NASA STS Recordation Oral History Project
Edited Oral History Transcript

Frances A. Ferris
Interviewed by Rebecca Wright
Downey, California – 24 August 2010

Wright: Today is August 24th, 2010. This interview is being conducted with Frances Ferris in Downey, California as part of the NASA STS Recordation Oral History Project. Interviewer is Rebecca Wright. Thank you so much for coming in this afternoon. I’d like you to start by telling us briefly about your career with Rockwell [International Corporation] and [The] Boeing [Company].

Ferris: When I got out of college, I had two job offers. One was to work on a boiling water nuclear reactor, and one was to work on the Space Shuttle. It was an obvious choice for me to accept the offer from Rockwell and work on the Space Shuttle program. I came into a group called the purge, vent and drain group, PV&D for short. The easiest way to explain what PV&D did is environmental control of unpressurized compartments, the parts of the vehicle that were not the crew module.

Part of PV&D was purging the vehicle with nitrogen on the [launch] pad to dilute any hazardous gases. There’s a system that detects hazardous gases in the vehicle to determine if we have a leak before launch; a drain system, which just allowed water to drain out; and venting. When you have a vehicle on the ground and you’re at one atmosphere and you go into space where there’s no atmosphere, all that gas leaves the vehicle. The orbiter is in different structural compartments and you have to make sure that as the gas vents out of each compartment it does so at a rate that you don’t get excessive delta pressures across pieces of the structure. The system controls that to limit the structural loads.

Wright: You have simplified that well. It’s an extensive engineering complex system.

Ferris: It was interesting to me in part because the hardware goes from nose to tail, so I got to interface with people who worked all over the vehicle in all kinds of systems as opposed to being isolated to one part of the vehicle.

Wright: Share with us a few more details of how all these systems work together but can impact each other, and how you were able to ensure that all were running. You did an analysis on a lot of those systems to make sure they were at their peak performance. Can you give us a few more details on how that worked?

Ferris: The PV&D systems are mostly ground-based systems. You have ground equipment that interfaces with the flight vehicle, and you’re getting data on pressures and temperatures or for the haz [hazardous] gas system on concentrations of oxygen and hydrogen. All that data goes into the firing rooms. In many cases we have launch commit criteria which are constraints. If you get above or below a certain limit you either call a hold or you scrub for the day.

The vent system is the one that’s active during flight. The vent doors are closed on the pad, and right before launch they open up and allow the nitrogen in the compartments to escape. They stay open while we’re on orbit and they close before deorbit, because as you’re coming in on a hot entry you don’t want to ingest hot gases. Then at a certain altitude, between 70 to 80,000 feet, they open up again. That’s when you start hitting the atmosphere and you allow repressurization of the orbiter.

Wright: It’s an amazing technological structure. You worked with that system for about 11 years. Were there a lot of changes or evolution to the system while you were involved in it?

Ferris: I actually hired in in 1980, so [OV-]102 Columbia was already at [NASA] Kennedy Space Center [Florida]. The bulk of the design had already been completed. I worked on mostly certification of systems for flight. But as we flew the vehicles we found that there would be efficiencies for processing the vehicle or safety improvements. Then there were changes.

We also had some cases where we had difficulty with the hardware performing to specifications. We had a unit called the wing vent relief door, and it allowed venting of the wing through the mid-body if the wing external vent door did not open. It was a large panel that was supposed to open at a certain differential pressure. The cracking pressure range was very narrow, and there’s a lot of vibration in that area.

We had a lot of issues with the door either opening too soon—mostly too soon, which is not really a hazardous situation. Too late would create too much pressure. We looked at the environment to see if we were overtesting, and ended up finally making a recommendation that we could delete the door and just vent the wing with the mid-body compartment. That saved us a considerable amount of weight, it saved software space, it eliminated some critical failure modes. All in all it turned out to be a good change.

There were many mods [modifications] that came on as a result of large projects that PV&D was a small part of. One was the addition of the drag parachute system and the crew escape system. Things like that always involved the PV&D group.

Wright: Were those part of the modifications after the [Space Shuttle] Challenger accident [STS 51-L]?

Ferris: After the Challenger accident, yes.

Wright: Were you part of the work that resulted in the development of replacing the ducting with Kevlar [para-aramid synthetic fiber] and epoxy [polyepoxide]?

Ferris: No, I think that was before my time. It was always Kevlar-epoxy.

Wright: You also worked during that time period on the thermal control system.

Ferris: Yes. The thermal control system, or TCS, are the internal blankets. When you see video of the vehicle and the doors are open and you see nothing but white, those are the TCS blankets. They’re to control temperatures of the structure and the other hardware systems when you’re on orbit, because going from sunshine to night you’re ranging from +150 degrees to -150 degrees [Fahrenheit]. That design was pretty much done. It was a small group of people and they needed a supervisor, so I just inherited them along with my PV&D group.

The interesting thing about that system is almost any change someplace else affected the blankets. If you changed the structure you had to adjust and adapt, if you ran new lines you needed penetrations. The difficult part was that the blanket design always got done at the end. Once everybody finished and finalized their design, then we came at the end and accommodated everybody else—as long as they remembered to tell us.

Sometimes at the Palmdale [location in California] they’d go to install a blanket and they’d say, “We can’t install this blanket because there’s this tube that needs to go through the blanket and there’s no penetration.” We’d have to scramble at the last minute and get those kinds of things changed.

Wright: Did that happen a lot where you were having to scramble at the end?

Ferris: It depended how many mods were being done. If there was a lot of rerouting of hardware—we’d do our best to do the coordination up front, but sometimes people are in a rush and they hurry and they forget to hand off that information.

Wright: While you were there we lost Challenger. Talk about the impact on the areas that you worked in, and how the loss of that orbiter impacted the changes that were made for the future.

Ferris: I started supporting the mission activities about STS-3. We had gotten to a point where systems like PV&D that were not considered critical didn’t do the real-time launch support anymore, so I was actually in my office when the accident happened and heard about it secondhand. Then of course everybody got involved in the investigation, because there was no clue as to what had caused the problem.

I got started on the investigation team. It became clear fairly early on that the problem was the booster and not the orbiter, and certainly not any of the systems that I worked on. After that, NASA went through a very rigorous recertification and reverification of the entire Shuttle program. We had all our orbiter requirements in the OVEI, the orbital vehicle end item specification.

We went through a DCR [design certification review] where we examined every requirement and how we met it and whether the analysis and testing we did to meet the requirement was adequate and the validation was adequate. And [we] made a recommendation whether or not we needed to do more work or adjust the requirement in some cases or to just document areas where maybe we fell short a little bit but still had adequate safety margins. That whole process took a couple of years. Then of course a lot of safety mods came out of the accident. Two we talked about a minute ago, the crew escape system and the drag [para]chute system. There were quite a few design changes after the Challenger accident.

Wright: Did your work take you outside of the facility? Were you working on teams and meetings throughout the agency?

Ferris: I was primarily in Downey. As vehicles were being built I was doing testing up at Palmdale. Earlier in my career I traveled quite a bit to Kennedy because I would do a lot of [support] testing out there. It seemed like I was always going to Florida and never going to Houston [Texas, Johnson Space Center]. Then once I started going to Houston I almost never went to Florida again.

Part of the closure of actions associated with the review after the Challenger accident was the one time I actually went to NASA Headquarters [Washington, DC] because we were briefing a program manager on the impact of a broken window on ascent. That was the only time I ever went to Washington, DC, for work.

Wright: When you refer to testing at the Cape [Canaveral, Florida], can you give us an example of what that was?

Ferris: Mostly what I supported was structural leakage testing. I mentioned that we had the vent system. There was typically a ratio of the area of the vent to the volume of the compartment. But when you build a vehicle like that, just like your car, everything’s not sealed up; you have little gaps and little holes. So one of the things we would do is pressurize the different compartments of the vehicle and literally walk around and feel for where air was blowing out and try to quantify how much air was blowing out.

The analytical folks that did the venting analysis put this data in their program. There are different pressure coefficients on different parts of the vehicle, so it was critical to really know where the leakages were. There was a lot of work done early on baselining the structural leakage on every vehicle. It took us several flights to understand that that number was very stable.

Wright: There are a number of orbiters. Did you find a lot of differences or were the orbiters the same?

Ferris: There were differences. Some would leak a lot more around door perimeters. I think it’s the buildup. You have different tolerances on your parts, so if one side is on the thinner side and the other side is also thinner you might get a little bit more of a gap.

Then the structure design did change over years. It didn’t vary greatly, but we ended up having to build a different set of pass-fail requirements for each vehicle because they were different enough. That’s what we were really looking for, not what the number was but how much did something change. Because if something changed, it could be indicative of some type of failure that you’d want to go investigate further before you flew.

Wright: In the ’90s the Shuttle fleet was grounded due to hydrogen leaks. You were involved with the effort to return the fleet back. Can you talk about that event and how you were involved and how you determined the resolution of the problem?

Ferris: That was mostly due to the fact that part of the PV&D system was the hazardous gas detection system. We sampled the effluent out of the mid-fuselage, the cargo bay and the aft. The aft is where the engines are and you’ve got lots of hydrogen and oxygen going through those systems. We would pull a sample of gas continuously, the gas would go in the mass spectrometer, and it would yield the percentage of hydrogen and oxygen detected; also helium, because there’s a background of helium.

The haz gas system was the system that detected unacceptable levels of hydrogen. Before the first flight of every vehicle they did what they called a flight readiness firing. On the pad they load the propellant and the oxidizer in the tank, go through a normal launch countdown, light the engines for a short period of time, and then shut the engines down. That was enough time for the main propulsion system and the engines to pressurize and you would see an increase in hydrogen in the aft compartment at that time. Based on the slope of the increase of the hydrogen and the peak and the way it decreased, you could determine how much the whole propulsion system was leaking. We determined launch commit criteria based on that data.

Mostly what I did was in support of the main propulsion system folks. When Challenger went through its FRF [flight readiness firing] we saw the huge, huge hydrogen leak, something that was not acceptable to fly, and took a very, very long time to try to find the source of that leak. They were looking for leakage in all the ordinary places, in joints where parts connected to each other where you might have a little gap or a seal that had a crack in it, and they never found anything.

They actually found the leak by accident. In the parent metal of the main combustion chamber of the engine there had been a weld that had not been done properly and started a crack. We actually did a second firing to try to find it because we weren’t sure where it was. The propulsion team developed what they called a helium signature test where they bagged the propulsion system as much as possible, pressurized and measured the helium, and that gave them an indication of whether they would have a hydrogen leak during flight. It doesn’t take much of a hydrogen leak to get a combustible mixture in the aft compartment.

In 1990, I believe what happened was we had a leak that was in the disconnect area between the orbiter and the ET, the external tank. It took quite a bit of time just to pinpoint the area, and then there was a lot of discussion as to how would we ever know if we had a leak in this area? My team did several studies on whether there was any type of instrumentation we could install in this gap to determine if we had a leak. The gap was less than a half an inch thick.

We put helium in that gap because you didn’t want a leak [to] build up and become pure oxygen or pure hydrogen, so you have to keep diluting and mixing and moving the gases out. We came in and made some recommendations about whether or not you could put a unique haz gas sensor there or if the best way to detect leakage was to put a pressure measurement there. The program also had hydrogen detection measurements external to the vehicle which they’d pull down right before they’d light the engines.

That was a long summer, and I was pregnant that summer too. So I was tired, very tired.

Wright: Were you in residence for the entire time?

Ferris: No, I went back and forth. I actually never spent much time out there. The Challenger FRF was probably the worst trip I had because I had planned to go for four or five days, and I ended up there for about two and a half weeks. You only take enough clothes with you for the time you think you’re going to be there.

Wright: You mentioned the propulsion guys. Were you working with people from [NASA] Marshall [Space Flight Center, Huntsville, Alabama] as well or were you a separate team?

Ferris: No, the orbiter propulsion guys were the ones I worked with. They worked really closely with the Marshall folks.

Wright: I find these projects very interesting because they’re all little standalone ones—the drag chute panel [on STS-95].

Ferris: The door fell off [during launch], yes.

Wright: Tell us about when you learned about that event and how your team helped resolve that issue.

Ferris: We had a Mission Support Room here in Downey at the time. We were there and everything seemed fine, the mission was going great. Then folks that were reviewing video said, “Something fell off.” It was hard for me to see at first—I’m not very good at that type of thing—but once they refined the video, yes, something fell off. The word was going around it was the drag chute door. “How could that fall off? It’s fastened on there pretty well, and it’s big. That’s not going to happen.” It turned out it did.

That was John [H.] Glenn’s mission when he flew as a senator, so it was very high profile, lots of media attention. We had a couple of things going on. It became clear right away that the investigation was going to go in dozens of different directions. I ended up being the person on the Rockwell side [Rockwell sold aerospace divisions to Boeing in 1996 – Boeing North American subsidiary formed] who was coordinating all the action items and making sure that Rockwell had the right team of people working on that action item.

We had two big telecons a day to talk about the progress. You sit in these meetings and it becomes hard to get any work done because you’re reporting on what’s going on. This failure was interesting because we had to figure out why the door fell off, and we had a vehicle on orbit that didn’t have a door. So we had the root cause investigation and another set of investigations about what do we do when we land, is it safe to land?

We managed to get some video that showed the aft end of the vehicle. There was some browning and maybe a little charring of straps, but pretty much the drag chute compartment looked intact. We had very limited instrumentation and the data that we had wasn’t downlinked, I don’t think you got it until you got back on the ground. The video results pretty much matched what our thermal analysis said, so we knew we had a fairly intact system.

The next set of analysis was what happens when we go through a reentry and we don’t have that protective door with the TPS [thermal protection system]. Luckily the temperatures in that area are more severe during ascent than descent. The determination was made that we’d survive the entry, that there wouldn’t be any issue. There was concern if you got damage and then you tried to deploy the chute, would it hang up and do more harm than good? There was a lot of discussion about if we deploy the chute are we going to destroy some evidence that would help us determine what happened and why it happened and what corrective action we needed to take. That was very very fast-paced, because decisions needed to be made pretty quickly.

We ended up deciding to not deploy the chute. We had a safe landing, the chute looked pretty much just like it did on orbit. They were able to retrieve that and as we were going through the hardware investigation, we went through the original design and what are the environments. The engines burn hydrogen-rich. During launch there are sparklers that set off the free hydrogen in the area so when the engines ignite you don’t have a detonation of hydrogen.

It turns out that there are some pockets that don’t really burn off, so there is a main engine ignition pressure environment that was not accounted for originally. When we did our original analysis and testing we didn’t account for this little poof of pressure on the back end. We analyzed our design against that environment and we still were not finding a problem. We looked at the way the door was installed, we looked at the materials we used. We were examining this from every angle we could think of.

It took months to find out that the problem was the pin that went in the hinge that held the door in place. If you got a pin that was on the low end of the material property strength, it could break with the engine ignition environment. We had never had that situation where we had the low margin pin and the high pressure environment at the same time. I believe we actually flew again before we discovered that that was the root cause, and we made a decision to lock the door in place because we didn’t want to take a chance on having a door fall off again.

The drag chute system helps shorten the rollout after landing and it takes some of the load off the braking system, but it’s called a Criticality 3/3 system, which means it’s not mandatory for safety. There was a lot of discussion about should we still use it, should we take the chance? We did end up, like I said, pinning the door for at least one flight before we figured out what the problem was and we put in stronger pins.

Wright: Easy solution to a hard problem.

Ferris: Yes. I remember going through this and being so frustrated because we had looked at everything, we thought, and we couldn’t find anything to point to as the failure cause. I remember one of the stress analysts who had been with Rockwell for ages, who was our premier expert in this area, telling me, “Frances, there’s a reason, and we will find it.” We finally did, but it was a long time coming. It was a very interesting problem, and it was fun to be in the middle of the heat of the action too.

Wright: Did you have a specific area that you kept going after? Was there one that you thought might be the problem?

Ferris: I was skeptical of the engine ignition environment, but it turned out to be real. A lot of people were looking at video trying to draw conclusions from the color of the plume and the burning. It turned out to be like most problems we’ve had on the Shuttle Program. It’s not one thing, it’s usually a combination of several things that come to bite us. The obvious individual things we understand and we plan for and we design for, but sometimes the combination of things are a little bit more difficult to predict.

Wright: A couple years later you led the Boeing team to resolve the ET separation bolt protrusion problem right before STS-92.

Ferris: There was some ET video, and somebody noticed as they were looking at video from STS-106 [the preceding flight]—we got out of sync in the numbering of the STS missions. There are bolts that hold the tank to the orbiter, and after the engines are shut down there are pyros [pyrotechnic fasteners] that separate this bolt and then the vehicles come apart. This bolt is huge. Somebody noticed on the ET side that after separation the bolt appeared to go into the tank and then come back out and then go back in. We had never intended for that bolt to have that bounceback effect. Then folks started to look at past video, and it had been there before but never the degree of protrusion that we saw on STS-106.

In some cases it was more of when you looked in this hole that the bolt went into, you would see a shadow and then the thickness of that shadow would decrease. The bolt maybe didn’t come out of the plane. So we started to look at what would happen if that bolt hit the orbiter? Things have to be very very balanced when the two vehicles separate or you impart a load on the orbiter or a different load on the tank. Then you can have twisting, and there is the possibility that you have re-contact because the vehicle is going up and the tank starts to tumble and rolls over. You don’t want that to happen.

There was a lot of investigation on that, mostly analysis. We were looking at the loads, at the trajectories and the GN&C [Guidance Navigation & Control], and an awful lot of analysis on the strength of the bolt. We ended up analytically showing that there was no way to re-contact the vehicle, and cleared it. But as happens very often, these kinds of discoveries happen close to launch so you’re under a lot of pressure to get that done. This is another case where I didn’t do the work but I was helping the team get organized and focused, making sure all the actions got worked and the story pulled together. This was another one of those things where it was not just an orbiter problem; it was an orbiter and tank problem, so it was an integrated action.

Wright: Are there others that came to mind that you worked on, some situations or activities during those years when you were up close and personal with the orbiter?

Ferris: I talked a little bit about the wing vent relief door. That was one of the first things I worked on when I was out of college and it took years to get to the point where we deleted it. One of the other things I worked on was on the window system. Not very many people know it, but when you see a window on the orbiter there’s actually three pieces of glass. The inside is a pressure pane, the outside is a thermal pane and the middle one is called a redundant pane. It can take the heat load and the pressure load.

The cavities in between go from one atmosphere, 14.7 psi on the ground, to zero. That inner pane has the crew module, which is one atmosphere, and zero on the other side, so you have to vent those cavities. We had a system called the window cavity conditioning system. You have to keep those cavities very clean because you don’t want lint or condensation that blocks the crew’s view, especially on landing. They also do photography out of those windows.

We had a desiccant canister that had desiccant beads in it. When air reentered it would go through this canister and the moisture would be drawn out by these beads so that you wouldn’t get any window fogging. In case that canister got clogged we had little check valves. When the delta pressure got too high [the valves] would open up and you would take the risk of the contamination, because it was a backup system. On turnaround those valves tended to stick. If you had just lubricated them they’d be fine, but if they sat for too long they’d stick.

Again we had very tight margins on operation, so we ended up getting rid of those valves and putting in two desiccant canisters. You usually like to have redundancy that’s of a different design so that if you had a generic problem you would not have the same problem in both redundant paths. But we had a great deal of test data that said no matter how much you shake those beads they don’t turn into powder and block the filter and clog up. Those beads are changed every now and then because they will saturate with water. That was a mod [modification] that was a long time coming. It was not safety-critical, so it would get bumped to the bottom of the priority list but as time went by we actually did implement that.

Wright: Did you find when the fleet was grounded you were able to do some of those mods?

Ferris: A lot of those things that were not a priority then floated to the top. Of course after the [Space Shuttle] Columbia accident [STS-107] there were quite a few changes that were made during that time period. Changes in the way we flew and gathered in-flight data, especially on the TPS, and lots of mods in detection systems. As you mentioned, a lot of mods that folks always wanted to do but could never really get enough priority on got the attention that we wanted, and we were able to implement a lot of improvements during that time.

Wright: One of the major things that you’ve done is sustaining engineering and logistics support. Explain that and your role in that program.

Ferris: Sustaining engineering is really supporting the vehicle once it’s been delivered. It’s out of our hands as the original equipment manufacturer, the OEM. The people who process it and fly it have the vehicle. The importance of sustaining engineering is we’re the people that designed the vehicle, developed in the systems. We know the testing we did, the analysis we did to qualify and certify the design of the vehicle. We know how it was intended to operate. So part of the role in sustaining engineering is if a problem or a failure occurs on the vehicle, “Do I have to fix it, do I have to replace it or is it acceptable?” Does it meet the original design intent, that’s what sustaining engineering does.

With logistics we were largely supporting the spares and repairs of hardware. Defining spares requirements, supporting repair of hardware that we designed and built. We had the original contracts with the vendors who delivered components. It was working with the OEMs of those parts to make sure that they refurbished and repaired hardware and delivered good spares to the program.

Wright: You referred to something that involved a design, test and hardware pedigree. I thought that was a very interesting term.

Ferris: I think I did that in problem investigation. One of the things that the Shuttle Program is very rigorous about is understanding the hardware pedigree. For all our hardware and materials, we have lot numbers, lot date codes—we have the build paper so you know from the beginning to the end the history of that hardware. We’ve solved many problems by looking at it.

A failure, if you determine it’s a material issue, can you pin it down to just this one lot of material? And if you can, what other hardware is indicted and where is that hardware? There’s a very strict configuration management system that tells you by serial number where everything is, when it went in, if it ever came out, did it get reinstalled again, did it go get refurbished, did it go to the vendor, etc., etc. That’s very important to solving problems.

Wright: Have the tracking systems changed since you’ve been here on how to follow that pedigree?

Ferris: They’ve gotten better. Having more things that are available by desktop computer or Web-based, it’s gotten even better. One of the big improvements we had is what we call TIPS [tile information processing system], our thermal protection system information. That system tracks all the tile and blankets, the external insulation on the vehicle. In the beginning most of what it tracked was configuration and installations.

As time has gone by they’ve expanded it to track failures and repairs and all other kinds of occurrences with the hardware. They’re able to deliver maps for each vehicle; it’s a wealth of information in that system. It started off as basic, and as people discovered it would really be nice if I could put my fingers on this information easily, the program has gone back and expanded it.

Wright: You came in 1980 and you’re still working, so you’ve seen quite an evolution in just the software systems to track the Shuttle.

Ferris: Yes, absolutely. We didn’t have personal computers when I hired in. That’s been an issue too, because all our original records are on paper, some on microfiche or tape. So we have many data systems that are incomplete in that regard because they pick up at a certain point. Some areas they’ve been able to go back and scan data and get them into the databases, but some you just have it past a certain point in time. In some cases you’re just relying on people’s personal files, keeping track of things.

Wright: You served as the deputy associate program director where your team had more than 60 hardware systems. How were you involved in overseeing what all these systems were doing?

Ferris: The associate program director and I had a team of project managers that were focused in certain technical discipline areas. We had somebody in charge of avionics systems, somebody in charge of fluid and propulsion, somebody in charge of structures. They were doing the more day-to-day involvement in what these individual teams of 60 subsystems were doing. Then we would get the reports. If anybody had a problem we’d know what it was, and we’d hear the stories and we’d get involved and give direction to the team that was working the problem.

As we were getting ready to roll out or to launch, the teams would come forward with their rationale that said that they were ready to fly. We put together packages for NASA for every rollout and flight to say these are the mods we’ve incorporated on this flight and this is how we certified, these are the in-flight anomalies we experienced on the last mission, and this is how we’ve resolved it for this coming flight. Requirements changes, change paper, critical process changes, all of that. You can’t be intimately involved with 60 groups of people, so you have to rely on a good team of folks to bubble things up and keep track of things.

Wright: Unfortunately you went through both of the [Shuttle] accidents. Tell me about your involvement with the Columbia accident investigation.

Ferris: The orbiter team started to narrow it down fairly quickly. Not as quickly as they did on Challenger, but the NASA orbiter formed 16 subteams to investigate different areas. I ended up being the leader of one of the teams, the corrective action record team. A corrective action record, or a CAR, is the process and the paper we use when we have a functional failure. If something broke or leaked or didn’t turn off or didn’t turn on or didn’t move as fast as it was supposed to, you called it a CAR. That team’s job was to look at all the CARs from early on in the program and see if there was anything there that might have pointed to the situation we had with Columbia that maybe we missed. Did we not recognize something, did we recommend a corrective action that didn’t get implemented, did we not make the right recommendation for corrective action?

That was a bit of a tedious task, but important. I had a great group of people in Houston and Florida and out in Huntington Beach [California], and we just plowed through the paper. I would say it was one of the teams whose job was easiest because we weren’t breaking new ground, we were reviewing old paper. One of the things I was most proud of was because we were the first team to finish, we designed our final report and that outline was the outline that Ralph [R.] Roe [Jr.], who was the head of SSVEO [Space Shuttle Vehicle Engineering Office], imposed on all the other teams to use.

I also supported the debris team, which was a bit similar. We were not looking at sources of debris but at past missions where we had experienced damage due to debris. Again we were looking at when we found damage, how did we identify the source of the debris, how did we identify any corrective action that needed to be made, any design changes? You would see debris impacts that would repeat in certain areas. We did go through decisions where we said, “We’re seeing a lot of pitting here and so maybe we ought to have a higher density tile in this area to protect us,” and we would make that recommendation. Again, was there anything that we recognized in the past that should have clued us in that we had a systemic problem or something that needed attention before we flew again? It was a very very difficult time.

Wright: You were here, as you mentioned, for the builds of the orbiters. You also mentioned that you had chosen this job over your other [offer]. Can you spend a few minutes talking about what that was like for you to come join an aerospace industry, and being a female [when] there weren’t a lot of female engineers? Share some of those first days and what it was like becoming part of this very exciting team of people.

Ferris: It was an interesting time because Rockwell was hiring a lot of new college graduates. They went through the post-Apollo era where they were downsizing significantly, and then they started the Shuttle orbiter development and design. They didn’t hire people for a long time, and they were starting to get a really huge age gap. It was a fun time, because there were a lot of young people that were hired in at the same time as I was. You had this little community of folks, and everybody doing different things.

Like you said, not a lot of women. I went to a small college that focused on engineering and science, so there weren’t a lot of women there but the percentages there were higher than they were at work. I found it unsettling not to have other women to talk to, women that did the same sort of thing that I did. That really pushed me into getting active with Society of Women Engineers. That was my opportunity to really get to know a lot of other women that were in similar situations as I was at work.

As time has progressed and I’ve moved up the management chain, I’ve become one of those people that the younger women look at and look for advice. That’s interesting. One thing I will say is that it can be an advantage and a disadvantage. You compound that—being young and a woman at a time when you’re dealing with a lot of older guys. But the benefit was if I did something well, they all remembered my name, whereas if it was one of the men, it’s just another one of the young guys. It was hard to forget me because I was the one woman in the room.

It became pretty important to me early on to really be prepared. It affected me in that I started wearing a skirt to work every day because I never knew if I was going to end up in the vice president’s office. If I was going to end up in the vice president’s office, I was going to look the part of an engineer who knew what she was talking about. As opposed to some of the other younger guys who still came to work in jeans and T-shirts.

It was fun. It’s really a nice thing when people ask you what do you do and you say, “I work on the Space Shuttle,” to see their reaction and have that something that you can really be proud of. I tell this story a lot. My older boy was in the second grade with this little boy who just adored space. I was always bringing him things from work, little souvenir kinds of things. The kids were having a snack after a Little League [youth baseball] game and I was sitting on the bleachers next to this little boy. He must have been seven or eight years old, and he looks at me says, “You have the best job in the whole world.”

I said, “Why do you say that?”

He said, “Because you get to climb in rockets and things.”

I looked at him and I said, “You know what? You’re right, I have the best job in the whole wide world.” It just touches your heart. You feel, “I’m doing something important and it’s worthwhile,” and it’s a good feeling.

Wright: You basically grew up in your career [with] the Shuttle program. That had to be very rewarding that you were part of those changes.

Ferris: Yes. Like I said, the vehicle was already designed and the first one was delivered, but being there from STS-1 all the way through now—hopefully through the last flight. It’s interesting too, because I worked with many people that from the time they were children knew they wanted to work in space. They had this fascination and this desire. I had no idea what I wanted to work on, but once I came to Rockwell and I got a chance to work in an area where I got to see the whole vehicle and lots of different people and get exposure to different areas and growth in responsibility—I never saw a reason to leave.

It’s been really good for me. I just hit my 30th anniversary in June. I never thought I’d get there, but yes, 30 years. And now I’m one of the old guys.

Wright: You have been through very many missions and modifications. What was it like to see [the orbiter] completed and on its way? Can you share with us an experience?

Ferris: It’s pretty exciting. I did a lot of work on Challenger up at Palmdale. STS-4 landed at Edwards [Air Force Base, California]—because they were all landing at Edwards at that time—July 4th. Columbia landed and Challenger took off that same day to go to Florida. That was really something for me, because I’d never seen a landing before. I would have thought it’s just like an airplane coming in, but it was amazing because the vehicle falls so fast. Then to see the [Boeing] 747 [aircraft] take off with Challenger that I had crawled inside the wing and all parts of the vehicle was really gratifying.

Wright: You had to standardize an orbiter problem resolution process. Why is that so important for the safety of the orbiter to have a standardized process?

Ferris: One of the things that Rockwell—and Boeing—is really good at is solving hardware problems. We just go into attack mode. But sometimes you’re reinventing the wheel every time you do it. You can have these folks that have very active hardware and they’re solving problems a lot. Then you have a failure in another system that is pretty benign and they haven’t had a failure in five years. It’s like restarting the process and figuring out what do I do, where do I start.

We went through an exercise where we said, “Okay, there are certain things you do when you investigate a problem when you’re looking to solve the problem.” If you look at the presentations that we make during rollout reviews and flight readiness reviews, there are standard sections: description of the system, how does it operate, how did we certify it, hardware pedigree, the software. What we did was just describe each one of those steps that need to be assessed.

Not every step needs to be assessed for every problem. We created a checklist and then a description of what’s involved in each of those steps so that it made it easy for the hardware team to remember everything that they had to do, assign the action items to different people. Then they could track it and all that data naturally folded into a presentation that we would make to the customer to explain what happened, what are the consequences if it happens again, what’s the criticality, the redundancy, and if it’s okay to fly without taking action first.

Wright: Did you find yourself in a position through these last 30 years of being the odd man out saying wait or go? Were you a lone voice at some point?

Ferris: I wouldn’t say so much a lone voice. We’re working a big problem right now where we had a thruster failure at [NASA] White Sands [Test Facility, New Mexico], and it’s a very big failure. The subsystem manager who’s leading this failure investigation, I contacted him and said, “I’m going to send you this process. I know you know how to do this but this checklist will just be a reminder to make sure that nothing falls through the cracks.”

I’m not known for keeping my mouth shut. I’m not a very quiet person, so if I think something needs to be done I can find a way directly or indirectly to influence something. If I can’t get the hardware guys to listen sometimes I’ll go backdoor to the safety community, and if they bring it up it’ll get taken care of.

We have gone to the customer many times. I try to encourage the SSMs [subsystem managers] and the other people who are doing the investigation work. Somebody gives you a deadline and you can’t meet it, it’s unreasonable, you need to stand up and say so, because it’s too important not to do a good job. What we’ve found is if we say I can’t do that tomorrow but I’ll have it in three days, they’re pretty receptive to that. Sometimes management pushes just to see what they can get out of us, but I’ve never really had a situation where I felt like I wasn’t listened to.

Wright: Having processes in place helps you have that standardization to fall back on. It’s not your idea, it’s accepted behavior.

Ferris: Right. I try to couch it to people like, “I’m trying to help. I’m not telling you what to do, I’m trying to give you an asset that’ll help you.”

Wright: Sounds like good management. I’m sure you’ve learned a lot of good lessons along the way. Did you have some mentors or some individuals that helped you hone your skills?

Ferris: Yes. I’ve had a number of people, official and unofficial. It ranged from the first secretary in my group who taught me some lessons that I keep with me. I try to teach my kids some of these lessons because they’re life lessons, not just work lessons.

When I was made the supervisor of the PV&D group I was the youngest person in the group. The group had a design section and an analytical section and I was in the analysis side. That was the side that they typically chose the management from. I had a couple of very experienced designers who really helped me understand. They’d bring me something to sign. They’d go through it, and they’d explain the whole thing, teach me what was going on.

I’ve had examples of good managers and bad managers. I’ve had a lot of management direct supervision that have been very open to just talking. Very early in my career, especially as a new supervisor, I’d go in and I’d say this is the situation, what do I do? I think that kind of thing helped quite a bit. Then you have the people that are role models. I think as I’ve gotten older my temperament has evened out. I was much more excitable when I was younger and got more emotional. Now it’s easier to keep it below the surface. I’ve had people tell me, “You’re demanding but you’re fair.”

Wright: Sounds like a compliment. I’m sure they’ve seen you give a lot so that helps when you demand a lot. Do you want to share any of those life lessons from that secretary with us?

Ferris: Don’t upset your secretary, she’s one of the most important people in your lives. They really know what the bosses want. They’re good people to befriend and they can help quite a bit.

Wright: Your job duties moved physically. Talk a few minutes about the impact of closing the facility and having to move to a different location [when the aerospace company acquisitions and mergers occurred].

Ferris: We were in Downey. It’s hard because when you’re in engineering and in aerospace you figure out where you’re going to work first, and then you figure out where you’re going to live. Whereas I think if you have a career that is more widespread as far as job opportunities, you figure out where you’re going to live and then you try to find a job near where you live.

We were in Downey and the aerospace and defense part of Rockwell had been bought by Boeing. Then Boeing merged with McDonnell Douglas [Corporation] and had this property in Huntington Beach. They decided to shut down our Downey work and move us to Huntington Beach. My commute went from 22 miles to 33 miles along stretches of freeway that were much less amenable to getting to and from work quickly.

Wright: What year was that?

Ferris: I think it was October of ’99. The good thing about it was that Boeing made a capital investment to build a state-of-the-art Mission Support Room in Huntington Beach. What we had in Downey were conference tables that had computers on top of them. It was really an old conference room that had been adapted for use. We then designed a state-of-the-art room with large screens, with real consoles, with printers at the workstations so that people didn’t have to get up to get their print jobs. That was a very big project. The room was amazing and was really the envy of some of the NASA folks too.

For me personally it was about the work. I figured if I have to drive farther for 15 years or however long I’m going to be working in order to keep working on this program, that’s what I was going to do. Southern California real estate being what it is, the idea of moving wasn’t feasible. It would cost a lot of money to move and I wouldn’t have gotten the kind of property I have. So you complain, get it out of your system and move on.

Wright: In the mid ’90s NASA consolidated the contracts. Was your work impacted by the SFOC [Space Flight Operations] Contract? You were involved in the transition, is that correct?

Ferris: Yes. I actually worked on the proposal to go from being the prime contractor to NASA to being the subcontractor to USA [United Space Alliance]. I worked on the determination of what work had we done that now USA would do, and the org [organization] structure that we would have and the relationships that we would have with our new direct customer. It took quite a bit of getting used to.

We were used to going directly to the NASA folks and now you have this intermediate organization. They were a brand-new organization, and it took them quite a bit of time to hire some people and get the skills. There were areas where we continued to do work that they were taking on until they could hire the personnel and train the personnel and take it over. It was just growing pains. What I told people was the job gets done because the people on the floor who do the real work are still doing the same job they did the day before. They get the work done and they get the right answers, and it’s all us management folks that are churning.

Wright: What do you feel has been the most significant challenge that you’ve had to deal with since you’ve been in this business? You can think about it. What do you feel like you’ve accomplished when you look back on your career? What are some of the proudest things?

Ferris: For me a lot of it is the people. Obviously the vehicle and the system and the performance is amazing, but some of the most rewarding parts are dealing with the people and pulling teams together and getting them to work together in common cause and come to a solution. It’s also the most frustrating at times.

Wright: It can’t be easy when you have lots of experts sitting at the table.

Ferris: Yes, and lots of personalities. But working on something that’s so visible is great. When you know how complicated the vehicle is and we have so few problems. There’s a million things that could go wrong, and they don’t. It’s kind of discouraging that we’re going to stop flying, because I feel like we’re just hitting our stride. The number of problems we have on the ground has gone down significantly, and the number of problems and the severity of the problems that we see on orbit has gone down significantly. People really know their stuff, and now we’re going to stop. That’s sad. I’d say the technical stuff is not the hard part. It is challenging and it pushes you, but the most challenging thing right now is facing stopping and all the people who are going to be out of work.

Wright: Are you involved in the transition toward retirement at all?

Ferris: Some of that work is being done by folks in my department, in my project office. I’m involved in setting what the reduced budgets are going to be and in defining the areas that are going to go down and to what level and what timing.

Wright: That has to be difficult after 30 years of building it up. I guess it’s like you’re both ending your career at the same time. Have you thought about the most challenging aspect of your life in the Shuttle program?

Ferris: I think it’s been working after the two accidents, because there’s just the despair and loss of direction. But everybody jumps in, and there’s so much to do and the pace is so fast that you don’t have time to think about that aspect of it. Columbia seemed much worse to me than Challenger. I’m not really sure why, but it just felt more personal. Maybe it’s because of the fact that the debris fell on the ground, and we saw that for months and months of activity. I did have a chance to go to Florida where they had put all the recovered pieces of the vehicle and laid it out. That was very sobering.

Wright: Have you had an opportunity to go to a launch?

Ferris: I have seen two launches. I’ve been in Florida for launches where I’ve been in a little room with no window watching a computer screen countdown and a black-and-white TV monitor. But I saw the first flight of [OV-] 105 [Endeavour, STS-49]. I managed to get outside in the last few minutes and see that launch. Then the very next launch I was in Orlando [Florida], and I drove and I got to be on the causeway to see it. It’s indescribable. I was very lucky this last April I was able to get my brother-in-law, sister-in-law, my niece and nephew in the VIP area [for STS-131]. I was pretty proud of myself for getting them so close. They were just awed.

My nephew especially has been very, very into the space program for a long time. I can’t remember what flight it was, but we had a number of astronauts that came to Downey. My nephew was maybe eight at the time. He was very into space. I had a crew picture, and we had maybe four crew members visiting so I was trying to get autographs on the picture so that I could frame it and send it to him. I’d gone up to the pilot and I told him, “This is for my nephew.”

He says, “I tell you what. I’m going to do better than just signing this picture.” He reached into his pocket and he pulled out one of their crew patches. He said, “This is a flight-flown patch. We flew this on our mission, and I want your nephew to have it.” That was just so amazing. He was so young I wasn’t sure he would understand how special that was.

My husband made this great framed thing. It had the crew picture in the middle, double-matted. It had the patch on there. It was a mission to the [International] Space Station so I had an ISS pin and a Shuttle program pin cut out in the mat. Then on the back it had the names of the crew members and what the mission was. We took it up to Minnesota and he was speechless when we handed it to him. He was just speechless.

It turned out the pilot was Rick [D.] Husband who had given me that patch. I think that’s part of the personal connection I felt when we lost Columbia.

Wright: He’s probably thinking his aunt does have the coolest job in the world.

Ferris: Yes. He’s 15 now and he still has it in his bedroom. I’m the cool aunt, I get them neat stuff.

Wright: As our time starts to close, were there other areas that you want to talk about?

Ferris: The one area that I thought was important was the transition of subsystem managers from NASA to Boeing. Subsystem managers are the experts for a certain system. NASA had always held that role, whether it was an element of the structure, an analytical area like thermal or stress or the hydraulic system or main propulsion mechanisms. That had been the government’s responsibility. When NASA created SFOC they wanted NASA personnel to get more out of the day-to-day work and do a more surveillance role, and a determination was made that the subsystem manager position would go from NASA to Boeing. Not everybody was very fond of that idea.

We formed a team with a USA rep [representative], me as the Boeing rep, and a NASA rep. We defined requirements, we defined a process, we determined what criteria the Boeing subsystem manager had to meet to demonstrate that they could indeed take on this role and responsibility. This is a position that the orbiter program has created, and you’re saying you are the expert and you are the spokesperson for this system.

We created the process. It was supposed to be a two-year project and we finished in 18 months. It went through a series of reviews all the way up to the NASA orbiter program manager. It was something I was going to do on a part-time basis, and I ended up having to step out of my day-to-day job because it was just overwhelming. I did that 75 to 80 percent of my time. But it was really good to see the whole community recognize our people as being worthy of being declared the expert.

When jobs moved out of California to Houston and Florida, many of our subsystem managers did not relocate. We did a similar process to shift that to another Boeing person, and we’re still following that today.

Wright: When all of the transition started, did you see a lot of difference in how tasks were handled now that the expertise had been shifted over from NASA to Boeing?

Ferris: No, really not. There were some areas where it was hard for some people to let go and they were maybe more involved than they needed to be. There were some people, because of personalities on the Boeing side, that maybe weren’t forceful enough and didn’t step up from a take charge leadership role. It’s not just about the technical know-how, it’s about taking on the leadership for that system.

We had been so intimately involved with the NASA personnel that it was just a matter of who was speaking up and who was making the presentations. The work was the same. Very often we were very key in doing the work, turning it over to NASA. It wasn’t that big a change. The process was a big deal, doing it afterwards was not.

I think you covered pretty much my whole career. It was a big transition for us when we moved out of California, because my job moved to Houston and I was not in a position to relocate.

[End of interview]