NASA Safety Panel: Commercial Crew Program Making Progress But Challenges Remain

Credit: NASA

by Douglas Messier
Managing Editor

Even as SpaceX prepares to make its first Crew Dragon flight test to the International Space Station (ISS) next month, challenges remain for certifying the vehicle to carry NASA astronauts, according to a new safety report.

In its annual report released last week, NASA’s Aerospace Safety Advisory Panel (ASAP) identified two inter-related safety concerns with SpaceX’s system: the redesign of helium composite overwrap pressure vessels (COPVs) used in the Falcon 9 rocket, and the company’s desire to load astronauts aboard Crew Dragon before fueling the booster.

ASAP’s report also expressed concerns about the certification of parachute systems for Crew Dragon and Boeing’s Starliner spacecraft. Starliner is also scheduled to make two flight tests to the space station this year in advance of providing transportation on a commercial basis.

Falcon 9 explodes on the launch pad. (Credit:

On Sept. 1, 2017, a Falcon 9 rocket exploded on the launch pad at Cape Canaveral while it was being fueled for a pre-flight engine test. An Israeli communications satellite was lost and the launch pad severely damaged in the resulting fireball, which began in the booster’s second stage.

At the time of the explosion, the rocket was being loaded with super cold, densified propellants. SpaceX traced the explosion to one of the helium COPVs located on the inside of the second stage liquid oxygen (LOX) tank. The company said frozen LOX became trapped between the composite over wrap and the liner, setting off a spark that caused the explosion.

Although no similar accidents have occurred on subsequent Falcon 9 flights, SpaceX has been designing and testing an updated helium vessel known as COPV 2.0 to eliminate the possibility of another explosion.

“Testing to date has identified a potential ignition source related to fiber breakage, but the impact of this ignition source has yet to be determined,” ASAP said in its report. “Consequently, while NASA and SpaceX have made significant progress in understanding the COPV 2.0 behavior in its environment, we believe that the team has yet to arrive at a clear definition of the risk posture or mitigation strategies related to operations with the redesigned COPV….

“It is imperative that the Program understands the potential hazards, the controls of those hazards, and the margins involved, and also ensures that the operating environment stays within those margins if the redesigned COPV tanks are to be implemented for crewed flights,” the report added.

SpaceX’s “load-and-go” plan to place astronauts aboard Crew Dragon and then fuel the Falcon 9 booster has caused a significant amount of concern. In past programs, the rocket was fueled and allowed to settle first, then a small team placed the crew aboard.

NASA’s International Space Station Advisory Committee has unanimously opposed the new procedure. In December 2015, Committee Chairman and former NASA astronaut Tom Stafford laid out the panel’s concerns in a December 2015 letter to Associate Administrator William Gerstenmaier.

“There is a unanimous, and strong, feeling by the committee that scheduling the crew to be on board the Dragon spacecraft prior to loading oxidizer into the rocket is contrary to booster safety criteria that has been in place for over 50 years, both in this country and internationally,” Stafford wrote. “Historically, neither the crew nor any other personnel have ever been allowed in or near the booster during fueling. Only after the booster is fully fueled and stabilized are the few essential people allowed near it.”

The densified, super cold propellants provide the Falcon 9 with performance, allowing it to carry heavier payloads. For maximum effectiveness, the propellants need to be loaded just prior to launch so that they do not start warming up. Thus, it makes sense to place the crew aboard first.

The ASAP report said the NASA Engineering and Safety Center (NESC) has determined that load-and-go plan is feasible with proper precautions. (Emphasis mine)

“The NESC has independently studied the load and go procedure and provided a thorough report that identifies the hazards and available controls,” the ASAP report stated. “Based on the NESC report, the CCP has decided that the load and go concept is viable if subsequent analysis is adequate and if verifiable controls are identified and implemented for all the credible hazard causes that could potentially result in an emergency situation or worse.”

The panel said the risk of load-and-go could be acceptable if the steps stipulated by NESC are implemented. However, ASAP is primarily concerned that the COPV issues be resolved before any astronauts are loaded aboard a Crew Dragon.

“Upon gaining a greater understanding of the margins related to operating with the redesigned COPV, NASA should re-assess the adequacy of the controls associated with the load and go procedure to ensure that the operating environment dictated by this process is within the acceptable safety limits of not only the COPV 2.0 tanks, but all other identified hazards as well,” the report stated.

Boeing conducted the first in a series of reliability tests of its CST-100 Starliner flight drogue and main parachute system Feb. 22, 2018, over Yuma, Arizona. (Credit: NASA)

ASAP also expressed concerns about the parachute systems on both SpaceX’s Crew Dragon and Boeing’s Starliner.

“The ASAP firmly believes that before the crewed missions are conducted, each provider’s parachute systems must be fully qualified, including successful completion of the reliability testing with a consistent design,” the report stated.

“Qualification tests, which are tests designed to prove that the final design meets requirements, should not be confused with design and flight testing, the purpose of which is to collect data to establish the final parachute configuration. We encourage the Program to continue to look carefully at the parachute qualification process for both providers,” the document added.

NASA has stipulated that Crew Dragon and Starliner meet a 1-in-240 number for loss of crew (LOC). ASAP’s report said that while the LOC numbers are important, they should not distract NASA and the two providers from mitigating high-risk areas through design or operational procedures.

“It is important for NASA to evaluate the many other parameters available—including redundancy in designs, reliability, identified hazards and their controls, as well as the certification process—in addition to understanding the data behind the LOC calculations, in order to determine the resultant risk posture for the commercial vehicles….Relying on only the LOC number to describe program risk moving forward is insufficient and misleading,” the report stated.

ASAP said it appears that NASA has been prioritizing safety over schedule.

“To date, we still see no direct evidence across NASA that schedule pressure is driving decisions that will adversely impact safety, but important testing remains,” the report stated. “As with all testing of complex space hardware, inevitable discoveries will likely necessitate the careful weighing of all the technical and operational aspects of risk-benefit trades.”

The panel also stressed clear communications when it comes to certifying components and systems.

“A clear set of guidelines for how to proceed when a certification condition is inadequate, and what defines ‘inadequate,’ needs to be specified and communicated to the workforce,” the report stated. “In addition, it should be recognized by all parties, both internal and external to NASA, that the certification process is not merely a ‘paperwork’ process; it involves considerable detailed technical activity by both NASA and the partners.”

The panel made two recommendations to NASA concerning commercial crew.

Required Actions for Crewed Flight Test Risk Reduction: NASA should confirm and then clearly communicate the required content and configuration for the upcoming CCP test flights-Demo-1 and Orbital Flight Test (OFT)-specifically, those items that must be successfully demonstrated prior to the first crewed flights.

Action to Ensure U.S. Access to the International Space Station Given Commercial Crew Program Schedule Risk: Due to the potential for delays in the schedule for the first Commercial Crew Program (CCP) flights with crew, senior NASA leadership should work with the Administration and the Congress to guarantee continuing access to ISS for U.S. crew members until such time that U.S. capability to deliver crew to ISS is established.

NASA had not responded to either recommendation by the time the annual report was printed.

  • Robert G. Oler

    I am quite aware of that. I did not mention the dollar figure someone else did.

  • Robert G. Oler

    So, one way to help rectify the situation is to have the US Government
    pay for new services from multiple providers in order to drive down

    end quote

    I dont need to repeat my thoughts on the matter Space News published them 🙂

  • Robert G. Oler

    Millions of people desire the experience of going to space .. it is THAT simple Robert .” end quote

    I dont believe that is true…and if it is it is highly price sensitive

    “I just do not understand why a pilot of all people can not understand
    that. There is no reason to get a private pilot lic. you can just buy a

    we are not talking a self financed private pilots license here or a “thing” for personal enjoyment

    we are talking something that is going to require an enormous investment by the US taxpayers as a whole and the last reason they are going to fund that investment is to give people a thrill…one most of them will not handle well, will step back from, and certianly are unable to pay for

    thrill seeking is an individual thing. I fly airplanes for fun and profit, skin dive, build amateur radio stuff, and backpack. (this summer I am aiming to go up Ari) but thats all a personal thing. and I pay for it

    if one is going to get the country to pony up tax dollars for infrasture there has to be a reason to do it.

    so far there is none.

  • Mr Snarky Answer

    You don’t have any proof they need to “change significant parts”. The time between flights is mostly NDE to verify their modeling of wear and tear. Once they have a big enough database they can relax the intrusive NDE after each flight. The rest of time is queueing for mission and integration flow.

    Let me put it this way, early B5 booster still had the old cork grid fin hinge covers which sometimes get damaged on the way down. They were replaced with metal covers that don’t require replacement between flights. They have walked the entire booster in this manner and are basically past hinge covers.

  • Vladislaw

    Desire is not based on price! Of course fulfillment of them can be price sensitive… that is the point behind Musk drive to lower price.. to a point that people can do it.
    I may desire a yacht but settle for a rowboat .. orbital vs suborbit.

    So that japanese billionaire that bought the first rocket.. that is going to set tax payers back BILLIONS for infrastructure?

  • duheagle

    Which? Doing the test or opening ASAP’s minds? The first is obviously possible, but probably not something SpaceX any longer cares to spend so much as a dime to do. On the second, I’m inclined to agree with you.

  • duheagle

    And then it gets launched and works in real life too. That’s what really seems to stick in the craws of SpaceX’s non-friends.

  • duheagle

    I’ve been trying to figure out your last line for two days now. Did you mean to write “Challenger lite” and make an uncaught typo? Or do you mean what you wrote – except for maybe a missing hyphen? In which case I have to ask in what way, including potential total crew loss, a D2 parachute failure would be “Challenger-like?” As others have pointed out, the SuperDracos are still there and I’m betting they’re programmed to kick in if the parachutes fail – in which case I still fail to see whatever you think was your point.

  • duheagle

    Or so you maintain, anyway.

  • duheagle

    Months between flights is a product of payload availability and range capability. Changing of significant parts is something you simply assume without evidence.

  • duheagle

    The ability of each landing system to back up the other could be usefully demonstrated via a brief “burp” firing of the SuperDraco’s at an altitude above that of drogue deployment on a freight-only return with a parachute-moderated descent and splashdown at sea. NASA seems to have refused to go along with even this modest approach.

  • duheagle

    Yes, quite interesting. I hope the proposal is for Mk. 1 SH -Starship.

  • Robert G. Oler

    it is when you are discussing federal funds. I think you overstate the numbers badly…but we will see…I dont think its going to happen

  • Robert G. Oler

    I am comfortable with what I wrote

    the chute problems are very similar to the O rings…and no the Super dracos wont land the vehicle if the chutes fail. there is no software for that. sorry

  • Robert G. Oler

    maybe in your world but not in any real world

    you realize that SpaceX while having success with their propulsive landings 1) took sometime to get there and 2) its not 100 percent …

    I suspect they will have asimilar curve with Dragon 2 propulsive landings…ie they would need to try it a few times to get it correct…and even then they would have to demonstrate how they would switch to the chute if the thing had trouble

    I would want to see that happen if I were flying in it

  • Lee

    Maybe, maybe not. SX has flown block 5’s on the following dates:



    There are gaps between launches on all manner of time scales, from as little as two days to a bit over two months. I get that SX needed to fly a few missions to get a feel for how things performed and what needed to be fixed. Let’s call that four flights. It would make sense for SX to turn around a booster as fast as possible once it knew how fast it *could* do so. Doing so would prove that they are doing minimal work between flights, and thus have a reusable product. They have demonstrably NOT done that. That leads actual engineering types (hardware not software engineers) to conclude that there are systems that need significant refurbishment between flights. Hence the delays.

    However, it’s all academic. By the end of the year, SX will have launched enough for us to know how fast they can turn around a booster. Based on the evidence so far, I’m going to go out on a limb and say the minimum will be just under two months, if that.

    That all said, 1049 is especially troubling. The gap between its two flights was four months. There are several other flights in that period which used refurbed stages (three of five flights between 1049’s first and second flight). To me, that more than anything in the data above says that quick turnaround isn’t going to happen.

    Also note that the upcoming launch on 2/22/19 is using a refurb booster. If you were trying to prove quick turnaround, why wouldn’t you have used a more recently flown booster? Three of the four boosters since 1047 last launched have survived. None of them were selected for this mission. Therefore, the logical conclusion is that SX can’t turn boosters around in less than 3-4 months, at least not yet.

  • Mr Snarky Answer

    You don’t have any proof they need to “change significant parts”. This is just a fabrication in your mind. The time between flights is mostly NDE to verify their modeling of wear and tear. Once they have a big enough database they can relax the intrusive NDE after each flight. The rest of time is queueing for mission and integration flow.

    Let me put it this way, early B5 booster still had the old cork grid fin hinge covers which sometimes get damaged on the way down. They were replaced with metal covers that don’t require replacement between flights. They have walked the entire booster in this manner and are basically past hinge covers.

  • Vladislaw

    I was under the mistaken impression we were referring to commercial space and access to commercial space systems.. as far as desire to ride the space shuttle .. as I stated before .. you had a better chance at becoming a US Senator over becoming an Astronaut for NASA. That is what the paradigm shift is all about .. the size of your checkbook and the market place will determine if you can fulfill your desire .. not jumping through government hoops to decide.

  • Robert G. Oler

    Not a fan boy, but I admire their solid technical record.

  • Robert G. Oler

    I hope it works

  • Robert G. Oler

    That is not true…

  • Robert G. Oler

    You nailed it…

  • Robert G. Oler

    The timeline is really quite good proof…they have made a claim that they can turn one around in a day or a week I forget what it is now….why are they not getting closer to it

    I will go out on a limb here…they will never break the 6 to 8 week barrier. I will be impressed if they get under 10.

    And also it is likely just barely affordable…ie the cost of recovery and refurbishment are coming very close to a new vehicle

  • Jeff2Space

    And if you were a US Senator, you stood a better chance of flying on the shuttle as a passenger than you did as part of the general public. The US space shuttle flew lots of “payload specialists” that, upon close inspection, had little to no legitimate reason to be there other than politics, foreign relations, favors to contractors, and etc. In other words, they were simply passengers.

  • Jeff2Space

    At least SpaceX has two Falcon Heavy flights scheduled this year. SLS first flight keeps moving to the right at $2+ billion each year. The lost opportunity cost due to SLS is staggering.

  • Jeff2Space

    Your op-ed seems to be at odds with many of your forum comments.

  • Mr Snarky Answer

    No it isn’t, sorry. Until you come up with hard evidence of swapping major parts nothing you say on the subject hold any weight.

  • redneck

    I thought the same until I thought about the wording. He believes in harnessing the private sector to the government program. Many of the rest of us believe in unleashing the private sector to follow demand. It can sound very alike before the small details.

  • duheagle

    What? The chutes have a problem in cold weather?

    Okay, we’ll just leave that in the realm of RGO autograph model gnomic utterances.

    As for the Superdracos and an emergency landing, how would you know anything about the software load for a D2?

  • duheagle

    Your tiresome insistence that a craft with only a single way to get to the ground safely is safer, somehow, than a craft with two entirely different and independent ways to do the same is getting a little old. Unlike wine, whine doesn’t improve with age.

  • Robert G. Oler

    it is actually a expanded version of them 🙂

  • Robert G. Oler

    when one of the ways is completely unproven it has no value. Musk has never landed a Dragon propulsively and his propulsive landing record is no where near 100 percent

    unlike wine ignorance does not get better with being repeated

  • duheagle

    And now Musk has moved on from wanting or needing to land Dragon propulsively to wanting and needing to land Starship propulsively. And there’s no recalcitrant NASA to argue about the bill for the testing – it’s all on SpaceX’s dime.

    Why am I sure that when SpaceX succeeds in doing this repeatedly you are not going to be among those applauding?

  • duheagle

    Over the history of CC, NASA has done a lot less waiting on SpaceX than SpaceX has done waiting on NASA. Propulsive landing was always part of the D2 plan right from the start in 2014. NASA didn’t start raising BS objections about that until the anti-SpaceX contingent within it had gotten their act together and started to pull in harness.

    SpaceX certainly isn’t unwilling to foot the bill for vertical landing tests of a new vehicle – it’s already planning to do all such tests on its own dime for SH-Starship. But I can see why there was little attraction in doing so on a vehicle being built for an increasingly capricious and arbitrary NASA.

    So SpaceX locked down D2 as a NASA-only design and went about its own future business on its own and at its own chosen pace. NASA probably isn’t through jerking SpaceX around anent D2, but it hardly matters anymore. If NASA wants to slow down D2 some more to please Boeing or Sen. Shelby, it is the only entity that will be harmed thereby.

    Once SH-Starship is flying, SpaceX can always offer to use its new shiny rocket to fulfill remaining CRS and CC obligations if NASA is also willing. It might even be able to do so before NASA would need to use those two extra Soyuz seats it now says it wants to buy.

  • Robert G. Oler

    I will of course watch this with enormous interest. If SpaceX losses first and second stages at the same rate that they lost falcon 9 first stages until they worked it out I will be curious to see how long they can sustain the losses

    from a safety standpoint whaat should trouble all thinking people is that they still lose first stages in recovery. with the “unique” cooling systems that Musk is designing for the reentry systems…I suspect that future losss are on the way

    we will see. I always applaud when technical success is had. its not succeeding at technology that is the hard point…it the economiics of it. ask Airbus with their 380 🙂

  • Robert G. Oler

    NASA has always had cold feet about propulsive landing. how many tries do you think SpaceX would have had to have done to get it “right” based on their F9 first stage experience. I gave it at least 3

  • Robert G. Oler

    if all they are doing during this period is inspections itis the slowest B check I have ever seen

  • Robert G. Oler

    yes and the Falcon H flights are in my view very important to their future. SLS is nothing but a waste

  • Lee

    Initially there was to be around 40 -> 45 days between the two upcoming FH flights (which are supposed to use the same cores). Well, the time between launches is now something around 130-140 days. I refer you to my comment above as to what that means…

    Saying that time between core reuse is driven by payload schedule can only be an excuse for turn around times in excess of 100 days for so long. We’re quickly approaching the end of that window.

    I suspect that once it is proven beyond a shadow of a doubt that F9/FH will never be able to turn around in less than a couple of months, let alone less than a couple of days, the goalposts will magically be moved to say that Musk doesn’t care about that anymore, he’s expending all his energy getting SS/SH up and running.

    Are Oler and I the only people who see that there are a lot of others who refuse to accept reality? Oh, wait, that’s because we deal in hard data and actual facts, not pie-in-the-sky dreams 🙂

    To be clear, I think Musk has done great things with FH/F9, things that got me pumped up about spaceflight again. However, yet again, he’s falling short of his grandiose claims…