NASA Commercial Crew Program:
Continued Delays Pose Risks for Uninterrupted Access to the International Space Station
Government Accountability Office
Testimony Before the Subcommittee on Space,
Committee on Science, Space, and Technology,
House of Representatives
Statement of Cristina T. Chaplain Director, Acquisition and Sourcing Management
January 17, 2018
Space X Risks
Similar to our findings in February 2017, our ongoing work indicates that the Commercial Crew Program’s top programmatic and safety risks for SpaceX, are in part, related to ongoing launch vehicle design and development efforts.
SpaceX must close several of the program’s top risks related to its upgraded launch vehicle design, the Falcon 9 Block 5, before it can be certified for human spaceflight. Included in this Block 5 design is SpaceX’s redesign of the composite overwrap pressure vessel. SpaceX officials stated the new design aims to eliminate risks identified in the older design, which was involved in an anomaly that caused a mishap in September 2016. Separately, SpaceX officials told us that the Block 5 design also includes design changes to address cracks in the turbine of its engine identified during development testing.
NASA program officials told us that they had informed SpaceX that the cracks were an unacceptable risk for human spaceflight. SpaceX officials told us that they have made design changes, captured in this Block 5 upgrade, that did not result in any cracking during initial life testing. However, this risk will not be closed until SpaceX successfully completes qualification testing in accordance with NASA’s standards without any cracks. SpaceX officials stated they expect this testing to be completed in first quarter calendar year 2018.
Finally, both the program and a NASA advisory group consider SpaceX’s plan to fuel the launch vehicle after the astronauts are on board the spacecraft to be a potential safety risk. SpaceX’s perspective is that this operation may be a lower risk to the crew. To better understand the propellant loading procedures, the program and SpaceX agreed to demonstrate the loading process five times from the launch site in the final crew configuration prior to the crewed flight test.
Our ongoing work indicates that Boeing is mitigating several risks in order to certify its crew transportation system, including challenges related to its abort system performance, parachutes, and its launch vehicle.
Boeing is addressing a risk that its abort system, which it needs for human spaceflight certification, may not meet the program’s requirement to have sufficient control of the vehicle through an abort. In some abort scenarios, Boeing has found that the spacecraft may tumble and that could pose a threat to the crew’s safety. To validate the effectiveness of its abort system, Boeing has conducted extensive wind tunnel testing and plans to complete a pad abort test in April 2018.
Boeing is also addressing a risk that during re-entry to the Earth’s atmosphere, a portion of the spacecraft’s forward heat shield may reconnect and damage the parachute system. (The forward heat shield protects the parachute system during re-entry.) NASA’s independent analysis indicates that this may occur if both parachutes that pull the forward heat shield away from the spacecraft deploy as expected. Boeing’s analysis indicates the risk exists only if one of two parachutes does not deploy as expected. If the program determines this risk is unacceptable, Boeing would need to redesign the parachute system, which the program estimates could result in at least a 6-month delay.
Finally, one of the program’s top programmatic and safety concerns is that it may not have enough information from Boeing’s launch vehicle provider, United Launch Alliance, to assess if the launch vehicle prevents or controls cracking that could lead to catastrophic failures. The program and Boeing are in the process of negotiating next steps.
Program Safety Risk
The Commercial Crew Program has identified the ability of it and its contractors to meet a crew safety requirement as one of its top risks. NASA established the “loss of crew” metric as a way to measure the safety of a crew transportation system. The metric captures the probability of death or permanent disability to one or more crew members. Under each contract, the current loss of crew requirement is 1 in 270, meaning that the contractors’ systems must carry no more than a 1 in 270 probability of incurring loss of crew. Near the end of the Space Shuttle program, the probability of loss of crew was approximately 1 in 90. As part of our ongoing work, we continue to work with NASA to understand how the loss of crew requirement was established for the Commercial Crew Program.
Program officials told us that Commercial Crew is the first NASA program that the agency will evaluate against a probabilistic loss of crew requirement. They said that if the contractors cannot meet the loss of crew requirement at 1 in 270, NASA could still certify their systems by employing operational mitigations. They said this would entail a potentially increased level of risk or uncertainty related to the level of risk for the crew.
Program officials told us their main focus is to work with the contractors to ensure that the spacecraft designs are robust from a safety perspective. The loss of crew metric and the associated models used to measure it are tools that help achieve that goal. For example, Boeing told us that in early 2016, it needed to identify ways to reduce the mass of its spacecraft. As Boeing found opportunities to reduce the spacecraft mass, the program stated that it had to consider how implementing those design changes would affect its loss of crew analysis in addition to compliance with other performance and safety requirements.
According to the program, it is working with both contractors to address the factors that drive loss of crew risk through design changes or additional testing to gain more information on the performance and reliability of systems. As part of our ongoing work, we will continue to assess the extent to which the contractors are meeting this requirement and what tools the program and NASA will use to determine if the contractors meet the requirement.
Program office workload. In February 2017, we found that the Commercial Crew Program was using contractually defined mechanisms to gain a high level of visibility into the contractors’ crew transportation systems, but also found that the Commercial Crew Program’s workload was an emerging schedule risk.
At that time, program officials told us that one of their greatest upcoming challenges will be to keep pace with the contractors’ schedules so that the program does not delay certification. Specifically, they told us they are concerned about an upcoming “bow wave” of work because the program must complete two oversight activities—phased safety reviews and verification closure notices—concurrently in order to support the contractors’ design certification reviews, uncrewed and crewed flight test missions, and final certification.
The Commercial Crew Program is working to complete its three-phased safety review, which will ensure that the contractors have identified all safety-critical hazards and implemented associated controls, but it is behind schedule. Both the contractors and the program have contributed to these delays.
- In phase one, Boeing and SpaceX identified risks in their designs and developed reports on potential hazards, the controls they put in place to mitigate them, and explanations for how the controls will mitigate the hazards.
- In phase two, which is ongoing, the program reviews and approves the contractors’ hazard reports, and develops strategies to verify and validate that the controls are effective.
- In phase three, the contractors plan to conduct the verification activities and incrementally close the reports.
The Commercial Crew Program’s review and approval of the contractors’ hazard reports have taken longer than planned. The program originally planned to complete phase two in early 2016, but through our ongoing work, we have found that as of October 2017, neither contractor had completed this phase. At that time, Boeing had completed 90 percent and SpaceX had completed 70 percent of the Phase 2 reports.
The Commercial Crew Program’s verification closure notice process, which is used to verify that the contractors have met all requirements, is one of the other key oversight activities and potential workload challenges for the program. The program is completing that process concurrently with the phased safety reviews. The verification closure process is initiated by the contractor when it provides the program with data and evidence to substantiate that it has met each requirement, and is completed when the program has reviewed and approved the contractor’s evidence to verify that each requirement has been met.
The Commercial Crew Program must also approve a subset of verification closure notices before key tests or milestones can occur. For example, the ISS requirements and a portion of the Commercial Crew Program requirements must be met before Boeing and SpaceX’s uncrewed flights to the ISS, which are currently planned for the third quarter of 2018.
The program’s ability to smooth its workload is limited because the contractors generally control their development schedules. In February 2017, we found, however, that proposed changes to the Boeing and SpaceX schedules could help alleviate some of the concurrency between the program’s phased safety reviews and verification closure process. We will continue to monitor the efforts as part of our ongoing work.