Significant Commercial Crew Challenges Ahead for Boeing, SpaceX & NASA


Key Excerpts from

NASA Commercial Crew Program:
Continued Delays Pose Risks for Uninterrupted Access to the International Space Station

Government Accountability Office
[Full Testimony]

Testimony Before the Subcommittee on Space,
Committee on Science, Space, and Technology,
House of Representatives
Statement of Cristina T. Chaplain Director, Acquisition and Sourcing Management
January 17, 2018

Space X Risks

Dragon 2 wledment and heat shield. (Credit: SpaceX)

Similar to our findings in February 2017, our ongoing work indicates that the Commercial Crew Program’s top programmatic and safety risks for SpaceX, are in part, related to ongoing launch vehicle design and development efforts.

SpaceX must close several of the program’s top risks related to its upgraded launch vehicle design, the Falcon 9 Block 5, before it can be certified for human spaceflight. Included in this Block 5 design is SpaceX’s redesign of the composite overwrap pressure vessel. SpaceX officials stated the new design aims to eliminate risks identified in the older design, which was involved in an anomaly that caused a mishap in September 2016. Separately, SpaceX officials told us that the Block 5 design also includes design changes to address cracks in the turbine of its engine identified during development testing.

NASA program officials told us that they had informed SpaceX that the cracks were an unacceptable risk for human spaceflight. SpaceX officials told us that they have made design changes, captured in this Block 5 upgrade, that did not result in any cracking during initial life testing. However, this risk will not be closed until SpaceX successfully completes qualification testing in accordance with NASA’s standards without any cracks. SpaceX officials stated they expect this testing to be completed in first quarter calendar year 2018.

Finally, both the program and a NASA advisory group consider SpaceX’s plan to fuel the launch vehicle after the astronauts are on board the spacecraft to be a potential safety risk. SpaceX’s perspective is that this operation may be a lower risk to the crew. To better understand the propellant loading procedures, the program and SpaceX agreed to demonstrate the loading process five times from the launch site in the final crew configuration prior to the crewed flight test.

Boeing Risks

Inside Boeing’s Commercial Crew and Cargo Processing Facility at NASA’s Kennedy Space Center in Florida, a technician works on one of the company’s CST-100 Starliner spacecraft. (Credit: NASA/Kim Shiflett)

Our ongoing work indicates that Boeing is mitigating several risks in order to certify its crew transportation system, including challenges related to its abort system performance, parachutes, and its launch vehicle.

Boeing is addressing a risk that its abort system, which it needs for human spaceflight certification, may not meet the program’s requirement to have sufficient control of the vehicle through an abort. In some abort scenarios, Boeing has found that the spacecraft may tumble and that could pose a threat to the crew’s safety. To validate the effectiveness of its abort system, Boeing has conducted extensive wind tunnel testing and plans to complete a pad abort test in April 2018.

Boeing is also addressing a risk that during re-entry to the Earth’s atmosphere, a portion of the spacecraft’s forward heat shield may reconnect and damage the parachute system. (The forward heat shield protects the parachute system during re-entry.) NASA’s independent analysis indicates that this may occur if both parachutes that pull the forward heat shield away from the spacecraft deploy as expected. Boeing’s analysis indicates the risk exists only if one of two parachutes does not deploy as expected. If the program determines this risk is unacceptable, Boeing would need to redesign the parachute system, which the program estimates could result in at least a 6-month delay.

Finally, one of the program’s top programmatic and safety concerns is that it may not have enough information from Boeing’s launch vehicle provider, United Launch Alliance, to assess if the launch vehicle prevents or controls cracking that could lead to catastrophic failures. The program and Boeing are in the process of negotiating next steps.

Program Safety Risk

Boeing and SpaceX commercial crew systems. (Credit: GAO)

The Commercial Crew Program has identified the ability of it and its contractors to meet a crew safety requirement as one of its top risks. NASA established the “loss of crew” metric as a way to measure the safety of a crew transportation system. The metric captures the probability of death or permanent disability to one or more crew members. Under each contract, the current loss of crew requirement is 1 in 270, meaning that the contractors’ systems must carry no more than a 1 in 270 probability of incurring loss of crew. Near the end of the Space Shuttle program, the probability of loss of crew was approximately 1 in 90. As part of our ongoing work, we continue to work with NASA to understand how the loss of crew requirement was established for the Commercial Crew Program.

Program officials told us that Commercial Crew is the first NASA program that the agency will evaluate against a probabilistic loss of crew requirement. They said that if the contractors cannot meet the loss of crew requirement at 1 in 270, NASA could still certify their systems by employing operational mitigations. They said this would entail a potentially increased level of risk or uncertainty related to the level of risk for the crew.

Program officials told us their main focus is to work with the contractors to ensure that the spacecraft designs are robust from a safety perspective. The loss of crew metric and the associated models used to measure it are tools that help achieve that goal. For example, Boeing told us that in early 2016, it needed to identify ways to reduce the mass of its spacecraft. As Boeing found opportunities to reduce the spacecraft mass, the program stated that it had to consider how implementing those design changes would affect its loss of crew analysis in addition to compliance with other performance and safety requirements.

According to the program, it is working with both contractors to address the factors that drive loss of crew risk through design changes or additional testing to gain more information on the performance and reliability of systems. As part of our ongoing work, we will continue to assess the extent to which the contractors are meeting this requirement and what tools the program and NASA will use to determine if the contractors meet the requirement.

Program office workload. In February 2017, we found that the Commercial Crew Program was using contractually defined mechanisms to gain a high level of visibility into the contractors’ crew transportation systems, but also found that the Commercial Crew Program’s workload was an emerging schedule risk.

At that time, program officials told us that one of their greatest upcoming challenges will be to keep pace with the contractors’ schedules so that the program does not delay certification. Specifically, they told us they are concerned about an upcoming “bow wave” of work because the program must complete two oversight activities—phased safety reviews and verification closure notices—concurrently in order to support the contractors’ design certification reviews, uncrewed and crewed flight test missions, and final certification.

The Commercial Crew Program is working to complete its three-phased safety review, which will ensure that the contractors have identified all safety-critical hazards and implemented associated controls, but it is behind schedule. Both the contractors and the program have contributed to these delays.

  • In phase one, Boeing and SpaceX identified risks in their designs and developed reports on potential hazards, the controls they put in place to mitigate them, and explanations for how the controls will mitigate the hazards.
  • In phase two, which is ongoing, the program reviews and approves the contractors’ hazard reports, and develops strategies to verify and validate that the controls are effective.
  • In phase three, the contractors plan to conduct the verification activities and incrementally close the reports.

The Commercial Crew Program’s review and approval of the contractors’ hazard reports have taken longer than planned. The program originally planned to complete phase two in early 2016, but through our ongoing work, we have found that as of October 2017, neither contractor had completed this phase. At that time, Boeing had completed 90 percent and SpaceX had completed 70 percent of the Phase 2 reports.

The Commercial Crew Program’s verification closure notice process, which is used to verify that the contractors have met all requirements, is one of the other key oversight activities and potential workload challenges for the program. The program is completing that process concurrently with the phased safety reviews. The verification closure process is initiated by the contractor when it provides the program with data and evidence to substantiate that it has met each requirement, and is completed when the program has reviewed and approved the contractor’s evidence to verify that each requirement has been met.

The Commercial Crew Program must also approve a subset of verification closure notices before key tests or milestones can occur. For example, the ISS requirements and a portion of the Commercial Crew Program requirements must be met before Boeing and SpaceX’s uncrewed flights to the ISS, which are currently planned for the third quarter of 2018.

The program’s ability to smooth its workload is limited because the contractors generally control their development schedules. In February 2017, we found, however, that proposed changes to the Boeing and SpaceX schedules could help alleviate some of the concurrency between the program’s phased safety reviews and verification closure process. We will continue to monitor the efforts as part of our ongoing work.

  • JS Initials

    The solution for both Boeing and SpaceX is easy; send up crewed spacecraft into orbit this year, after successful unmanned orbital missions & unmanned emergency contingency capsule tests in the first half of 2018..
    NASA will not allow rendezvous of these commercial spacecraft with the ISS this year, but that doesn’t preclude both Boeing & SpaceX sending up crews to practice orbital missions without ISS approach objectives. Shoot! Being & SpaceX could even send up their employees trained to do emergency button-pushing or fly-by-wire maneuvers if NASA bars the use of NASA astronauts from boarding these craft this year.

  • Michael Vaicaitis

    Are you offering to the pay extra launch costs for this “easy” solution?.
    There are two problem areas for SpaceX and Boeing. Firstly, they have to overcome the obvious technical hurdles. Secondly, they have to convince NASA that their standards are being met. Until, both criteria are achieved they cannot finalise their vehicles. Sending their vehicles to orbit and saying “See, they work just fine”, is not the kind of convincing that NASA is looking for.

  • Michael Halpern

    As was said there are technical hurdles and safety certifications.

    There is good reason to have the safety requirements so high, other than being significantly better than Shuttle, Dragon 2 and CST 100 (and descendants) are not just going to fly government missions where making acceptable risk calls is easier, as commercial vehicles they are going to be able to fly commercial missions, this has the potential to open up a number of markets, markets that will be easily put in danger if these vehicles have deadly mishaps, they may also, likely launch far more frequently than any previous crewed spacecraft, therefore they need to start with close to the highest achievable safety rating with current techology knowing that it will only improve from there

  • windbourne

    1 weird thought that dawned on me, is that once we have several commercial manned systems, is the perfect time for Russia, or even Europe, to develop a new manned system. Russia keeps saying that they want to re-develop one that will take 7 up. That is the time to do it.

  • Michael Halpern

    Yup and the LOC rating is high because they are commercial vehicles and because of that acceptable risk decisions are much harder to make, it’s one thing if government employees who signed up for the high risk are tragically lost, it’s another if a young but high potential market is crippled.

  • Michael Halpern

    You mean past time, yes it’s a good time to do it, but in order for such development to work effectively you have to culturally see advantages in said development. That is reflected in the funding for space programs, outside the US that funding is usually quite small,

  • Arthur Hamilton

    “Program officials told us that Commercial Crew is the first NASA program that the agency will evaluate against a probabilistic loss of crew requirement. According to the program, it is working with both contractors to address the factors that drive loss of crew risk through design changes or additional testing to gain more information on the performance and reliability of systems.”

    Now I know what happened to D2 propulsive landing. Too risky for NASA.

  • Arthur Hamilton

    The Russians are working on their new manned system.