Man-Rating the Machines

(July - December 1959)

SADDLING ballistic missiles for manned space flight was in some respects like trying to ride Sinbad's roc: the bird was not built for a topside burden, and man was not meant for that sort of punishment. Once accepted in theory that this fabulous bird could be domesticated and that some men could tolerate, even enjoy, the strains and stresses of such a ride, practical questions of marrying the separate abilities of man and machine demanded immediate answers. Engineers in the Space Task Group and other NASA researchers at Langley, Lewis, and Ames were providing some of these answers; engineers and technicians in industry and in quasi-military organizations contributed equally important answers. The primary task of the Task Group managing Mercury was to ask the right questions and to insist on better answers from the industrial producers of the parts and from the academic, industrial, and military suppliers of services.

In the latter half of 1959, as STG monitored the gathering momentum of the various manufacturers, the urgent search for ways to reduce the ultimate risk of sending a man for a ride in an artificial moon lifted by a missile gradually became more systematic and better organized. The theme of this chapter is the quest for reliability in the automatic machinery developed for the Mercury mission. Making these devices safe enough for man took longer and exposed more doubts than STG had expected originally. During the curiously quiet first half of 1960, the flexibility of the Mercury astronaut complemented and speeded the symbiosis of man and missile, of astronaut and capsule. Technology, or hardware, and techniques, or procedures - sometimes called "software" by hardware engineers - both had to be developed. But because they were equally novel, reliability had to be built into the new tools before dexterity could be acquired in their use.¹

At the beginning of 1959 NASA Headquarters had worried about three scientific unknowns needing resolution before actual attempts to conduct manned orbital flights. In their contribution to a House Committee Staff Report prognosticating for Congress on The Next Ten Years in Space, 1959-1969, Administrator T. Keith Glennan and the chief scientists at the helm of NASA in Washington listed these imperatives that must be investigated before man could go into space:

The problems known to exist include (1) high-energy radiation, both primary and cosmic ray and the newer plasma type discovered in the IGY satellite series; (2) man's ability to withstand long periods of loneliness and strain while subjected to the strange environment of which weightlessness is the factor least evaluated; and (3) reentry into the atmosphere and safe landing. The reliability of the launching rocket must be increased before a manned capsule is used as a payload. Once these basic questions have been answered, then we can place a manned vehicle in orbit about the earth.²

By July 1959 the engineers in the Space Task Group were no longer concerned by the unknowns in each of these problematic areas. They had obviated the need for high-energy radiation shielding by selecting a circular orbit around the equatorial zone at an altitude between 80 and 120 miles, well above the stratosphere and well below the Van Allen belts. Loneliness would be no problem because the communications network would keep the astronaut in almost constant voice contact with ground crews. Weightlessness, to be sure, was the factor least evaluated, but by now this was the prime scientific variable that Project Mercury was designed to answer. The psychological outlook was good anyway, argued STG rhetorically, for does not everyone who has learned to swim enjoy the freedom and relatively "weightless" state when immersed in water? As to reentry, the strain of positive and negative acceleration forces had almost certainly been conquered; only a few questions remained unanswered about actual reentry and recovery stresses. Indeed, what Headquarters had left unnumbered in its presentation and therefore seemed to have regarded almost as an afterthought, the Task Group considered the paramount problem: the reliability of the rocket boosters must be increased before manned capsules could be attached to them.

The first major proof test of a critical part of the Mercury spacecraft design occurred on April 12, 1959. After a dismal failure a month before, the escape-tower rocket attached to a full-scale boilerplate model demonstrated it ability to lift both man and capsule away from a dangerous booster still on the ground. Giving first priority to providing an escape system in case of failure at launch was evidence of a pervading lack of confidence in the reliability of the big rockets. The men of the Space Task Group were not liquid-fuel propulsion experts; they had to rely on missile technicians and managers to convert weapon systems into launch vehicles for spacecraft. Since no one was expert in spacecraft engineering, STG had to rely on itself and on McDonnell Aircraft Corporation to gain as much experience as rapidly as possible with the capsule and its systems. This high adventure of learning how, specifically, to orbit a man safely was shared by a growing number of people supporting Project Mercury.

Mercury Team Takes Shape

Although Robert R. Gilruth's Space Task Group was growing rapidly, it remained small enough and intimate enough throughout 1959 to make everyone feel his worth. The creative engineering challenge of the project inspired an esprit that could be measured by the amount of voluntary overtime and vacation time relinquished by the members of STG. Gilruth's administrative assistant for staff services, 46-year-old Paul D. Taylor, died of a heart attack in May and was mourned by his colleagues as a martyr who overworked himself in the cause.³

According to its own estimates of present and future manpower requirements, the Task Group was hard pressed to meet all its commitments in mid-1959. At the beginning of the new fiscal year on July 1, NASA authorized the Task Group to hire another 100 persons, mostly recent college graduates. A total of 488 authorized positions was to be filled by the end of the calendar year. But STG argued that only one of its three major divisions at work on Mercury - Operations, under Charles W. Mathews - was fairly equal in numbers to the tasks at hand so far. The Flight Systems Division, under Maxime A. Faget, was called "greatly understaffed," and the Engineering and Contract Administration Division, now under the acting leadership of the Canadian James A. Chamberlin, was in "such urgent need" of more technical and administrative help that the Space Task Group requested 200 additional positions, to be filled within the next three months. Estimates of increased Langley and Lewis support activities for Project Mercury almost doubled this personnel request. The sheer size and immense scope of industrial and military personnel required to support Mercury stirred STG to a premonition of precarious control:

In summary, a detailed study of staffing requirements for Project Mercury shows that the presently authorized complement of 388 should be increased by 330 positions during fiscal year 1960 in order to maintain the project schedules. This staff of 718 should be available by September of 1959, but orderly recruitment and integration of the additional staff would defer the filling of the complement until April of 1960. It is believed that everything practicable in the line of contracting on Project Mercury has been done without going to the extreme of effectively relinquishing control of the project. Failure to obtain the additional personnel shown must result in either major slippage of the schedule or in NASA effectively losing control of the project to the military or to industry.⁴

Because there was still no official commitment to manned space flight programs beyond Mercury and because hope was still high that manned orbital flight could be accomplished by the end of 1960, the Task Group accepted its temporary status and planned to phase out the people working on Project Mercury beginning in June 1961. Such plans were tentative, of course, and did not reckon with the technical and organizational problems that were to stretch out the program, nor with the astronautical and political events that were to change the course and expand the role of NASA's manned space flight efforts in 1961.

Nevertheless, by early August 1959, Gilruth was able to put his own field element of the Goddard Space Flight Center in much better order through a major reorganization.⁵ His new title, Director of Project Mercury, was indicative of the expanded size and activity of the Task Group. The functions of "project manager" for engineering administration devolved upon Chamberlin, who also headed the new Capsule Coordination Committee. Addition of staff services and elaboration of branch and section working group leaders after August 3 made STG's organization charts much more detailed. But the block diagrams, while helpful to new recruits and to industrial visitors at the crowded old brick administration building at the eastern entrance to Langley Field, showed rather artificial separations of activity and authority within STG. The intimacy of the original group had suffered inevitable attrition as the result of an eightfold increase in size in less than a year, but the "inner circle" still operated personally rather than formally. Outside relationships, even those with Langley Research Center, on the other side of the airbase, were rapidly demanding more formality.

A partial solution to these problems, which in time grew to be one of the most important organizational decisions ever made for Project Mercury, was the informal agreement made in August 1959 between the Defense Department and NASA to select two men to act as "single points-of-contact." DOD appointed Major General Donald N. Yates, Commander of the Air Force Missile Test Center, to become in October its representative for military support activities for Project Mercury. The job of mobilizing and coordinating such diverse activities as Air Force prelaunch and launch support, Navy search and recovery operations, Army tracking and communications facilities, and joint service and bioastronautics resources demanded systematic, formal organization.⁶ In turn, Hugh L. Dryden for NASA asked the chief of the High Speed Flight Station, Walter C. Williams, to join Gilruth to act as the contact point with Yates. Effective September 1, 1959, Williams and his colleagues Kenneth S. Kleinknecht and Martin A. Byrnes accepted transfers from NASA's High Speed Flight Station - shortly to be renamed the NASA Flight Research Center - to the Space Task Group. Having pioneered since 1945 in airborne launches of rocket research aircraft, Williams was a senior convert to the vertical ground launch cause of Mercury. Faget especially welcomed him. A personable and forceful leader, Williams took a position on a level with Charles J. Donlan. Each was an associate director for Project Mercury, Williams specializing in operations and Donlan in development. Williams had guided the NACA-NASA role in the flight operations of the X-15 rocket plane to a point just two days short of its first powered flight, on September 17, with North American Aviation's test pilot A. Scott Crossfield at the controls. When Williams, Kleinknecht, and Byrnes took up the higher national priority and professional challenge of working with spacecraft rather than aircraft, they brought to STG valuable operational and development experience with the highest-performance manned flight vehicles then in existence.⁷

Although there was pressure to get on with operations planning, engineering the Mercury capsule was still the primary task during these days. McDonnell and STG had swapped permanent field representatives during the spring in the persons of Frank G. Morgan and Wilbur H. Gray. Morgan came to live in a motel at Langley. Gray found a residence in St. Louis near the north side of Lambert Field, where the McDonnell plant was spread around the perimeter of the municipal airport. Though their technical liaison work was heavy, Morgan and Gray acted as hosts and guides as much as consultants, because visits by exchange delegations of engineers were so frequent. Just as the coordination of these meetings and trips for the development of the capsule became imperative among the aircraft and spacecraft designers and developers, so were closer, more orderly relations required with the developers of the ballistic missile boosters. Aerospace engineers often used one word to express the adaptation of systems, modules, organizations, and even technologies to one another: that word was "interface"; it connoted problems of integration, convergence, and synthesis of indeterminate magnitude.

Converging Technologies

The problem of man-rating the Redstone rocket was tackled with characteristic gusto by Joachim P. Kuettner, the man Wernher von Braun had called in 1958 to lead the Army's effort if Project Adam had been authorized. Kuettner had earned doctorates in law, physics, and meteorology before he became a flight engineer and test pilot for Messerschmitt during the Third Reich. Having been one of the first to test a manned version of the V-1 in 1944, Kuettner had made further use of his avocation as a jet aircraft and sailplane pilot for the U.S. Air Force Cambridge Research Center before joining the Army Ballistic Missile Agency (ABMA) at Huntsville.

In retrospect Kuettner has generalized about the problem of "Man-Rating Space Carrier Vehicles" in terms relating his experience with both aviation and missile technologies:

While it is admittedly an oversimplification, the difference between the two technologies may be stated in the following general terms. From an aviation standpoint, man is not only the subject of transportation, and as such in need of protection as a passenger; but he is also a most important integral part of the machine over which he truly has control. His decisions in expected and unexpected situations are probably the greatest contributions to his own safety. Aviation, to the best of our knowledge, has never seen the necessity for a fully automatic initiation of emergency escape.

In contrast, rocket technology has been for 20 years a missile technology governed by the requirements of target accuracy and maximum range. As such, it had to develop automatic controls. Unlike a human payload, a warhead has no use except on the target. Once the missile fails, it may as well destroy itself during flight. (For this reason, missilery has accepted aerodynamically unstable vehicles which, in case of loss of thrust, flip over and break apart, destroying themselves in the air.) There has been no need to save the payload after a successful flight or in case of a catastrophe.

The development of manned space flight is not just a matter of replacing a warhead by a manned cabin. Suddenly, a switch is thrown between two parallel tracks, those of missile technology and those of aviation technology, and an attempt is made to move the precious human payload from one track to the other. As in all last-minute switchings, one has to be careful to assure that no derailment takes place.⁸

In the spring of 1959, while Kuettner was still signing himself the "Adam-NASA Project Engineer," he and his deputy, Earl M. Butler, began a series of triangular conferences, with Kurt H. Debus and Emil P. Bertram of ABMA's Missile Firing Laboratory at the Cape, in one corner, and Charles Mathews and Jerome B. Hammack, the Mercury-Redstone project engineer for STG, in the Langley corner. Between these informal discussions and six formal study panels inaugurated by von Braun, a consensus was supposed to arise on, among other things, the sort of emergency detection system necessary to warn of impending cataclysms in the booster and to trigger some sort of automatic ejection. Preliminary agreements on a design for an abort or safety system began early in good accord. But the uncertain reliability program, booster recovery proposal, capsule design changes, and electrical interface problems fouled the subsequent development of the Redstone abort-sensing system.⁹ In this respect the Atlas was more nearly ready than the Redstone by the end of the year.

Many factors contributed to the slippage in the Mercury-Redstone schedule, but one significant cause for delay grew out of a subtle difference between ABMA and STG in their approach to pilot safety and reliability. The role of the astronaut was clearly at issue here longer than anywhere else. Conditioned by their designs for Project Adam, the Huntsville rocketmen thought of the astronaut throughout 1959 as merely an "occupant" or "passenger." The Adam proposal for an escape system during off-the-pad aborts would have ejected a biopack capsule laterally into a tank of water alongside the launch pad. Having less trust than STG in the reliability of "Old Reliable," the Redstone engineers insisted on putting safety first and making it fully automatic wherever possible. Reliability, they insisted, is only a concept and should be secondary to safety. This attitude was illustrated in the introductory paragraphs of the ABMA proposal for the Redstone emergency detection system. The author, Fred W. Brandner, began by saying that the use of missiles for transporting man would demand an automatic escape system to assure pilot safety:

This system has to rely on emergency sensors. There are an enormous number of missile components which may conceivably fail. Obviously, it would be impractical and actually unsafe to clutter up the missile with emergency sensors. However, many malfunctions will lead to identical results, and, in sensing these results and selecting the proper quantities, one can reduce the number of sensors to a few basic types.¹⁰

Brandner proposed to measure only three basic quantities: the control system attitude and angular velocity, the 60-volt control and 28-volt general electrical power supplies, and the chamber pressure of the propulsion system. To ensure "a high degree of passenger (pilot) safety" on the Mercury-Redstone rocket, if operational limits set on these sensors should ever be exceeded the capsule would eject from the booster and be lowered by parachute.

Brandner's modest proposal stated the issue but not the solution to the general question of man-machine relationships in Project Mercury. In 1959 the technical debate was still inextricably mixed up with previous attitudes toward the precise role of man in a manned satellite. Could the pilot test the vehicle or should the vehicle test the pilot? Mercury was NASA's program and STG's responsibility, but at this stage of development the military establishment and missile industries still knew, or thought they knew, more about the technological path for man's first climb into space than NASA-STG did.¹¹

From the Pentagon, for example, Brigadier General Homer A. Boushey, Director of Advanced Technology for the Air Force, had predicted in January that the most important key to space flight in the next decade would be not simply manned but rather piloted spacecraft:

By piloted spacecraft, I refer to a vehicle wherein the pilot operates controls and directs the vehicle. This is quite a different concept from the so-called man-in-space proposal which merely takes a human "along for the ride" to permit observation of his reactions and assess his capabilities. The high-speed flight experience of the NACA and the Air Force has shown that piloted craft return research data more effectively and more economically than do unmanned vehicles. While there is a place, certainly, for automatic, instrumented vehicles, I believe man himself will prove "the essential payload" to the full utilization of space. Orbital rendezvous, controlled landing after reentry, and space missions other than the simplest sensing and reporting type, will require man. If for no other reason than that of reliability, man will more than pay his way.¹²

Boushey's percipient remarks illustrated the persistent residue of misunderstanding remaining from interagency competition for the manned satellite project in the pre-NASA, pre-Mercury period. Task Group officials felt compelled to defend the distinctive nature of Mercury and to emphasize that NASA astronauts were never intended to be passive passengers. Rather, they were to prove their full potential as pilots, within limits prescribed by the mission requirements programmed into the automatic systems. Although there were long and hard arguments within STG as to whether man should be considered "in the loop" or "out of the loop" in performing various tasks, the preponderance of NACA-bred aeronautical engineers in STG usually voted for as active an astronaut as possible.

Outside pressures from scientists and missile engineers also helped unify and consolidate opinion within STG. The distinguished research chief of Bell Telephone Laboratories and one of the fathers of communication satellites, John R. Pierce, summed up the argument for automation: "All we need to louse things up completely is a skilled space pilot with his hands itching for the controls."¹³

The problem of man-rating the Atlas was preoccupying another task force of still larger proportions than the one concerned with the Redstone. The industrial and military engineers in southern California and at the Cape who were trying to make the Atlas meet its design specifications could and did mobilize more resources than either STG or ABMA could command. A few individuals stood out as leaders in the vast effort. Kuettner's counterpart for the AirForce was Bernhard A. Hohmann, another former test pilot at Peenemünde West, who had been project engineer on the first two models of the Messerschmitt-163, one of the first rocket-powered aircraft. In August 1959, Major General Osmond J. Ritland of the Air Force Ballistic Missile Division (BMD) assigned him the job of supervising the systems engineering at Space Technology Laboratories (STL) for a pilot safety and reliability program on the Mercury-Atlas series. As Brandner did for the Redstone, D. Richard White, an STL electronics engineer, made the preliminary designs for the Atlas emergency detection system. White was inspired, he said, "one Sunday in May when I imagined myself sitting atop that bird." Edward B. Doll, STL's Atlas project manager, could never imagine anyone foolish enough to sit on an Atlas, but he allowed Hohmann and White to proceed with their commitments.¹⁴ STL performed an overall technical direction over the associate contractors for the Atlas similar to that performed by STG for NASA, but with significant differences. STL had not been involved in the original MX-774 design behind the Atlas, and although it became closely associated with conceptual development of Atlas as a weapon, ultimate responsibility remained with the Air Force Ballistic Missile Division. Both STL and STG were systems engineering organizations, but STG had a deeper background in research and was directly responsible for the development of the project it managed; STL had broader experience in systems engineering, missile development, and business management.

Hohmann and his assistant, Ernst R. Letsch, huddled closely with the reliability statisticians at STL, led by Harry R. Powell, and with BMD's Mercury project liaison officer, Lieutenant Colonel Robert H. Brundin, also appointed by Ritland in August 1959. But the main responsibility for detail design, development, and production work fell on the shoulders of the manufacturers, General Dynamics (formerly Convair)/Astronautics (GD/A or CV/A) of San Diego. The details, tooling, and implementation of the emergency detection or abort sensing system for the Atlas were guided by Charles E. Wilson, Tom E. Heinsheimer, and Frank Wendzel. Their boss, Philip E. Culbertson, the Mercury project manager for General Dynamics/Astronautics, conferred repeatedly and sometimes heatedly with Hohmann, Brundin, Doll, and his own factory production engineers, John Hopman, Gus Grossaint, Frank B. Kemper, and R. W. Keehn.¹⁵

Here, too, a triangular dialogue was going on during initial considerations for man-rating the Atlas. But STG engineers were far away, busy with other matters, and knew well how little they knew about the Atlas. NASA and the Air Force, like STG and the Army, informally had agreed to divide developmental responsibility and labor at the capsule-separation point in the trajectory. So STG was not directly involved in the tripartite workings of the so-called "BMD-STL-GD/A complex" in southern California.

Looking at Project Mercury from the West Coast in 1959 gave a set of very different perspectives on the prospects for accomplishing the program on time and in style. South of Los Angeles International Airport there was no consensus and precious little communication of the confidence felt across the continent on the coast of Virginia. But STL, Convair, and Air Force representatives at the Cape gradually diffused some of the contagious enthusiasm of STG while commuting between home and field operations. More important still, the sense of desperate military urgency to develop an operational ICBM still pervaded the factories and offices devoted to the Atlas in southern California. Motivation already mobilized might easily be transferred if only the Atlas could be proved by the end of the year. STG was more sanguine about this forthcoming proof than the Atlas people, and NASA Headquarters seemed even more optimistic.

Perhaps symbolic of the profound Air Force distrust of the "bare Atlas" approach and indicative of lingering doubts about the competence of the STG neophytes who had stolen the march on man in space was the acronymic name imposed by Air Force officers on the abort sensing system. White and Wilson wanted to call it simply the Atlas "abort sensing system." No, someone in authority insisted, let's make the name more appropriate to STG's plans to use the Atlas "as is."¹⁶ So this play on words, "Abort Sensing and Implementation System," became the designator for the only part of the Atlas created solely for the purpose of man-rating that missile. Reliability was truly designed into the "ASIS"; once this component was proven and installed, the Atlas ICBM should, it was hoped, be electromechanically transformed into the Mercury-Atlas launch vehicle.

Astronaut Donald K. Slayton defended his prospective role and STG's stance on the issue of automation when he addressed his brethren in the Society of Experimental Test Pilots on October 9. By his own admission, these were some "stubborn, frank" words:

First, I would like to establish the requirement for the pilot.... Objections to the pilot range from the engineer, who semi-seriously notes that all problems of Mercury would be tremendously simplified if we didn't have to worry about the bloody astronaut, to the military man who wonders whether a college-trained chimpanzee or the village idiot might not do as well in space as an experienced test pilot. The latter is associating Mercury with the Air Force MISS or Army Adam programs which were essentially man in a barrel approaches. The answer to the engineer is obvious and simple. If you eliminate the astronaut, you can see man has no place in space. This answer doesn't satisfy the military skeptic, however, since he is not questioning the concept of a man in space but rather what type man. I hate to hear anyone contend that present day pilots have no place in the space age and that non-pilots can perform the space mission effectively. If this were true, the aircraft driver could count himself among the dinosaurs not too many years hence.

* * *

Not only a pilot, but a highly trained experimental test pilot is desirable … as in any scientific endeavor the individual who can collect maximum valid data in minimum time under adverse circumstances is highly desirable. The one group of men highly trained and experienced in operating, observing, and analyzing airborne vehicles is the body of experimental test pilots represented here today. Selection of any one for initial space flights who is not qualified to be a member of this organization would be equivalent to selecting a new flying school graduate for the first flight on the B-70, as an example. Too much is involved and the expense is too great.¹⁷

Slayton's defense of Mercury before his professional colleagues outside NASA was echoed time and again in the next two years by NASA spokesmen. But many critics remained skeptical because it was obvious that Mercury was being designed to fly first without man. Flight controllers and electronics engineers who had specialized in ground control of supersonic interceptors and who had confidence in the reliability of remote control of automatic weapon systems were the least enthusiastic about allowing the pilots to have manual overrides. Christopher C. Kraft, Jr., the chief flight director for STG, preceded Slayton on the same program at the meeting of the experimental test pilots. He reviewed the range network to be provided and the operational plan to be used for the Mercury orbital mission. At that time, Kraft circumspectly avoided any public indication of his personal views on the role the astronaut would play, but years later he confessed his bias:

The real knowledge of Mercury lies in the change of the basic philosophy of the program. At the beginning, the capabilities of Man were not known, so the systems had to be designed to function automatically. But with the addition of Man to the loop, this philosophy changed 180 degrees since primary success of the mission depended on man backing up automatic equipment that could fail.¹⁸

In public, the managers of NASA and of Mercury, who had to request funds and justify their actions before Congress and the people, appeared as optimistic as possible and pointed out what could be achieved with successful missions. Privately, they not only had doubts, they cultivated a group of professional pessimists whose job it was to consider every conceivable malevolent contingency. John P. Mayer, Carl R. Huss, and Howard W. Tindall, Jr., first led STG's Mission Analysis Branch and set a precedent for spending ten times as much effort on planning for abnormal missions as for normal ones.¹⁹

Although not always obvious to STG, there also were differences in attitudes within the space medicine fraternity. Since mid-1958, men like Siegfried J. Gerathewohl and George R. Steinkamp had led the school of thought that believed that man was more nearly machine-rated than machines were man-rated. Conversely, the chief of the space medicine division of the Air Force's School of Aviation Medicine, Colonel Paul A. Campbell, influentially asserted his belief that "in these past two or three years the situation has suddenly changed, and the machine capability has advanced far beyond man's capability."²⁰ Other biologists and medical college specialists also had doubts about the peculiar combination of stresses - from high to zero to high g loads - that the man in Mercury must endure. Whatever the majority medical opinion might have been, the Task Group felt itself beleaguered by bioastronautical specialists who wanted to "animal-rate" the spaceflight machines all the way from amoebas through primates before risking a man's life in orbit.

Approaches to Reliability

"Reliability" was a slippery word, connoting more than it denoted. Yet as an engineering concept it had basic utility and a recognized place in both aviation and missile technology. The quest for some means of predicting failures and thereby raising the odds toward success began modestly as a conscious effort among STG and McDonnell engineers only in mid-1959, after design and development work on major systems was well under way. Other engineering groups working in support of Project Mercury also began rather late to take special care to stimulate quality control and formal reliability programs for booster and capsule systems. Mercury would never have been undertaken in the first place if the general "state-of-the-art" had not been considered ready, but mathematical analyses of the word "reliability" both clarified its operational meaning and stirred resistance to the statistical approach to quality control.

The fifties had witnessed a remarkable growth in the application of statistical quality control to ensure the reliability of weapon systems and automatic machinery. The science of operations analysis and the art of quality management had emerged by the end of the decade as special vocations. Administrator Glennan himself, as president of Case Institute of Technology, had encouraged the development over the decade of one of the nation's foremost centers for operations research at Case.²¹ STG executive engineers studied an almost pedestrian example of these new methods for more scientific management of efficiency; it was one given by an automobile executive who compared the reliability of his corporation's product over 32 years before 1959:

If the parts going into the 1959 car were of the same quality level as those that went into the 1927 car, chances would be even that the current model would not run.

This does not mean that the 1927 car was no good. On the contrary, its quality was excellent for that time. But it was a relatively simple product, containing only 232 critical parts. The 1959 car has 688 such parts. The more the critical parts, the higher the quality level of each individual part must be if the end product is to be reliable.²²

In view of the fact that estimates showed over 40,000 critical parts in the Atlas and 40,000 more in the capsule, the awesome scale and scope of a reliability program for Mercury made it difficult to decide where to begin.

To organize engineering design information and data on component performance, someone had first to classify, name, or define the "critical parts." To create interrelated systems and to analyze them as separate entities at the same time was difficult. The Space Task Group and McDonnell worked on creation at the expense of analysis through 1959. Gradually NASA Headquarters and Air Force systems engineers steered attention to certain "semantic" problems in the primitive concepts being used for reliability analyses. For instance, what constitutes a "system"? How should one define "failure"? What indices or coefficients best "measure" overall system performance from subsystem data?²³

These and other features of reliability prediction were so distasteful to creative engineers that many seriously questioned the validity and even the reliability of reliability predictions. "Reliability engineering," admitted one apologist in this field, "may seem to be more mysticism and black art than it is down-to-earth engineering. In particular, many engineers look on reliability prediction as a kind of space-age astrology in which failure rate tables have been substituted for the zodiac."²⁴ Around STG this skeptical attitude was fairly representative. But at NASA Headquarters, Richard E. Horner, newly arrived in June 1959 as Associate Administrator and third man in command, had brought in a small staff of mathematicians and statisticians. It was led by Nicholas E. Golovin, who transferred from the Air Force to NASA some of the mathematical techniques lending quantitative support to demands for qualitative assurance. Theory-in-Washington versus practice-at-Langley were in conflict for a year until the nature of "reliability" for pilot safety on the one hand and for mission success on the other became more clearly understood by both parties. The pressure exerted by Golovin and NASA Headquarters to get the Task Group and McDonnell to change its approach to raising reliability levels became a significant feature in redesign and reliability testing during 1960.²⁵

Scientists, statisticians, and actuaries, working with large populations of entities or events, had long been able to achieve excellent predicitions by defining reliability as probability, but in so doing they sacrificed any claim to know what would happen in a unique instance. Engineers and managers responsible for a specific mission or project tended to ridicule probability theory and to call it invidiously "the numbers game." Being limited to a small set of events and forced by time to overlap design, development, test, and operations phases, they could not accept the statistical viewpoint. They demanded that reliability be redefined as an ability. The senior statistician at Space Technology Laboratories for the Atlas weapon system, Harry Powell, recognized and elaborated on this distinction while his colleagues became involved with man-rating the Atlas. His remarks indicated the STL and Convair/Astronautics faced the same divergence of opinion that NASA Headquarters and STG confronted:

If reliability is to be truly understood and controlled, then it must be thought of as a device a physical property which behaves in accordance with certain physical laws. In order to insure that a device will have these physical properties it is necessary to consider it first as a design parameter. In other words, reliability is a property of the equipment which must be designed into the equipment by the engineers. Reliability cannot be tested into a device and it cannot be inspected into a device; it can only be achieved if it is first designed into a device. Most design engineers are acutely aware that they are under several obligations - to meet schedules, to design their equipment with certain space and weight limitations, and to create a black box (a subsystem) which will give certain outputs when certain inputs are fed into it. It is imperative that they also be aware of their obligation to design a device which will in fact perform its required function under operation conditions whenever it is called upon to do so.²⁶

There is a rule in probability theory that the reliability of a system is exactly equal to the product of the reliability of each of its subsystems in series. The obvious way to obviate untrustworthy black boxes was to connect two black boxes in parallel to perform the same function. In other words, redundancy was the technique most often used to ensure reliability.

After the cancellation of Mercury-Jupiter, Kuettner and others at ABMA set about a serious effort to develop a parachute system to recover the Redstone booster. They also began to concentrate on the simplifications necessary for the sake of reliability to custom-build a man-rated Redstone. Starting with the advanced, elongated version of the rocket, which had been renamed the "Jupiter-C" in 1956 for the Army's ablation research on reentry test vehicles, Kuettner called upon the expertise of all who could spare time from the Saturn program to help decide how to man-rate their stock. The fundamental change made to the Jupiter-C airframe was the elimination of its staging capability. Other modifications stripped it of its more sophisticated components while permitting it to retain greater performance characteristics than the original single-stage Redstone.²⁷

The designers of the Redstone and Jupiter missile systems proposed an extensive list of basic modifications to adapt the vehicle to the Mercury capsule. The elongated fuel tanks of the Jupiter-C had to be retained for 20 extra seconds of engine burning time, especially since they decided to revert to alcohol for fuel rather than use the more powerful but more toxic hydyne that fueled the Jupiter-C. Another high-pressure nitrogen tank to pressurize the larger fuel tank and an auxiliary hydrogen peroxide fuel tank to power the engine turbopump also had to be added. To increase the reliability of the advanced Redstone, they had to simplify other parts of the Jupiter-C system. Instead of the sophisticated autopilot called ST-80, one of the first inertial guidance systems (the LEV-3 ) was reinstalled as the guidance mechanism. The after unit of the payload on the old Redstone, which had contained a pressurized instrument compartment, became the permanent forebody of the main tank assembly, there being no need to provide terminal guidance for the new payload. A spacecraft adapter ring likewise had to be designed to simplify interface coordination and to ensure clean separation between capsule and booster. At the other end of the launch vehicle it was necessary to use the most recent engine model, the A-7, to avoid a possible shortage of spare parts. Hans G. Paul and William E. Davidson, ABMA propulsion engineers, took the basic responsibility for "manrating" this engine.²⁸

Although STG engineers bought the Redstone in the first place because it was considered an "off-the-shelf" rocket, they gradually learned through Hammack's liaison with Butler that the Mercury-Redstone was in danger of being modified in about 800 particulars, enough to vitiate the record of reliability established by the earlier Redstones and Jupiter-Cs. Too much redesign also meant reopening the Pandora's box of engineering "trade-offs," the compromises between overdesign and underdesign. Von Braun's team tended in the former direction; Gilruth's in the latter. To use Kuettner's distinction, ABMA wanted "positive redundancy" to ensure aborts whenever required, whereas STG wanted more "negative redundancy" to avoid aborts unless absolutely essential.²⁹ This distinction was the crux of the dispute and the essence of the distinction between "pilot safety" and "mission success."

On July 22, 1959, STG engineers received a group of reliability experts from von Braun's Development Operations Division at Huntsville. Three decades of rocket experience had ingrained strongly held views among the 100 or so leaders of this organization about how to ensure successful missions. The ABMA representatives told STG that they did not play the "numbers game" but attacked reliability from an exhaustive engineering test viewpoint. Their experience had proved the adequacy of their own reliability program, carried out by a separate working group on a level with other engineering groups and staffed by persons from all departments in the Development Operations Division of ABMA. In conference with design engineers, ABMA reliability experts normally set up test specifications and environmental requirements for proving equipment compliance. STG felt sympathetic to this approach to reliability, but systems analysts at NASA Headquarters did not.

As for the prime contractor's reliability program, in the first major textbook studied by the astronauts, McDonnell's "Project Mercury Indoctrination" manual, distributed in May 1959, the pilots read these reassuring words:

The problem of attaining a high degree of reliability for Project Mercury has received more attention than has any other previous missile or aircraft system. Reliability has been a primary design parameter since the inception of the project.³⁰

Accompanying reliability diagrams showed over 60 separate redundancies designed into the various capsule systems, allowing alternate pilot actions in the event of equipment malfunctions during an orbital mission.

McDonnell specified three salient features of its reliability program in this preliminary indoctrination manual. First, by making reliability a design requirement and by allowing no more than a permissible number of failures before redesign and retesting were required, reliability was made a conscious goal from the beginning of manufacture. Second, five separate procedures were to implement the development program: evaluations, stress analyses, design reviews, failure reporting, and failure analysis. Third, reliability would be demonstrated finally by both qualification and reliability testing.

These assurances did not seem adequate; STG, as well as NASA-Washington, requested McDonnell to clarify its reliability policy in more detail and to hold a new symposium in mid-August to prove the claim that "reliability is everybody's business at McDonnell." McDonnell responded by changing its "design objective" approach to what may be called a "development objective" approach. The new program, drawn by Walter A. Harman and Eugene A. Kunznick, explicitly set forth mean times to failure and added more exhaustive demonstrations, or "life tests," for certain critical components. More fundamental assumptions were made explicit, such as: "the reliability of the crew is one (1.0)," and "the probability of a catastrophic explosion of the booster, of any of the rockets, of the reaction control system, or of the environmental control system is negligible."³¹ McDonnell's presentation at this symposium stressed new quality control procedures and effectively satisfied STG for the moment. Golovin and his NASA Headquarters statisticians were pleased to note refinement in sophistication toward reliability prediction in the capsule contractor's figures for the ultimate 28-hour Mercury mission. At the August 1959 reliability symposium, McDonnell assigned impressively high percentage figures as reliability goals for both mission and safety success:

To John C. French, who began the first reliability studies for Gilruth's group, this kind of table represented the "numbers game," mere gambling odds that might deceive the naive into believing that if not the fourth, then the third, decimal place was significant. French was an experienced systems engineer who recognized that numbers like these did mean something: obviously the authors felt the weakest link in the chain of events necessary to achieve mission success was the launch vehicle. McDonnell believed the safety of the astronaut would be ensured by the escape system, but the coefficient ".7917" diluted the confidence in overall mission success to ".7781." McDonnell and STG agreed that the onus was on the Atlas to prove its safety and reliability as a booster for the Mercury mission.

That point was not disputed by the men responsible for the Atlas. They professed even less confidence in their product for this purpose than the capsule contractor had. Not until November 13, 1959, did representatives of the Air Force Ballistic Missile Division and Space Technology Laboratories visit Langley to present in detail their case for a thoroughgoing plan to man-rate the Atlas as a Mercury booster. Harry Powell had prepared a carefully qualified chart that estimated that the reliability of the Mercury booster would reach approximately 75 percent only in mid-1961, and the first upbend (at about 86 percent) on that curve was to occur another year later.³² Such pessimism might have been overwhelming to STG except that no abort-sensing system was yet computed as a factor in this extrapolation. Also STG and STL agreed never to entertain the idea of "random failure" as a viable explanation.

Because aircraft designers and missile experts held different opinions about which systems should be duplicated, redundancy itself was often a subject of dispute. Passenger aircraft were provided with many redundant features, including multiple engines and automatic, semi-automatic, and manual control systems, so that commercial flight safety had been made practically perfect. But in the military missile programs of 1959, redundancy to ensure mission success had been relegated to the duplication of the complete missile, "by making and launching enough to be sure that the required number will reach each target."³³ In the age of "overkill," one out of four, for instance, might be considered quite sufficient to accomplish the destructive mission of the ICBM. Both McDonnell and the Task Group placed more faith in quality control procedures and in redundant system development than in mathematical models for reliability prediction during design.

In the course of further symposia and conferences during the autumn, the Space Task Group, working with military systems analysts and industrial quality controllers, learned more than it taught about improving reliability programs. Abe Silverstein, whose Headquarters office was retitled Space Flight Programs (instead of Development) at the end of the year, was especially eager to see STG set up its own reliability program, with procedures for closer monitoring of subcontracts.³⁴

But before STG could presume to teach, it had to learn much more about the mechanics of the Redstone and the Atlas. Mathews had his own mathematicians check the case histories for failures of every Redstone, Jupiter, and Atlas that had ever been launched. A statistical population of over 60 Redstone and about 30 Atlas launches yielded clinical diagnoses for generalizing about the most likely ways these boosters might fail. Gerald W. Brewer, Jack Cohen, and Stanley H. Cohn collected much of this work for STG, and then Mathews, Brandner of ABMA, White of STL, and others formulated some ground rules for the development of the two abort-sensing systems.

All the investigators were pleasantly surprised to find relatively few catastrophic conditions among the failures. Their biggest problem was not what to look for or when to allow the escape rocket to blast away but rather how to avoid "nuisance aborts." Such unnecessary or premature escapes would arise from overemphasis on pilot safety or "positive redundancy" at the expense of mission success. Long arguments ensued over several questions: How simple is safe? How redundant can you get and still have simplicity? How do you design a fail-safe abort-sensing system without overdesigning its sensitivity to situations less than catastrophic?³⁵

Without trying to define every term, Mathews and his associates agreed that only imminent catastrophic failures were to be sensed, that reliability should be biased in favor of pilot protection, and that all signals from abort sensing should be displayed in the spacecraft. Application of these ground rules to the Redstone led to development of an automatic abort-sensing system (AASS) that sensed "downstream" or fairly gross parameters, each of which was representative of many different types of failures. Merely "critical," as opposed to "catastrophic," situations were not allowed to trigger the escape system automatically. Such merely "critical" situations as partial loss of thrust, a fire in the capsule, deviation from flight path, or loss of tank pressure might possibly be corrected or tolerated. But catastrophic situations were defined as existing where there were no seconds of time for intelligent decisions, corrective actions, or manual abort. The abort system for the Mercury-Redstone sensed and was activated by such typical catastrophic situations as excessive attitude deviations or turning rates (leading to high angles of attack during high dynamic pressures and resulting in a structural breakup), as sudden loss of tank or bulkhead differential pressure in pressure-stabilized structures, as loss of electrical power in the control and instrument system, and as loss of thrust immediately after liftoff.³⁶

If any of these situations should arise, the automatic abort-sensing system was supposed to initiate an explosively rapid sequence of events. First, the engine of the Redstone would cut off (except during the initial moments over the launch site). Then the capsule would separate from the booster. And this would be followed by the ignition of the escape rocket, with acceleration up and away from the booster, and finally by the normal sequencing of events in the recovery phase of the launch profile.

During August, September, and October, the Task Group improved its understanding of the interrelated parts and procedures being developed for Mercury. New definitions were formulated in hardware and words. Some old worries - the heatshield, for instance - were abandoned as newer concerns replaced them. The success of Big Joe and the promise of Little Joe shots promoted confidence and sustained enthusiasm. At the end of this period optimistic forecasts were the rule, not only for booster readiness but also for firm operational schedules. The first Mercury-Redstone and Mercury-Atlas qualification flight tests were scheduled for launchings in May 1960. Even the final goal of Project Mercury, the achievement of manned orbital flight around Earth, still appeared possible by March 1961.³⁷

But as autumn blended into winter in 1959, optimism cooled along with the weather. The job of keeping snow clear of its own drive was difficult enough, but heavier equipment than that possessed by the Task Group was necessary to plow aside the drifts that sometimes covered the streets of interagency cooperation. In particular, the Mercury-Redstone schedule began to look progressively more snowbound in the early winter of 1959, largely because the capsule and the Atlas commanded primary attention.

At the end of August, Gilruth had proposed to Major General John B. Medaris, commanding ABMA, that the first attempt at a Mercury-Redstone launch from the Cape be set for February 1, 1960. This proposal represented a slippage of about four months since February 1959, when the initial understanding between ABMA and STG had been reached. But the prospects for rapid accomplishments in the next six months were brighter at Langley than at Huntsville, St. Louis, or the Cape. Plans to use eight Mercury-Redstones for ballistic training flights between February and October 1960 were still in effect, and STG also hoped to complete six manned Redstone flights by March 1961 before launching the first of the manned Mercury-Atlas configurations. Such optimism was not entirely the result of youthful naivete or of underestimates of complexity. In large part, target dates were set deliberately at the nearest edge of possible completion periods to combat Parkinson's Law regarding bureaucratic administration, that work expands to fill the time allotted for its completion.³⁸

Much of the fault for Redstone slippages must revert to STG for having canceled the Mercury-Jupiter series rather precipitously, thereby unceremoniously relegating the 4000 members of von Braun's division at Huntsville almost to "task element" status as far as Mercury was concerned. Although the Jupiter program per se was being phased out at ABMA, its sires, who sparked the entire Army Ordnance team, were sensitive to criticism of their strange love for space travel.³⁹ STG engineers should not have been surprised that the cancellation of the Mercury-Jupiter series would cause a reaction in Huntsville that would reverberate to the Cape and through Washington.⁴⁰

Although NASA Headquarters had carefully coordinated STG's recommendation in this matter, many other factors contributed to the change in the Mercury program management plans that forecast the slip of MR-1 past MA-1 on the flight test schedule. There were at least three technical reasons for the Mercury-Redstone slippages as well as several other, perhaps more important, psychological and policy-planning reasons for this change in the "progressive buildup of tests" principle.

Foremost among all causes of delay was the fact that the pacing item, McDonnell's production model of the Mercury capsule, took longer to build than anyone supposed it would.^4l Because systems integration within the spacecraft was lagging by several months, every other area would be delayed also to some degree. Secondly, the design and development of the abort-sensing systems for the Redstone and Atlas were attacked separately and not cross-fertilized. The basic dispute over safety versus success, or positive versus negative redundancy, could be settled only with actual flight test experience.

A third technical reason for the fact that the Redstone team, with its ready and waiting boosters, failed to lead off the series of qualification flight tests was related to the Teutonic approach to reliability. Long years of experience with rockets, together perhaps with some native cultural concern for meticulous craftsmanship, gave the von Braun group high confidence that most so-called "reliability" problems could be obviated by hard work, more flight tests, and intensive engineering attention to every detail. Elaborate operational checkouts were to be made at Huntsville and the Cape. STG agreed to these procedures in August, but by November time was clearly in contention between Huntsville and Langley. The Task Group wanted to launch its first three Redstones for Mercury during May and June 1960, but if this were possible, it was hardly advisable from ABMA's point of view.⁴²

By then, however, this could be considered a family dispute among stepbrothers within NASA. On October 21, 1959, President Eisenhower announced his decision, pending congressional approval, to transfer the von Braun group and the Saturn project from ABMA to NASA. If this decision solved a morale problem among members of the Development Operations Division at ABMA, it undoubtedly complicated certain institutional and political problems. Jockeying for position probably intensified rather than abated, as plans for the future use of the Saturn launch vehicle overshadowed Mercury for the moment. Another five months were required to complete a transfer plan, and eight months would elapse before the official transfer was completed on July 1, 1960.⁴³

Although the plans for the escape of a pilot from a malfunctioning Redstone were complex, plans for a similar emergency detection system on the Atlas were several times more complicated. Three engines, rather than one, with an overall range and thrust capability well over three times greater, and with guidance, gimbaling, and structural separation mechanisms far more complex than those to be used on the Redstone - these were some of the factors that put the problem of man-rating the Atlas on a higher plane of difficulty. The Mercury capsule escape system was, of course, the same for both boosters, but the emergency detection systems had to be tailored to the differences between the launching vehicles. The single-stage Redstone was a piece of battlefield artillery that could stand on its own four fins, for example, whereas the fragile "gas-bag" Atlas would crumple if not pressurized. And in flight, the Atlas' outboard engines must stage properly and drop away from the central sustainer engine before the escape tower could be jettisoned.

While Charles Wilson and his crew at Convair in San Diego worked out the detailed design and hardware for ASIS, Richard White led Space Technology Laboratories through more detailed analytical studies and simulation tests at El Segundo. Their concurrent efforts ensured that the airborne emergency detection system for the Mercury-Atlas evolved, as Powell insisted it must, with the steadfast goal of reliability. Inspection and test programs were inaugurated separately by Hohmann, beginning in October, but reliability was designed into the ASIS black box from May onward. Wilson and White soon discovered that their biggest problem concerned the prevention of recontact between booster and capsule after separation. Alan B. Kehlet and Bruce G. Jackson of STG had the primary responsibility to determine the proper thrust offset of the escape rocket and to ensure against recontact, but "Monte Carlo" probability analyses were done by both Convair and the Space Task Group.⁴⁴

In addition to the ASIS, the Atlas D had to be modified in a number of other ways before it could carry a man. Because the Mercury-Atlas configuration was taller by approximately 20 feet than the Atlas D weapon system, the rate gyro package for the autopilot had to be installed 20 feet higher on the airframe, so it would sense more precisely the rate of change of booster attitude during launch. The Atlas would not need posigrade rockets to assist separation because the Mercury capsule would embody its own posigrade rockets inside its retrorocket package. Because the capsule's posigrade rockets could conceivably burn through the thin skin of the liquid-oxygen dome, a fiber-glass shield covering the entire dome was attached to the mating ring. The two small vernier rocket engines, which on the ICBM had thrust on after sustainer engine cutoff, or "SECO," for last-minute trajectory corrections, were regoverned to delete the "vernier solo" phase of operation, thus saving more weight and complexity. In addition to the use of older, more reliable types of valves and special lightweight telemetry, only one other major booster modification was considered at first. The man-rated Atlas D would use the so-called "wet start" instead of the newer, faster "dry start" method of ignition. A water pulse sent ahead of the fuel into the combustion chambers would effect slower and smoother initial thrust buildup, minimizing structural stress on the engine before liftoff. This change saved approximately 60 pounds, by enabling the use of a thinner skin gauge in the Atlas airframe. But the "thin-skinned" Atlas soon proved to be too thin-skinned, and the weight saved was lost again in 1961, when a thicker skin was found to be essential in the conical tank section just under the capsule. The longer, lighter spacecraft payload proved a cause of additional dynamic loads and buffeting problems, calling for more strength in the Atlas forebody.⁴⁵

After additional study of the idiosyncracies of the Atlas missile, Mathews, Wilson of Convair, and White decided on the parameters most in need of monitoring for abort indications:

1. the liquid oxygen tank pressure,
2. the differential pressure across the intermediate bulkhead,
3. the booster attitude rates about all three axes,
4. rocket engine injector manifold pressures,
5. sustainer hydraulic pressure, and
6. primary electrical power.

Dual sensors gauging each of these catastrophic possibilities were fairly easily developed. If any one of these conditions should arise or any system should fail, the ASIS would by itself initiate the explosive escape sequence. But any one of four men with their fingers poised over pushbuttons also could abort the mission: the test conductor, the flight director in the control center, the range safety officer, or the astronaut with his left thumb would be able to decide if and when the escape rocket should be ignited. But these manual abort capabilities were only supplements, with built-in time delays, to the automatic abort sensing and implementation system. During the portion of the flight powered by the Atlas, human judgment was to be secondary to a transistorized watchdog autopilot. Their moral obligation to pilot safety made the Atlas redesigners reduce man-control to this minimum. Culbertson later explained, "While it was true that mission success provided pilot safety, provision for pilot safety did not always improve the probability of mission success"⁴⁶

One of the most important analytical tasks in man-rating the Atlas was the careful and continuous study of the mathematical guidance equations for the launch phase of all the missions. Three men at Space Technology Laboratories shared this responsibility, C. L. Pittman, Robert M. Page, and Duncan McPherson. While Convair was learning that it cost approximately 40 percent more to build a man-rated Mercury-Atlas than a missile system, STL's mathematicians and systems engineers, like Hohmann and Letsch, were working out their differences on how to control quality and augment reliability. By the end of 1959, Hohmann had sold his plans for pilot safety. They were based on applying supercharged aircraft production techniques to industrial practices for military missile production. To live with the Atlas required no less and eventually much more.⁴⁷

Critical Components of the Capsule

Basic as the boosters were for successful manned space flight, they were not the only machines that had to be certified for safety before a man's life could be entrusted to them. The capsule with all its systems and subsystems, designed to operate automatically on unmanned test flights at first, would also have to have reliable provisions for operation with a normal, or even with an incapacitated or unconscious, man aboard. Man-rating the spacecraft, therefore, involved the paradoxical process of dehumanizing it first for rehumanizing later.

When the seven Mercury astronauts first visited the McDonnell Aircraft Corporation laboratories and factory, for three days in May 1959, each was handed an indoctrination manual and given opportunities to inspect the mockup capsule and to review the requests for alterations made by the Mockup Review Board in March. Immediately they expressed some uneasiness about the poor visibility afforded by the two remotely placed portholes and about the difficulty of climbing out the bottleneck top of the capsule.⁴⁸ So, based on these and numerous other criticisms expressed by the men for whom these machines were being built, redesign studies were begun.

Just as Maxime Faget was the chief NACA-NASA designer of the capsule configuration and mission concept, so John F. Yardley, his closest counterpart in the McDonnell organization, was the chief developer of the Mercury capsule. Neither Faget nor Yardley was the nominal leader of the vast team within which each worked, but both animated the technical talents of their colleagues, from design through the final development stages of the Mercury hardware. John Yardley held a master's degree in applied mechanics, had worked for McDonnell since 1946 as a stress analyst, strength engineer, and project leader, and he was exceptionally talented in his capacity for work and for synthesizing technical knowledge. By telephone, teletype, and face to face, Faget and Yardley consulted each other about the multitude of detailed design and development decisions involved in production throughout 1959. But their bilateral agreements were restricted to details. Larger decisions regarding the development of systems or interaction between subsystems were reserved for the 17 different working groups in STG and the 10 or so at McDonnell. James Chamberlin instigated this capsule coordination system and gradually replaced Faget in relations with Yardley during the next year.⁴⁹

In 1959 the McDonnell Aircraft Corporation became the 100th-largest industrial company in the United States, employing approximately 24,000 people to produce goods (primarily the F4H-1 Phantom twin-jet fighter for the Navy) and services (mainly computer time, electronic equipment, and systems engineering) valued at $436 million. Within this corporate context, the contract with NASA for about $20 million to manufacture 12 or more spacecraft, requiring only 300 or 400 workers and representing less than five percent of McDonnell's annual sales volume, appeared rather minuscule. The president of the corporation, J. S. McDonnell, in September 1959 wrote for his twentieth annual report to stockholders that "there is no need to stampede away from the aircraft business."⁵⁰

When the prime contract for Mercury was awarded to McDonnell, the Corporation's vice-president for project management, David S. Lewis, assigned Logan T. MacMillan, a tall, tactful test pilot and mechanical engineer with a winning manner, to be companywide project manager with authority to mobilize the resources of the Corporation for the new venture. MacMillan, of the same age and rank as Faget, soon found it difficult to reconcile McDonnell's development and production phases with NASA's concurrent research and test phases. Time, cost, and quality control were interdependent, and now the astronauts and STG had called for major design changes in the window size and placement, the side entrance-exit hatch, the instrument panel, and switch accessibility. To his top management, MacMillan reported on July 18, 1959:

The Space Task Group is a rather loosely knit organization of former Research Engineers. The Coordination Office is an attempt to channel and control information and requirements against MAC more closely and is a good move. It is clear, however, regardless of whether or not it succeeds, the NASA philosophy of investigation and approval of the smallest technical details will continue, and request for changes will also continue. We will continue to handle this by being responsive to requests for studies and recommendations and to be as flexible as we possibly can to incorporate changes. It is imperative that we continue to improve our capability to make these studies promptly, submit change proposals to cover the increased work as soon as possible, and evaluate the effect of changes on delivery schedules rapidly.⁵¹

A month later MacMillan complained by teletype message directly to Paul E. Purser that coordination meetings were being held too frequently for effective action on items from preceding meetings. He suggested that later meetings be scheduled "for one month from time minutes are received at MAC." But the pace did not slow significantly; the finish line simply moved farther away.

MacMillan and Yardley, together with Edward M. Flesh and William Dubusker, two older, more experienced production engineers, supervised the bulk of the load for McDonnell in tooling up, making jigs and fixtures, and organizing their craftsmen and procedures for production. Kendall Perkins, McDonnell's vice-president for engineering, had deliberately assigned Yardley and Flesh, combining youthful enthusiasm and experienced caution, to start the manufacture - literally the handmaking - of the first spaceframe. The subsequent design and technical development at McDonnell was carried out under their direction.⁵²

By July 1959, Dubusker, the tooling superintendent, had completed McDonnell's first surgically clean "white room" for the later manufacturing phases, had taken on the job of manufacturing manager for Mercury, and had moved some 200 workmen onto the new production lines. Learning to fusion-weld titanium .010-inch thin in an encapsulated argon atmosphere was his first challenge and proudest accomplishment. But before the year was over, Dubusker had to contend with retooling for other unusual materials, with rising requirements for cleanliness, with stricter demands for machined tolerances, and with higher standards for quality control.

Flesh, the engineering manager, and Dubusker drew on all of McDonnell's experience with shingled-skin structures around jet afterburners for heat protection. Their machinists had previously worked with the patented metal, René 41, a nickel-base steel alloy purchasable only from General Electric, but arc-jet tests of the afterbody shingles on the outer shell of the capsule showed a need for some ingenious new fabricating techniques.⁵³

While Yardley and Flesh concentrated on developing the most critical components for the Mercury capsule, two other McDonnell employees began to play significant roles in man-rating this machinery. The company was fortunate to have its own so-called "astronaut" in the person of Gilbert B. North, another test-pilot engineer but one with a unique relationship for the NASA contract. He was always being confused with his identical twin brother, Warren J. North, who served Silverstein and George M. Low in Washington as NASA Headquarters participant and monitor in astronaut training. Gilbert North served McDonnell as chief human guinea pig in the St. Louis ground tests. Warren and "Bert" North actively promoted the incorporation of test-pilot concerns in the Mercury program from two standpoints outside STG.

Most of the astronauts and test pilots, including the North twins, instinctively resented the "interference" of psychologists and psychiatrists in Project Mercury. Willing to wager their careers and perhaps their necks on the automatic systems of the capsule and booster, the pilots preferred to study the reliability of the machines and to assume themselves adaptable and self-reliant in any situation. They were thus unprepared to discover that psychologists would be among their strongest allies in gaining a more active role for man during Mercury missions. Throughout 1959, arguments over the necessity for the three-axis handcontroller, as opposed to the more traditional two-axis stick and one-axis pedal control system, demonstrated these pilots' confidence in themselves. Distrusting what they regarded as tender-minded psychology and psychiatry, the astronauts-in-training studied hard to become more tough-minded electromechanical engineers. And indeed their first complaints regarding spacecraft design resulted in changes adopted formally during September for later models of the capsule.⁵⁴

John Yardley fortunately was not quite so tough-minded and recognized early an imbalance in detail design considerations. He insisted on having the cross-fertilization of parallel human engineering studies. McDonnell hired in February a "human engineering" expert, Edward R. Jones, to conduct studies of pilot tasks and to analyze the various ways in which the man might fail his machines. Proposing straightaway a thorough training regimen for the astronauts in procedures simulators, Jones went on to program a statistical computation of the human-factors implications of failures in the automatic systems in the Mercury capsule. By November 1959, Yardley and Jones together had convinced a majority of McDonnell engineers that man should more often be in the automatic loop than out of it.⁵⁵

Part of the problem faced by Jones, Yardley, and the astronauts in regard to human factors and the "inhuman" automatic control systems was the initial position taken by seven members of a study group at the Minneapolis-Honeywell Regulator Company in March 1959. Assigned to recommend approaches to mission analysis and cockpit layout, this group, led by John W. Senders, James Bailey, and Leif Arneson, had reported to McDonnell that since "this vehicle does not behave like an airplane … . There is no apparent need for a complex, highly integrated display configuration at a sacrifice of reliability."⁵⁶ Jones studied the Minneapolis-Honeywell reports carefully and said they expressed a "wooden man" approach. Assuming pilot safety would be provided for, Jones believed more provisions should be made for the pilot to assure mission success. In August, Jones and a colleague, David T. Grober, wrote for Yardley a description of the quantifiable differences between flying this spacecraft and flying aircraft. They admitted: "Primary control is automatic. For vehicle operation, man has been added to the system as a redundant component who can assume a number of functions at his discretion dependent upon his diagnosis of the state of the system. Thus, manual control is secondary."⁵⁷ But Jones and Grober pointed to at least eight ways in which automation for reliability could interact with the autonomy of the astronaut to vary the chances both for pilot safety and for mission success. They warned McDonnell's reliability engineers against assuming, as they had in their latest formal reliability program given STG, that the reliability of the astronaut is unity:

It has been assumed naively by those who are not familiar with the capsule that the operation of the systems will not be difficult because of the automatic programming of the normal mission and because of an assumed simplicity of the systems. However, preliminary analysis indicates that the operation of the capsule, considering the stringent mission requirements and the physiological environment, will be as difficult or probably more difficult than high performance aircraft. A vast number of different potential malfunctions may occur in the capsule's systems, and the isolation of these malfunctions can be extremely difficult. Mission reliability determinations assume the astronaut can detect and operate these systems without error.

Only three months later Jones read a paper before the American Rocket Society that, while not a reversal of primary and secondary control modes for the manned satellite, marked a symbolic shift from automation to monitored automatic flight. Man's function in space flight, argued Jones, should now be recognized as something more than secondary, if still less than primary:

Serious discussions have advocated that man should be anesthetized or tranquillized or rendered passive in some other manner in order that he would not interfere with the operation of the vehicle … . As equipment becomes available, a more realistic approach evolves. It is now apparent with the Mercury capsule that man, beyond his scientific role, is an essential component who can add considerably to systems effectiveness when he is given adequate instruments, controls, and is trained. Thus an evolution has occurred … with increased emphasis now on the positive contribution the astronaut can make.⁵⁸

Jones spoke, presumably, of the general attitudes prevailing around McDonnell. His fellow psychologist in STG, Robert B. Voas, supported his evaluation.

Nevertheless, until some Mercury missions were flown automatically to qualify the integration of all systems, man would not be allowed to fly one. Of all the critical systems in Mercury, therefore, the automatic controls, a part of which was the "autopilot," were most crucial for man-rating the capsule.

Guidance and control engineers in Project Mercury were often plagued by semantic confusions between the different electromechanical systems they designed and developed to stabilize, guide, control, or adjust relative motion. Their nomenclature helped confound confusion by the similarity of initials in official use to denote their orientation systems: ACS, ASCS, RCS, and RSCS all looked similar to men with other concerns, but some evolutionary reasons help explain the technical differences behind the initials. ACS, for Attitude Control System, applied specifically only to the Big Joe capsule, becoming a generic term in Mercury nomenclature after that launch in September 1959. In its place the redundant designation ASCS, for Attitude (or Automatic) Stabilization and Control System, grew up as a name for the autopilot, an airborne electronic computer that compared inputs of electronic sensory information with any deviation from preset reference points on gyroscopes or with the horizon. Outputs from the autopilot could then command small jets called thrusters to spew out small quantities of hot gas in order to maintain balance in space. These hydrogen peroxide jets, their fuel tanks, plumbing, and valves were called simply the RCS, or Reaction Control System.⁵⁹ The last of this quartet of initials, RSCS, requires a more thorough explanation.

In August and September 1959, the stabilization controls and drag-braking drogue chute were proving troublesome, and everyone in STG knew this. Provisions for the astronaut, or "human black box," in the control loop complicated every facet of the system, and yet the pilot had little choice over its operation. Robert G. Chilton, Thomas V. Chambers, and other STG controls engineers reconsidered the several different ways in which the Mercury capsule was being designed to act by chemical reflexes with complete self-control.

From the very beginning of controls design for a manned ballistic satellite, Honeywell had suggested using the same digital electronic system, for simplicity's sake, to control all Mercury flights. But this "simple" equipment was unnecessarily complicated for the first flight tests and could cause some unnecessary problems. Also, a direct mechanical linkage to a completely independent, completely redundant reaction control system had been provided to ensure that the pilot could adjust manually and proportionally his capsule's attitude in orbit. But this overweight and oversize manual redundancy, fundamental to the Mercury objective of testing man's capability as a pilot in space, was an exceedingly uneconomical part of the original design.

McDonnell and Honeywell controls engineers moved ahead with their development of the digital system while Chilton wrestled with the problem of raising the efficiency of the thirsty manual proportional thrusters. A wired jumper from the handcontroller to the jets for the ASCS should enable the astronaut to tilt or rotate his craft in its trajectory by electrically switching on and off the tiny solenoid valves that supplied hydrogen peroxide gas to the automatic thruster combustion chambers. Because this "fly-by-wire" system completely circumvented the autopilot, inserting the astronaut's senses and brain in its stead, it was not automatic. Rather, it operated semi-automatically; it would allow the pilot to aid or interfere with the automatic adjustment of rotation around his pitch, roll, and yaw axes. Thus in the autumn of 1959 the automatic attitude control system was already compromised by the addition of the semi-automatic fly-by-wire feature.

But this redundancy still seemed inadequate for mission success. Both McDonnell and STG controls engineers proposed various approaches to other attitude control systems for the Mercury capsule in the spring and summer, but Logan MacMillan resisted all such suggestions, awaiting NASA's formulation of a definite policy for judging the urgency of contract change proposals. Every change would invite inevitable delays, and the long lead time for a new alternate control system (an AASCS!) made MacMillan, Yardley, and Flesh very skeptical of that approach.⁶⁰

The fresh insight of one of the Canadians in STG's flight controls section, Richard R. Carley, helped Chilton to see the need for a second completely independent rate-command orientation system. Together they wrote a compromise proposal early in July that served as the midwife for a "rate damping" system for stabilization control:

There is a natural reluctance to relinquish the mechanical linkage to the solenoid valves but the redundant fly-by-wire systems offer mechanical simplification with regard to plumbing and valving hydrogen peroxide so the overall reliability may not change appreciably. In fact, considering the controlability of the capsule as a factor in mission reliability, a net gain should result. Simulation tests indicate that manual control of the capsule attitude during retrograde firing will be a difficult task requiring much practice on the part of the pilot. By changing the command function from acceleration to rate, the task complexity will be greatly reduced and the developmental effort on display and controller characteristics can be reduced accordingly.⁶¹

Out of interminable meetings and proliferating technical committees, a compromise did finally emerge. Chilton's group, together with J. W. Twombly of McDonnell, worked out the design for a semi-automatic rate augmentation system. By connecting three more wires from the handcontroller to the three pairs of solenoid valves guarding the fuel flow to the manual reaction jets, the designers built a bench version of a rate-command control system that utilized the small rate gyros formerly supplying the references only for cockpit instruments. For the production model, rate command fuel would be taken only from the manual supply tank. By the end of October, Chilton's group and Minneapolis-Honeywell had completed preliminary designs of this rate orientation system, now officially sanctioned as contract change No. 61 and called the "RSCS." But the difficult electrical circuit for its independent rate logic system was only in the breadboard stage: wires had been stretched over the two-dimensional drawings as a preliminary test of the circuit designs.

The manual proportional method of slewing the capsule around required an extravagant use of fuel, but the rate mode relegated the manual to a last-ditch method of attitude control. Now with "rate command," essentially another fly-by-wire system superimposed on the manual reaction controls, the astronaut might control precisely his movements in pitch, yaw, and roll by small spurts of gas that would tip him up or down, right or left, and over on one side or the other. The exact attitude of the capsule at the critical time of retrograde firing could be held by this method, and the slow-roll stabilization of the capsule during reentry also could be accomplished by this system. Thus the quest for reliability led to four different methods of orienting the capsule by the end of 1959. Making both the automatic mode (through fly-by-wire provisions) and the manual mode (through the rate command, or RSCS) redundantly operable gave the astronaut three out of four options.

McDonnell and STG already were working with nine major subcontractors and 667 third-tier vendors, and the effort to man-rate all their products and all these subsystems - indeed each part from tiny diodes to the pressure vessel - required thawing out and refreezing the specification control drawings several times. When at the beginning of October NASA approved the funds for installation of an explosive side-egress hatch, a trapezoidal observation window, and another stabilization and control system, McDonnell engineers had already undertaken these and consequent redesign requirements. This independent advance action was evidence of a more advanced approach to the need for concurrent development and production.⁶²

To save weight without sacrificing reliability, the electronic specialists - like all other Mercury design engineers - looked for microminiaturized, solid-state components. But they found less than they hoped. Miniature parts were evolving rapidly into microminiaturized parts, but the latter did not have good reliability records yet. Collins Radio Company, for example, holding the subcontract for capsule communications equipment,emphasized the conservative use of miniaturized but not superminiaturized components to achieve greater reliability.⁶³ Since the beginning of the development program the target of an effective capsule launch weight of 2,700 pounds had been overshot continuously, primarily because of slight but cumulative increments in electrical circuitry weights. Vendors consistently seemed to underestimate the weights of the parts they supplied. At the beginning of October the effective capsule weight was estimated at 2859 pounds. This seemed likely to grow to 3,000 pounds unless firm action was taken. A special coordination meeting in St. Louis at the beginning of October established a weight-reduction diet for the capsule development program and admonished NASA "all along the line to decide how much weight reduction should be sought and what items of capsule equipment should be sacrificed in order to achieve the desired reduction."⁶⁴

At the time STG was considering the RSCS, it was also thinking of eliminating the 17.5-pound drogue parachute in the interest of weightsaving. The "fist-ribbon" drogue stabilizer, six feet in diameter and composed of concentric and radial strips of nylon, was being tested at Edwards Air Force Base and at the El Centro Naval Parachute Test Facility, at subsonic and transonic speeds and at altitudes down from 70,000 feet over the Salton Sea. One of the first canopies, released at a speed of mach 1.08 from an F-104 jet fighter at an altitude above 10 miles, plummeted into denser air whipping, fluttering, and spinning so badly that it disintegrated after a minute of this punishment. This test had put a special premium on development of the rate stabilization control system.

The recent decision to substitute a ring-sail for the extended-skirt main landing parachute made Gilruth fear that there might not be enough experience with big parachutes to determine whether they had similar bad characteristics. Gilruth and Donlan were so unsettled by the chute tests in general that they appealed to Washington for an expansion of applied research programs aimed at the development of more reliable parachute systems:

It is apparent that the large load cargo type of parachute is far from as reliable as the personnel parachute that most people are familiar with. Part of this lack of reliability is due to unknown scale effects, perhaps. However, it is known that a great deal of this loss of reliability is due to the various fixes that are employed on large parachutes to attenuate the opening shock. Such fixes as extended skirts, slots, reefing, and other devices are designed to cause a parachute to open more slowly. Therefore, it is not surprising that this tendency to open slower is also accompanied by a tendency not to open at all.⁶⁵

Continued tests of the main parachute revealed few additional problems, but the drogue chute tests were getting worse. By the end of September the problem of drogue behavior at relatively high altitudes and barely supersonic speeds was so critical that the director of Langley thought it might be "easier to avoid than to solve."⁶⁶ All sorts of alternatives, including a flexible inflatable-wing glider proposed by Francis M. Rogallo of Langley,a string of discs trailing like a Chinese kite, and simple spherical balloons, were proposed as possible means of avoiding the instability of porous parachute canopies at high altitudes, where the air to inflate them is so rare.

Toward the end of 1959 still another lesson learned from studies of the aerodynamic stability of the capsule in the rarefied upper atmosphere added a slight refinement to the Mercury configuration. To break a possible "freeze" if the stable capsule should reenter the atmosphere small end forward, a spring-loaded destabilizing flap was installed under the escape pylon. Donlan and Purser asked George Low to explain around Washington why this "mousetrap" destabilizing flap was added to the antenna canister and why this innovation would require further wind tunnel tests:

The Mercury exit configuration ( antenna canister forward without escape tower) has been shown to be statically stable at mach numbers greater than four. This stability is undesirable because of the possibility of the capsule reentering the atmosphere antenna canister forward. Tunnel tests at a mach number of six have indicated that a destabilizing flap prevents this undesirable stability region. It is therefore necessary to know the effect of this destabilizing flap at subsonic and supersonic speeds.⁶⁷

Continued poor performance of the fist-ribbon drogue convinced Faget, Chamberlin, and Yardley by the end of 1959 that the drogue chute should be eliminated altogether, but Gilruth and Purser, among others, saw as yet no cheaper insurance and no more workable alternative.⁶⁸ The mousetrap destabilization flap and the rate stabilization system would help to fill only the mid-portion of the gap in the reentry flight profile. It was still a long way down from 100,000 to 10,000 feet above sea level - roughly 17 miles as a rock might drop. But by this time, the big questions concerning the first part of the reentry profile had been answered by the Big Joe flight.

Big Joe Shot

On the same day, September 9, 1959, both the major preliminary flight test of Project Mercury and the final qualification flight test of the operational Atlas ICBM occurred, in separate launches from opposite sides of the United States. While NASA and STG were focusing their attention on the performance of Atlas booster No. 10-D, being launched from Cape Canaveral, most of the men behind the Atlas were watching missile No. 12-D being launched from Vandenberg Air Force Base in California. A novitiate crew of Strategic Air Command (SAC) officers and men had groomed No. 12-D for this critical test flight southwestward over the Pacific Missile Range. Likewise, neophytes from NASA stood by their payload on the Atlas 10-D, awaiting the results of its southeastward flight over the Atlantic Missile Range. If all went well this day, the Atlas would have proved itself capable both as an operational ICBM and as a launch vehicle for a Mercury ballistic flight. Reliability was something else again, but capability could be proved with one demonstration.

The men from Space Technology Laboratories; from Convair/Astronautics; Rocketdyne; General Electric; Pan American, who managed the "housekeeping" of the Atlantic Missile Range; and numerous other contractors supporting the Air Force development of the Atlas, deserved to be called experts. They had had experience in launching this rocket. By contrast, NASA personnel were even greener than the SAC crew going through the countdown at Vandenberg. NASA did not intend to learn to launch its own Atlases, but STG did hope to gain some expertise for living through its launches. The job of launching Big Joe belonged to the Air Force, supported by the Convair/Astronautics team at the Cape - Byron G. McNabb, Travis L. Maloy, Thomas J. O'Malley, C. A. Johnston, and others. Charles Mathews, the STG mission director, learned much about his operational requirements working with these men on Big Joe.

Few people outside the military-industrial teams working on the Atlas could have known what was happening in the ICBM program in mid-1959.⁶⁹ The fourth and supposedly standard version of the Atlas ICBM, designated the Atlas D, rapidly supplanted the third development version, called Atlas C, during the summer of 1959. Earlier A and B models, fired in 1957 and 1958, had phased through C and into D concurrently. The Air Force had committed itself in December 1958 to supply NASA with standard Atlas Ds for all Mercury missions. The first installment on this commitment came due in September, at the same time that the weapon system was to prove itself operational. Since April 14, 1959, when the first series-D missile exploded 30 seconds after liftoff, only four other Atlas Ds had been launched, the second and third of which were partial failures or partial successes, depending upon one's point of view.⁷⁰

In July and August, however, the two successful Atlas-D launchings were supplemented by exceptionally encouraging flights of the last two series-C Atlases. Atlas 8-C had flown on July 21, bearing "RVX-2," or the first ablative reentry nose cone adapted to the Atlas. It was especially welcome to STG officials; both the flight and the recovery provided demonstrative evidence to reinforce STG's commitment to the ablation principle for the Mercury heatshield.⁷¹

Joe is a common name, but there was nothing common about the big Atlas missile and the Mercury payload that stood poised upright at launch complex 14 at Cape Canaveral on September 9, 1959. Some had hoped that Big Joe would skyrocket on July 4, but the launch date was postponed until mid-August by the Air Force because the booster did not check out perfectly at first. Then it was put off until early September by STG engineers, who were stymied by troubles in the sophisticated instrumentation and telemetry. Finally, on the evening of September 8, Atlas 10-D, the sixth of this model to be flight tested, stood on its launch pad at Cape Canaveral with a replica of the Mercury capsule (minus an escape tower) at its tip. All NASA waited for the countdown to begin at midnight. About a fourth of the Space Task Group members were at the Cape for the "Atlas ablation test." From this first full-scale, full-throttle simulation of the reentry problem, every member could expect further task definitions.

If Atlas 10-D should fail, if the boilerplate capsule should fail its test or be lost, then a backup shot, Big Joe II, would have to be made. But without proof that the ablation heatshield could actually protect a man from the intense frictional heat of reentry, and without dynamic evidence that the frustum-shaped spacecraft would actually align itself blunt-end-forward as it pierced the atmosphere, all the rest of the "R and D" invested in Faget's plan would avail little.⁷²

The nose-cone-capsule for Big Joe, handcrafted by NASA machinists, had no retrorocket package. The inner structure held only a half-size instrumented pressure vessel instead of a pressurized cabin contoured to the outer configuration. Built in two segments, the lower half by Lewis and the upper by Langley craftsmen, the main body of the spacecraft replica was fabricated of such relatively thin sheets of corrugated Inconel alloy in monocoque construction that the appellation "boilerplate" capsule was especially ironic.⁷³

For this model of the Mercury payload, more than a hundred thermocouples were installed around the capsule skin to register temperatures inside and under the heatshield, sides, and afterbody. Jacob Moser and a group of instrumentation specialists from Lewis had developed a multiplex system for transmitting data over a single telemetry link from all thermocouples plus 50 other instruments, including microphones, pressure gauges, and accelerometers.

Back in Cleveland, three controls engineers, Harold Gold, Robert R. Miller, and H. Warren Plohr, had designed a "cold-gas" attitude control system, using high-pressure nitrogen for fuel. They had worked directly with Minneapolis-Honeywell to devise the gyros, logic, and thrusters for the critical about-face maneuver after separation. It was essentially unique in its use of cold-gas nitrogen thrusters rather than the "hot-gas" hydrogen peroxide systems that Bell Aerosystems had developed for the X-15 program.⁷⁴

To STG novices watching the launch preparations, the Atlas and the organization of people it required to get off the ground seemed incredibly complex. But they themselves were not well organized even for their sole responsibility with the payload. Big Joe had three bosses, all at work under Mathews. Aleck C. Bond, the Langley heat-transfer specialist, had accepted from Faget almost a year ago the responsibility for the overall mission success. B. Porter Brown, the Langley engineer first sent to pave the way for STG at the Cape, acted as STG's chief liaison with the Air Force-Convair team. And Scott H. Simpkinson, leading the group of about 45 test-operations people from Lewis, had been living with the capsule for Big Joe in a corner of Hangar S since the second week in June, when checkout and preflight operations tests began. The NASA-Goddard crew still held most of the hangar space in preparation for Vanguard III, their culminating launch, scheduled later in September.⁷⁵

Porter Brown bore the title of NASA Atlas-Mercury Test Coordinator and worked - along with NASA Headquarters representative Melvin Gough - under nominal direction from the Missile Test Center. To fathom the complexity of launch operations and organizations at the Cape required expertise, tact, and drive. Security restrictions were so strict for the Atlas, and agencies and launch crews so compartmentalized, that horizontal or interpersonal communications in the lower echelons were virtually nonexistent. Brown had to keep vertical communications open and establish STG's "need-to-know" at every step.⁷⁶

To launch a missile required a stack of documents almost as tall as a gantry. Documents called "preliminary requirements," "operations requirements," "operations directives," "test directives," and innumerable other coordinating catalogs had to be circulated and their orders followed before, during, and after getting a rocket off the ground. To active young engineers with a mission, this paperwork could only be frustrating, but Air Force experience had shown the value of the documentation system in imposing order on a chaotic situation.⁷⁷

Atlas 10-D was programmed to rise, pitch over horizontally to the Atlantic before it reached its 100-mile peak altitude, then pitch down slightly before releasing its corrugated nose cone at a shallow angle barely below the horizontal. In the near vacuum of space at that altitude, tiny automatic thrusters in the capsule should make it turn around for a shallow reentry into the stratosphere. The friction of the air, gradually braking the speed of the descent, would dissipate the kinetic energy imparted to the capsule by the Atlas. An incandescent cauldron of this transformed energy would envelop the capsule like a crucible as it penetrated denser air. It was hoped that enough of this heat would be deflected by the slip stream and boiled away into the turbulent boundary layer of the shock-wave to protect the capsule from vaporization. This flight should simulate closely what a man must ride through if he was to live to talk about an Atlas-boosted, Mercury-returned orbital flight around Earth.

About 2:30 a.m., a 19-minute hold in the countdown was called to investigate a peculiar indication from the Burroughs computer that was to guide the launch. A malfunction was found in the Azusa impact prediction beacon, a transponder in the booster. Since there were several redundant means, including an IBM machine that was part of the range safety system, for predicting the impact point, the trouble was ignored, the countdown resumed, and liftoff occurred at 3:19 a.m.⁷⁸

It was a beautiful launch. The night sky lit up and the beach trembled with the roar of the Rocketdyne engines. For the first two minutes everyone was elated. Then suddenly oscillograph traces indicated that the two outboard booster engines had not separated from the centerline sustainer engine, as they were supposed to do when their fuel was exhausted. Flight controllers and test conductors in the blockhouse and control center began to worry about "BECO" (or booster engine cutoff) as contradictory signals appeared on their panels and computer readout rolls. Apparently all systems within the capsule were performing as planned, but the capsule seemed not to do its half-somersault. The added weight of the booster engines retarded velocity by 3,000 feet per second. The Burroughs computer predicted an impact point about 500 miles short. All eight reaction control jets seemed to be working perfectly, yet the reentry attitude could not be verified before the telemetry blackout occurred as the capsule skidded back into the atmosphere.⁷⁹ No one could ascertain what had happened during that 20-minute flight unless the recovery forces downrange could retrieve the capsule and its onboard tape recordings.

Six ships of Destroyer Flotilla Four began racing uprange at flank speed. Patrol and tracking planes started flying their search patterns. Before dawn, tracking ships and downrange tracking stations detected the sofar bomb explosion underwater, and provided new coordinates for the point of impact. As the sun rose over the sea, a Navy P2V Neptune patrol plane, homing in on a sarah beacon signal, reported sighting the capsule bobbing in the water. It vectored the nearest destroyer, now still over 100 miles away, to the green-dyed area for retrieval. It was still too early to tell whether the primary objectives of Big Joe had been achieved. But as the morning progressed, more evidence from the range made it appear that all telemetry had functioned properly. If the capsule could be recovered before it sank, the most important objective, finding out how well the capsule's ablation shield had endured reentry, could be evaluated quickly.

While eager newsmen at the Cape were being cautioned to avoid erroneously identifying this custom-built prototype as the Mercury capsule, technicians were busily analyzing "quick-look" data that would give more information about booster and payload separation performance, the attitude control system, the internal and external temperature history of the model, noise and vibration levels, telemetry and tracking effectiveness, and acceleration and deceleration peaks.

About seven hours after launch, exultation swept over the Big Joe launch team at the Cape when the destroyer Strong reported that she had netted the precious capsule intact and secured it on deck. The terrestrial return trip by water and air required another 12 hours. As soon as the transferring cargo plane arrived at Patrick Air Force Base, the capsule was loaded onto a dolly, and a police escort cleared the way for the shrouded trailer bearing the tangible remains of the Big Joe mission along the 15 miles through Cocoa Beach to Cape Canaveral.

When the capsule arrived back home in Hangar S, about midnight, every NASA person at the launch site that day gathered around the capsule for a joyous autopsy. Gilruth, Faget, Mathews, Bond, Brown, and Simpkinson stood by as someone dropped the canvas veiling the secret heatshield. The group marveled at the superb condition of their archetype. Bond ran his fingers over the now cool glass beads on the face of the ablation shield, noticed that the afterbody was barely singed. Brown scratched the white-paint legend "United States" and found it hardly discolored. Although one of the afterbody recovery eyes was welded shut by reentry heating, a piece of masking tape, which Simpkinson had allowed to remain, was still intact inside the outer conical shell. A tired but happy crew unscrewed the two halves of the inner pressure vessel and handed to Gilruth a letter that had been sealed inside and signed by 53 people under Mathews in anticipation of this occasion:

This note comes to you after being transported into space during the successful flight of the "Big Joe" capsule, the first full-scale flight operation associated with Project Mercury. The people who have worked on this project hereby send you greetings and congratulations.⁸⁰

Within a week, data reduction made possible the reconstruction of the inflight history of Big Joe. As suspected, the outboard engines had failed to stage after booster engine cutoff, and the additional weight degraded the Atlas velocity about 3,000 feet per second. This meant the trajectory of the flight path had been steeper and slightly lower than planned and that the sustainer engine had powered the capsule into a steeper downward course before burnout. Without a positive force to divide the two objects in free fall, the capsule had separated from the booster about 138 seconds late, after all of its high-pressure nitrogen fuel was expended in trying futilely to turn both booster and spacecraft around for reentry. When it finally broke loose from the launch vehicle at an altitude of 345,000 feet and at a space-fixed speed of almost 15,000 miles per hour, the capsule was an exhausted, passive, free-falling body. Yet by virtue of its configuration and center of gravity, the capsule turned itself around without the aid of either thrusters or damping controls and reentered the atmosphere successfully. The dynamic stability of the capsule configuration was so good that doubt of its ability to damp out its entry oscillations was also ended.

The heat pulse sustained in the actual Big Joe trajectory was shorter but considerably more severe than planned. If STG had been testing a beryllium heat sink shield, these untoward conditions would not have proved anything. For the ablation heatshield, the length of the heat pulse was sufficient to prove the value of the approach. The sequencing, structures, instrumentation, and cooling system had all worked well. The recovery of the capsule inspired so much confidence among STG leaders that Big Joe II, the backup launch, was canceled within three weeks.

Cores and slices taken from the conservatively designed heatshield at many locations proved that the heating was uniform over its face and that its structural integrity had survived impact without compromise. The depth of ablation charring was shallow enough to leave at least two-thirds of the fiber-glass material in pristine condition. Bond and Andre J. Meyer were especially pleased with the large margin for error represented by the thickness of the heatshield remaining. Subsequently, they were able to reduce the thickness and the weight of the shield by almost one half.

One note of caution remained in all the jubilation following Big Joe. Leonard Rabb, the head of Faget's theoretical heat transfer section, signed a memo on October 7 demanding action to prove that the short heat pulse on Big Joe could be disregarded. "Calculations indicate," said Rabb, "that the present Mercury heatshield will not survive a reentry due to natural decay." If retrorockets should be lost or become inoperative and if the ablation shield in orbit should have to sustain and dissipate the long, slow building of the heat pulse over 24 hours or so, catastrophe would result, Rabb warned:

Under no circumstances should the weight of the heat shield itself be shaved. Recent calculations cast doubt on the shield's performance, not only for natural decay reentry but for the one retro [rocket instead of three or two] case as well.⁸¹

By the end of October, the working papers giving the results of Big Joe were published, and gradually the lessons learned from this shot were incorporated in a number of major redesign decisions. The features that became standard for Project Mercury as a result of Big Joe have been summarized by Aleck Bond:

1. In view of the excellent performance of the ablation shield, the back-up beryllium heat sink shield was dropped from further consideration for Mercury orbital missions.
2. The basic heat shield fabrication techniques employed for the Big Joe shield were adopted for the Mercury heat shield.
3. The detailed temperature measurements made on the Big Joe shield provided for an efficient design thickness for the Mercury shield.
4. The afterbody heat transfer measurements indicated a need for heavier external thermal protection than had been provided for the Mercury spacecraft, and as a result the shingles on the conical afterbody were thickened and on the cylindrical afterbody the original René shingles were replaced with th thick beryllium shingles in order to handle the high heating loads in this region.

   * * *

   The ability of the spacecraft to survive the severe test of reentry from near-orbital velocities in spite of its unprecedented release conditions, is certainly worthy of note. The heat shield performance was excellent and the results indicated that the original design concepts were sound. The spacecraft performance as a freebody reentry vehicle was exceptional. An important characteristic of the Mercury design was demonstrated; that the spacecraft could reenter the atmosphere at high angles of attack and maintain the heat shield forward attitude without the aid of a control system!⁸²

The elation of the Task Group over the dynamic proof of its passive design of Mercury was not shared by the Atlas people. Their booster 10-D, having failed to stage, performed only marginally and in fact was classed a failure by the Air Force and STL. But across the country, on the Pacific Coast, Atlas 12-D, launched by the SAC crew under the tutelage of Convair/Astronautics and STL, performed as a true ICBM on a 5,200-mile flight to its target in the South Pacific. Immediately thereafter the Air Force announced the Atlas was now operational. Apparently the force-in-being totaled only the two missiles erected in training gantries at Vandenberg, but the delicate balance of power could not wait for the buildup of numbers.⁸³

Big Joe
Sept. 9, 1959

Little Joe Series

While the results of the Big Joe launch were being studied, a five-man investigating committee at Langley was trying to learn why the first Little Joe shot, on August 21, 1959, had miscarried so badly. Out at Wallops Island that Friday morning several weeks earlier, the first Little Joe (LJ-1) had sat on its launcher, tilted toward the sea, with a full-sized model capsule and escape system on top. Its test mission was to determine how well the escape rocket would function under the most severe dynamic loading conditions anticipated during a Mercury-Atlas launching. At 35 minutes before launch, evacuation of the area had been proceeding on schedule, and the batteries for the programmer and destruct system in the test booster were being charged. Suddenly, half an hour before launchtime, an explosive flash and roar startled several photographers and crewmen into diving for cover.

No one was injured, but when the smoke cleared it was evident that only the capsule-and-tower combination had been launched, on a trajectory similar to an off-the-pad abort. The booster and adapter-clamp ring remained intact on the launcher. Near apogee, at about 2000 feet, the clamping ring that held tower to capsule released and the little pyro-rocket for jettisoning the tower fired.⁸⁴

The accident report on LJ-1, issued on September 18, blamed the premature firing of the Grand Central escape rocket on an electrical leak, or what missile engineers were calling "transients," "ghost" voltages or currents, or simply a "glitch" in a relay circuit. The fault was found in a coil. It had been specially designed as a positive redundancy to protect biological specimens from too rapid an abort and as a negative redundancy to prevent inadvertent destruction of the test booster. Again the problem of upgrading the machines to provide safety for animal payloads as well as to ensure mission success had created unexpected problems. This first trial of the brand-new Little Joe test booster apparently had been too ambitious. Fortunately the momentum of the Little Joe test series was not disturbed by the debacle of the boilerplate payload on Little Joe No. 1.

North American Aviation finished and shipped on September 25, 1959, its sixth and last airframe for the Little Joe booster as promised. The Space Task Group therefore had available at the beginning of October all the Little Joe test boosters it had ordered. Designed primarily to man-rate the escape system operating from a Mercury-Atlas already in flight, the Little Joe booster also was committed to perform some biological research before fulfilling its primary mission.⁸⁵

More by coincidence than by design, the next three Little Joe boosters were launched from Wallops Island exactly one month apart in the autumn of 1959. Still the primary aerodynamic test objectives remained unfulfilled. But the fourth shot, in January 1960, finally worked precisely as planned. STG was satisfied that its own pilot safety provisions were viable under the worst possible aerodynamic conditions. The same kind of test on McDonnell's finished product, rather than on boilerplate demonstration capsules, perhaps could be made the following summer.

On October 4, 1959, the same booster that had been jilted by the capsule and escape rocket in August was finally fired, this time with a double dummy - an uninstrumented boilerplate model fitted with an inert escape rocket system. After the fiasco of LJ- 1, the more modest purpose of this test, which later became known as Little Joe 6 (LJ-6), was to prove the "reliability" of the whole booster propulsion cluster. All four Pollux motors, plus four smaller Recruit motors, were set to fire in sequence. Little Joe 6, 55 feet tall and weighing 20 tons at liftoff, blasted up to a peak altitude barely short of 40 miles; then it was intentionally destroyed after two and a half minutes of flight to prove the destruct system. Impact was over 70 miles from Wallops Island. All went well.⁸⁶

Satisfied that Little Joe had proved itself as a booster, the supervisory team of NASA engineers, consisting of John C. Palmer from Wallops, and Roland English, James Mayo, Clifford Nelson, Charles McFall of Langley, and William M. Bland and Robert O. Piland of the Space Task Group, prepared for a new effort to check the correct operation of the abort escape system at maximum loading conditions. The region called "max q" (for maximum dynamic pressure) by aerodynamicists is the portion of the flight path at which relative speed between the vehicle and the atmosphere produces the greatest air resistance on the vehicle. Many variables were involved, but roughly both Little Joe and the Mercury-Atlas were expected to experience dynamic pressures of almost 1,000 pounds per square foot at an approximate altitude of six miles after about one minute of flight time.

For the second attempt at this primary mission, Little Joe 1-A (LJ-1A) needed to propel another dummy capsule and pylon to the max q region. Both drogue and main parachute behavior were to be carefully studied on this flight. Surprised by the insistent demands from the news media to witness these developmental flight tests, STG gave the press a careful enumeration of situations that might call for a "hold" or a "scratch" of the shot.⁸⁷

On November 4, 1959, when the second Little Joe booster was successfully launched, newspapermen could see nothing wrong. The flight looked straight and true until the rocket was out of sight. But the test engineers in the control center observed that the escape motor did not fire until 10 seconds after the point of maximum dynamic pressure. The parachutes and recovery operations performed well enough to fulfill secondary and tertiary objectives, but precisely why escape was too slow was never fully understood. Later analysis showed only that the delayed ignition of the escape rocket caused the separation of capsule from booster at a pressure only one-tenth of that programmed.⁸⁸ Because the next scheduled launch of a Little Joe booster was already committed to a test for certain aeromedical objectives and was now in a late stage of preparation, the primary aerodynamic test of the escape system was postponed until January, when a third try, to be called Little Joe 1-B, could be made.

Back in May, STG had begun planning with the Air Force School of Aviation Medicine to include some biological packages in later Little Joe flights. The booster designated No. 5 was reserved specifically to qualify all systems in the McDonnell capsule, carrying a chimpanzee occupant and escaping from a simulated Atlas explosion at the point of max q.⁸⁹

After the disappointment of Little Joe 1-A, Donlan, Bland, and Piland decided to pull out the stops on Little Joe 2 and allow the aeromedical specialists to run all the experiments they wanted on a high-powered flight. The School of Aviation Medicine had made ready a biological package for its primate passenger, a small rhesus monkey named "Sam," after his alma mater. In addition to Sam's special capsule for rocket flight, the military physicians now prepared barley seeds, rat nerve cells, neurospora, tissue cultures, and insect packets to measure the effects of primary radiation, changes in appearance and capacity for reproduction, and ova and larvae responses to the space environment.

Little Joe 2 promised to be a spectacular flight if everything went as planned. The engineers could see how the capsule escape system would function under conditions of high mach number and low dynamic pressure; more important technically, they could measure the motions, aerodynamic loads, and aerodynamic heating experience of the capsule entering from the intermediate height of about 70 miles. The Air Force medical specialists might also learn about other things, but their chief interest was to see how well Sam himself would withstand weightlessness during the trip. This was also the chief interest of Alan B. Shepard and Virgil I. Grissom, who came to see this launch.⁹⁰

On December 4, 1959, just before noon, the third Little Joe, LJ-2, ripped through the air under full power and burned out at an altitude of 100,000 feet. The tower and capsule separated as planned and the escape rocket gave an additional boost, throwing the capsule into a coasting trajectory that reached its zenith just short of 280,000 feet, or 53 miles. This peak height was about 100,000 feet lower than expected because of a serious windage error, so Sam experienced only three minutes of weightlessness instead of four. He survived the mild reentry, the not-so-mild impact, and six hours of confinement before he was recovered by a destroyer and liberated from his inner envelope.⁹¹

Little Joe 2
Dec. 4, 1959

All preliminary indications reflected a highly successful flight. For the first time Little Joe had achieved full success on all three orders of its programmed test objectives. Congratulatory letters sped around the circuit among those responsible. It was a satisfying way to close out the year. But STG engineers knew that this full-performance test of the Little Joe was not the most crucial case for man-rating the Mercury escape system. They still had to prove that at max q, where everything conspired to produce failure, the escape system could be relied upon to save the life of any man who ventured into this region aboard an Atlas.

Later evaluations of Little Joe 2 were somewhat less sanguine. Biologists were disappointed: although results were better than on any previous biological space flight, they were still not good enough. STG engineers still awaited the more crucial test of the escape system under maximum aerodynamic stress. And the Mercury managers were disappointed at the way the news media had dramatized the animal experiments at the expense of the equally significant demonstration of technological progress.⁹²

Public information officers John A. Powers of STG and E. Harry Kolcum of NASA Headquarters tried to correct the "misplaced emphasis" in the news stories before the fourth Little Joe shot, Little Joe 1-B, occurred in January. By this time, Gilruth wished the press would note "the relatively minor role of this particular task in the context of the total Mercury program."⁹³ But again, to the reporters the star of the event was "Miss Sam," the female counterpart to the occupant of LJ-2, whose life was at stake and whose nervous system was to be tested in psychomotor performance tasks during the short but severe flight. Some of the newsmen perhaps knew or divined that several of the astronauts wanted to ride one of the next Little Joes into space.

Finally, on January 21, 1960, with the fourth launching of the Little Joe series, the escape system performed as planned at the point of max q.⁹⁴ Propelled by two Pollux main motors, Little Joe 1-B blasted up to the nominal altitude of slightly less than nine miles and attained a maximum velocity slightly over 2,000 miles per hour. Then the escape rocket kicked on the overdrive for an additional 250 feet in one second to "rescue" the Mercury replica from a simulated booster failure at that point. Over a range of 11.5 miles out to sea, Miss Sam, in her biopack prepared by medical technicians from Brooks Air Force Base and its School of Aviation Medicine, not only survived these severe g loads but also performed well (except for a 30-second lapse) at her business of watching for the light and pulling the lever. After 8.5 minutes of flight, during which the sequence system and capsule landing systems worked perfectly, Miss Sam touched down. She was recovered almost immediately by a Marine helicopter, and was returned in excellent condition to Wallops Station within 45 minutes after liftoff.⁹⁵

For half a minute after the escape rocket fired, the little rhesus monkey had been badly shaken up and did not respond to stimuli, but otherwise Miss Sam acted the role of the perfectly trained primate automaton throughout the flight. Evidence of nystagmus after escape rocket firing and after impact on the water did cause concern, for it suggested that an astronaut's effectiveness as a backup to the parachute system might be impaired. The internal noise level proved to be higher than expected, likewise causing some other worries over the provisions for communications and pilot comfort.⁹⁶

To this point, the Little Joe series of five actual and attempted flights had expended four of the six test boosters North American had made for NASA and five prototype capsules made in the Langley shops. The primary test objectives for these solid-fuel-boosted models were an integral part of the development flight program conducted within NASA by the Space Task Group, with Langley and Wallops support. Now only two Little Joe boosters remained for the qualification flight tests. North American had manufactured seven Little Joe airframes, but one of these had been retained at the plant in Downey, California, for static loading tests. STG ordered the refurbishment of this seventh airframe so as to have three Little Joe boosters for the qualification flight program. The success of Little Joe 1-B in January 1960 meant that the next flight, the sixth, to be known as LJ-5, would be the first to fly a real Mercury capsule from the McDonnell production line.⁹⁷ In passing from development flight tests with boilerplate models to qualification flight tests with the "real McDonnell" capsule, the Space Task Group moved further away from research into development and toward operations.

One World Network

From the beginning of 1959, the United States' first manned space flight program was committed to manned ballistic suborbital flights as prerequisite to a manned orbital flight, and to a world-wide tracking and communications network as a safeguard for its man in orbit. Both of these distinguishing features were means of man-rating its machines. The second began to be implemented only in the latter half of 1959, after NASA Headquarters had relieved STG of the burden of the network.

Neither suborbital flight nor the tracking network for Mercury was established with any real notion of what the Soviets were doing toward a manned space flight program. But that the Soviets were doing something toward this end was made perfectly clear by Premier Nikita Khrushchev during his autumn tour of the United States. Having presented President Eisenhower with a medallion of the Soviet coat-of-arms borne by Lunik II, the first manmade object to hit the Moon, Khrushchev visited Hollywood, Iowa cornfields, and the Presidential retreat at Camp David. His departure coincided with press announcements that Soviet pilots were training for an assault on the cosmos. The first pictures of the back of the Moon, made by Lunik III on October 4, demonstrated impressive Soviet sophistication in guidance, control, and telemetry, if not in photography.⁹⁸

If various American government agencies late in 1959 knew more than the public did about the probable speed and direction of the Soviet manned space program, this information was not passed down to the Space Task Group. Top administrators in Washington were undoubtedly accorded "need-to-know" briefings on Soviet progress, but at the working level around STG at Langley there was no such privileged information on the so-called "space race." In fact, not until mid-December did STG learn some of the operational details of Air Force programs then being conducted on the West Coast. Even the Dyna-Soar program, so heavily influenced by Hartley A. Soulé, John W. Becker, and others at Langley, seemed at times to be out of reach to Mercury engineers.⁹⁹

In the "spirit of Camp David" the seven astronauts themselves proposed an exchange of visits and information with their Soviet counterparts, but to no avail. Proof that the United States and the Soviet Union could agree was shown in the Antarctic Treaty signed by 12 nations, including the two giants, on December 1, 1959. In the same spirit only a week later the NASA Administrator offered the services of the Mercury tracking network in support of any manned space flight the U.S.S.R. might care to undertake, but this offer also was stillborn. So sparse seemed available official information on Soviet manned space plans that Paul Purser, as special assistant to Gilruth, assumed an extra duty by beginning a scrapbook of published accounts relating to Soviet manned space flight plans.¹⁰⁰ It would have been "nice to know" in more detail what the Soviets were planning and how well they were proceeding, but STG's "need to know" was mainly psychological curiosity. Such information, if available, probably would have made little difference to the technological momentum of Project Mercury at the end of 1959. The impetus generated for the project by that time was truly formidable and still accelerating.

NASA Headquarters had relieved STG of developing the global range network in the spring of 1959, believing that the Tracking and Ground Instrumentation Unit (TAGIU) at Langley and the communications center at Goddard Space Flight Center together could develop radar and radio facilities more expeditiously. The wisdom of this assignment would prove itself; the communications network was never a cause for delay in Mercury operational schedules.

The decision to build an extensive new tracking network girdling the globe had derived largely from Langley studies of operational tracking requirements made by Edmond C. Buckley, Charles Mathews, Howard C. Kyle, Harry H. Ricker, and Clifford H. Nelson in the summer of 1958. Then followed four extensive and independent studies by Massachusetts Institute of Technology, Ford, Space Electronics, and Radio Corporation of America in the spring of 1959. Many interrelated technical, operational, and diplomatic considerations were involved in the evolution of the network, with pilot safety and limited capsule battery power setting the first standards.

Next to manufacturing the capsule itself, the Mercury network was the most expensive part of the entire program. But that network represented a capital investment in tracking and communications ability that NASA would also use effectively for scientific satellites and space probes. The full compass of the tracking range and communications network built for Project Mercury is beyond the scope of this volume, but salient features of the chain of tracking stations, of the communications grid, and of the ground instrumentation planned for Mercury set other basic parameters for the project. Hartley A. Soulé, the aeronautical scientist who directed Langley's part of the establishment, made a circumnavigation of the Earth to prepare the circumferential path for orbital overflights.¹⁰¹

When Christopher Kraft spoke to the Society of Experimental Test Pilots on October 9, 1959, he explained certain of the major criteria used to choose the orbital plane for Mercury and to select ground stations to monitor the man in orbit. "Since the first manned orbital flight will be a new type of operation involving many new experiences," Kraft said, "it would be desirable to keep the time in orbit as short as practical, while at the same time making an orbital flight." Emphasizing the necessity to secure an accurate and almost instantaneous determination of the potential orbit before actual insertion, as well as an exact retrofiring point and thereby a low-dispersion "footprint," or recovery area, Kraft explained how the first manned orbital mission should shoot for three rather than one or two orbits. He also listed four specific reasons why the best orbit inclination to the equatorial plane would be 32.5 degrees and the most desirable launching azimuth, or direction, would be 73 degrees true: (1) maximum use should be made of existing tracking stations and communications facilities; (2) the Atlantic Missile Range should be used for both the launching and the planned recovery area; (3) the orbital track should pass directly over the continental United States as much as possible to maximize unbroken tracking, especially during reentry; and (4) the orbital path should be planned to remain over friendly territory and temperate climatic zones.¹⁰²

These criteria constrained the choice of both Mercury's orbital plane and its launching azimuth. East-northeast was an unusual firing direction from Cape Canaveral, where ballistic missiles were normally shot southeastward down the Atlantic range. Taking the sinusoidal track displaced for each orbit as it would look on a Mercator world projection, Soulé, Francis B. Smith, and G. Barry Graves of Langley, Mathews, Kraft, and Kyle in STG, and many others resolved the complex trades between the Atlas booster characteristics, capsule weight limitations, launch safety considerations, suitable recovery areas, existing Defense Department tracking and communications networks, and available land for locating instrument stations. Soulé and his Tracking Unit at Langley shouldered most of the responsibility for the compromises between what should and could be done with electronic communications and telemetry to promote pilot safety and ensure mission success.

While STG delegated such decisions as whether to select sites in Kenya or Guadalcanal, where to use C- or S-band radars, and whether to lay a cable or build a redundant control center on Bermuda, it kept tight control on all matters affecting control of the missions and especially of the decisions on orbital parameters. John Mayer and Carl Huss, leading STG's Mission Analysis Branch, had learned their celestial mechanics from the traditions established by Johannes Kepler, Sir Isaac Newton, and Forest R. Moulton, but from 1957 through 1959 more and more data from various artificial satellites continually refined their calculations. Keeping in close touch with STL on the improving Atlas performance characteristics, Mayer's group sought to establish the ideal "launch window" or orbital insertion conditions. Not until May 1960 were these parameters established.¹⁰³

John D. Hodge, another Anglo-Canadian, who helped Mathews learn how the Defense Department launching and tracking teams operated at the Atlantic and the Pacific missile ranges, explained how the major compromise on man-rating the worldwide network was achieved in 1959. Physicians like Lieutenant Colonel David G. Simons, of Project Manhigh fame; Major Stanley C. White, on loan to STG from the Air Force; and Colonel George M. Knauf, the staff surgeon at the Air Force Missile Test Center, had argued for continuous medical monitoring and complete voice and television coverage around the world. Physicist-engineers, like Soulé, Smith, and Graves, saw these demands as virtually impossible. The doctors were forced to retreat when asked what could possibly be done after diagnosis had been made on an ailing astronaut in orbit. Twenty minutes would be the absolute minimum time required to return him to Earth from orbital altitude after retrofiring. "Aeromedical clinicians finally had to agree late in 1959," said Hodge, "that they could do little if anything to help the astronaut until he was recovered." Once in orbit the pilot's safety primarily depended upon mission success. Mission success depended at this stage primarily upon positive control over reentry and recovery operations. The ground command and tracking systems were consequently more important than complete voice or telemetry coverage.¹⁰⁴

Aside from the tight security surrounding the Atlas ICBM, perhaps the most closely guarded operational secret in Project Mercury was the ground control command frequencies established at strategic points around the Earth to enable flight controllers to retrieve capsule and astronaut from space in case of extreme necessity. Unlike the technological secret of the heatshield, this highly reliable command system was not classified as an industrial production secret, but rather to avoid any possible tampering or sabotage by electronic countermeasures.¹⁰⁵

Once the specifications for the tracking and ground information systems for Project Mercury had been drawn up and distributed at a bidders' briefing on May 21, 1959, the Tracking Unit at Langley proceeded to select a prime contractor for the tracking network. In mid-June the organization, membership, and procedures for a technical evaluation board and source selection panel were specified. A month later the evaluation of industrial proposals was completed. The Western Electric Company, supplier of the parts and builder of the network for the American Telephone and Telegraph system, won the prime contract to build the Mercury network. After NASA sent Western Electric a letter of intent on July 30, 1959, Rod Goetchius and Paul Lein began organizing the resources of Western Electric for Project Mercury.¹⁰⁶

Soulé arranged for six site survey teams chosen from his group at Langley to travel over Africa, Australia, various Pacific islands, and North America to choose locations for communications command posts. Much of the traveling Soulé did himself; he enjoyed both the technical intricacy and the scientific diplomacy of getting foreign scientists to urge their governments to cooperate for the tracking stations.¹⁰⁷

Meanwhile NASA Headquarters acquired from the National Academy of Sciences Arnold W. Frutkin, who had had experience during the IGY in dealing with the State Department and foreign governments for international cooperation in scientific affairs. Beginning in September 1959, Frutkin laid the staffwork basis with the United Kingdom for Mercury tracking stations in Nigeria and Zanzibar. Zanzibar and Mexico in particular appeared reluctant to accept at face value the United States' good - that is, civilian - intentions for Mercury. The President's brother, Milton Eisenhower, personally obtained consent for full Mexican cooperation.¹⁰⁸

By the end of November, preliminary designs for the Mercury tracking network were almost completed and a five-company industrial team was developing facilities. Western Electric had subcontracted to the Bendix Corporation for the search radars, telemetry equipment, and the unique display consoles for each site. Burns and Roe, Inc., took over the engineering and construction of the buildings, roads, towers, and other structural facilities at 14 sites. International Business Machines Corporation installed the computers at Goddard Space Flight Center, the Cape, and Bermuda, and supplied programming and operational services. Bell Telephone Laboratories, Inc., designed and developed the operations room of the Mercury Control Center at the Cape, and furnished a special procedures trainer for flight controllers as well as overall network systems analysis.

Eighteen ground stations were chosen for terminals in the communications network. Eleven of these sites, equipped with long-range precision radar equipment, would double for the tracking system. Sixteen of the stations were to have telemetry receivers, but only 8 of the 18 would be located on military missile ranges where existing radar and other facilities could be used. One new station (at Corpus Christi, Texas) would have to be established in the United States. Two stations were mobile, located on tracking ships at sea; seven were built in foreign countries. In November 1959, the total cost for the system was estimated at $41,000,000. The target dates for operational readiness were set as June 1, 1960, for suborbital Atlantic missions and as New Year's Day 1961 for worldwide operations.

The tracking and communications network for Project Mercury was a monumental enterprise that spanned three oceans and three continents by means of approximately 177,000 miles of hard-line communications circuitry. Although most of these wires were leased, the subtotals were likewise impressive: 102,000 miles of teletype, 60,000 miles of telephone, and over 15,000 miles of high-speed data circuits - plus the microwave radio telemetry and telecommunications circuits, which are not so easily described in linear distances. Although colossal in conception and execution, the Mercury tracking and communications network fell far short of 100-percent voice contact, telemetry contact, or tracking capability, not to speak of complete television coverage, which some aeromedical designers would have included.¹⁰⁹

Despite NASA's boast about "real-time," or instantaneous, communications, the historical novelty of the Mercury communications network lay less in the temporal than in the spatial dimension. So-called "instantaneous" communications were born in the l9th century with the installation of "speed-of-light" wired communications - the telegraph, submarine cables, and the telephone. Neither radio nor radiotelephone of the 20th century brought strategic placement of telecommunications installations into such a unified network that the time of signals from antipodal sides of the world could be reduced to an "instant." Transoceanic telephone conversations between Hong Kong and Houston, for example, still delayed responses by enough time to give one the feeling of talking to oneself. Synchronous communications satellites supposedly would soon change all this, but surface communications used for Mercury operations cost some slight, but nonetheless real, time in transmission. The real innovation of the Mercury network lay in its combination of extremely rapid communications lines, linked and cross-linked around the world, culminating in digital data processing, which displayed its results in Florida virtually as soon as computed in Maryland.¹¹⁰

Only the development of digital electronic computers in recent decades made possible quick enough data digestion and display to allow communications engineers to speak of "real-time" presentations for Project Mercury. Telemetry grew more sophisticated separately in industrial and military circles until biomedical telemetry became by 1959 a recognized part of the margin of safety for manned space flight. But computer technology did not suffer this kind of bifurcated development. In fact, commercially sold digital computers were ready and actually operating under canvas tents while workmen were laying block and brick for the permanent building to surround them. No construction time could be lost if the communications and computing center was to be completed at the Goddard Center early in 1960.¹¹¹

Harry J. Goett, formerly chief of Ames' Full Scale and Flight Research Division, took the reins as director of Goddard in September 1959. He found that the nucleus of some 150 Vanguard people had grown to approximately 500 employees. After Vanguard III finally terminated that program successfully on September 18, about one third of Goddard's complement turned to developing the facilities and teamwork for a space operations data control and reduction center. Actual direction of all Mercury computer programming was done from Langley by J. J. Donegan and H. W. Tindall, Jr., of the Tracking and Ground Instrumentation Unit. But in August 1959, John T. Mengel of Goddard conferred with Soulé; together with Edmond Buckley of NASA Headquarters they decided to assign about 14 senior engineers to specific Mercury problems. From October 1959 over the next 18 months this Goddard staff tripled in size and then doubled again when the Tracking Unit's responsibility and key men were transferred to Goddard.¹¹²

To raise the reliability of the computers and telemetry used in Project Mercury, redundancy and cybernetics were again incorporated in design. For example, "real-time multi-programming" was the name for a technique and some hardware developed as digestive aids for Mercury data processing machines. M. J. Buist and G. M. Weinberg of Goddard tried to describe their efforts to achieve "real-time" data:

The problem … is to develop a real-time computer system capable of receiving input arriving at asynchronous times and at different rates of transmission with minimum delay. It must be capable of performing mathematical computations while input is being received and edited. Simultaneously, it must send out information to numerous sites in varied formats and at varied speeds without human intervention.¹¹³

For this purpose two IBM 7090 transistorized computers were installed at Goddard, in Maryland. Two older model IBM 709 vacuum tube computers, one installed for NASA on Bermuda and the other an Air Force "IP" (impact predictor) for the Range Safety Officer at the Cape, were modified to handle a computer logic designed with equivalent alternative programs rather than with the usual subroutines. By means of special memory traps and automatic switching, the most critical data reduction operations were redundantly programmed into the IBM machines to ensure cross-checks on the man-rated machines in orbit.

Curiously, the difference between the IBM 709s and 7090s, so far as reliability was concerned in 1959, was the same difference the Mercury team encountered with miniaturization techniques. Although solid-state electronic devices like transistors, printed circuits, and molectronic capacitors promised tremendous savings in space, weight, and trouble-free operation, they were as yet so new that their reliability was not proved. The two 7090s at Goddard, therefore, were necessary redundancies for the heart or brain of the global tracking and target acquisition grid. The two independent and separate 709s at the Cape and Bermuda, amply stocked with spare parts, had the more limited but no less critical job of computing whether orbital launch conditions had been met. The two new transistorized computers at Goddard should man-rate the worldwide Mercury switchboard and data reduction. The older, more reliable vacuum-tube computers in the Mercury launch area should ensure nearly perfect orbital insertion conditions before the point of no return.¹¹⁴

That point of no return was first selected as insurance against landing in Africa. Later refinements to the "go/no go" decision point incorporated parameters from the standardized atmosphere, better drag coefficients, perturbation theory, preferred recovery areas, the improved Atlas booster, and the heavier Mercury capsule. These and many other intertwined considerations made the efforts of man-rating the machines for Mercury seem almost as limitless a task as space is a limitless continuum. They had the effect of canceling, for the time being, STG's hopes for an 18-orbit, or day long, final Mercury mission.

By the end of 1959 Project Mercury was well under way on many different fronts. The American astronauts, supposedly shifting from academically oriented training to practical engineering and operational exercises, were widely known as men in training to challenge the impressive Soviet performances in space. Most recently, Lunik III had photographed the unknown side of the Moon for the first time. A few Soviet names and faces appeared in Western publications as challenging indications that the U.S.S.R. too was training pilots for space flights. But the imagination and hopes of the American people were pinned on the seven of their own, each of whom had the chance of being the first human being to orbit Earth. Publicized in accord with the law and in response to public demand, the plans and progress of Project Mercury were for the most part open knowledge. NASA Headquarters was swamped with inquiries of all kinds from all sorts of people. The field managers of Mercury had ruefully discovered that people, or at least reporters, were more interested in people than machines, so they allowed "Shorty" Powers to skew publicity toward machine-rating the men rather than man-rating the machines.¹¹⁵