Certified Safe

What will it take for commercial companies to win a contract to transport NASA astronauts to and from the International Space Station? Andrew Chaikin, author of our December/January 2012 feature story on SpaceX, spoke in mid-November with the head of the agency’s Commercial Crew Program, Ed Mango.

Chaikin: NASA’s basic requirements for commercial crew vehicles include being able to dock with the ISS within 48 hours after launch, remain docked to the station for 210 days with minimal maintenance, and return to Earth within 4 to 8 hours after undocking. What are some of the other requirements?

Mango: Those things are all in the category of performance requirements, which you need to do the mission. Then there are safety requirements, such as the ability to have an abort system that can be operated anytime during ascent. We have requirements for loads on the crew; that’d be G[force]s and vibration and this kind of thing that are health and medical states. There are also requirements for making sure the crew can handle emergencies, such as a depressurization of the capsule. I would say of the requirements, two-thirds to three-quarters are really related to safety, and only about a quarter are related to mission items.

Chaikin: What are the G loads? Can you give me an idea of the max Gs you allow during launch?

Mango: The max Gs is roughly about 3. Similar to shuttle. I think we’re allowing excursions slightly higher than that at certain times, like Max Q [maximum dynamic pressure], but it can’t be sustained. The sustained [allowable G-force] is about 3.

Chaikin: And the probability of “loss of crew” has to be better than 1 in 1000?

Mango: Yes and no. What we've done is we've separated those into what you need for ascent and what you need for entry. For ascent it’s 1 in 500, and independently for entry it’s 1 in 500. We don’t want industry … to [interpret the 1-in-1,000 requirement] to say, “We’ve got a great ascent; we don't need as much descent protection.” In reality we’ve got to protect the life of the crew all the time.

Now [the probability for] the mission itself is 1 in 270. That is an overall number. That’s loss of crew for the entire mission profile, including ascent, on-orbit, and entry. The thing that drives the 1 in 270 is really micrometeorites and orbital debris … whatever things that are in space that you can collide with. So that’s what drops that number down, because you’ve got to look at the 210 days, the fact that your heat shield or something might be exposed to whatever that debris is for that period of time. NASA looks at Loss of Vehicle the same as Loss of Crew.  If the vehicle is damaged and it may not be detected prior to de-orbit, then you have loss of crew.

Chaikin: What about abort? People have said to me that’s the hardest part of commercial crew. Do you agree?

Mango: No, I don't. It is hard, but it's just as hard as guidance and navigation to dock with the station. It's just as hard as mass properties within a capsule or within a winged vehicle, to make sure your center of gravity on your vehicle is right not only for the mission but also for the landing—and when you have a winged vehicle, to make sure that you have the right sink rate and the right control of your spacecraft as it’s entering and landing. Those are just as hard, in fact sometimes harder, because you have less variables you can play with.

But I would say that the abort system, from a systems design standpoint, could be very complex. And I believe that most of our partners in [commercial crew] are very much seeing that the abort system is driving some of their key components and key drivers of their overall design. So it is definitely a driver, a huge driver. But I cannot necessarily say it's the most complex. That depends on the actual system itself.

Chaikin: Let me just broaden the question then. For a vehicle that has not flown crew before, what do you need to see? Is it a question of saying, you've done X number of tests and the results are within X percentage of reliability? For these brand-new vehicles, how will you know when it's okay to put NASA astronauts on them?

Mango: Very good question. There are a number of things we are going to require in order for us to certify the vehicle. For an abort system, we are going to have a reliability number that says that when you push the ‘big red button,’ the system will actually work, and you get the crew back to the surface safely. Whatever that abort system is, whether it’s parachutes, or you’re going to a landing strip, or whatever. We are going to declare we've got to have 95 percent reliability, which is pretty high for an abort system that you’re hopefully never going to use in the life of your program. But it’s got to be there.

Now, how do you get there? What we will request during the next phase of our program is a proposal from the bidders [describing] what they plan to do to verify that their system can meet our certification requirements. I always get this question: “How many abort tests do companies gotta go do?” And there isn't a right answer. Because it depends a lot on all the other variables. How many component tests are you doing? How much are you making sure the reliability of those components are up to speed and ready to meet the requirement? …. I believe at some point we will have to have some level of demonstration that says you have met the capability of your abort system.

Chaikin: What you're saying is there's no prescribed test sequence or flight test plus ground test sequence. It could be a whole matrix of tests that would then give you an acceptable result.

Mango: Correct.

So that's the abort system. The rest of the vehicle is really kind of done the same way. We, NASA, already have in our requirements sections that say, for this particular requirement we suggest that the company do the verification of that particular certification requirement by test, analysis, demonstration, or inspection…. All those kind of things we will work with the contractor to put together [into] a good plan that NASA will buy into.

Chaikin: When do you think this next round of requesting proposals will happen?

Mango: Before the end of [2011] we will have a request for proposals on the street; that’s our plan. And we hope to award the Integrated Design Contract (IDC) in the summer of 2012. And then that will go for about two years. Throughout that process we will begin to work with the contractor on what that certification plan will be. And by the end of that contract, we will have what's called the Critical Design Review, which is our key design milestone.

Chaikin: That's the point at which you say the design can be finalized.

Mango: The design can be finalized; now you go to certification. And then you work through certification the next couple years. Anyway, that design process will conclude towards the end of the contract. And that's when we will sign up to a certification plan with the contractor.

Chaikin: And actually build vehicles.

Mango: At that point we will begin to build hardware and to test hardware.

Chaikin: [SpaceX CEO] Elon Musk says he thinks he'll be able to work with NASA to accomplish a safe and reliable system. But he says his worry is that the existing contract has language that gives NASA the right to make changes to the design requirements without adjusting the fee after work has already begun. He compares it to hiring a contractor to build a two-bedroom house, and after they’ve started saying, no, I want a four-bedroom house without adjusting the fee. And obviously, he says, that's not a workable situation. How do you address that concern?

Mango: What I’ve told all of industry is that if NASA changes the requirements, then we've got to bring dollars to the table to deal with that change of requirements.

Chaikin: Does that statement apply to the entire process, from the start to the completion of the vehicles?

Mango: That process does go throughout the entire timeframe of the program, basically. However I would also say that IDC only goes to critical design and probably some testing thereafter; it does not go all the way to a certified system. So there will be another contract mechanism for that, and it'll be like part two. And part two will have the same rules. If we change our requirements then we have to bring dollars to the table.

Chaikin: There is a lot of skepticism about whether commercial companies, particularly the new ones, can accomplish reliable, safe, and cost-effective spaceflight. There's even resistance to letting them try. Can you accomplish what you're trying to do with this program in spite of the skepticism and resistance that's out there?

Mango: Well, we are doing our best to do that. And I would say that a lot of important things that have happened in the country, or in the world for that matter, have happened despite criticism and despite folks who want to slow it down or not have it happen at all.

The members of my team are not folks that we hired from industry yesterday. Most everyone on the team has either worked space shuttle, like myself, Constellation, like myself, test flying, like some of the folks—Brent Jett who's an astronaut and a very good test pilot is on the team—and then folks from the space station program. We also have other folks on the program that have launched Atlases and Deltas and been part of the launch services program for many years as well.

So I think my biggest pushback on the skeptics is that they need to look at who is on the team from the NASA program who’s making this stuff happen, and NASA engineers. Our history would tell us what is important and what is not important in order to go get a design that can go work. There are some areas where we will push extremely hard to make sure that we will have a safe vehicle. At the same time many of us have grown up … in the space shuttle program. We’ve seen some of the hard parts of the shuttle program, and where we can change the way we do business to make it more innovative and also make it more cost-effective.

I would also say the same thing is true in the companies. For [commercial crew], all of these companies are not folks that are right off the street. They are folks that had worked for NASA, and left NASA, and went to work for the contractors. There are folks that went from one company in aerospace to another company in aerospace. And I would put money on the table that says the best aerospace capabilities of the world are represented by our American aerospace industry. Whether or not they have a name that might be SpaceX, or Boeing, or Blue Origin, or Sierra Nevada or United Launch Alliance is secondary to the fact that as a nation we do have the best capability in order to go put a safe vehicle in space. And so that is what’s driving us, what's driving the program to go get a capability. When we get proposals and when we figure out who are the right ones, then NASA is bringing its 50 years of history to those contractors to help them make sure we have a safe vehicle to go fly. I am confident that we will have a safe vehicle when we go fly by the middle of the decade.