Handbook Corrosion (1992) WW Part 12 docx

Where susceptible materials were used, the supplier was required, at the minimum, to take the following actions to reduce stress-corrosion problems to the extent feasible: • Select less

Fig 2 Profile of shuttle mission Each shuttle orbiter can fly a minimum of 100 missions and carry as much as

29,500 kg (65,000 lb) of cargo and up to seven crew members into orbit It can return 14,500 kg (32,000 lb) of cargo to earth klb = 1000 lb; klbf = 1000 lbf

The requirement to achieve a minimum-weight orbiter (68,000 kg, or 150,000 lb, dry weight) has necessitated use of the most efficient structural materials and processes The requirement for 100-mission reuse has extended advancements in thermal protection materials well beyond the state-of-the-art existing at the inception of the design

Corrosion Control Program: Space Shuttle Orbiter

The key to a successful corrosion control program for the space shuttle orbiter was to develop sound technical and management programs Although the major structural parts of the orbiter, such as the wings, tail, fuselage, and cabin, were manufactured by only a few companies, it was estimated that more than 20,000 suppliers were responsible for providing systems and parts for the vehicle It was necessary to review and control all orbiter parts to provide the high levels of reliability required

The material and process management program consisted of the following key elements:

• A material and process group in engineering

• A drawing review system requiring sign-off by a materials engineer

• A tracking system for all materials

• An orbiter materials and process control specification

• A corrosion-control and finishes specification

• A stress-corrosion control plan

Each material application was reviewed by a qualified material and process engineer who had sign-off authority on drawing, engineering orders, and material rework dispositions A material tracking system was set up at the inception of the program to prevent 12 material-related hazards from occurring on the orbiter These include controls for atmospheric corrosion and stress corrosion, fluid and propellent incompatibilities, age life, flammability, toxicity, offgassing, and condensation of volatile condensible matters Materials and finishes were identified, evaluated, and, when accepted, entered into a computer Material identification even included those materials used in minute quantities, such as the ink used to stamp part numbers or the nearly invisible cetyl alcohol lubricants on fasteners A master directory (index) of the behavior of each material in the 12 hazardous categories was maintained and used as a reference

In each hazardous category, a series of encoded, acceptable engineering approaches for each "buyoff" was listed to assist the engineer For example, a part may be made from a material having a stress-corrosion threshold of 50% of its tensile yield strength, yet be acceptable because:

• It is adequately coated

• It experiences no significant tensile stresses in the critical stress-corrosion direction (including residual and installation stresses)

• It is in a benign environment, such as the cabin

In a few cases, the complexity of the part, such as a motor, precluded a separate evaluation of each material, and the entire configuration was qualification tested in its intended-use environment to avoid these hazards

A Material and Process Control Specification (MC999-0096) was placed on all major subcontractors A similar specification controlled parts that were designed and manufactured in-house These specifications included controls for fluid systems compatibility, stress corrosion, atmospheric corrosion, and galvanic corrosion The controls imposed are summarized below

Control of Fluid Systems Compatibility. A fluid systems compatibility analysis is required that covers all fluids and materials used in the system, such as testing, processing, inspection, and operation, along with known or expected trace contaminants Fluid system compatibility refers to interaction problems involved with materials and the liquid or gaseous subsystems The problems experienced generally fall into the following categories:

• Autoignition: Spontaneous ignition of the material or the fluid

• Impact ignition: Ignition brought about by shock or impact within the fluid

• Catalytic reaction: Reactions such as the catalytic decomposition of the fluid

• Material degradation: This includes such phenomena as chemical attack, corrosion, galvanic corrosion,

stress corrosion, hydrogen embrittlement, and crack growth acceleration with metals and includes embrittlement, abnormal swelling, leaching of plasticizers, ultraviolet degradation, and so on, with nonmetallic materials

• Fluid degradation: Reactions in which the physical or chemical characteristics of the fluid are altered

• Potential ignition: Ignition due to proximity to electrical ignition sources

Materials selection was required to minimize the compatibility problems with the fluid systems Material-fluid combinations that result in autoignition, impact ignition, or another catastrophic mode of failure were not permitted

The use of electrical and electronic components exposed to nondielectric fluid systems was avoided Buyer approval was required prior to using electronic components in hazardous fluid systems

Metallic materials listed in Appendix I of MC999-0096 are rated for compatibility with gaseous oxygen (GOX), liquid oxygen (LOX), nitrogen tetroxide (N2O4), hydrazine (N2H4), monomethyl hydrazine (MMH), and low-pressure ( 3.1 MPa, or 450 psi) and high-pressure (>3.1 MPa, or 450 psi) hydrogen Nonmetallic materials listed in Appendix II of MC999-0096 are rated for compatibility with low- and high-pressure GOX, LOX, N2O4, N2H4, MMH, liquid hydrogen, and hydraulic fluid

Materials that are compatible and noncompatible with titanium are listed in MF0004-018

Lubricants for static service with special fluids (application to elastomers, metals, and threads) are:

Fluid Lubricant

Ammonia Krytox 240 AC; Braycoat 3L-38RP; Braycoat 815Z oil

Deionized water Krytox 240 AC; Braycoat 3L-38RP; Braycoat 815Z oil

Freon 21 DC F-6-1101

Lubricants for dynamic service with special fluids must be resolved on an individual basis Use of the above lists did not absolve the seller of full responsibility for verifying compatibility under the particular design conditions used by his fluid system

Control of Stress Corrosion. The subcontractor was required to prepare a stress-corrosion plan utilizing MSFC Specification 522A as a guideline for controlling stress corrosion and to take the actions necessary to prevent such failures Wherever possible, the supplier was required to select materials that are either not susceptible to stress corrosion

or have a high resistance to stress corrosion in the anticipated life cycle environment Where susceptible materials were used, the supplier was required, at the minimum, to take the following actions to reduce stress-corrosion problems to the extent feasible:

• Select less susceptible alloys, tempers, or clad products

• Reduce sustained stress levels on the part below stress-corrosion threshold levels, especially in the more susceptible short-transverse grain direction

• Protect the part from the detrimental environment by hermetically sealing or coating the part or by inhibiting the environment (closed system)

• Avoid or reduce residual stresses in parts or assemblies by stress relieving, by avoiding interference fits,

or by shimming assemblies

• Avoid galvanic couples, which may tend to accelerate stress corrosion

• Provide for regular inspection of parts to determine surface flaws and cracking during the life cycle of the part

• Improve the surface quality by reducing surface roughness and/or increasing surface compressive stresses

• Avoid the use of titanium in contact with silver, silver-plated material, or silver-plated fasteners, such as silver-plated A-286 nuts

Control of Galvanic Corrosion. Dissimilar metals were not to be used in intimate contact unless they were suitably protected against galvanic corrosion Because of the seriousness of galvanic corrosion, every effort was made to avoid the use of dissimilar metals, to exclude moisture or other electrolytes from the system, and to protect metal surfaces in the contact area Metals were considered compatible if they were in the same grouping as specified in MSFC-SPEC-250, Class II, or if the difference in solution potential was 0.25 V or less

Control of Atmospheric Corrosion. All parts, assemblies, and equipment, including spares, were finished to provide protection from corrosion in accordance with the requirements of MSFC-SPEC-250, Class II, as a minimum All organic finishes and anodized aluminum that contact titanium were limited to surfaces not normally exposed to propellants A finish specification delineating the finishes used on each specific material in any particular application and corrosion control procedure was prepared by the orbiter contractor The finish specification and related procedures from the subcontractor were required to provide for in-process corrosion control Specific requirements were also given for:

• Surface preparation for adhesive bonding

• Finish systems for interior and exterior surfaces (including those surfaces to which the thermal protection system was to be bonded)

• Fastener installations

• Joints and faying surface sealing

• Protection for parts to be shipped for vehicle final assembly

Designing to Control Corrosion of the Space Shuttle Orbiter

From a corrosion control standpoint, it is convenient to separate the space shuttle orbiter into four categories; primary structure, fluid systems, mechanical systems, and avionics systems Each of these areas has its own unique problems

Primary Structure

Weight and cost both dictated that the primary structure of the orbiter be made from aluminum The majority of this structure was made from heat-treated alloys of the 2000 and 7000 series (Fig 3) However, some 5000- and 6000-series alloys were also used

Fig 3 Typical materials of construction for the space shuttle orbiter

Aluminum Airframe. Prior to alloy selection, two surveys were conducted The first was to identify steps to be taken

to avoid stress-corrosion problems with aluminum alloys, and the second to identify a corrosion protection system that could survive the unique spacecraft environment

The stress-corrosion survey, conducted in the early 1970s, indicated that virtually all stress-corrosion failures in service

occurred in the 2000-series alloys in the T3, T4, and T6XX tempers and in the 7000-series alloys in the T6XX tempers and perpendicular to the short-transverse direction Only alloys 2024, 2124, and 2219 have high SCC resistance in the T6XX

tempers In forgings, stress corrosion occurred in end grain runout along the forging parting lines In extrusions and plate, failures occurred where parts were severely formed, where interference fits had occurred, or where assembly stresses were high Theoretically, stress corrosion will not occur until all three of the essential elements are present: a susceptible microstructure, a corrosive environment, and surface tensile stresses If any one of these was eliminated, stress corrosion should not occur The approach used on the orbiter, however, was to eliminate or minimize all three of these conditions to the maximum practical extent

First, only aluminum alloys were permitted with a minimum 170-MPa (25-ksi) stress-corrosion threshold (according to

the supplier's standard test methods: 30 days in salt spray) in all directions This eliminated the T3, T4, and T6XX tempers

of nearly all the 2000- and 7000-series alloys, whose stress-corrosion thresholds could be as low as 48 MPa (7 ksi) or less

in the short-transverse direction The preferred microstructure of the -T73 and -T76 tempers was chosen for 7000-series alloys, and although some weight penalty was incurred, program reliability was well served Because most of the aluminum structure is designed for compressive loading (buckling, crippling) or shear, a very small weight penalty

actually resulted For the 2000-series alloys, the T8XX tempers were used predominantly; however, in a few cases, the T6

or T62 tempers were used for alloys 2124 and 2219

Second, every effort was made to reduce residual stress levels Mill products were ordered in stress-relieved tempers (for example, T651 or T851) wherever possible to reduce machining distortion and susceptibility to stress corrosion Interference fits were limited to stress levels below 67% of the stress-corrosion thresholds Tables were prepared to allow the materials and process engineer to ascertain stress levels resulting from interference fit pins and bushings into various size lugs Residual stresses in assembly were minimized by shimming Forming by bending, which put the short-transverse direction into tension, was not permitted

Finally, the corrosion-protective paint system (described below) was applied to all aluminum parts As of 1986, no incidents of aluminum stress-corrosion failures have been reported on the orbiter since its inception in 1972

The second survey conducted in the early 1970s involved the selection of a paint system that would meet the unique requirements of the shuttle The system had to provide protection to aluminum from corrosion for a minimum of 10 years

of seacoast exposure, without touchup, because it must also serve as the base to which the thermal protection system (TPS) tiles of the shuttle are bonded Unlike commercial aircraft, the external surfaces could not be washed, repainted, or protected from water intrusion and crevice corrosion by using water-displacing chemicals

The paint system had to endure temperatures of 175 °C (350 °F) during entry and landing because heat from reentry soaked back into the structure It had to be capable of surviving space vacuum and low temperatures (-155 °C, or -250 °F) without degradation Minimum offgassing was desirable to avoid giving off toxic fumes inside the cabin (crew hazard) or the condensation of volatile material on windows or optical (thermal) control surfaces The need for exceptional corrosion resistance was further mandated by the floating bilge; that is, the orbiter is stacked and launched in a vertical attitude, operates in zero gravity, and reenters and lands horizontally It was not possible to ensure that all water drains out of the structure in all attitudes

The paint system chosen was a chromate-inhibited epoxy polyamine primer This system was tough, abrasion resistant, and durable Surfaces to be painted were either anodized according to MIL-A-8625 type II, Class 1, or chemically filmed according to MIL-C-5541, class 1A Each coat of paint was 0.015 to 0.023 mm (0.6 to 0.9 mil) thick A single coat of the chromated epoxy polyamine primer demonstrated 1500 h of salt spray protection without corrosion, even in areas scratched through to bare aluminum

The surface to which the external TPS was bonded had a single coat of the chromated epoxy polyamine paint It achieved additional corrosion protection from a room-temperature vulcanized (RTV) adhesive layer 0.13 to 0.23 mm (5 to 9 mils) thick used to bond the tiles In the cargo bay area, the single coat of epoxy polyamine primer was overcoated with one coat of polyurethane (MIL-C-83286 or MIL-C-81773) to achieve the required optical properties absorptivity ( ), emissivity ( ), and the proper / ratio for heat control The interior of the cabin required the use of nonglare coatings and selected colors Again, a single undercoat of the chromated epoxy polyamine primer was coated with polyurethane In this case, the polyurethane not only provided a durable color but also acted as a barrier to unacceptable offgassing products of the primer

Parts were painted as details, drilled and assembled, and then repainted upon assembly to coat the fasteners Although it was desirable from a corrosion standpoint to install all rivets wet, practical manufacturing considerations did not permit it

Automatic riveting machines, which were used to install nearly 90,000 rivets in the wing, could not use wet rivet installations

The weight reduction demands of the program resulted in the elimination of the use of two coats of paint on interior surfaces More than 500 kg (1100 lb) of paint were used to cover 8175 m2 (88,000 ft2) of surface By substituting an anodize coating for one coat of primer, significant weight savings were realized Consequently, the finish system for

Discovery and Atlantis followed the general scheme:

Exterior TPS surface Anodize + 1 coat chromated epoxy polyamine primer + 1 coat RTV adhesive

Exterior non-TPS

surfaces

Anodize + 1 coat chromated epoxy polyamine primer

Interior surface Anodize + either 1 coat chromated epoxy polyamine primer or 1 coat polyurethane

Crew compartment Chemical film or anodize + 1 coat chromated epoxy polyamine primer + 1 coat polyurethane or anodize

only

The forward fuselage was fabricated as a sheet metal skin-stringer design in aluminum alloy 2024-T6 Suspended inside the forward fuselage was an all-welded aluminum pressurized cabin made from aluminum alloy 2219 using the T6 and T8 tempers It was approximately conical in shape, about 5 m (17 ft) long and tapering from 5 to 2.4 m (17 to 8 ft) in diameter at its forward end The mild and aft fuselage structures were machined from aluminum alloy 2124-T851 plate Major frames were of aluminum alloy 7075 in the T76 or T73 tempers

Aluminum honeycomb sandwich was extensively used in the wings and body flap area Corrosion protection systems must prevent corrosion of the thin (0.025 to 0.075 mm, or 1 to 3 mil) honeycomb core (usually aluminum alloy 5056-H39) and delamination of the skins Face sheet skins could not be alclad, because corrosion would proceed in the plane of the sheet, resulting in delamination of the bond line To prevent corrosion, all aluminum cores were protected with conversion coatings and were nonperforated; the face sheets used corrosion-resistant adhesive primers, and the sandwich assemblies were sealed at the edges to prevent water entry

Structural Joints and Fasteners. The corrosion engineers favored the assembly of structural joints with RTV faying surface sealants; however, the electrical bonding requirements or grounding of each panel eliminated this approach Electrical bonding requires a maximum dc resistance of 2.5 m across joints requiring lightning protection or radio frequency grounding for electrical or electronic equipment For a typical faying surface joints, local removal of the paint

or anodize on the detail (down to bare metal) is required in the area of the fastener Bare aluminum surfaces are subsequently coated with a chemical film (MIL-C-5541, class 1A) The joint is then bolted with stainless steel fasteners using stainless steel washers under the bolthead and nut to protect aluminum surfaces during application of torque Fasteners are installed with the shank portion wetted with chromated epoxy polyamine primer Joints are subsequently touched up with a chemical film and a coat of chromated epoxy polyamine primer around the washers Faying surfaces are sealed with a continuous fillet of RTV 577, which is a white, thixotropic silicone rubber material

There are approximately 30 different kinds of electrical grounding joints available to suite various designs on the orbiter; the grounding techniques used include jumpers, spot welds, staples, metallized tape, and the method described above Even an adhesively bonded edge member or a T-section bonded to a honeycomb face sheet must be provided with a ground to the face sheet itself

Dissimilar-metal joints are permitted on the orbiter without additional galvanic protection if they fall within the range shown in Table 1 Table 1 should be used only a guideline, and such factors as cathode-to-anode area ratios, corrosive environments, and other detrimental factors must be evaluated

Table 1 Metals and alloys compatible in dissimilar-metal couples

The fasteners chosen for the spacecraft are all basically corrosion resistant, but care must be taken with dissimilar-metal combinations Bolts are typically made of alloys A-286 (965 to 1380 MPa, or 140 to 200 ksi), Inconel alloy 718 (1240 MPa, or 180 ksi), and MP35N (1655 MPa, or 240 ksi) For applications up to 870 °C (1600 °F), Udimet 500 is used (1035 MPa, or 150 ksi) Of these materials, only A-286 has shown any corrosion in service Thecorrosion is only superficial and

of on real concern It is removed only for cosmetic reasons None of these alloys is susceptible to hydrogen embrittlement

in orbiter vehicle service

Nuts are made from A-286 and Inconel alloy 718 and are lubricated with a thin (0.005 to 0.01 mm, or 0.2 to 0.4 mil) silver plate Bolts and nuts are always installed with washers The aluminum, therefore, never contacts the silver plate Because the hole, as previously mentioned, is coated with wet chromated epoxy polyamine primer, no moisture can penetrate between the stainless or nickel shank and the aluminum hole Stainless steel washers are separated from the aluminum surface with a dry coat of primer (where electrical grounding is not required) or a chemical film coating plus a

touchup of the primmer around the washer (where electrical grounding is required) No problems with galvanic corrosion are experienced in these installations

Inserts, made from A-286, are silver plated and must also be installed into aluminum wetted on their exterior with the chromated epoxy polyamine primer Where nuts are used in contact with titanium, only molybdenum disulfide-type dry film lubricants are used Experience has shown that silver in contact with titanium at approximately 265 °C (500 °F) or above can bring about stress-corrosion cracking (SCC) of titanium (Ref 2, 3, 4) Titanium contact with silver is also prohibited by MIL-S-5002

Titanium pin and collar fasteners are used for shear applications To save weight, the orbiter uses aluminum alloy 2024 collars rather than A-286 Again, the holes are wet coated with the chromated epoxy polyamine primer by applying primer to the fastener shank away from the threads Both ends of the fastener are subsequently touched up with the primer Where such fasteners are used on the graphite cargo bay doors, it is necessary to use RTV rubber as a corrosion barrier, thus completely encapsulating the aluminum collar to prevent corrosion

Rivets used on the spacecraft are made from aluminum alloy 2219-T62 These rivets provide good shear strength while avoiding the need to "ice box" rivets after solution treating, as is required with aluminum alloy 2024 rivets Further, aluminum alloy 2024 rivets would undergo aging at entry temperatures of the orbiter (175 °C, or 350 °F), resulting in an increased susceptibility to corrosion as grain-boundary precipitation initiated Aluminum alloy 2219-T81 rivets, although also commercially available, lack sufficient ductility to prevent cracking of driven heads (The widely used aerospace aluminum alloy 7050-T73 rivets were unavailable when the shuttle orbiter was being built.)

Other Structural Alloys. No corrosion protection (except for passivation treatments after fabrication) is considered necessary for stainless steels Stainless steels, particularly the precipitation-hardenable grades, will often display light surface corrosion products after extensive exposure A light abrasion will remove the corrosion No effort is made to passivate stainless parts as installed, because chemical spillage is considered more detrimental to the structure than any enhanced corrosion protection gained from passivation

Nickel alloys such as Inconel alloy 718 and Inconel alloy 625 are used for elevated-temperature service with no corrosion protection Inconel alloy 718 brazed honeycomb panels are used for the conical seals on the vertical stabilizer and for outboard elevon rub panels and flipper door panels Inconel alloy 625, made as a resistance-welded sandwich, is used to temperatures of 870 °C (1600 °F) The surface of the sandwich is coated with a wear-resistant high-emittance chromium oxide coating

Titanium also requires no further corrosion protection Titanium, principally as Ti-6Al-4V, is widely used as forging, bar, and plate products throughout the spacecraft Many other high-strength titanium alloys are also used The major structural members of the aft thrust structure are made of Ti-6Al-4V These transmit the thrust of the liquid rocket engines to the orbiter structure Titanium honeycomb sandwiches, made by the liquid interface diffusion (LID) bonding process, are used as inboard elevon and flipper door panels Although the honeycomb has a perforated core, no corrosion is experienced

Because of prior experience in which processing and testing solutions had resulted in SCC of titanium alloys, a control specification, MF0004-018, has been imposed This specification defines a list of fluids that are suitable for titanium and the specific conditions under which their contact is appropriate

Beryllium alloy S-65 (99% Be min) is used structurally for the external tank door and for windshield retainers Beams providing structural support in the windshield area use either S-65 or CIP HIP-1 (Ref 5), which is also nonstructurally for the navigational base and the star tracker boom, as well as for heat sinks Beryllium must be protected in service The beryllium is anodized according to a Rockwell internal specification and is painted with one coat of chromated epoxy polyamine paint or chemically filmed in a manner similar to that used for aluminum (MIL-C-5541) Two coats of the chromated epoxy polyamine paint are then applied The anodized coating (0.05 mm, or 0.2 mil, minimum) reveals no corrosion when tested in 168 h of salt spray according to ASTM B 117

Steels must be protected in service from the seacoast environment Steels are often painted with chromated epoxy polyamine paint or plated with nickel or chromium, depending on the service Cadmium plating is not used except under rare circumstances, because it can easily sublime in space and redeposit on cooler adjacent surfaces To avoid problems with SCC and hydrogen embrittlement, steel alloys are restricted to 1380 MPa (200 ksi) or less in tensile applications, and precipitation-hardenable steels are restricted to the H1000 or higher-temperature tempers Steels with tensile strengths as

high as 2070 MPa (300 ksi) can be used for applications that involve bearing, compressive, or shear loads; such applications include ball or roller bearings,valve seats, and springs A more complete description of the corrosion protection of steel alloy parts that are in moving contact with each other can be found in the discussion "Mechanical Systems" in this article

Niobium is used for low-stress applications in the orbiter airframe structure Tubes and nozzle parts fabricated from niobium alloy C-103 (Nb-10Hf-1Ti-0.5Zr) are used in the reinforced carbon-carbon nose cap for the shuttle entry air data system (SEADS) program involving measurements of aerodynamics pressures These parts have a VH109 silicide coating

to prevent high-temperature oxidation The coating was chosen because of its performance at the design temperatures (1455 °C, or 2650 °F) (see the discussion "Case Histories" in this section) Niobium alloy C-103 parts are used as closeout members in elevon seals to shield the hot plasma from the interior structure and mechanisms These parts are coated with an R512E silicide coating They were designed for service at maximum temperatures of 1370 °C (2500 °F) Silicide coating systems are ceramic in nature and may be chipped by impact on edges or surfaces Tests were conducted

to verify that parts with coating damage down to bare metal could still function for a limited number of flights (see the discussion "Case Histories" in this section)

Composite materials are widely used on the orbiter and present no corrosion problems except for graphite epoxy structures Although graphite is compatible with titanium, corrosion-resistant steels (A-286 and 300-series stainless steels), nickel, and cobalt-base alloys, the galvanic potential between graphite and aluminum or graphite and steel requires special design considerations Suitable galvanic isolation is accomplished by using a layer of titanium foil, Tedlar, Kapton, or type 120 glass fabric with suitable resin plus two coats of chromate epoxy polyamine primer All edges of the joints between the graphite and the aluminum or steel are sealed with RTV silicone to preclude moisture intrusion

More than 300 boron/aluminum composite tubes with diffusion-bonded Ti-6Al-4V clevises are used on the orbiter, principally in the mid fuselage to stabilize frames or as pressure vessel supports The aluminum portion is painted with chromated epoxy polyamine primer These present no special corrosion design problems Also, there are no corrosion problems with boron epoxy-bonded reinforcements on titanium thrust structure tubes in the aft thrust structure

Fluid Systems

The space shuttle orbiter fluid systems must provide for the storage, transfer, and regulation of 17 different fluids, as shown in Table 2 The fluid systems can be grouped into major functional areas:

• Environmental control and life support system (ECLSS)

• Electrical power system (EPS)

• Reaction control system (RCS)

• Orbital maneuvering system (OMS)

• Main propulsion system (MPS)

• Auxiliary power units (APU)

• Hydraulic system (HYD)

Table 2 Fluids used on the space shuttle orbiter

See also Fig 4

NA(a) (b) One tank

3 Freon-21 Mid and aft fuselage ECLSS 272.16

kg (600 lb)

NA 1000 System

4 Freon-1301 Crew compartment ECLSS (fire

extinguisher)

5.17 kg (11.4 lb)

NA 1000 Three tanks

5 Fluorinert, FC-40 Mid fuselage EPS 17.5 kg

(39 lb)

NA Fuel cell coolant

loops Forward RCS

module

Forward RCS 3.81 kg

(8.4 lb)

NA (c) Two tanks OMS/RCS modules OMS 44 kg

(97 lb)

NA (c) Two tanks Aft fuselage MPS 529.52 L

(18.6 ft3)

NA (c) Four tanks Mid fuselage MPS 1843.4 L

204 °C (400 °F)

(d) Three systems

8 Hydraulic fluid

Landing gear struts LDG 13.6 kg

(30 lb)

110 °C (230 °F)

(d) Nose and main

gear

kg (314 lb)

(d) Three systems Forward RCS

module

Forward RCS 480.75 L

(127 gal)

3.0% 0.2 One tank Aft RCS modules Aft RCS 961.5 L

3.0% 0.2 Two tanks

kg (228 lb)

NA (c) Four tanks

Forward RCS module

NA None Three tanks

16 Water (potable) Lower crew module LSS 289.4 kg

(638 lb)

NA None Four tanks

17 Water (waste) Lower crew module LSS 72.7 kg

(159.5 lb)

NA None One tank

(b) No threshold limit value; upper limit is 6 h at 1 atm of pressure, lower limit is 19%

(c) Simple asphyxiant, no threshold limit value

(d) No threshold limit value; inhalation of vapors not encountered in normal use

The locations of the pressure vessels used to contain these fluids are shown in Fig 4 Design information covering these pressure vessels is given in Table 3

Table 3 Major shuttle orbiter pressure vessels

2

(accumulator)

2.0 1.6 230 2.4 345 3.2 460

Forward RCS

Kevlar/Ti-6Al-4V(a) 2 475 18.7 1.5 27.6 4000 36.6 5310 41.4 6000 Aft RCS Kevlar/Ti-6Al-4V(a) 4 475 18.7 1.5 27.6 4000 36.6 5310 41.4 6000 OMS Kevlar/Ti-6Al-4V(a) 2 1024 40.3 1.5 33.6 4875 44.9 6510 50.5 7325 MPS Kevlar/Ti-6Al-4V(a) 7 663 26.1 1.5 31.0 4500 42.7 6190 46.5 6750

12.0 1.7 250 20.7 3000 41.4 6000

635 ×

86

25 × 3.4

Hydraulic

fluid

HYD Chromium-plated

4130 steel cylinder, 2024-T851 aluminum piston

RCS

Ti-6Al-4V(b) 1 991 39 1.5 2.4 350 3.2 465 3.6 525 Aft RCS Ti-6Al-4V(b) 2 991 39 1.5 2.4 350 3.2 465 3.6 525

ECLSS Kevlar/Ti-6Al-4V(a) 4 660 26 1.5 22.8 3300 28.8 4175 34.1 4950 OMS Ti-6Al-4V(a) 2 84 3.3 2.5 3.1 450 6.2 900 7.4 1080

2

(accumulator)

2.0 0.6 90 0.9 135 1.2 180

Crew module

Same as above 4 902 ×

394

35.5

× 15.5

Same as above 1 902 ×

394

35.5

× 15.5 2.0 0.1 20 0.3 40

Water, APU Ti-6Al-4V(a) 1 432 17 4.0 3.0 435 4.5 655 12.1 1755

cooling APU Ti-6Al-4V 1 244 9.6 8.0 0.7 100 4.1 600 5.5 800

Note: The pressure vessels listed in Table 3 may differ slightly from Table 2, because Table 3 includes major accumulators, pressure vessels integral to a particular hardware system, and extra pressure vessels needed for some missions

Fig 4 Locations of liquids and gases in the space shuttle orbiter Numbers correspond to the fluid index

numbers used in Table 2

Plumbing Lines. The philosophy followed in corrosion control for fluid systems and pressure vessels was to select materials that were compatible with the fluids without protective coatings and to control the fluid chemistry, not only as purchased but also during vehicle loading and operations Stainless steel lines are used for all systems except hydraulic fluids and hot gaseous oxygen Hydraulic fluids are contained in Ti-3Al-2.5V lines Inconel alloy 718 is used for hot gaseous oxygen lines

Because many of the fluids are hazardous (toxic, explosive), metallurgical joints were used in all permanent connections

of stainless and Inconel alloy lines Type 304L stainless steel was used for service with helium, hydrazine, liquid hydrogen, liquid oxygen, monomethyl hydrazine, nitrogen, and nitrogen tetroxide Type 304L was selected to avoid potential sensitization Most of the permanent joints were automatically welded by orbiting arc equipment, using an external sleeve of the same alloy to supply reinforcement to the weld bead, as shown in Fig 5(a) The bead geometry on the inside of the tube is smooth and free from crevices that may initiate chemical attack The stainless steel tubing, in many cases, is in the one-eight hard condition, and the sleeve also provides added strength to compensate for the localized annealing at the welds and heat-affected zone (HAZ); this results in the full efficiency of the one-eighth hard material

Fig 5 Stainless steel and Inconel alloy fluid system permanent joints (a) Automatic weld, inert gas, tungsten

arc (b) Braze joint

Alloy 21-6-9 stainless steel was used in lines carrying ammonia, breathing oxygen, freons, oxygen, hot gaseous hydrogen (280 °C, or 540 °F), nitrogen, and waters The stainless steel was usually brazed with gold alloy Nicoro 80 (81.5 Au-16.5Cu-2Ni) in a configuration shown in Fig 5(b) This configuration also eliminates an internal crevice in the lines, because the brazing alloy flows along the capillary between the tube and sleeve, seals it, and forms a fillet along the periphery of the sleeve There were two concerns with this braze combination First, would the braze alloy create a galvanic-corrosion problem? Testing of the electrode potentials and exposures with actual fluids showed no galvanic effect that could be detected Second, would the copper in the braze alloy cause liquid-metal embrittlement? The literature indicated the 21-6-9 alloy to be particularly susceptible to copper embrittlement Joints were made and sectioned to reveal the microstructure of the brazed joint

Intrusion of the brazing alloy into grain boundaries did occur, but never exceeded 0.05 mm (2 mils) even after four induction brazing cycles The intrusion did not affect the static or fatigue strength of the joint; in fact, it appeared to give a superior attachment to the substrate

In many cases, stainless steel lines must connect pressure vessels made from titanium alloys such as Ti-6Al-4V Typically, a bimetallic joint is used in which a steel tube is joined to a titanium tube or fitting, which is then welded to the pressure vessel The steel-to-titanium tube joints are made by coextrusion or, in the case of the APU water tank, by swaging Aluminum-stainless steel joints are required for attachment of plumbing to the aluminum alloy 2219-T6 tank These joints are made friction welding No galvanic-corrosion problems have been experienced with the fluids involved

For hot gaseous oxygen lines operating to 31 MPa (4500 psi) and 300 °C (570 °F), it was more efficient to use Inconel alloy 718 to obtain the required strength at temperature Inconel joints were welded in the same manner as the type 304L stainless steel joints described above The Inconel alloy joints also had a type 304L stainless steel sleeve, which provided sufficient reinforcement to ensure that nearly the full heat-treat properties of the Inconel alloy 718 tubing were realized (ultimate tensile strength: 1240 MPa, or 180 ksi; tensile yield strength: 1035 MPa, or 150 ksi) Initial attempts were made

to braze this alloy, but because of its tenacious high-temperature oxide film, repeat braze-debraze cycles (even over nickel-plated ends) could not be achieved

The environmental control and life support system was designed to provide:

• Atmospheric control to the pressurized crew cabin (oxygen, nitrogen, carbon dioxide, water vapor, odor)

• Pressure control to the crew cabin

• Thermal control to the crew cabin and avionics boxes

• Potable water and waste management control

The temperature of the crew cabin is maintained between 16 and 32 °C (61 and 90 °F) Oxygen partial pressure is maintained at 22,000 N/m2 (3.2 psi), and nitrogen is added to achieve pressures of 70,500 N/m2 (10.2 psi) for space operations and 101,000 N/m2 (14.7 psi) for launching conditions Relative humidity is controlled to prevent condensation

of moisture Therefore, the cabin atmosphere is a benign environment from a corrosion standpoint

Aluminum cold plates are used to remove heat from the electronic boxes in the mid and aft fuselages The cold plates are fluxless brazed with aluminum alloy 6951 face sheets and aluminum alloy 6061 cores Freon 21 (dichloromonofluoromethane) is the coolant Stainless steel cold plates are used in the crew cabin to carry heat from avionics boxes within the cabin These coldplates are brazed from AISI type 304L sheet using Amdry 930 (Ni-22.5Mn-5Cu-7Si) Deionized water is used in the stainless steel cold plates A water loop transfers the excess heat from the cabin and cabin avionics equipment to the freon cooling loop by way of the cabin heat exchanger The freon cooling loop delivers this heat, together with the heat from the fuel cells, payloads, and mid and aft avionics equipment, to a large aluminum radiator (111 m2, or 1195 ft2) where the heat is radiated into space When the cargo bay doors are closed during ascent of immediately before reentry, an active thermal rejection system, the flash evaporator, is employed Heat is rejected by the boiling of water in this system

Stainless steel was chosen for water lines because of the prior difficulties encountered on the Apollo program with aluminum lines and cold plates Despite the use of inhibitors such as triethanolaminephosphate (TEAP) and sodium mercaptobenzothiozole (NABT) on Apollo aluminum systems, serious corrosion problems were encountered Solutions had to be continuously circulated to avoid solution concentration gradients leading to localized corrosion (pitting) of the aluminum lines Pits as deep as 0.7 mm (28 mils) were found in aluminum lines after limited service

To preclude problems with corrosion in water systems on the space shuttle orbiter, it was decided that stainless steel would be used for all water (cooling and potable) lines Each material in the water path was identified, evaluated and accepted or changed, and tested in a control loop at NASA (Houston) for up to 2 years of service Orbiter water chemistry was controlled to limit oxygen content to 0.5 ppm (to avoid localized oxygen concentration cells), conductivity was limited to 3.3 × 10-6 -1 · cm-1, and the pH was controlled within the 6.0 to 8.0 range After more than 5 years of service,

no corrosion problems have been experienced with stainless steel

Waste water is handled by 21-6-9 stainless steel lines and is stored in aluminum alloy 6061-T6 tanks Waste water tends

to be extremely corrosive to aluminum However, coatings such as Tufram, a tetrafluoroethylene-impregnated anodize, have been used effectively to protect aluminum tanks from urine

The ammonia (NH3 boiler provides for heat rejection at altitudes below approximately 30.5 km (100,000 ft); at these altitudes, the cargo bay doors are closed, and the boiling of the flash evaporator can no longer provide sufficient cooling

to the freon The ammonia boiler is a shell and tube heat exchanger with a single pass on the ammonia side and two passes for each Freon-21 coolant loop The ammonia flows through the bank of 77 small-diameter stainless steel tubes, and the Freon-21 flows over the exterior of the tubes Because these tubes have such thin walls (0.2 mm, or 8 mils), perforation by corrosion is a major concern Corrosion has been experienced as isolated areas of intergranular attack due

to misprocessing of type 304L stainless steel tubing Very small amounts of carbon residue left on a thin-wall tube such as this will result in sensitization during its brazing cycle A change has recently been made to a stabilized grade (type 347 stainless steel) to avoid these problems

Ammonia is stored on a titanium Ti-6A1-4V pressure vessel No corrosion problems have been experienced in this application Nitrogen is stored at 22.8 MPa (3300 psi) in Ti-6A1-4V pressure vessels that are filament overwrapped with Kevlar 49 aramid It presents no corrosion problems

Gaseous breathing oxygen is stored in a pressure vessel made from Inconel alloy 718 that is also overwrapped with Kevlar 49 aramid filament It also operates at 22.8 MPa (3300 psi) Extreme care must be taken when designing either liquid or gaseous oxygen systems because of the dangers of ignition with metals and organic materials (Ref 6) Titanium and magnesium are not used in oxygen systems for this reason and are considered to be highly reactive under impact Materials that are considered satisfactory for use must pass an impact test consisting of 20 consecutive impacts at an energy level of 98 J (72 ft·lb) when tested in the Army Ballistic Missile Agency (ABMA) Impact Tester according to NHB 8060.1, Test 13 Further, when gaseous oxygen pressures exceed 6.9 MPa (1000 psi), materials must also pass dynamic qualification (pneumatic impact) according to NHB 8060.1, Test 14

Although extreme care is taken in material selection for oxygen systems, this is not enough to ensure an ignition-free system (see the discussion "Case Histories" in this section) Because an oxygen ignition is a catastrophic event that results

in an explosion and significant molten metal, it is not always possible to reconstruct the precise cause of a failure Metallic materials that pass the above tests can still ignite if design or manufacturing operations result in:

• Energetic particle impact, caused by particles accelerated to sonic velocities

• Contamination

• Pneumatic shock from rapid valve opening across large pressure differences

• Fretting or galling, generating particles and localized high temperatures

• Frictional heating, such as by flowing past a feather edge

• Gaseous heating, such as by adiabatic compression and Helmholz resonance (resonance in blind columns) (Ref 7, 8)

Of the various engineering metals tested, Inconel alloy 718 and Monel alloy 400 offer superior resistance to ignition problems and are preferred in valves in which dynamic problems can occur When properly designed and manufactured, stainless steel has been successfully used in oxygen and LOX valves Aluminum, stainless steel, and Inconel have been employed without incident in numerous oxygen pressure vessels

The electrical power system uses fuel cells to generate electricity by combining gaseous hydrogen and oxygen The

electrolyte in the fuel cell potassium hydroxide is contained between gold-plated magnesium electrodes For corrosion protection, the magnesium substrate is plated with zinc, copper, and nickel beneath the gold

The hydrogen and oxygen are stored as supercritical gases in double-wall pressure vessels The hydrogen is contained in

an aluminum alloy 2219-T6 inner shell that has been electron beam welded; the oxygen is stored in an inner pressure vessel of electron beam welded Inconel alloy 718 Both tanks are suspended within pressure-tight external shells made of aluminum alloy 2219-T6 A series of 12 S-glass/epoxy straps suspend the inner tank from the forged girth ring of the outer shell The annulus between the vessels contains multilayered reflective insulation A pressure level 1 × 10-5 torr is maintained by a vacuum ion pump Aluminum alloy 2219-T6 is very susceptible to intergranular pitting corrosion, and care must be taken during fabrication to prevent dirt particles and/or moisture from coming in contact with it (see the discussion "Case Histories" in this section)

The reaction control system uses rocket engines burning monomethyl hydrazine (MMH) with N2O4 to achieve the desired attitude control of the orbiter while in orbit The 38 reaction control engines are each capable of providing 3870 N (870 lbf) of thrust Six vernier RCS engines allow fine tuning of the orbiter attitude They develop 111 N (25 lbf) of thrust each

Both N2O4 and MMH are stored in pressure vessels made of Ti-6A-4V Several precautions must be taken in the case of

N2O4 First, ingestion of moisture will result in the formation of nitric acid, which can be corrosive to some elements of the system

Second, N2O4 spills can be dangerous because of toxicity and can be destructive to spacecraft hardware Nitrogen tetroxide will readily corrode nickel, strip off protective paints, and dissolve nylon In addition, because it is an aggressive oxidizer, N2O4 can react violently and ignite organic materials

Third, N2O4 will cause SCC of titanium in the absence of a trace of nitric oxide (NO) (Ref 9, 10, 11, 12) (see the discussion "Case Histories" in this section) Current specifications call for 1.5 to 3% NO; but repeated loading causes volatile loss of NO, and storage may cause stratification Although only a trace of NO (perhaps as little as 0.2%) will prevent SCC, care must be taken to ensure at least 0.6% NO to be safe

Fourth, impact ignition of titanium can occur in N2O4 Tests have shown that threaded fasteners can suffer localized melting and that even an impact of inert material, such as glass or sand, on the titanium surface can result in localized melting in N2O4 Unlike the oxygen reaction, the reaction is quickly quenched and occurs as low as the 54- to 68-J (40 to 50-ft-lb) level on the ABMA Impact Tester Therefore, only aluminum fasteners threaded into titanium N2O4 tanks are permitted on the space shuttle orbiter, this ensures that designs are free of contamination and potential impacts

Finally, one of the major problems with N2O4 is not the problem of spacecraft corrosion but the deposition of corrosion products (picked up during storage) into valves, preventing valve closure and restricting flow Nitrogen tetroxide dissolves small amounts of iron (a few parts per million) from storage tanks The solubility of the iron is a function of temperature, water content, and NO content Proper conditioning of N2O4 prior to loading will precipitate out complex iron nitrate compounds; this will prevent problems caused by corrosion product deposition (see the discussion "Case Histories" in this section)

Monomethyl hydrazine itself can cause problems Although it is not as unstable or reactive as neat (pure) hydrazine, which will be covered in detail in the discussion "Auxiliary Power Unit" in this section, it must be handled in essentially the same way as pure hydrazine

Rocket chambers used in the reaction control system are made from niobium alloy C-103 These are coated with an R512A silicide coating that prevents oxidation in high-temperature service (up to 1315 °C, or 2400 °F) No oxidation problems with reaction control engine chambers have been experienced in service The primary chambers are film cooled with hydrazine Burnthrough has occurred in laboratory testing under off-limit conditions (engine instability); however, current design modifications prevent further structural damage to the spacecraft by using automatic sensing devices that shut off fuel and oxidizer valves if penetration of chamber walls occurs

The vernier engines have also shown localized burnthrough during extensive laboratory testing when hot oxidizer impinges on the silicide coating This condition is aggravated by the thousands of thermal cycles (thermal fatigue) required by this engine, the inability of the coating to accommodate minor machining offsets or discrepancies without fracture, the lack of a fuel-cooling film along the inside of this chamber design, and a doublet-type injector that limits the mixing of the fuel and oxidizer (see the discussion "Case Histories" in this section)

Helium pressure vessels (28 MPa, or 4000 psi) made of annealed Ti-6Al-4V liners overwrapped with Kevlar 49 aramid filament provide the pressure necessary to feed the propellants Some corrosion problems have been encountered in helium systems The orbiter has experienced problems with hydrazine vapors migrating into the fine orifices of helium valves Reactions with surface contaminants have resulted in plugging of orifices due to complex hydrazine deposits (see the discussion "Case Histories" in this section) Helium systems must always be designed to be compatible with the fuels and oxidizers with which they are used, because back migration (diffusion) of these substances will occur

The orbital maneuvering system provides the propulsion to insert the shuttle orbiter into earth orbit, to change orbit, to rendezvous, and to deorbit As with the reaction control system, it also uses the storable propellants N2O4 and MMH, as well as a helium pressurant system The two OMS engines are capable of providing 267,000 N (6000 lbf) of thrust The propellant tanks have the capacity to provide a change in velocity of 300 m/s (1000 ft/s) when carrying a full payload of 29,500 kg (65,000 lb)

The nozzles are made of niobium alloy FS-85 coated with an R512E silicide coating that is used for the RCS rocker chambers These nozzles are used for service to 1350 °C (2480 °F) (Ref 13) Injectors are made from diffusion-bonded 300-series stainless steel platelets Platelets have injector hole patterns etched in them by a photographic etching process

The pressure vessels for the fuel and oxidizers, operating at 2.2 MPa (315 psi), are made from annealed Ti-6Al-4V The helium pressure vessels (33 MPa, or 4800 psi) are made from annealed Ti-6Al-4V overwrapped with Kevlar 49 aramid filament

The fuel and oxidizer present the same types of problems as those experienced in the RCS, except for the nozzle extensions High-temperature oxidation of the nozzle extensions has occurred in areas where mechanical deformation (buckling) caused cracking and spalling of the silicide coating and where thermocouple attach brackets were broken off in service (see the discussion "Case Histories" in this section)

The main propulsion system provides the vacuum-jacketed lines for carrying liquid hydrogen and liquid oxygen from the external tank to the shuttle main engines These lines are also used to carry high-pressure high-temperature gaseous oxygen and hydrogen back to the external tank as a pressurant to expel the liquid hydrogen and liquid oxygen

The compatibility problems with gaseous oxygen have been covered in the discussion "Environmental Control and Life Support System" in this section With gaseous hydrogen, the compatibility issue concerns the embrittlement of metals by hydrogen under certain specific conditions The extent of embrittlement is a function of hydrogen pressure, strain level, and, probably, time of exposure the embrittlement is thought to occur from rupture of the protective oxide film of the metal, followed by some mechanism by which atomic (nascent) hydrogen enters the metal In mild cases, this embrittlement takes the form of a reduction in notched strength in hydrogen compared with specimens exposed to helium

or air In more severe cases, the ductility or tensile strength of the alloy changes significantly

In the case of titanium, embrittling hydrides are formed; within a few minutes, these hydrides can result in the destruction

of the entire cross section of a part (see the discussion "Case Histories" in this section) For this reason, exposure of titanium to hydrogen is totally avoided

With other metals, it is important to verify compatibility at the maximum service pressures Most metals do not show significant property changes below 3.45 MPa (500 psi) At hydrogen pressures of 13.8 MPa (2000 psi), materials such as Inconel alloy 718 show measurable loss of ductility, and at 69 MPa (10,000 psi), even austenitic stainless steel is affected

No accepted criterion exists for the use of metals in gaseous hydrogen At the Rockwell Space Transportation System

Division, for example, an alloy is used in gaseous hydrogen if its sharp notched (Kt 17) to unnotched strength ratio at maximum design pressure does not fall below 1.0 and if a factor of safety of four is maintained in the system At the Rockwell Rocketdyne division, materials are strain limited, and materials susceptible to high-pressure gaseous hydrogen are copper plated (0.1 to 0.25 mm, or 4 to 10 mils) to ensure that no adverse reactions occur Welds in nickel alloys are overlayed on the root side by two layers of Inconel alloy 903

Leakage of hydrogen is a major concern in design because hydrogen can form an explosive mixture with air at concentrations between 4 and 96% hydrogen The aft areas of the orbiter are extensively purged with helium before launch to avoid this problem if a leak occurs

The vacuum-jacketed lines carrying LOX and LH2 are of two size 305 mm (12 in.) and 430 mm (17 in.) in diameter and are made of welded Inconel alloy 718 Inconel alloy 718 is ideal for this service because it is compatible with both liquid and gaseous hydrogen (at these pressures) and maintains high ductility below -253 °C (-423 °F) The vacuum-jacketed lines must accommodate expansion and contraction and are designed to do so by articulation and angulation at joints Bellows of Inconel alloy 718 accommodate angulation while containing the cryogens The articulation is provided by gimbal rings and internally supported ball-strut tie-rod assemblies The hardened balls, ranging in size from 32 to 57 mm (1 to 2 in.) in diameter, are made of a tungsten carbide (Stoody 2) alloy

Inconel alloy 718 (see the discussion "Plumbing Lines" in this section) is used for the high-pressure high-temperature oxygen lines (31 MPa, or 4500 psi, at 280 °C, or 540 °F) that deliver pressurant to the external tank Helium pressure vessels are made from annealed Ti-6Al-4V and annealed Ti-6Al-4V overwrapped with Kevlar 49 filament

The auxiliary power unit provides hydraulic pressure for the actuation of a number of flight control systems, including the rudder, speed brake, body flap, elevons, landing gear, and brakes Power is obtained by vaporizing and decomposing neat (pure) hydrazine in a catalyst bed and passing it through a two-stage turbine, which in turn drives a hydraulic pump Each of the three APUs develops 100 kW (135 hp), and the pump delivers 18 MPa (3000 psi) to the hydraulic system

The compatibility of hydrazine with materials in a system must consider several points First, hydrazine can be unstable and will decompose into N2, H2, and NH3, causing a rapid pressure rise and, if not properly vented, an explosion Neat (pure) hydrazine tends to be more reactive (unstable) than monomethyl hydrazine Decomposition is catalyzed by metal surfaces and/or contaminants left on surfaces, even after cleaning The data base in aerospace is large and highly inaccurate regarding metal-hydrazine compatibility for several reasons:

• Many of the early investigators rated compatibility as satisfactory based on appearance of the metal specimen exposed, not the fluid reaction

• No uniform cleaning method or decomposition criteria existed when data were generated

• No uniform controls were used in testing

The current approach at the Space Transportation and System Division is to use materials that have a history of satisfactory hydrazine service at the temperatures expected Where a new material is used, pressures rise tests of the new material versus time are made, along with controls of compatible materials cleaned in the same manner Literature data, because of their unreliability, are not used except to indicate which materials should be tested

Second, a metal should also be checked with hydrazine to determine its autoignition temperature (AIT) This is done to ensure the AIT is safely below operating temperature No standards are available for autoignition testing Frequently, the fluid is allowed to drip onto a heated plate of the test metal, and the temperature of the test metal is slowly raised until ignition occurs

Third, hydrazine, with even short exposure to air (a few seconds), will react with CO2 to form carbazic acid a very viscous, sticky compound which can clog lines, orifices, or valves It can also aggressively attack certain metals, such as cobalt and nickel Hydrazine systems must always be kept under an inert gaseous blanket whenever opened

Fourth, hydrazine (and carbazic acid) will dissolve or selectively leach certain metals This may later result in malfunction

of a valve by the flow-decay phenomenon, in which hydrazine salts of these metals end up precipitating at valve seat areas (see the discussion "Case Histories" in this section)

Fifth, every effort must be taken to avoid hydrazine spills, because hydrazine is very toxic (Table 2) and highly flammable in air if spread out over a large area (large surface-to-volume ratio) Ignition has occurred when hydrazine was spilled or orbiter thermal protection system tiles made from sintered pure SiO2 filaments

The metals used in the APU in contact with hydrazine include 300-series stainless steels, precipitation-hardening steels, tungsten carbide (for valve seats), and Hastelloy alloy B After the hydrazine has been decomposed by the catalyst bed, its major compatibility problem is with the formation of nitrides by the hot ammonia gas formed The catalyst bed exceeds

925 °C (1700 °F), and the turbine operates at 595 °C (1100 °F) Alloys are chosen both for high-temperature properties and resistance to nitriding The turbine wheel and blades are made from René 41 The wheel has a circumferential Inconel alloy 625 shroud welded with Hastelloy alloy W wire to the blade tips The injector section and catalyst bed housing are from Hastelloy alloy B

The hydraulic system uses predominately type 300 series stainless steel valves and components attached to 2.5V lines The titanium lines were chosen because they saved approximately 270 kg (600 lb) over stainless steel Permanent joints are externally "swaged" with Permaswage fittings that also incorporate RTV 630 rubber seal rings as a backup to the metal-to-metal seal In the presence of hydraulic oil, the rubber expands, ensuring a tight joint capable of sealing hydraulic oil Hydraulic oil per MIL-H-83282A is used throughout the spacecraft except in the landing gear struts, where oil per MIL-H-5606C is used Control of the chlorine content of hydraulic oil is the most important approach to ensuring corrosion-free systems (Chlorine concentrations above 100 ppm can cause corrosion problems.) No major corrosion problems have been experienced in the shuttle orbiter hydraulic systems

• Paints, such as chromated epoxy polyamines

• Phosphate coating (DOD-P-16232) with oils

• Cadmium-titanium or cadmium plating plus an overcoating

In addition, lubrication coatings such as Braycoat grease (space compatible), molybdenum disulfide in an organic matrix,

or Vitrolube NPI-1220 (a high-temperature vitreous-base lubricant) are used Where sufficient corrosion resistance cannot

be achieved with steels, corrosion-resistant alloys are used, such as Inconel alloy 718, titanium Ti-6Al-4V or 4Zn-6Mo, and precipitation-hardenable steels (such as 17-4PH, 15-5PH, AM350, AM355, and Custom 455)

Ti-6Al-2Sn-For bearings, type 440C stainless steel and 52100 bearing steel area used, protected with Braycoat grease High-strength springs are made of type 301 stainless steel in the condition B spring temper, Elgiloy, and 17-7PH in the CH900 condition High-strength Belleville washers, using 6150 low-alloy steel, exhibit the best resistance to hydrogen embrittlement if they are coated with vapor-deposited aluminum (see the discussion "Case Histories" in this section) Some use is also made of maraging steels and 9Ni-4Co-0.3C steel for such applications as hydraulic cylinders

Pyrotechnic devices are used to separate the external tank from the orbiter, to release umbilicals, and to open emergency escape hatches or panels Pyrotechnic devices operate in a number of different ways In some designs, the explosive device is within the bolt or nut, forcing its separation Other designs may cut a panel with a linear-shaped charge or blow a panel joint apart far enough to break bolts at a prenotched section Explosively actuated guillotines have been used on the Apollo to cut cables or shrouds and have been used in some shuttle applications Pyrotechnic devices have been used to deploy parachutes or to release landing gear On the shuttle orbiter, most pyrotechnic devices are made

of Inconel alloy 718 This includes the frangible nuts attaching the external tank to the orbiter in the aft section, the explosive bolts that mate the external tank with the orbiter in the forward section, and the crew escape and emergency egress hatches

Guillotine blades have been made of Inconel alloy 718, A-286, and corrosion-protected tool steels No corrosion problems have occurred in these areas

The orbiter landing gear system is a conventional aircraft tricycle configuration with steerable nose gear and the main left and right landing gear The major parts of the system include the shock strut assembly, wheels and tires, axles, brakes and antiskid controls, and nose wheel steering and damping controls Initiation of the system hydraulically releases uplock hooks that permit the landing gear to free fall into the extended position Springs and hydraulic actuators assist in the free fall Pyrotechnic actuators may also unlock the uplock hooks if the hydraulic system malfunctions When fully extended, the gear is locked by spring-loaded bungees

Minimum weight was a prime consideration in the design of the landing gear This resulted in the need to use strength materials, highly efficient braking materials, and minimum thicknesses for tires and wheels Tires were designed for 2 landings, brakes for 5 landings, and wheels for 100 missions, although increased loading has reduced wheel life somewhat The steel used for parts carrying high loads was primarily 300M at a 1895-MPa (275-ksi) strength level The use of high-strength steels in this manner represented a deviation from limitations placed by the Material and Process Group on steel strength levels throughout the spacecraft (see the discussion "Primary Structure" in this section) At this high strength level, steel is notch and impact sensitive, has limited toughness, is prone to stress-corrosion problems, and is highly susceptible to hydrogen embrittlement Its selection, however, was based on a history of satisfactory use in landing gear applications for both civilian and military aircraft over a 20-year period Nevertheless, serious embrittlement problems were encountered during development and in early orbiter service

high-The 300M steel was corrosion protected on functional surfaces by either cadmium alone or by chromium plating Nonfunctional surfaces were coated with a cadmium-titanium plating plus a chromated epoxy polyamine paint primer and

a polyurethane topcoat Normally, cadmium plating would be avoided because of its tendency for sublimation and redeposition in the space environment, but the environment of the landing gear in the orbiter wheel wells precluded space exposure and sublimation problems No corrosion problems have been identified with the 300M finish system in service; however, several misprocessing problems with chromium plating and plating of the cadmium-titanium finish have resulted in hydrogen embrittlement failures (see the discussion "Case Histories" in this section) The cadmium-titanium plating is considered to be a low-embrittlement plating process and is currently covered by MIL-STD-1500

The current brake designs use thermal grade beryllium heat sink disks (both rotors and stators) with reinforced carbon linings They are chemically filmed in a manner similar to that described for aluminum in MIL-C-5541 and are unprotected on their mating (working) surfaces Temperatures during braking can be very high locally because of uneven pressure distributions and have occasionally resulted in beryllium carbide formation (>1095 °C, or 2000 °F) during high-energy stops in early brake designs Carbide formation results in embrittlement, cracking, and potential failure of the braking system Unfailed parts showing this condition are scrapped Galvanic corrosion between the carbon and beryllium would appear to be a concern, but such a problem has never occurred Newer brake designs will use structural carbon-carbon to replace the beryllium; this will result in longer life (lower lifetime costs) and higher energy absorption capability, but higher axle and wheel temperatures are expected

carbon-Axles were made of 300M steel The nose landing gear axle was later changed to Inconel alloy 718 for improved fatigue life The cadmium-titanium coating on the 300M main landing gear axles will not exceed 230 °C (450 °F) during normal operation and is safe from liquid cadmium embrittlement In a rare, high energy level emergency stop, this temperature

could be exceeded, resulting in a potential for cadmium embrittlement This would occur as heat from the brakes soaks back into the axle well after the vehicle has stopped Under these conditions, the axle would be replaced

Wheels are currently made of die-forged halves of aluminum alloy 7049-T73 that are bolted together with high-strength MP35N fasteners The main wheels are chemically filmed according to MIL-C-5541, followed by a chromated epoxy polyamine primer (MIL-P-23377) and a topcoat of polyurethane according to MIL-C-83286 for corrosion protection The nose wheel substitutes anodizing for the chemical film treatment; otherwise, it is identical No corrosion problems have been experienced

Aluminum alloy 7075-T73 is used for hydraulic actuators Exterior surfaces are protected by chromate conversion coating plus chromated epoxy polyamine primer and polyurethane topcoat Interior surfaces are immersed in hydraulic fluid and are not coated No corrosion problems have occurred with the aluminum acuators

Avionics

All orbiter avionics systems are located within the spacecraft structure or pressurized cabin; therefore, from a corrosion standpoint, they experience a controlled and relatively benign atmosphere that is free of rain and salt spray Electronic equipment located within the orbiter cabin or cargo bay areas, because of the controlled humidity, cannot experience condensation of moisture, but equipment within the aft equipment bays can experience potential condensation Based on the types of equipment, corrosion protection can be further examined in three areas:

All electrically active surfaces of electrical and electronic circuits, including solder joints, printed circuits, and wire terminations, are conformally coated The coatings used include Dow Corning 3140 and 3145, Columbia Technology Hysol and Furane Plastics polyurethanes, and General Electric RTV 560 and RTV 566 Printed circuit conformal coating thicknesses range from 50 to 250 m (2 to 10 mils) Coatings on other surfaces range from 100 to 375 m (4 to 15 mils)

Electrical connector metallic parts are made of various aluminum alloys of 300-series stainless steels All aluminum parts are nickel plated Plating thickness is not always specified, but conectors must pass salt spray corrosion tests per MIL-STD-202, method 101, test condition B

Connector pin and socket contacts are electrolytically gold plated over a copper and nickel strike A gold plate thickness

of 1.25 m (50 in.) is considered to be borderline between porous and nonporous plating All orbiter connector contacts include a minimum gold plating thickness of 2.5 m (100 in.) When mated, the connectors are environmentally sealed

by peripheral gaskets

No major problems have occurred with corrosion of avionics devices Nitrogen tetroxide spills in the OMS pod areas and forward RCS areas have required in-depth evaluation of the suitability of connectors and pin contacts; however, no abnormal functions were noted even though connector bodies turned green

Case Histories

Despite extensive efforts to anticipate and avoid corrosion problems with manned spacecraft, such problems will inevitably occur Corrosion problems, as a group, have clearly become the most critical and costly problems with metals used on space vehicles Because many corrosion problems can result in unexpected or catastrophic failures, especially those of SCC, hydrogen embrittlement, and metal ignition (in oxidizers), their impact is usually severe Extensive efforts must be made to identify the precise cause of failrue and to provide suitable inspections and rework for existing hardware; the lives of the astronauts cannot be jeopardized nor can the risk be taken of severe damage to a $2 billion orbiter As a consequence, some corrosion problems have resulted in rather expensive launch delays, and the inevitable questions are asked: "Why did this occur? Why was this not foreseen?"

There are no simple answers Field experience is unparalled in revealing differences in behavior from laboratory test results or the deficiencies in the hardware designs The reasons for corrosion problems discussed in this section can be broadly categorized as follows:

• Lack of adequate protection of parts during the manufacturing cycle

• Failure to remove processing chemicals or fluids completely

• Failure to provide an adequate hydrogen embrittlement relief

• Use of improper or contaminated fluids during manufacturing or testing

• Failure to control fluid chemistry within a spacecraft fluid system

• Inadequate corrosion protection

• Unknown reactions or unforeseen problems

In this section, a variety of different corrosion problems that have occurred will be presented These embrace many metal systems, such as aluminum, stainless steel, low-alloy and precipitation-hardenable steels, nickel, titanium, and niobium,

as well as several different types of corrosion attack The descriptions that follow will identify the specific causes of the corrosion, its characteristics, and how it was corrected

Aluminum Spacecraft Structural Parts. Typical pitting attack (Fig 6) occurred on an aluminum alloy 2014-T6 tests part during the Apollo program The maximum depth of attack was 0.1 mm (4 mils), about the same as the diameter The pitting is intergranular If the quench rated is sufficiently rapid during the heat treating of aluminum, no intergranular

corrosion occurs within a pit (see the article "Heat Treating of Aluminum Alloys" in Heat Treating, Volume 4 of ASM Handbook) Because pits such as that shown in Fig 6 are only slightly larger in diameter than a human hair, they may be

missed unless close surface examination of aluminum is made at a magnification of 5 to 10× This has made it difficult to convince in-house manufacturing personnel or subcontractors of the seriousness of protecting surfaces, and it is only when a gross area of pitting becomes obvious that arguments cease Another Rockwell facility in Tulsa insisted that the pitting problem was characteristics of the California environment and even ran 6-month exposure tests of unprotected aluminum to prove it Results are shown in Fig 7 The coupon shown in Fig 7(a) was heat-treated aluminum alloy 2024 exposed in the metal-processing area, and the one shown in Fig 7(b) was heat-treated aluminum alloy 2014 exposed in the manufacturing area

Fig 6 Pitting corrosion of an aluminum alloy 2014-T6 sheet Pitting occured during the manufacturing cycle

Note the intergranular nature of the pit 150×

Fig 7 Heat-treated aluminum pitted from 6 months of in-plant exposure (a) Aluminum alloy 2024 exposed in

the metal-processing area (b) Aluminum alloy 2014 exposed in the manufacturing area Note the intergranular nature of the pits Both 285×

Typical pitting on improperly protected spacecraft parts is shown in Fig 8 The pits shown are typical of those found in a 7075-T6 radial shear beam of the Apollo Service Module after a fatigue test failure Although the fatigue test represented

an overtest of the structure, pitting and extensive end-grain attack from the chemical milling process contributed to the failure Figure 9 shows typical pitting corrosion of an aluminum alloy 2024-T62 fitting resulting from inadequate protection during manufacturing

Fig 8 Pitting corrosion of an aluminum alloy 7075-T6 aluminum radial shear beam from the Apollo program

The beam is machined and chemically milled from a 64-mm (2.5-in.) think plate to a final nominal thickness of 0.45 mm (0.018 in.) Pitting occurred from improper protection either during manufacturing or in service 30×

Fig 9 Pitting corrosion of an aluminum alloy 2024-T62 structural fitting used on the space shuttle orbiter (a)

Fitting that was pitted from lack of interim protection after machining 0.25× (b) Enlargement of pitted surface 4×

Pitting of structures may lead to premature fatigue failure in critically loaded or cycled parts; however, in many cases, it is not critical Pitting of honeycomb sandwich face sheets may undermine the integrity of the sandwich by moisture ingestion Pitting of gear teeth or springs often leads to failure in mechanical systems Pitting in fluid-containing hardware (pressure vessels, tubes) may lead to perforation and leakage By the time pitting is discovered on structural parts, the part may have already cost $25,000 because of extensive machining, or it may be part of a welded assembly worth over $1 million dollars; therefore, every effort is made to save the part

Pitting corrosion is aluminum must be deactivated, or pits will continue to grow as the aluminum oxide that is formed continues to absorb moisture from the air Pits can be deactivated in place by using a proprietary deoxidizer, followed by

a deionized water rinse, wipe, and pH test of the pits Local masking is used Pits are then brush chemically filmed according to MIL-C-5541 and painted Where stress analysis permits, pits can be sanded flush or removed with a dental drill or hole drill In some cases, bonded doublers are added to restore strength

Filiform Corrosion

Filiform corrosion is a special form of corrosion that occurs underneath a protective film It is a moving oxygen concentration cell Corrosion takes the form of threadlike or filamentary trails and proceeds along the metal surface rather than penetrating through the thickness Significant filiform corrosion can occur in a matter of hours or days It develops in the presence of relative humidities as low as 60% A key condition for the development of filiform corrosion is that the film is semipermeable, permitting oxygen as well as humidity to pass through it Filiform corrosion, therefore, is essentially a form of crevice corrosion in which one member forming the crevice (the protective film) is semipermeable

In filiform corrosion, an anodic head, typically 0.08 to 0.13 mm (3 to 5 mils) wide, advances and dissolves the metal in its path The pH of the head is highly acidic (often as low as 1), and the tail or trail increases in pH, often exceeding a pH of

8 As the anodic head advances, the cathodic region behind it fills with corrosion products Filiform corrosion can be recognized by the following characteristics:

• Relatively shallow corrosion of the metal surface

• Meandering, filamentary pathways

• Occurrence below a paint or other protective film

To prevent filiform corrosion, coatings with lower permeability to water and oxygen are required The following is an example of failure of a pressure vessel by filiform corrosion

Liquid Hydrogen Pressure Vessel. During modification of the Columbia vehicle, an aluminum alloy 2219-T6 liquid

hydrogen tank used for supplying hydrogen to the fuel cells was removed from the vehicle and stored inside the plant for

a 3-month period; the tank was inadvertently exposed to the atmosphere When this was discovered a moisture test was conducted of the air inside the vessel It indicated higher than acceptable levels The exterior of the pressure vessel was covered by a vacuum jacket (see the discussion "Electrical Power System" in this section) and protected from corrosion Boroscopic examination of the interior of the tank revealed a corroded zone completely encircling the vessel on both sides

of the electron beam girth weld The zone was approximately 4.7 mm ( in.) wide and centered 9.5 mm ( in.) from the edge of the girth weld (Fig 10)

Fig 10 Filiform corrosion in an aluminum alloy 2219-T6 hydrogen tank used on the space shuttle orbiter

Attack was due to atmospheric humidity Small spherical beads in (a) are splatter from electron beam welding (a) Root side of weld showing filiform corrosion beyond the HAZ (b) to (d) Enlargements of the corrosion attack at 60×, 235×, and 1180×, respectively

It was not possible to verify the depth of the attack or to deactivate the corrosion in place Therefore, it was necessary to remove the tank from service and examine it metallographically Although the attack turned out to be superficial, the fatigue life of the vessel could not have been evaluated nondestructively

At the time of examination, it was believed that the corrosion zones on both sides of the welds were brought about by a preferential anodic phase in the weld HAZs or a preferential anodic zone caused by differences in permeability and thickness of the protective oxide coating If moisture had condensed in the tank, corrosion would have taken place at the

tank bottom Because the corrosion path encircled the weld, it was suspected that corrosion occurred in the water vapor phase

Surprisingly, metallographic examination revealed that the corroded areas were entirely free of corrosion products (Fig 10) This indicated that the corrosion had occurred at an earlier stage of manufacture and was passivated and removed by chemical cleaning Although searches of manufacturing records could not verify it, the most probable cause of corrosion was believed to be filiform corrosion occurring under a tape used to attach a protective paper or film over the surfaces prepared for welding No other explanation adequately accounted for the lack of corrosion products, the shallowness of attack (0.1 mm, or 0.4 mil), and the filamentary network observed

Galvanic Corrosion

Galvanic corrosion results from or is accelerated by dissimilar-metal contact The more electronegative metal becomes the anode and is corroded The more electropositive metal becomes the cathode and is not attacked The severity of galvanic corrosion depends on the flow of current; therefore, corrosion rates tend to be accelerated when larger differences in potential exist between the two metals Corrosion damage to the anode becomes more severe as the cathode-to-anode ratio increases Corrosion rates also increase as solution conductivities increase To prevent galvanic corrosion, parts can be isolated from each other electrically, can be coated, or the anode can be cathodically protected by impressed current or other sacrificial, more anodic materials or coatings If paint is used, the most effective member to coat is the cathode because the reduction in the cathode-to-anode ratio is extremely effective If the anode alone were coated, corrosion would rapidly occur at coating defects accelerated by the very large cathode-to-anode area ratios

When galvanic couples occur in spacecraft structures that exceed the requirements given in Table 1, the accepted design practice is to use two coats of paint as a moisture barrier and for electrical isolation Designs should prevent entrapment of water and should provide for sealing of crevices In fluid systems, detrimental galvanic couples are avoided In the first 6 years of service of the space shuttle orbiter, four major galvanic problems arose: three with structural components and one

During inspection of the wing of the Columbia vehicle after one of its early flights, blisters were seen in the chromated

epoxy polyamine paint used to protect the spar (Fig 11) The blisters occurred mostly along the edge pattern of the Inconel blankets Removal of the paint revealed highly localized pitting with depths ranging from 12 to 350 m (0.5 to 14 mils), perforating the face sheets in the thinnest areas

Fig 11 Galvanic corrosion of aluminum alloy 2024-T8l sheet of orbiter front wing spar from the Columbia

orbiter (a) Corrosion appeared as aluminum oxide deposits (arrow) along the edge of an Inconel alloy 601 foil covered insulation blanket (b) Open pits (arrow) in an area that was in contact with the foil insulation blanket (c) Oxide buildup under paint in a similar contact area causes formation of "bubbles" (arrow)

The interface between the Inconel foil package and the wing spar permitted capillary moisture entrapment, especially while the orbiter was vertical on the launch pad Although it was protected with two coats of the chromated epoxy polyamine paint, the galvanic current was able to perforate the paint Because the foil blankets were unpainted, the cathode-to-anode ratio at paint flaws was extremely large

Accelerated salt spray testing showed that the corrosion could appear within 300 h with two coats of paint, but aluminum was fully protected from the galvanic corrosion with a 75- m (3-mil) coating of RTV 560 or three coats of paint The pits

on the orbiter were deactivated Pit depths were measured More than 700 local areas exceeded acceptable pit depth criteria and required the bonding of approximately 200 doublers to prevent fatigue or perforation into the honeycomb core The spar was refinished with three coats of paint; the edges of the foil blankets were coated with 75 m (3 mils) of RTV 560

Elevons. Similar galvanic corrosion of aluminum alloy 2024-T81 occurred in the elevons under flipper doors and rub panels where Inconel alloy 601 foil insulation blankets rested against painted aluminum honeycomb face sheet Corrosion was deactivated; however, in this case, a nylon-type surface insulation was used to replace the foil blankets, eliminating the galvanic couple

Orbital Maneuvering System Pod Structure. Galvanic attack similar to that discussed above occurred in the OMS

pod of the Columbia, where goldized Kapton multilayer reflective insulation was in contact with painted aluminum In

this case, a faulty environmental seal permitted water entry, but no provisions were available to drain the water The pits

were sanded, ground out, or deactivated The area was chemically filmed and painted with two coats of chromated epoxy polyamine paint and then recoated with 75 to 125 m (3 to 5 mils) of RTV 560 Organic-coated aluminized Kapton insulation was also substituted for the goldized Kapton insulation

Environmental Control and Life Support System Outlet Water Valve. After the sixth flight of the orbiter, a potable water valve was discovered to be leaking The leak emanated form a zone of corroded material that traversed the length of the valve forging Although the valve body was manufactured from a type 304L stainless steel forging, the material within the corroded zone was found to be low-carbon steel It was learned that the carbon steel had been accidentally introduced in the ingot in the final stages of solidification Subsequently, the ingot was rolled into bar and then forged Because any of more than 50 other valves from that heat could have the same defect, a complete review of all parts was made The defect could be detected easily by the copper sulfate test according to Method 102 of MIL-STD-753A It was recommended that this test be performed followed by repassivation

Figure 12(a) shows the tube section with a longitudinal streak through it (appears similar to a crayon mark) Figure 12(b) shows the corroded area that laked Attack is seen completely through the tube wall in Fig 12(c) The microstructure was then etched with 3% nital to bring out the carbon steel (Fig 12d) Figures 12(e) and 12(f) show x-ray dot maps of nickel and chromium concentrations, respectively, through the inclusion shown in Fig 12(d) Figures 12(b) to (d) show that the carbon steel is anodic to the stainless steel in water and that corrosion was accelerated by this galvanic couple Although this problem could not have been anticipated, the supplier would have recognized the problem if he had passivated and inspected the stainless steel properly

Fig 12 Galvanic corrosion of forged type 304L stainless steel ECLSS outlet water valve used on the shuttle

orbiter (a) Tubular section of water valve with embedded longitudinal inclusion (between arrows) 2.5× (b) Enlargement of inclusion revealing perforation 125× (c) Section through perforated area 45× (d) Section through inclusion showing beginning of galvanic attack Nital etch (3%) used to bring out structure of carbon steel 85× (e) Electron dot map of nickel content through the inclusion 55× (f) Electron dot map of chromium content through the inclusion 55×

CuAl2 at grain boundaries occurs The CuAl2 is more noble than the adjacent aluminum, and intergranular corrosion of the adjacent aluminum takes place Artificial aging of aluminum causes precipitates to occur throughout the grains as well

as in the grain boundaries, thus minimizing localized corrosion Stainless steels, when heated into or cooled through the 425- to 870-°C (800- to 1600-°F) range, will precipitate chromium carbides preferentially at grain boundaries, resulting in anodic paths adjacent to these grain boundaries Lowering carbon levels to below 0.03% (to avoid a continuous carbide grain-boundary network) or adding niobium or titanium (to precipitate carbides) will permit the chromium in the grain boundaries to keep the steel from becoming sensitized

Intergranular corrosion is insidious in that little actual corrosion is required before the structural integrity of a part or the perforation of a fluid container occurs A knowledge of metallurgy is important in preventing intergranular corrosion attack because microstructure is sensitive to composition, temperatures, cooling rates, and surface contamination

The ammonia boiler, as previously described, is a heat exchanger using Freon-21 and ammonia The Freon-21 picks

up heat from the orbiter electronic boxes, the crew cabin, and the payloads, and the heat is dissipated by boiling ammonia when the orbiter radiators cannot be deployed, such as during the final stages of reentry Accidental contamination of these tube surfaces prior to brazing of the heat exchanger resulted in the sensitization of some of the thin-wall (0.2 mm, or

8 mil) type 304L stainless steel tubes The sensitized tubes were attacked and perforated by the fluid (Fig 13)

Fig 13 Intergranular corrosion of a type 304L stainless steel tube in a shuttle orbiter ammonia boiler (a) Test

performed to show tube ductility 1× (b) Cross section through the thin-wall (0.2 mm, or 8 mils) tube revealing sensitization on outside diameter due to carbonaceous deposit formed during brazing 75× (c) Surface SEM showing grain-boundary carbides are being removed from outside diameter during corrosion 980×

The corrective action was to change the tubing to type 347 stainless steel to prevent chromium carbide precipitation at grain boundaries if parts were accidentally contaminated prior to brazing In addition, procedures to prevent contamination in the future were upgraded Particular emphasis was placed on removal of carbonaceous, drawing compounds from tube surfaces before brazing

Selective Leaching

Selective leaching (also called parting, dealloying, or demetallification) occurs when the corrosion process removes one

or more elements from the alloy matrix Specific categories of selective leaching often carry the name of the dissolved element in their title, such as dezincification, dealuminification, denickelification, or decobaltification In the case of gray cast iron, selective leaching is called graphitic corrosion The process can occur in single-phase alloys, for example, with brasses having high zinc content such as a 70Cu-30Zn alloy It can also occur in multiphase alloys

In the selective leaching process, typically one of two mechanisms occurs; alloy dissolution and replating of the cathodic element or selective dissolution of an anodic alloy constituent In any case, the matrix that is left is spongy and porous and has very little strength or integrity In some cases, a large, localized area of metal (a plug) is attacked

Selective leaching can be prevented by proper alloy selection, that is, matching the alloy system to a particular environment Changing ratios of alloying elements and adding inhibition elements are often satisfactory approaches In

aerospace, selective leaching is a rare problem Where it occurs, a proper alloy selection or changing the processing medium is the key to prevention

Gas Generator Valve Module (GGVM) Valve Seats. The APU of the shuttle orbiter contains a GGVM that utilizes four tungsten carbide valve seats to regulate hydrazine flow to the catalyst bed The 5-mm (0.2-in.) diam valve seats have sealing lands that are only 115 to 150 m (0.0045 to 0.0060 in.) wide The seats are manufactured from sintered KZ-96 tungsten carbide containing 5% Co as binder

In mid-1985, valve leakage problems during acceptance testing were traced to a breakdown of the valve seat sealing lands The problem became widespread, with a high rejection rate during acceptance testing procedures (ATP)

It was determined that revised cleaning procedures that had been implemented recently to correct a GGVM contamination problem early in the program were subjecting the seats to long periods of exposure to deionized water and ultrasonic cleaning Tests proved that such exposure produced leaching of the cobalt binder from the sintered tungsten carbide alloy Subsequent impacting of the valve seats by the poppets (during ATP) resulted in breakdown of the seats and the noted leakage failures (Fig 14)

Fig 14 Selective leaching of a tungsten carbide valve seat in a shuttle orbiter APU gas generator valve module

Leaching of the cobalt binder was caused by excessive exposure to water during ultrasonic cleaning and hot water rinsing (a) Valve seat showing narrow sealing surface 0.1 to 0.15 mm (4.5 to 6 mils) wide 8× (b) Loss

of sealing surface due to selective leaching and poppet impact 45× (c) SEM cross section showing depth of leaching 1600×

As a by-product of the testing, it was found that a small amount of leaching of the cobalt also occurs from exposure to decomposition by-products of hydrazine, the system fluid This leaching action is several orders of magnitude less than that from deionized water Tests were underway in the time period from 1985 to 1986 to identify alternative tungsten carbide alloys that might be acceptable substitutes for KZ-96 Alloys under investigation included those with different binders and those with finer grain sizes The corrective action taken during the manufacturing cycle was to substitute isopropyl alcohol for deionized water in all operations

Crevice Corrosion

Crevice corrosion results from a concentration cell formed between the electrolyte within the crevice, which is oxygen starved, and the electrolyte outside the crevice, where oxygen is more plentiful The material within the crevice acts as the anode, and the exterior material becomes the cathode This is similar to pitting, in which the base of the pit becomes the anode The author finds it convenient to view a crevice as a plane of corrosion, that is, a two-dimensional pit The resistance of materials to crevice corrosion varies widely Those metals whose protective oxides films result from oxygen adsorbed to the surfaces and are in dynamic equilibrium with the outside environment, such as stainless steels, appear to suffer most when shut off from oxygen by crevices

In good corrosion design practice, crevices are avoided whenever possible Crevices not only trap water or the chemical being processed but also become sumps for the other contaminants in the system, often resulting in major corrosion problems Spacecraft structural faying surfaces, for example, either include a faying surface sealant or the edges are fillet

sealed (see the discussion "Structural Joints and Fasteners" in this section) Sometimes, however, a crevice cannot be avoided, as shown in the cases below Therefore, additional care is required to avoid detrimental corrosion

Anodized Aluminum Window Frames. The exterior window frames on the space shuttle orbiter are made of aluminum alloy 2124-T851 that has been anodized according to a Rockwell specification by using a sulfuric acid anodize,

a black dye, and a sodium dichromate seal The window frames are protected from heat during spacecraft entry by pure silica tiles Two grooves within each window frame contain the fibrafax thermal seal (to prevent hot gas plasma flow) and the Viton pressure (environmental) seal The side windows, when the orbiter is stacked for launch on the pad, provide for possible water entrapment in a small portion of the periphery of the windows Rain can wash down window surfaces, picking up salt deposits from seacoast exposure The aluminum window frame peak temperature is approximately 55 °C (130 °F)

After the eighth flight of the space shuttle orbiter, two side windows were removed from the Challenger vehicle for

examination The window surfaces had appeared to have a hazy opacity even after polishing The opacity was due to microscopic erosion of unknown origin Examination of the window frame showed several localized areas of corrosion through the anodized coating in and adjacent to the seal grooves The areas away from the crevice were uncorroded (Fig 15) The recommended corrective action for new window frames was to add a coat of chromated epoxy polyamine primer, followed by a coat of polyurethane over the black anodize

Fig 15 Crevice corrosion of an anodized aluminum alloy 2024-T851 window frame from the space shuttle

Challenger Corrosion occurred along both thermal and environmental sealing grooves (a) Window frame

showing locations of corrosion (arrows) (b) Enlargement of (a) showing corrosion in Viton seal area (arrows) Rain water carrying dissolved salt deposits from the window was the corrosive medium

Aluminum Brazed Joints. The nature of the brazing process is to provide a gap between faying surfaces that will act

as a capillary for braze alloy flow Selection of the braze processes used for the plumbing systems lines on the Apollo and the space shuttle orbiter depended on the braze alloy filling the capillary gap to ensure the inside of the tube would not have a crevice (see the discussion "Plumbing Lines" in this section) These stainless steel brazes were made under an inert gas shield, and no flux was required

In brazing aluminum, however, it is necessary to use a flux to remove its tenacious oxide film and to ensure wetting of the faying surfaces The brazing fluxes usually consist of mixtures of alkali and alkaline earth chlorides and fluorides, sometimes containing aluminum fluoride or cryolite (3NaF·AlF3) Braze fluxes will often become entrapped between the faying surfaces, and if the joint is completely sealed by a fillet, no problems arise However, when incomplete fillets occur, the brazing fluxes, which are generally hygroscopic, will bleed out and cause corrosion

Cleaning of the part and verifying that surfaces are free of fluorides and chlorides do not always solve the problem, because weeks later the part can be covered with flocculent aluminum hydroxide corrosion products Brazing of aluminum is generally avoided on the shuttle orbiter wherever possible Aluminum cold plates are made by fluxless brazing in inert gas under temperatures and pressure sufficient to ensure braze alloy flow In electronic boxes in which braze designs have been used, the joints are vacuum impregnated with a resin seal to avoid bleedout of entrapped fluxes This appears to be quite satisfactory

On the Apollo program, aluminum-to-stainless steel tube brazes were used in discrete applications The stainless tube was tin plated Problems experienced with braze bleedout are shown in Fig 16

Fig 16 Crevice corrosion of an Apollo aluminum-stainless steel brazed joint caused by bleedout of the brazing

alloy Upper portion is aluminum alloy 6061-T6, lower portion is tin-plated type 304L stainless steel Brazing alloy was 718 aluminum (a) Foaming of aluminum hydroxide corrosion products (arrows) Entrapped flux exposed to air caused corrosion 1× (b) Cross section through pockets of entrapped flux (arrows)

Fretting Corrosion

Fretting is the abrasive wear of two touching surfaces subject to cyclic relative motions of extremely small amplitude Fretting corrosion is an increased degree of deterioration that occurs because of repeated corrosion or oxidation of the freshly abraded surface and the accumulation of abrasive corrosion products between these surfaces Although fretting is often limited to small, localized patches of wear, it can eventually provide a path for leakage (for example, valve seats) or

an initiation site for fatigue Fretting corrosion can be controlled by lubrication of the faying surfaces, restricting the degree of movement, or by the selection of materials and combinations that are less susceptible to fretting (see Table 4 in the article "Corrosion in the Aircraft Industry" in this Volume)

Rudder Speed Brake Power Drive Unit Spacer. The mounting bolts of the rudder speed brake power drive unit of the space shuttle orbiter are made of A-286 stainless steel heat treated to 965 MPa (140 ksi) Bolts are either 15.9 or 22.2

mm ( or in.) in diameter The bolts are sleeved with a spacer that passes through a spherical bearing The spacer is made of 17-4 PH steel (H1150M), and the bearing is Inconel alloy 718 heat treated to 1240 MPa (180 ksi) The surface

finish on the spacer is 16 RHR (root height reading) When the power drive unit was removed from the Enterprise

vehicle, fretting corrosion was discovered on the exterior of the spacer and the interior of the ball The fretting corrosion

of the 17-4PH was quite severe, as shown in Fig 17 The corrective action consisted of changing the spacer to Inconel alloy 718 and applying a dry film (molybdenum disulfide) coating

Fig 17 Fretting corrosion of a steel spacer used to mount the rudder speed brake on the shuttle orbiter The

spacer is made of 17-4PH H1150M stainless steel (a) Spacer on bolt shows contact area with an Inconel alloy

718 spherical bearing Fretted area is between arrows (b) Enlargement of fretting corrosion 1× (c) Mating Inconel alloy 718 bearing showing a similar pattern but only superficial marring of surface 1.5× (d) Cross section through fretting corrosion 175×

Stress-Corrosion Cracking

Stress corrosion requires the simultaneous occurrence of three conditions: a susceptible material or microstructure, a corrosive environment, and surface tensile stresses Control of stress corrosion is achieved by avoiding any one of these conditions (see the discussion "Control of Stress Corrosion" in this section) Each metal family has its own unique environments in which it displays susceptibility to stress corrosion

Stress-corrosion cracking is one of the most insidious forms of corrosion because it often comes on without any warning and results in major, sometimes catastrophic, structural failures In fluid systems, the presence or absence of a trace element can make the difference between no reaction and a major failure Prior laboratory testing may have missed a potential problem that occurs in service, as illustrated in some of the failures below It is mandatory that the cause of a stress-corrosion failure be demonstrated in the laboratory after a suspected stress corrodent has been identified and that testing be conducted as closely as possible to the chemical and metallurgical conditions experienced by the failed hardware

The injector tube of the space shuttle orbiter auxiliary power unit carries liquid hydrazine to a catalyst bed, where it is heated and decomposes into nitrogen, hydrogen, and a trace of ammonia The hot decomposed gases drive a turbine wheel

to generate secondary power for spacecraft systems Shortly after touchdown from the ninth launch of the orbiter, two of three APUs detonated (Ref 14) Extensive investigation determined that the cause of the detonations was the decomposition of hydrazine While the orbiter was in orbit, hydrazine had leaked through cracks in the Hastelloy alloy B injector tube walls of two different APUs In the space vacuum, evaporation withdrew heat from the leaking fluid, resulting in the formation of hydrazine snow balls During reentry, the snow balls melted and ignited somewhere below

12 km (40,000 ft) in altitude and the heat resulted in decomposition and detonation of the hydrazine

The fractures on each tube were intergranular, started on the inside diameter, occurred in almost identical locations, and extended 220 to 240° around the periphery (Fig 18) The cracks were determined to be caused by stress corrosion, as evidenced from their appearance and by extensive testing that eliminated all other failure mechanisms

Fig 18 Stress-corrosion cracking of a Hastelloy alloy B orbiter APU injector tube in a hydrazine environment

(a) Typical injector tube and catalyst bed (b) Failed tube of APU #1 Arrow shows area of SCC (c) Fracture faces of failed APU #2 injector Dark areas (arrows) have been stress corroded Bright areas were ductile fracture from tensile load used to separate parts 6× (d) Enlarged fracture face of (c) showing intergranular character 940× (e) Surface SEM of tube inside diameter showing etching of carbides in grain boundaries (arrow) and surface 370× (f) Sensitized surface layer on inside diameter due to carbide contamination (from electrical discharge machining process) entering braze cycle 285× (g) Enlargement of surface corrosion 3450×

It was demonstrated by laboratory testing that ammonia or ammonium hydroxide was the only potential fluid that could cause stress corrosion of Hastelloy alloy B on the spacecraft The ammonium vapors resulted from decomposition of hydrazine in the catalyst bed, probably as a result of hydrazine leaking into the injector tubes through the valve seat or from the equilibrium of the gas generator environment within the tube after shutdown Moisture, resulting in the formation of ammonium hydroxide, was available from atmosphere migrating back into the exhaust duct Misalignment and cocking of the injector tubes during installation resulted in high stresses in the failure area (up to yield stress) A sensitized microstructure of precipitated carbides along inside diameter grain boundaries provided a preferred path for stress corrosion to proceed A carbide network found on the inside diameter of the injector tubes was the result of carbon deposited during the electrical discharge machining process to machine the injector tube bore Subsequent injector tube brazing and cool-down cycles permitted grain-boundary diffusion and precipitation

The solution was to eliminate the preload stresses on the injector tube by instrumenting the installation and to eliminate the sensitized carbide network by reaming the tube inside diameter The braze cycle was raised to 1185 °C (2165 °F) to ensure uniform diffusion of any carbides, followed by rapid cooling to ensure that any carbides inherent to the basic alloy

(0.05 max) would not precipitate at grain boundaries Later designs of injector tubes were also internally coated with a thin chromized layer

The Reaction Control System injector of the Space Shuttle orbiter is made from uncoated niobium alloy C 103 This injector is bolted to a titanium mounting ring section A niobium alloy C 103 chamber is then welded to the injector face Cracking was observed in the sharp radius of the injector adjacent to the bolting ring Examination of the fracture face showed that the attack was intergranular and had fine eruptions (popcorn balls) of niobium oxide on its surface

A review of the manufacturing sequence isolated the problem to those steps performed between the bolting of the titanium flange section to the injector flange and the final operation in which the engine was baked at 315 °C (600 °F) for

20 h to remove resin from the insulation encasing the engine The most probable cause of cracking was thought to be stress corrosion occurring from entrapment of an etchant (50% HNO3-50% HF) used to remove traces of iron and copper from the niobium prior to welding of the chamber to the injector Repeated laboratory attempts to duplicate failure were unsuccessful until a method was devised to entrap the etchant between two pieces of niobium while tensile stresses were applied during sustained heating in the 290- to 315-°C (550- to 600-°F) range The failure was duplicated and attributed to hot fluoride salt SCC (Fig 19) (Ref 15) Performing the acid etching and rinsing prior to bolting the injector assembly prevented future occurrences

Fig 19 Fluoride hot salt SCC of niobium alloy C 103 injector used on the orbiter RCS chambers (a) Schematic

of C 103 injector and titanium bolting ring showing failure area (b) Cross section through failure showing intergranular attack 60× (c) Fracture face showing grain boundaries and microscopic eruptions of niobium oxide 1035×

Reaction Control System Oxidizer Pressure Vessels. Nitrogen tetroxide, a storable hypergolic oxidizer, was used in the service propulsion system (SPS) and in the reaction control system on the Apollo program The SPS provided the propulsion for orbit insertion, lunar flight, return from the moon, and deorbit for entry The RCS provided for vehicle attitude control through roll, pitch, and yaw engines Titanium alloy Ti-6Al-4V was chosen for pressure vessels in both systems as a result of laboratory tests on corrosion, stress corrosion, and impact ignition with N2O4

Qualification testing of the SPS pressure vessel for 46 days of exposure under a membrane stress of 690 MPa (100 ksi) was completed without problems in mid-1964 In January 1965, an RCS pressure vessel of the same alloy, protected from

N2O4 by a teflon positive expulsion bladder, cracked in six adjacent locations (Ref 9, 10, 11, 12) The cracks were parallel

to each other and perpendicular to the maximum stress The fracture surface had a red stain and was flat and brittle in appearance Because no NO was supposedly in contact with the vessel, it was believed that misprocessing may have

caused the fractures Subsequent testing of ten pressure vessels without bladders in June of that year was conducted to ascertain if misprocessing could be bracketed to certain manufactured pressure vessel lots over a period of time Within

34 h after testing, one of the pressure vessels blew up (Fig 20) and within a few days most of the others had failed

Fig 20 Stress-corrosion failure of an Apollo Ti-6Al-4V RCS pressure vessel due to nitrogen tetroxide (a) Failed

vessel after exposure to pressurized N2O2 for 34 h (b) Cross section through typical stress-corrosion cracks 250× (c) Correlation between the number of cracks per square inch and stress level (d) Cracking in cylindrical section where hoop stress predominates (3) Cracking in biaxial area where stresses are approximately equal (d) and (e) Both 35×

The cause of the failure was immediately suspected to be stress corrosion, but the aggressive fluid that contacted these surfaces was not immediately determined Cracks occurred very close together on the inside of the pressure vessel, and the number of cracks per unit area was proportional to the local stress Pressure vessels of the same design, when tested with N2O4 by Rockwell on the West Coast, did not fail The RCS tank contractor Bell Aerosystems Company, was soon able to demonstrate coupon failures in N2O4, but Rockwell could not, although over 300 specimens were cleaned and tested under more than 40 variables, including various contaminants

Chemical testing of the propellants used at Bell and Rockwell revealed no differences or out-of-specification conditions Existing chemical techniques were not capable of accurately quantifying all species present in the N2O4, especially compounds of nitrogen; however, cooling of the propellants revealed a color difference in N2O4 between the supplies at Bell and Rockwell The N2O4 at Rockwell, when cooled to -18 °C (0 °F), turned green because of the presence of nitric oxide (NO), but the N2O4 at Bell was yellow The green color resulted from a mixture of N2O4 (yellow) and dissolved NO

as N2O3 (blue) Rockwell supplies of N2O4 had been purchased earlier than those of Bell Aerospace

Investigation revealed that a change in the military specification MIL-P-26539 had been made during this time period to improve the specific impulse of N2O4 by oxygenating the trace quantities of residual NO This simple change had a devastating effect on its stress-corrosion behavior with titanium Testing indicated as little as 0.2% NO was probably sufficient to inhibit the SCC of titanium Specifications were changed thereafter to require a minimum NO content of 0.6%; present grades contain 1.5 to 3% NO Addition of NO to existing supplies solved the problem

Early in the investigation, it was believed that no stress corrosion could occur in solutions as nonconductive as N2O4

(specific conductivity at 25 °C or 80 °F, is 3.1 × 10-13 - · cm-1) However, because of the low conductivity of N2O4, only closely spaced local cathodes and anodes could carry corrosion currents (Fig 20) This resulted in a large number of cracks (up to 70 cracks/in.) rather than a single crack This investigation also illustrated how past stress-corrosion test results or pressure vessel qualification can be voided by minor chemical changes in the corroding medium This is further illustrated in the following discussion

Service Propulsion System Fuel Tanks. The storable hypergolic fuel used for the service propulsion system on the Apollo Service Module was a blend of 50% hydrazine and 50% unsymmetrical dimethyl hydrazine It was contained in two titanium Ti-6Al-4V pressure vessels approximately 1.2 m (4 ft) in diameter and 3 m (10 ft) long Because hydrazine compounds are toxic and dangerous to handle, a "referee" fluid with similar density and flow characteristics was used in system checkout testing Methanol was chosen as a safe fluid based on subcontracted studies conducted for the program Methanol had been successfully used as a fluid in a tri-flush cleaning process for propellant systems at that point in time Among the other advantages, it had a low explosive potential, was miscible with both fuel and water, and would leave surfaces residue free

During an acceptance test of the Apollo Spacecraft 101 service module prior to delivery, an SPS fuel pressure vessel (SN054) containing methanol developed cracks adjacent to the welds (Fig 21) The test was stopped This acceptance test had been run 38 times on similar pressure vessels without problems Failure analysis could not reveal the cause of the cracking The fractures had branching cracks characteristic of stress corrosion yet fracture faces exhibited a somewhat featureless quasi-cleavage appearance without typical stress-corrosion features The adjacent material was ductile and within chemistry

Fig 21 Stress-corrosion cracking of a solution-treated and aged Ti-6Al-4V Apollo SPS fuel pressure vessel

during a system checkout test Fluid test medium was methanol (a) Cross section adjacent to weld in cracked vessel 65× (b) Another crack near the same weld 65× (c) and (d) TEM fractographs of fracture surface showing no particular stress-corrosion features Both 2500×

Misprocessing of pressure vessels during manufacturing was suspected, because the supplier had previously demonstrated that pickup of cleaning agents and contaminants on a Ti-6Al-4V pressure vessel prior to a heat-treat aging cycle would result in delayed stress-corrosion failure These included such contaminants as finger prints, chlorinated kitchen cleansers, and liquid hand soap A similar crack adjacent to the weld occurred on the first development pressure vessel for this program was thought to be caused by such contamination (Fig 22)

Fig 22 Stress-corrosion failure in an Apollo Ti-6Al-4V pressure vessel development test (a) and (b) TEMs of

fracture face of stress-corrosion crack in the vessel in a 24-h distilled water exposure after contamination of titanium with soap prior to heat treatment (aging) Fine hairlike wrinkles are characteristic of stress corrosion (c) and (d) Stress-corrosion failure of first Apollo SPS development pressure vessel of Ti-6Al-4V Cause unknown

The Spacecraft 017 service module was then put into test An additional test was initiated to ensure that no marginal SPS pressure vessels would pass through system checkout This additional test consisted of 25 pressure cycles, followed by a 24-h pressure hold After only a few hours into the hold cycle, the replaced SPS pressure vessel failed catastrophically (Fig 23)

Fig 23 Stress-corrosion failure of a solution-treated and aged Ti-6Al-4V Apollo SPS fuel pressure vessel during

a sustained pressure test in methanol (a) Explosive failure of the tank occurred, resulting in severe ripping of the cylinder section (b) Dome section fragmented by explosion (c) Fracture origin and TEM fractographs of fracture face showing quasi-cleavage failure (d) Surface of outside diameter showing crazing of oxide film under load and machining lines 2500× (e) Similar view of inside diameter surface 2500× (f) Titanium notched stress-corrosion specimens cracked at pin-loading areas in methanol Pins were austenitic stainless steel

The investigation conducted after this failure disclosed that titanium will undergo SCC in methanol (Ref 9, 16, 17, 18, 19, 20) Attack is promoted by crazing of the protective oxide film It was learned that minor changes in the testing procedures could inhibit or accelerate the reaction For example, the addition of 1% H2O inhibited the reaction completely It could be restarted by a 5 ppm addition of chloride Initial stress-corrosion testing in the laboratory was performed with available aluminum text fixtures, with 300-series stainless steel, and then with titanium No failures occurred in aluminum fixtures (apparently it provided cathodic protection) Failures in stainless steel fixtures occurred at the specimen pin areas, not at the sharp notches used to initiate stress cracking Failures occurred in only a few hours with stainless steel because it apparently accelerated the reaction by galvanic coupling Specimens tested to the same stress levels in titanium fixtures often took several times as long to fail

The obvious solution to the problem was to replace the methanol with a suitable alternate fluid Isopropyl alcohol was chosen after considerable testing This incident further resulted in the imposition of a control specification (MF0004-018) for all fluids that contact titanium for existing and future space designs