NASA safety advisors on Thursday lauded hardware milestones on Boeing and SpaceX commercial crew capsules, but said multiple technical issues, including problems with parachutes, must be resolved before the human-rated ships are ready to carry astronauts, adding that both companies continue to pursue schedules that appear to be unachievable.
Members of the Aerospace Safety Advisory Panel said engineers at both companies, which work under contract to NASA, are examining their parachute designs after encountering failures during testing.
The chair of the safety panel also said Thursday that Boeing and SpaceX’s most recent schedules for orbital test flights of their commercial space taxis remain overly-ambitious. She added that, so far, safety remains a priority in NASA’s commercial crew program, but cautioned that schedule pressures could be exacerbated by Thursday’s emergency landing of two-man crew heading to the station on a Soyuz rocket, which threw the schedule for future Soyuz crew launches into question.
“We have not seen the (commercial crew) program make decisions detrimental to safety, but currently projected schedules for uncrewed and crewed test flights for both providers have considerable risk and do not appear achievable,” said Patricia Sanders, the safety board’s chair and former executive director of the Missile Defense Agency.
SpaceX plans to launch its first Crew Dragon spacecraft on an unpiloted mission to the International Space Station as soon as January. Boeing plans a similar orbital test flight, without astronauts, no earlier than March.
Assuming the flights go well, those fully autonomous demo missions will be followed by crew flight tests — in June for SpaceX’s Crew Dragon and in August for Boeing’s CST-100 Starliner — according to a schedule update published by NASA last week.
The failure of a Soyuz rocket Thursday during the launch of a two-man crew bound for the space station raised questions about whether crews can remain on the space station if Russia’s investigation into the accident keeps future astronaut launches grounded.
Russian cosmonaut Alexey Ovchinin and NASA flight engineer Nick Hague safely landed downrange in Kazakhstan inside their Soyuz MS-10 descent module, which carried them away from the rocket failure around two minutes after liftoff.
Russian investigations into rocket failures typically go faster than inquiries into launch accidents in the United States, and NASA Administrator Jim Bridenstine said Friday he saw no reason to think the next Soyuz crew launch in Decmeber — with Russian, U.S. and Canadian crew members — will be postponed in the wake of Thursday’s emergency landing.
While Russian engineers may close out their investigation into Thursday’s launch failure in time to keep upcoming crew launches on track, NASA’s agreement with the Russian space agency to pay for U.S. astronaut seats on Soyuz launches expires next year, with the final landing under the NASA-Roscosmos contract scheduled in January 2020.
If SpaceX or Boeing is not ready to launch astronauts by then, there could a gap in U.S. presence on the station. NASA and Roscosmos have already agreed to extend the length of upcoming space station expeditions to six months or longer, pushing out the final landing under the Soyuz seat contract from 2019 to January 2020.
NASA and Boeing have agreed that the first crew test flight of the CST-100 Starliner, originally conceived to last a few weeks, could be converted into a long-duration stay at the space station, ensuring a U.S. astronaut presence on the orbiting outpost.
A similar deal could be executed between NASA and SpaceX.
Once the commercial crew contractors are flying operationally, NASA and Roscosmos have an “in-kind” agreement to fly a Russian cosmonaut on each U.S. crew launch and a U.S. or partner astronaut on each Soyuz mission to ensure the space station always has at least one crew member capable of managing the U.S. and Russian segments of the research complex.
In remarks at the opening of Thursday’s ASAP meeting, Sanders expressed concerns that NASA’s efforts to ensure continuous U.S. presence on the space station should not come at the cost of safety.
“The panel believes that an over-constrained schedule driven by any real or perceived potential gap in astronaut transport to the ISS, possibly exacerbated by this morning’s events, poses a danger that sound engineering design solutions could be superseded, critical program content could be delayed or deleted, and decisions of ‘good enough’ (could) be made based on insufficient data,” Sanders said in Thursday’s previously-scheduled meeting, which convened hours after the Soyuz launch failure.
Panel members said NASA should make sure SpaceX and Boeing’s unpiloted test flights include demonstrations of all the critical spacecraft systems necessary for human spaceflight, ensuring each component has been tested before astronauts fly on the commercial spaceships.
SpaceX’s first Crew Dragon spacecraft, assigned to an orbital test flight designated Demo-1 without astronauts on-board, arrived at Cape Canaveral in July to begin final preparations for launch on a Falcon 9 rocket.
Don McErlean, an ASAP member, said SpaceX’s flight hardware continues to move closer to launch.
“This certainly is a positive trend and appears to be proceeding reasonably well,” he said Thursday. “However, while the current hardware continues to move along, even to the extent that some of that may be at the Cape, there are serious difficulties and challenges that remain in the schedule in terms of technical issues.”
One major area of concern identified by McErlean involves the Crew Dragon’s parachutes, which are similar to the chutes used on SpaceX’s Dragon cargo capsule. He pointed to unspecified anomalies observed on parachutes during testing and on Dragon returns on cargo missions from the space station.
“Recent parachute testing, both using the commercial crew program qualification testing regimen and some anomalies that have been witnessed in the resupply contract, which is also handled by SpaceX, showed that there have been difficulties and problems with the parachute design,” McErlean said. “Clearly, one cannot risk crew without there being complete confidence in the parachute design.”
He said NASA’s commercial crew program has a requirement for both contractors to verify the performance of all their critical systems on an unpiloted test flight before a crew demo mission, and parachutes “clearly” constitute a critical system.
If the parachute system has to be redesigned, McErlean said, the Crew Dragon’s unpiloted Demo-1 test flight should be postponed to make sure the new parachute design is demonstrated on a real space mission before putting astronauts on-board.
He said it is not clear whether a redesign will be required in the Crew Dragon parachute system, which includes a series of pilot and drogue chutes, and four main parachutes to slow the capsule for splashdown at sea.
“Potential redesigns may be required, which then drive the requirement for additional qualification and certification testing,” McErlean said. “We remain adamant that the program requirement for certification is … that an uncrewed flight test of the crew configuration must take place first. We continue to support that. It is our (understanding) that the (commercial crew) program continues to support that.”
“Clearly, redesign drives recursion testing, additional qualification testing, and flight testing, which can clearly lead to schedule impacts,” McErlean said. “So although we have hardware progressing, we have some serious design issues illustrated by these recent anomalies, which will require investigation prior to resolution, and at the moment, we do not have on hand what the solution to those problems are.”
McErlean also updated the safety advisory board on engineers’ continuing study of the Falcon 9 rocket’s helium pressurant tanks, one of which was blamed for an on-pad rocket explosion in 2016.
SpaceX is expected to debut a redesigned second stage helium tank, or composite overwrapped pressure vessel, on the Crew Dragon Demo-1 launch, then fly the tank on seven Falcon 9 missions to meet NASA’s safety requirements before using it on a launch with astronauts on-board.
Assuming SpaceX’s improved helium tanks work as advertised, NASA officials say they are comfortable with the company’s “load-and-go” fueling method for crew missions, in which the astronauts will strap into the Crew Dragon spacecraft and the support team will be evacuated from the launch pad before filling of the Falcon 9 with propellants.
The load-and-go technique runs counter to NASA practices on the space shuttle and earlier human-rated launchers, but SpaceX argues it is safer, and an abort system will be armed to carry the astronauts to safety in the event of an explosive accident like the one that destroyed a Falcon 9 rocket and its satellite payload during a countdown in 2016.
SpaceX believe the 2016 rocket explosion most likely occurred when liquid oxygen propellant froze in a buckle or void between the aluminum liner and carbon overwrap of one of the COPVs. While investigators were unable to pinpoint a “root cause,” engineers concluded the solid oxygen likely ignited from friction or breaking fibers on the outside of the helium tank, causing the Falcon 9’s upper stage to burst in a ball of flame.
The helium bottles store cold helium to be injected into the propellant tanks to maintain their pressures in flight.
SpaceX modified its fueling and helium loading procedures after the September 2016 accident to prevent solid oxygen from forming, and the new COPV design incorporates changes the company says will eliminate the buckles altogether.
In an update presented to the NASA Advisory Council’s human exploration and operations committee in August, NASA commercial crew program manager Kathy Lueders said qualification of the upgraded COPV — dubbed COPV 2.0 — was complete, and a “safe-life demonstration” was ongoing.
“At the moment, we still do not have final resolution of the root cause of the COPV failures, which are generally considered to have caused at least one on-pad accident and also affect the total safety of the load-and-go concept that is intended to be used (on crew launches),” McErlean said Thursday. “These causes of various sorts remain under investigation. There are scientific investigations still ongoing looking for root cause analysis. They are working on improved configurations, but there remain open technical issues that still need to be completed and understood.”
In a speech Oct. 3 at the International Astronautical Congress in Bremen, Germany, SpaceX’s vice president of build and flight reliability Hans Koenigsmann said company is “getting close” to the first Crew Dragon test flight, but chalked up the reason for a delay to next year to “paperwork.”
“We are working hard to get this done this year, but at this time, the hardware might be ready, (but) we might still have to do some work on paper, on paperwork, and the certification side of it,” Koenigsmann said. “It’s going to be a close call whether we fly this year or not.”
McErlean, an aerospace industry consultant whose experience includes a post as the Defense Department’s chief engineer for naval aviation, said the the importance of certification “paperwork” should not be trivialized.
“We continue to hear these things about certification paperwork, and it’s one of my own personal hot buttons,” McErlean said Thursday. “The work is not paperwork in the sense of blindly filling out forms or writing letters or sending each other memos.”
Under the terms of the SpaceX and Boeing commercial crew contracts with NASA — valued at $2.6 billion and $4.2 billion, respectively — the companies are required to submit data on test results, design details and other parameters to the space agency. NASA engineers are responsible for reviewing the information and certifying that each design can accomplish the mission of carrying astronauts to and from the space station, and do it within NASA’s safety requirements.
“The NASA engineers then have some period of time in which to review that data — it could be test data, it could be analysis, it could be any number of things, and it depends on the parameter in question — review that data and validate that, indeed, the contractor has showed that that certification condition, whatever it may be, has been met, and then, and only then, does that engineer sign off that on this issue the design is adequate.
“That does have to be complete before crew flights on these systems, and it is essentially extremely important and should not be thought of as some sort of bureaucratic time delay,” McErlean said. “I wanted to bring that up, and it’s as true for the other partner as well.”
Boeing must also tackle several technical “long poles” before its CST-100 Starliner spacecraft is ready to fly in space, according to Chris Saindon, who updated NASA’s safety advisory board on Boeing’s status.
“Parachute testing is one of them, launch abort engine propulsion system anomalies … also some fractures in a pyro initiator assembly that was designed to separate modules,” Saindon said.
Boeing’s testing of a CST-100 structural test article is nearing completion, Saindon said, but, like SpaceX, Boeing is trying to resolve parachute issues discovered during drop tests.
“During one of the qualification tests, the last one that was done, parachute qualification test No. 3, the system didn’t function quite as expected, so there needs to be some analysis done on that,” Saindon said. “There is a root cause investigation underway.”
Without going into details, Saindon said the parachute test had an “unexpected outcome,” and parachute testing is on hold until Boeing completes the investigation into the problem.
“Then they’ve got to reinitiate the test program, and it’s not an easy test program with parachutes,” Saindon said. “It requires a high-altitude balloon, and it requires the right weather.”
Two more parachute qualification tests remain in Boeing’s test program, followed by six “reliability tests,” Saindon said.
Boeing has also studied parachute concerns related to launch abort scenarios if a problem occurred during the capsule’s climb into orbit on a United Launch Alliance Atlas 5 rocket, according to Saindon, but test results indicate that issue has been addressed.
Saindon also briefed the safety panel on the CST-100 Starliner’s launch abort engine anomaly, which occurred during a hotfire test of the escape engines in June.
At the end of a short firing of the craft’s four launch abort engines, which are designed to push the capsule away from a failing rocket, several of the engine valves failed to fully close, causing a propellant spill.
Saindon described the problem, which was not observed during test firings of single launch abort engines and only when four engines were fired together, as caused by a “harmonic resonance across the entire system.”
Boeing says its engineers have identified the problem, and will repeat the hotfire test before proceeding with a full-scale pad abort test to demonstrate the Starliner’s capability to safely carry astronauts away from an emergency on the launch pad.
“We have settled on one hardware fix and one software fix that will mitigate the problem that we saw with the hotfire earlier this year,” said Chris Ferguson, a former space shuttle commander-turned-Boeing astronaut who will fly on the CST-100 Starliner’s Crew Flight Test next year, in a briefing with reporters at the IAC earlier this month. “They will be rolled into the next hotfire test because we’ll have to repeat an element of what we did not prove to ourselves back in the first test, and that will likely take place in the March/April timeframe.”
“(There’s) one engineering hardware change, a small one, and a software change that will be rolled into the main fuel valves that will be mitigate the problem,” Ferguson said.
Saindon continued his briefing by discussing “unexpected failures” in the pyrotechnic system used to separate the CST-100 Starliner crew module from its service module before re-entry. The crew module, carrying the astronauts, will parachute to a an airbag-cushioned landing in the Western United States, while the service module will burn up on re-entry into the atmosphere.
“During qualification testing … there were some material failures on those pyrotechnic initiators,” Saindon said, who added that engineers from NASA and Boeing believe they have settled on an “interim solution” to the problem.
“Despite the fact that they failed, they seemed to perform the function as designed, which is to separate the crew module from the service module, but nevertheless, there’s a FOD (foreign object debris) hazard there if that initiator fractures, and that needs to be addressed.”
Echoing McErlean’s comments, Saindon, a former U.S. Navy pilot and former director of aviation safety programs at the U.S. Naval Safety Center, said the “validation and certification process is not paperwork, and there’s a lot to do.”
Email the author.
Follow Stephen Clark on Twitter: @StephenClark1.