RiskIt: NASA’s High Risk Commercial Cargo Strategy

A massive explosion occurred right after the Antares rocket hit the ground.
A massive explosion occurred right after the Antares rocket hit the ground.

Commercial Cargo’s Lower Costs Brought Higher Risks

By Douglas Messier
Managing Editor

In October 2014, NASA engineers were deeply worried about Orbital Sciences Corporation’s upcoming Orb-3 commercial resupply mission to the International Space Station (ISS).

An Antares booster was set to send a Cygnus cargo ship loaded with 2,215 kg (4,883 lb) of supplies to astronauts aboard the orbiting laboratory. It would be the third of eight Cygnus flights to the station under a Commercial Resupply Services-1 (CRS-1) contract worth $1.9 billion.

The engineers were worried about the reliability of the launch vehicle’s first stage AJ26 engines. The 40+-year old motors — leftovers from the Soviet Union’s failed manned lunar program — had been refurbished by Aerojet Rocketdyne. And lately, they had been showing their age during ground tests.

“NASA engineering personnel expressed significant concerns about the Orb-3 launch vehicle’s engines and the recent failures Orbital had experienced on test stands, characterizing the likelihood of mission failure for Orb-3 as ’50/50,'” according to an audit issued on June 28 by NASA’s Office of Inspector General (OIG). “In contrast, the ISS Program’s risk matrix reflected the risk of Orb-3 engine issues as ‘low’ and assigned a subjective risk of ‘elevated but acceptable.’”

[See: NASA’s Response to SpaceX’s June 2015 Launch Failure: Impacts on Commercial Resupply of the International Space Station]

Officially, NASA placed the odds of a CRS-1 flight failing catastrophically at 1-in-6 — high by traditional agency standards, but much lower than the engineers involved in the program were giving. The 1-in-6 odds covered CRS-1 flights by Orbital and SpaceX, which had a separate resupply contract worth $1.6 billion.

Normally, a 50-50 chance of failure would be reason to stop a launch until the engineers’ concerns could be addressed. But, this was not a launch under direct NASA control; the space agency was buying a contracted service. It’s also not clear how far up the chain of command the engineers’ concerns reached within the space agency.

“Although according to some ISS Program officials NASA management is generally willing to accept heightened risk for cargo missions, it is unclear whether senior NASA management clearly understood the increased likelihood of failure for the Orb-3 mission,” the report stated. “Even so, the disparity between 50/50 and 1-in-6 for the same mission raises questions about the adequacy of communication between the engineers and top program management.”

When the launch went forward on Oct. 28, 2014, it took all of 15 seconds for the engineers’ worst fears to be realized. The Antares exploded in a spectacular nighttime fireball, destroying the Cygnus with $51 million worth of cargo aboard and causing $16.2 million worth of damage the the launch complex.

An aerial view of the Wallops Island launch facilities taken by the Wallops Incident Response Team Oct. 29 following the failed launch attempt of Orbital Science Corp.'s Antares rocket Oct. 28. (Credit: NASA/Terry Zaperach)
An aerial view of the Wallops Island launch facilities taken by the Wallops Incident Response Team Oct. 29 following the failed launch attempt of Orbital Science Corp.’s Antares rocket Oct. 28. (Credit: NASA/Terry Zaperach)

Under terms of the CRS-1 contract, NASA ended up paying 80 percent of Orbital’s $240 million launch fee despite the mission being a complete failure. Orbital was made whole by an insurance policy that covered the $48 million in milestone payments the company forfeited for failing to deliver the cargo.

It was a costly failure. Assuming the cargo could be replaced at the same price, the cost of the accident can be estimated at:

  • Launch Cost: $192 million
  • Value of Lost Cargo: $51 million
  • Cost of Launch Complex Repairs: $16.2 million
  • Total: $259.2 million

The bulk of the $259.2 million came out of NASA’s budget. The space agency had most of the cargo on board. NASA also ended up paying $5 million for repairs to the launch pad. Private companies and researchers also lost satellites set to be deployed from and experiments to be conducted aboard the station.

Under the CRS-1 contract, NASA could not recover the $192 million in milestone payments it made before Antares exploded. Nor could the agency recover any of the other costs it incurred.

“The CRS-1 contracts do not require SpaceX or Orbital to re-fly failed missions or carry upmass from a failed mission on future flights, nor do they make the companies liable for any cargo destroyed as a result of a launch failure or other anomaly,” the OIG audit stated.

This practice of privatizing profits while leaving taxpayers to pay for failures might seem unfair. However, it “is not unusual for Government contracts relating to space operations given the associated expense and risks, and the limited number of capable contractors,” the report added. “Due to the relationship between risk and price, shifting more risk to the contractor would likely increase contract price.”

Investigators determined that a turbopump of one of the first stage engines failed. Orbital maintained that the turbopump was defective; Aerojet Rocketdyne claimed that it was likely damaged by debris that entered it from another part of the rocket.

Aerojet Rocketdyne agreed to pay $50 million to Orbital ATK — as the company is now known — as part of an agreement to end its contract to supply rocket engines for Antares. Orbital decided to refit the booster with modern Russian RD-181 engines.

More than 20 months later, Antares remains grounded as that process continues. A critical return to flight is likely in August. The company will not conduct a flight test with the new engines. Instead, it will place a Cygnus aboard and hope all goes as planned.

In the meantime, Orbital ATK has partly fulfilled its supply contract by launching Cygnus cargo ships on United Launch Alliance’s (ULA) Atlas V boosters.

A String of Accidents

The Antares failure was just beginning of the space station’s supply problems. In April 2015, a Russian Progress freighter tumbled out of control in orbit after launch from the Baikonur Cosmodrome. The mission was declared a total loss.

Dragon capsule separated from Falcon 9 launch vehicle.
Dragon capsule separated from Falcon 9 launch vehicle.

Two months after that accident, a SpaceX Falcon 9 rocket blew up after launch from Cape Canaveral, sending a Dragon resupply ship to the bottom of the Atlantic Ocean with cargo worth $118 million.

SpaceX forfeited 30 percent of its launch fee, which averages $133.3 million per flight. Parabolic Arc estimates the loss of the failed mission at:

  • Launch Cost: $93.3 million (estimate)
  • Value of Lost Cargo: $118 million
  • Total: $211.3 million

Add all these figures together, and the two failures cost an estimated $470.5 million. That cost does not include any additional flights NASA will have to order to fly replacement cargo.

Falcon 9 was grounded for six months. SpaceX investigators believe that a single defective strut supplied by a contractor caused the destruction of their rocket. A separate NASA investigation found that other factors in addition to the faulty strut likely contributed to the loss.

[See NASA Investigation into SpaceX’s Falcon 9 Explosion Questions Single Strut Theory]

Three failures in eight months strained supplies aboard the space station. Progress’ return to flight in July 2015 and a Japanese H-II resupply mission the following month eased the supply situation in orbit. There have been no subsequent cargo mission failures since the Falcon 9 accident.

Faster Better Cheaper — Chose Two

An Orbital Sciences Corporation Antares rocket is seen as it launches from Pad-0A at NASA's Wallops Flight Facility, Thursday, January 9, 2014, Wallops Island, VA. Antares is carrying the Cygnus spacecraft on a cargo resupply mission to the International Space Station. The Orbital-1 mission is Orbital Sciences' first contracted cargo delivery flight to the space station for NASA. Cygnus is carrying science experiments, crew provisions, spare parts and other hardware to the space station. Photo Credit: (NASA/Bill Ingalls)
An Orbital Sciences Corporation Antares rocket lifts off with the company’s first contracted cargo delivery flight to the space station for NASA. (Credit: NASA/Bill Ingalls)

There were more than just rockets and spaceships falling out of the sky when Antares and Falcon 9 exploded. The failures also brought a highly-touted NASA program back down to Earth, exposing the risks the agency had taken to make it a reality.

Following the loss of the space shuttle Columbia in 2004, the Bush Administration decided to stop flying the three remaining orbiters after they completed flights required to finish construction of the space station.

Officials also decided that NASA would no longer risk astronauts’ lives to deliver supplies to the ISS. Crew and cargo flights would be separated. NASA launched the Commercial Orbital Transportation Services (COTS) program, under which Orbital Science and SpaceX developed their cargo systems.

Today, COTS is a widely viewed as a tremendous success story. For an investment of about $800 million, NASA was able to fund the development of two new launch vehicles and cargo ships. Such thrift would not have been possible under traditional NASA contracting methods.

Private companies have built launch vehicles and spacecraft for NASA since the beginning of the Space Age. However, the space agency has typically been deeply involved in the design, construction and operation of the vehicles.

In the case of the space shuttle, Apollo and other human programs, NASA served as owner and operators of the systems. For planetary missions such as the Juno probe, the space agency maintains tight control over spacecraft production by private contractors and operates the missions. The agency purchases launch services from commercial providers such as ULA, Orbital ATK and SpaceX.

Atlas V liftoff (Credit: ULA)
Atlas V liftoff (Credit: ULA)

Developing new launch vehicles and spacecraft with close government involvement and oversight is a costly proposition.  The U.S. Air Force’s Evolved Expendable Launch Vehicle (EELV) program is a case in point.

Under the program, which was launched in 1994, the Air Force worked with Lockheed Martin and Boeing to develop two new launch vehicles, Atlas V and Delta IV. Although the government provided funding, the companies maintained ownership over the boosters and marketed their services commercially to the government and private customers.

At the time, large companies were planning large constellations of satellites that would bring communications to all corners of the globe. The assembly lines and the tooling for the boosters were sized for high-volume launch rates.

Frequent launches were important for two reasons: they would help keep prices competitive by spreading fixed costs over high booster outputs, and they would aid in ensuring reliability. Or, at least that was the plan.

The program was launched “under the assumption that mission assurance would be achieved through a high commercial launch rate,” according to the NASA OIG report. “However, in the late 1990’s there were several commercial and USAF launch failures and the commercial launch market collapsed, which caused USAF to transition from the original commercial-like approach to the increased role of a Government launch readiness verification and certification process.

“The creation of the launch verification matrix process – a process in which launch readiness verification activities are planned, executed, and recorded – is an example of this increased role,” the report stated. “Currently, the USAF has a comprehensive insight role into their contractors’ activities and the launch verification matrix is reviewed for efficient and effective mission assurance with each launch provider.”

Delta IV Heavy lifts off with the NROL-37 satellite. (Credit: ULA)
Delta IV Heavy lifts off with the NROL-37 satellite. (Credit: ULA)

The comprehensive insight and oversight have given Air Force officials a great deal of confidence in the two boosters — which has borne out by their launch histories. Although Atlas V and Delta IV have suffered in-flight anomalies, they have flown a combined 94 missions without a catastrophic failure since their debuts 2002 and 2003, respectively.

This level of reliability is crucial to the Air Force and national security agencies. The satellites they operate are crucial to national defense. Some of the spacecraft cost a $1 billion or more. Making sure they are safely placed into orbit is the top priority.

This approach has a high cost, however. The FAA estimates the cost of an Altas V launch ranges from $110 to $230 million, depending upon the variant used.  The price for a Delta IV launch ranges from $164 and $400 million.

A Commercial Approach

As NASA looked around for a way to supply the ISS with cargo after the space shuttle retired, it wanted some less expensive options. The agency also looked beyond ISS resupply toward a commercial future in low Earth orbit.

“One of the goals of the CRS-1 contract was to achieve reliable, cost effective access to low Earth orbit while creating a market environment in which commercial space transportation services are available to Government and private sector customers,” according to the OIG report.

To keep costs low, NASA took a much more hands-off approach oversight than it had used on previous programs. SpaceX and Orbital worked under Space Act Agreements, which were subject to far fewer government regulations than traditional contracting.

The companies were given much greater latitude in they developed their vehicles. For example, NASA was willing to accept the greater risks that went with using rocket engines that had been sitting in storage for 40 years. The loss of a cargo ship was far less serious than a crew vehicle.

A successful acceptance test of the AJ26 engine on Aug. 8, 2013. (Credit: NASA)
A successful acceptance test of the AJ26 engine on Aug. 8, 2013. (Credit: NASA)

While NASA has implemented a comprehensive certification process for Commercial Crew vehicles that will carry astronauts to the space station, nothing so detailed was put in place for cargo flights.

Cygnus and Dragon vehicles were certified for operations in proximity to the space station only. Nothing else about the spacecraft or their boosters underwent certification before commercial resupply missions began. (Falcon 9 has been since certified to carry defense and other NASA spacecraft.)

Reassessing Risk

For resupply flights, NASA deviated from the normal criteria it uses to evaluate mission risks. According to the OIG’s report, the space agency generally uses the following processes:

“Risk Classification for Payloads. This process categorizes payload risk as class A (high) through class D (low) and provides a structured approach for defining a hierarchy of risk combinations for payloads by considering such factors as availability of alternative research or reflight opportunities, success criteria, and magnitude of investment.

“Launch Services Risk Mitigation. This certification process categorizes launch vehicle risk as 1 (high), 2 (medium), or 3 (low) in conjunction with the payload classification and sets parameters for using a particular launch vehicle, such as flight experience and testing, verification, and risk management activities.”

The space agency has “informally treated CRS-1 cargo as class D payloads” regardless of what a payload was, how much it cost, or how difficult it would be to replace.  Under NASA risk management policies, “high-risk” launch vehicles can only carry class D payloads.

“This approach results in nebulous risk classifications not defined in NASA policy,” the OIG audit concluded. “In our view, using a more formal risk categorization approach for CRS-1 missions would better inform Agency management about the risk level of particular missions and allow for consideration of possible ways to mitigate associated risks such as requesting additional testing or, as suggested to us by a former program engineer in relation to the Orb-3 flight, that the company adjust the throttle to exert less force on the engines.”

International Docking Adapter. (Credit: NASA)
International Docking Adapter. (Credit: NASA)

The failed Falcon 9 flight carried a crucial piece of equipment that was not exactly a class D payload. The International Docking Adapter (IDA) was the first of two new mating systems to be installed on the space station for future commercial crew missions.

NASA wanted both adapters installed on station by May 2017 when the first of four flight tests by SpaceX and Boeing are set to begin. Instead, only one adapter will be installed, raising the risk of a failed flight test if one of the spacecraft has difficulty docking with it.

A replacement IDA is being built, but it is unlikely to be attached to ISS until after the commercial crew flight tests are set to be completed in early 2018.

“Although the ISS Program has spares of each of the parts, several key items with the longest lead times to manufacture, including the metal shielding that wraps around the Adapter, need to be fabricated,” the OIG report stated. “Moreover, even if NASA is able to meet its planned schedule, the Station likely will have only one Adapter when the commercial crew demonstration missions are scheduled to arrive in May, August, and December 2017, and February 2018.”

Outsourcing Risk Assessment

SpaceX Dragon freighter at ISS. (Credit: NASA)
SpaceX Dragon freighter at ISS. (Credit: NASA)

In addition to changing how it evaluated risk, NASA has also outsourced part of the process to the very commercial cargo contractors it employs. “The ISS Program heavily relies on SpaceX and Orbital to assess and mitigate risk for launches,” the OIG audit found.

The agency does have an “insight clause” in the contract that allows it to gain information about the risks associated with launches. NASA also conducts a technical assessment of the readiness and risk posture prior to a launch.

“However, ISS Program officials told us there is no integrated presentation or package that documents all risk areas for a given launch,” according to the OIG report. “Instead, separate presentations are used to determine the ‘acceptable’ risk posture – a term that evolves frequently. An acceptable risk may be based on such factors as the level of reserves and supplies aboard the ISS, the need to deliver or return research, or the timing of upcoming scheduled flights.”

Cygnus approaches ISS (Credit: NASA)
Cygnus approaches ISS (Credit: NASA)

The OIG report said that while flexibility in determining risks has some benefits, it “may also introduce confusion into the process.” The report cites the differing assessments of the doomed Orb-3 flight where management believed the risk of failure to be 1-in-6 while engineers closer to the program put the odds at 50/50.

“In our judgment, the absence of a multi-disciplined approach to launch readiness, such as identifying and understanding all launch vehicle and payload issues and assigning a more objective launch rating to the mission to aid in communication of the risk, hampers successful risk mitigation efforts,” the OIG report read.

OIG Recommendations

The OIG felt NASA could benefit from examining the much more thorough approach the U.S. Air Force took for the development and operation of the Atlas V and Delta IV launchers.

“USAF officials told us that after a series of launch failures in the late 1990s, they applied a more disciplined approach to launch mission assurance,” the report stated. “Adjustments to the depth and priority of the required insight in specific areas happened only after the contractors had a proven track record of success….

“ISS Program officials and officials in NASA’s Office of Safety and Mission Assurance agreed that a more regimented approach to communicating risk would benefit the ISS Program,” the report added.

The audit made two specific recommendations to NASA concerning risk. The first was that the agency incorporate the risks associated with the IDA into its risk management processes.

NASA agreed with the recommendation, saying it has already taken to steps to mitigate the impact of losing the adapter. The second adapter is set for launch later this month aboard a Dragon spacecraft. The replacement docking unit is on schedule for delivery in March 2017, the agency said. Both IDAs will be on station in time for the first commercial crew mission to follow the flight tests.

The second recommendation was for NASA to “quantify overall mission risk ratings and communicate the risks for upcoming launches early and in coordination with varying levels of engineering and management.”

NASA management did not concur with this recommendation. The lengthy response boils down to NASA believing it already has sufficient processes in place in this area.

“The risk for individual cargo launches, both foreign and domestic, are managed by the program through well-established control board processes….The ISS program manages the overall risk posture by assessing the risk of the cargo vehicle/launcher and by managing the manifest of the cargo vehicle in the context of ISS resupply needs and traffic model,” the agency wrote.

Conclusions

NASA’s commercial cargo effort is broadly seen as a successful private-public partnership that has been a relative bargain for the space agency.

However, those programs have come at a cost of NASA accepting much greater risks and suffering the financial losses and disruptions that have resulted from two launch failures. The losses cut into safety margins for astronauts aboard the station, and have added risk to upcoming commercial crew flight tests.

So far, the failures have not resulted in any critical situations for the ISS program. NASA officials have judged the problems to be an acceptable price to pay for what commercial cargo has provided the agency.

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save

Save