SpaceX Faces Challenge Over Astronaut Safety

Earlier this month, SpaceX delivered 10 new Iridium satellites to orbit aboard a Falcon 9 rocket in a flawless launch from California, and then landed one of the rocket stages on a ship. It was the company’s first flight since its disastrous launchpad accident in Florida this fall, which destroyed a rocket and $200 million in equipment. But the success came just days after a NASA report to Congress that again raised questions about the risks that the company’s fueling procedures could pose to astronauts.

The new annual report, by NASA’s Aerospace Safety Advisory Panel, raises concerns about SpaceX’s “load-and-go” rocket-fueling process, which calls for the fueling of super-chilled liquid oxygen to be conducted after astronauts have boarded the spacecraft, in order to keep the fuel as cold as possible. The approach is a break from conventional wisdom about space travel—typically rocket fueling occurs before a crew is aboard—and the report indicates possible challenges to that plan within NASA.

This isn’t the first time the panel has expressed concerns about the fueling method. After the SpaceX explosion in September, which took place during routine fueling procedures, the panel called for renewed attention to the issue, which it had raised at least once before.

Even determining the level of risk posed by the rockets is challenging, according to the panel. “Despite testing at the component and subassembly level, systems often display ’emergent’ behavior once they are used in the actual operational environment. We are concerned that any determination of risk associated with ‘load and go’ would have significant uncertainty,” it said.

In a statement to Fast Company, a SpaceX spokesperson reiterated the company’s commitment to making its approach “the safest and most reliable possible” through its NASA-led certification process for upcoming launches, and to incorporate lessons learned through its investigation into the September explosion. The ASAP report does not comment on those lessons because it was completed before the conclusion of SpaceX’s accident investigation.

According to SpaceX’s findings, which were issued two weeks ago and accepted by the Federal Aviation Administration, the explosion was caused by a bad reaction between liquid oxygen in the fuel tank and one of three small vessels containing very cold helium that are used to maintain pressure in the tank. The company also said it had identified “controls” against potential safety hazards and that these had been approved by NASA’s Safety Technical Review Board in July 2016.

Fueling Issues

SpaceX’s “load-and-go” approach to fueling, which fuels rockets only a half-hour before launch, is risky, critics say. SpaceX’s fueling technique uses a special kind of liquid oxygen; it also requires crews to board Dragon rockets before fueling begins. NASA is particularly sensitive to safety concerns: Both the Columbia and Challenger disasters resulted in the deaths of two Shuttle crews, as well as exhaustive investigations and holds on future space shuttle flights. Given past incidents, some at NASA are worried that incidents at private space travel companies could not only result in tragedy but potentially derail future public-private manned space travel partnerships.

In the past, NASA flew astronauts into space on its own. Since the end of the Shuttle, the U.S. has sent missions to the International Space Station by renting seats aboard Russian-flown Soyuz rockets, at around $80 million apiece. Next year, NASA intends to begin relying on SpaceX and Boeing to deliver astronauts to the ISS at a cheaper price, and to extend its relationship with other space firms like Jeff Bezos’s Blue Origin. Earlier this month, NASA ordered four additional flights from SpaceX and Boeing, tripling the companies’ contracted missions to the ISS.

The flipside of NASA’s work with the private sector, however, is less control over the inner workings of private vendors. This shift shows up in NASA’s contracts. When NASA had direct control over the Space Shuttle’s design specifications, they gave contractors between 10,000 and 12,000 requirements that they had to meet. By comparison, in NASA’s Commercial Crew contracts, Boeing and SpaceX only have to meet 280 design requirements. The same contracts also assume a certain risk of things going catastrophically wrong; they demand that the new space capsules keep their crews safe in 99.6% of missions. By that math, NASA believes that 1 of every 270 missions could fail. NASA has to account for everything—even the mathematical likelihood of fatal incidents.

NASA’s reports also raised concerns with fault tolerances on Boeing’s new Centaur rockets, which are expected to be used in NASA’s commercial crew program. In an email, Boeing spokesperson William Barksdale told Fast Company that the “ULA [United Launch Alliance, a Boeing-Lockheed Martin partnership] and Boeing are committed to mission success and flying crews safely aboard the CST-100 Starliner that will launch atop the Atlas V. The Atlas V with a Centaur upper stage has a proven track record of 100% mission success, with 68 single-engine launches. Though not all components are fault tolerant at the individual component level, the Atlas V design is robust, and can compensate for anomalies, should they occur, due to overall system redundancies and margins, to ensure mission success.”

In the text of the report, NASA’s panel also spoke in unusually tough language about the need to pore over investigations of SpaceX’s 2016 launchpad accident with a fine-toothed comb:

“We strongly encourage NASA top management to scrutinize this issue and ensure that any decision to accept additional risk or novel risk controls with large uncertainties is justified by the value that will be gained. The decision should not be unduly influenced by other secondary factors such as schedule and budget concerns.”

In addition to the safety controls SpaceX is implementing, the company spokesperson also cited the Crew Dragon launch abort system, which is designed to eject astronauts to safety at the instant an anomaly is detected. CEO Elon Musk has said that the system would have been able to save any astronauts had they been aboard the rocket that exploded in September.

“SpaceX has designed a reliable fueling and launch process that minimizes the duration and number of personnel exposed to the hazards of launching a rocket,” said the spokesperson. “Over the last year and a half, NASA and SpaceX have performed a detailed safety analysis of all potential hazards with this process . . . As needed, any additional controls will be put in place to ensure crew safety, from the moment the astronauts reach the pad, through fueling, launch, and spaceflight, and until they are brought safely home.”

The company said it also recently met with the International Space Station Advisory Committee, and its chair, Maj. Gen. Thomas Stafford, “to provide them detailed information on our approach and answer a number of questions.”

The report arrived the same week that the Wall Street Journal published leaked SpaceX financial numbers from 2015, showing a $260-million loss following another incident, the explosion of a Falcon 9 rocket shortly after its launch in 2015, as well as big expectations for its satellite-based internet service.

It also came days before the inauguration of Donald J. Trump, whose administration has signaled an interest in public-private space collaborations and who has invited SpaceX CEO Elon Musk to be an advisor. On Tuesday, Musk met with Trump and other CEOs for a third time. In an investor note last week, Morgan Stanley analyst Adam Jonas described the benefit of the “important line of communication” Musk has with Trump. “We believe this level of coordination with the new administration could actually evolve into greater strategic value than with the prior administration,” Jonas wrote.

SpaceX’s next two launches—a commercial satellite scheduled for January 30th and a resupply mission to the International Space Station in February—will occur at Kennedy Space Center’s historic Launch Complex 39A. It will mark the first use of the launch pad that sent humans to the Moon since the days of the Space Shuttle.