal.” We designed a contraption: suction cups to go up and
hook onto a tile and pull on it with a load that we thought was sufficient
to prove that we had a good bond on the tile. John Yardley says, “I
got a question for you guys. When you pull on that tile how do you know
you didn’t decrease the strength, and you damaged it more so it’s
not going to be as strong now as it was before you pulled on it?”
Said, “Good question.” We developed a way to put microphones
on the tile when we pulled on them. We did a bunch of tests one weekend.
We found out how much noise a tile could make when you pulled on it
to know that it was okay. If it made too much noise when you pulled
on it, it meant you were causing too many failures. We developed this
criterion and we proof loaded tiles where we had to. Other tiles, [that
we did not proof load], we could say, “Even if it only has half
the bonding strength, we’re okay [for re-entry].”
We had to go through a combination of pull tests and analysis over all
25,000 tiles at the flight readiness review. I stood up [at the STS-1
flight readiness review] there, and went through the logic of why all
the tiles were okay. Lo and behold, they were okay. We lost seven tiles
on the first flight. It was in a noncritical area, it was on the OMS
[Orbital Maneuvering System] pod. I was at the Cape on the first flight.
When we got on orbit, we saw those tiles were off. I got in a Learjet
and came back to Houston, and we analyzed it. We said, “We’re
okay.” It was okay.
We expected to take off and remove a lot of tiles around each flight.
I don’t think to this day they remove very many at all. They’re
extremely fragile material. The tiles are a good system; they have the
required integrity. I’ve said here are all the environments it’s
good for: airloads, vibration, all this kind of thing. The thing the
tiles are not designed for, then or to this day, is any kind of impact
on the tiles. You can’t fly the vehicle through rain. It’ll
penetrate and go right into the tile. It won’t make it come off,
but it’ll ruin the glass coating on it. It cannot withstand foam
coming off the tank.
What we had to do, between ’78 and ’81, we had to prove
the integrity of all those tiles, that they would stay on the vehicle.
I’m not throwing stones, but I am going to throw stones a little
bit. The external tank, to this day, can’t ensure the integrity
of the thermal protection system on it. The tile is not designed and
cannot accommodate, was not designed for [foam loss]. Now what the program
has done, it’s done a great job. It understands where the critical
areas are. They beefed up the external tank insulation thermal protection
system so that they know it’s stronger in critical areas. They
also know that the tiles can withstand an impact of a certain size.
It breaks the coating. There’s been enough analysis done to say,
“You may hurt the structure a little bit but you’re not
going to lose the tile. You’re not going to let plasma blow through
It’s having to go along on crutches on every flight. Looking and
inspecting the vehicle to really make sure that this flight debris from
the external tank and anything else is not impacting the tiles. The
tiles in themselves were designed to exactly what they’re doing.
They’ve performed well. That was a huge huge challenge for us
to be able to pull that off in the last few years.
Wright: We were
talking, wanted to get you to clarify for us. When you did the testing
on the tiles with the suction cup contraption as you mentioned, each
one of those 25,000, you tested every tile that was on there?
Moser: No. No.
We checked most of them. The critical ones we checked. Some of them
we convinced ourselves that even without the full bond integrity we
were okay for flight. We didn’t proof load every single tile.
Others we analyzed, if there was a problem that they would crack. Others
we analyzed, if we lost a tile we wouldn’t lose the vehicle, that
we may damage the structure. Some of them you just like couldn’t
get the proof test device on. We didn’t proof load every 25,000.
We proof loaded a lot of them.
Wright: Did you
do the test again after STS-1? Was every it mission?
Moser: We did random
testing after that. We would select different areas of the vehicle and
we would just proof load them to see. Some of them we’d even pull
tiles off and look at them and check them. To this day they don’t
proof test anymore. I think they’ve gained enough confidence and
all in the process that the process is reliable. There was a question
about reliability of the process. Since we had to remove so many tiles
and put them back on, and it was a new process, we just didn’t
have the learning curve to have the confidence.
Those ones that you determined you didn’t need to do the tests
on, was that because of the position on the vehicle itself?
Moser: Yes. Right.
It was in an area where the temperature was not that critical if we
lost a tile like we did on the first flight. We lost some tiles on the
front edge of the OMS pod. It didn’t cause any damage whatsoever.
In those areas we convinced ourselves that we were okay. It could have
been a reusability issue. We may have had to repair some structure if
that happened, but we weren’t going to lose the vehicle so we
said we’re okay for first flight.
Let me add something to that. [I] talked about the conservation of complexity.
In the Shuttle Program it was, as I think said earlier about ’75,
the program was threatened to be canceled. [Richard M.] Nixon was the
President. He was not very supportive of the program, so we were having
to scurry and we were having to replan the schedule every year. We were
having to replan testing. We wouldn’t compromise safety. We had
to replan. A lot of the testing I talked about that we changed was because
of that. Until we had the Approach and Landing Test off the back of
the 747, which was in ’, the public got to see it, the Congress
got to see it, and they said, “Wow, this is an impressive machine!”
We visibly could see something so that all of a sudden, now the deal
was—I’ll say it like John Yardley said. “Get the son
of a bitch in space. Get that thing in space, or we’re going to
lose the program.”
We did things rapidly. We didn’t compromise safety, but we didn’t
have time to proof load all the tiles, didn’t necessarily have
to, but we knew we could maybe cause a little bit of structural damage
but [it was] not a safety issue. We did that to expedite getting the
vehicle in space. Once we got it in space then we reached another visible
milestone that had some awe associated with it.
Fast forward to the Space Station, one of the problems with the Space
Station, we didn’t have any awe events. Apollo—look at all
the Apollo events that we had: rockets lifting off frequently, a lot
of flights, a lot of test flights. The public could see a lot of things.
There could be a lot of accomplishments. If you don’t have the
awe events in a government program you’re going to lose it.
Wright: I guess
Hubble [Space Telescope] would be a good example of that as well.
Moser: Right. Exactly.
Exactly. The Constellation program, that’s a problem that it has.
It’s not going to have the awe. If the Constellation program continues
and returns people to the Moon, it’s not going to have the same
awe. We’ll never have that awe again, period. It’s gone.
Our lifetimes, we’re not going to see another awe like that. Even
if we land on Mars, it’s not going to be like the same awe as
landing on the Moon, but you have to have those. It’s part of
the PR [Public Relations]. It’s part of the selling. You got to
continuously sell to keep a government program alive like that. The
government is the only thing that can afford to have a program like
that. Stockholders aren’t going to do this. There’s not
of the Approach and Landing Test, were you able to be there for those
Moser: I was. I
was at the Approach and Landing Tests and the first flight.
Wright: Got to
see your structure in action.
Moser: [I] did.
It wasn’t much of a structural load for us, but it was a demonstration.
Let me add one other thing about the Shuttle Program, and then I’ll
get off of that. The challenges that I talked about, there was innovative,
the creativity, and things like that that made it successful, but the
thing that made it happen was we had the same team on the program from
start to finish.
Wright: Wow, that’s
Moser: That says
a lot. All of the key people were in the program from day one all the
way through. The Bob Thompsons, the Aaron Cohens, the John Yardleys,
the J. R. Thompsons, Bob Rieds. All the guys stayed on that program
from start to finish. It was that relationship that everybody had and
the knowledge and the confidence that everybody had in one another that
enabled it to happen.
This is a picture of something called the ham and eggs society. This
is Alan [M.] Lovelace right here. [Shows
photo] He was the Deputy Administrator at the time. He said, “There’s
an old story about what makes the successful breakfast is ham and eggs.
The chicken participates by providing the egg. The pig commits. You
guys committed to this program in personal sacrifice and a lot of other
things so I’m forming this ham and eggs society.” That’s
a picture of us at the Cape after the first launch down on the beach.
We tried to have a reunion last year of the ham and eggs society, and
it didn’t happen because the flight got canceled. We may try and
do it on the last Shuttle launch.
Moser: Some of
the guys are no longer there. They’ve gone. Some of them can’t
travel. I’m not getting old, but some of the other guys are.
good to know that you know that.
able to stay in touch. We contacted everybody there except one person.
We never could find one person that was there. Another thing that was
not having anything to do, but that was the personal experience. That
ham and eggs society was critical.
Wright: What a
great name for that.
[Break in audio]
Joe [Joseph P.] Allen is the only [person] that has that. [Shows
Wright: Have that
Moser: Have that
Joe, he probably got a kick out of that.
Moser: Oh, there’s
some of the artists. Some of the early sketches, saying, “Well
what do you want us to do?” That capped off my Shuttle experience
until I was sitting in mission control, sitting right up between Chris
Kraft and Aaron Cohen when Challenger [STS 51-L] happened. Within a
day, we knew what it was. We had enough evidence that we knew it was
the solid rocket motors that had caused the problem. I led the internal
investigation of it for the first week or so, and then it got out of
hand and got into the politics and got outside people involved. It took
us two years or something like that to fly again. Back to the Apollo
fire, completely redesigned the spacecraft and was flying in eight months.
Conservation of complexity.
Wright: Would you
like to try to stop here at this point so that we pick up at [another
just looking at my notes. I need to think about some other things.
Moser: Okay. Would
this be a good place?
Wright: I think
so. I think so.
[End of interview]
this link to view all the photos in Thomas L. Moser's photo gallery.
to JSC Oral History Website