NASA Releases Starliner Investigation Results: Class A Mishap

As an Amazon Associate we earn from qualifying purchases.

Key Takeaways

• Five service module thrusters failed during rendezvous due to oxidizer vaporization and Teflon poppet extrusion.
• Helium manifold leaks originated from seal material incompatibility and improper sizing of system components.
• Organizational challenges included inadequate qualification testing and limited data telemetry during the mission.

Introduction

The integration of commercial spacecraft into human space exploration represents a major shift in operational strategy for the aerospace community. The launch of the Starliner spacecraft on June 5, 2024, marked a milestone in this ongoing transition. Conducted under the Commercial Crew Program managed by NASA , the Crewed Flight Test was designed to certify the vehicle for regular operational transport to the International Space Station . The capsule carried astronauts Barry Wilmore and Sunita Williams on what was initially planned to be a short duration mission lasting roughly over a week. Due to severe propulsion system anomalies, the mission extended to 93 days. The spacecraft returned uncrewed in September 2024, while the flight crew remained aboard the space station to return later via a SpaceX vehicle.

Following the uncrewed return, a Program Investigation Team was chartered to evaluate the technical, cultural, and organizational factors contributing to the in-flight anomalies. The findings of this investigation revealed a complex interplay of hardware failures, qualification gaps, leadership missteps, and cultural breakdowns. Understanding these elements requires looking at both the physical systems that failed and the human processes that allowed those systems to be certified for flight. Reading historical accounts like Failure Is Not an Option reminds us that spaceflight is incredibly demanding, requiring rigorous engineering and constant vigilance to ensure safety.

Background on the Commercial Crew Strategy

To appreciate the context of the Starliner mission, it is helpful to examine the procurement strategy implemented by the government space agency. Historically, government engineers and specialists oversaw every development aspect of a spacecraft. A commercial aerospace contractor was chosen to build the system, but the government owned the hardware and managed the entire process. The new commercial approach shifted this dynamic. The government identified a need for a crew transportation system and established a broad set of safety requirements. Interested companies, such as Boeing , were encouraged to design vehicles using their own manufacturing techniques. The companies retained ownership of their hardware, while government engineers provided oversight and insight.

This model prioritized provider-led development and minimized traditional insight. The hands-off approach during the early contract initialization resulted in limited systems knowledge for the government teams. When anomalies arose during the flight test, this lack of detailed knowledge regarding the design, qualification, and performance of the propulsion system made the resolution process inefficient. It delayed decision-making and increased a sense of mistrust between the partner organizations.

Overview of the Technical Anomalies

The investigation focused on several distinct hardware anomalies that occurred during the mission. The propulsion system issues were the most prominent, affecting both the service module and the crew module. The investigation also identified problems with the helium pressurization system and the fault tolerance of the deorbit capability.

Service Module Thruster Failures

The service module reaction control system provides attitude control and small translation maneuvers. During the approach to the space station, five of these thrusters triggered fail-off alerts, resulting in a temporary loss of six degrees of freedom control. This loss of control on the docking axis required the crew to take manual piloting actions while ground teams performed troubleshooting. The flight control team was able to recover four of the five jets by commanding individual hot-fire tests. This allowed the spacecraft to complete the rendezvous and dock safely.

The investigation determined that the loss of thrust was caused by a combination of two-phase flow and mechanical deformation within the thruster valves. The thrusters use a hypergolic propellant combination consisting of monomethylhydrazine as the fuel and nitrogen tetroxide as the oxidizer. The thermal environment surrounding the thrusters became elevated due to a combination of solar heating, internal heat soakback from repeated firings, and integrated heating from the adjacent orbital maneuvering thrusters.

When the temperature of the nitrogen tetroxide increased beyond its boiling point, it transitioned from a liquid to a vapor. This vaporization, along with localized cavitation, reduced the mass flow rate of the oxidizer into the combustion chamber. The lower density of the two-phase flow choked the system, leading to a significant drop in chamber pressure. The fault detection software monitored this pressure drop and automatically removed the degraded thrusters from the control algorithm to prevent a buildup of residual propellants that could cause an unwanted detonation.

The thermal environment also affected the soft goods within the thruster valves. The oxidizer valve utilizes a Teflon poppet to seal the flow path. Exposure to the nitrogen tetroxide caused the Teflon to swell. When subjected to elevated temperatures and mechanical pressure from repeated actuation, the poppet extruded outward. This deformation created a physical obstruction in the flow path, further reducing the amount of oxidizer reaching the combustion chamber. Ground testing conducted at the White Sands Test Facility later replicated this extrusion, confirming it as a primary contributor to the loss of thrust.

The Unrecovered Thruster

While four of the thrusters regained partial functionality after cooling down, one specific thruster designated as B1A3 did not recover. After failing off during the initial approach, it was hot-fired later in the sequence. The temperature signatures indicated that the valve opened successfully, but the expected heating from combustion did not occur. The recorded chamber pressure was less than ten percent of the normal operating level. This suggested a complete blockage of the oxidizer line. The investigation considered foreign object debris or a fractured poppet as potential causes for this specific failure, though it is highly probable that it suffered a more severe version of the extrusion seen in the other thrusters.

Crew Module Thruster Issues

The crew module also relies on a reaction control system to maintain proper orientation during the descent phase of the mission. This system is completely separate from the service module propulsion hardware. During the uncrewed return sequence, one of the crew module thrusters failed to fire. The leading theory for this anomaly involves the formation of carbazic acid. Residual propellant interacting with carbon dioxide can form this acid, which is known to corrode stainless steel components.

The resulting corrosion particulates can accumulate within the thruster valve mechanism. This buildup prevents the valve from opening properly when commanded. While the spacecraft was still able to land safely using redundant systems, this failure reduced the fault tolerance of the descent control system. Losing an additional thruster on that specific control axis would have resulted in an uncontrolled reentry. The investigation into this specific anomaly remains ongoing, with hardware inspections and chemical analyses providing further insights into the corrosion process.

Helium Pressurization Leaks

The propulsion system relies on pressurized helium to force the liquid propellants from their tanks into the thruster manifolds. Helium is also used pneumatically to operate the dual poppet valves within each thruster. During the mission, the spacecraft experienced leaks in seven of the eight helium manifolds located within the service module. These leaks required careful management by the flight control team to ensure enough pressurant remained available to complete the mission objectives.

The investigation pinpointed material incompatibility as a primary driver of these leaks. The seals used within the helium manifold were exposed to vapors from the nitrogen tetroxide oxidizer. Over time, this exposure caused the seal material to degrade and lose its elasticity. Additionally, the design of the sealing glands and the sizing of the O-rings contributed to the problem. Insufficient gland fill and poor squeeze tolerances meant that the seals could not maintain a proper barrier when subjected to the dynamic temperature and pressure variations of the spaceflight environment. As the seals degraded, helium was allowed to escape into the vacuum of space.

Deorbit Capability Fault Tolerance

A separate but equally significant issue discovered during the mission pertained to the fault tolerance of the deorbit propulsion system. Spacecraft designed for human transport are generally required to possess two-fault tolerance for vital maneuvers like the deorbit burn. This means the system must be able to complete the maneuver even if two separate components fail.

A review of the system architecture revealed that the spacecraft lacked this required redundancy. This design flaw had been present since the early development phases but went unidentified until the pre-launch reviews for the flight test. The program accepted a variance to allow the mission to proceed with only one-fault tolerance, but the discovery highlighted gaps in the hazard analysis and verification processes. Relying on manual inspections of complex schematics rather than utilizing automated evaluation tools allowed this vulnerability to slip through multiple design reviews.

Inadequate Qualification Testing

A recurring theme throughout the investigation was the inadequacy of the qualification testing performed on the propulsion hardware prior to flight. The testing programs did not fully envelope the conditions the spacecraft would experience during an actual mission. The service module thrusters were evaluated in isolated environments that did not accurately represent the thermal dynamics of the integrated vehicle.

For example, the ground tests utilized active cooling systems to reduce the time needed between test runs. This artificial cooling prevented the thrusters from experiencing the thermal soakback that occurs in space when multiple thrusters are fired in rapid succession. The testing also failed to account for the integrated heating effects of the large orbital maneuvering engines located adjacent to the smaller control thrusters. Because the testing did not simulate these combined thermal loads, the vulnerability of the Teflon poppets to extrusion at elevated temperatures was not discovered prior to launch. Just as the crew in Apollo 13 relied on precise communication and rigorous problem-solving to survive unexpected equipment failures, modern aerospace engineers must rely on exhaustive and highly realistic testing to uncover vulnerabilities before a vehicle leaves the launch pad.

Data Limitations and Anomaly Resolution

The ability to diagnose the thruster failures during the mission was hampered by limitations in the spacecraft data systems. The flight computers generated commands to the thrusters at a very high frequency, with pulse durations as short as five milliseconds. However, the telemetry system recorded the chamber pressure sensor data at a much lower sample rate. This mismatch meant that the ground teams only received a fragmented picture of the thruster performance. Short pulses were often missed entirely in the downlink data, leading to aliasing effects where the high-frequency components of the pressure signal were misrepresented.

This lack of high-fidelity data contributed to a flawed anomaly resolution process. During the two uncrewed orbital flight tests that preceded this mission, several thrusters experienced similar fail-off conditions. Because the telemetry data was sparse, the engineering teams misdiagnosed these early anomalies as simple sensor faults rather than genuine hardware degradation. The acceptance of these unexplained anomalies without identifying the true root cause allowed the systemic issues to persist into the crewed mission.

Organizational Dynamics and Communication

Beyond the physical hardware, the investigation heavily scrutinized the organizational culture that managed the program. The shared accountability model implemented under the commercial contract was poorly understood and inconsistently applied. This led to a muddling of roles and responsibilities. The government teams often assumed the commercial provider was enforcing rigorous standards on its subcontractors, while the provider believed the government was accepting the risks associated with the design choices.

Mistrust between the partner organizations intensified as the mission progressed. Concerns arose regarding selective data sharing, with some government engineers feeling excluded from important technical discussions. The emphasis on provider autonomy clashed with the traditional government culture of rigorous technical oversight. The schedule pressure driven by the desire to meet launch dates created a high-stress environment that contributed to workforce fatigue and constrained the time available for thorough engineering reviews.

The decision-making process during the mission was marked by chaotic meeting schedules and overlapping authorities. Survey data collected from the mission participants indicated low effectiveness ratings in team dynamics and organizational structure. The eventual decision to return the spacecraft without its crew was driven by the inability to confidently bound the risk associated with the degraded thrusters. This decision prioritized safety but highlighted the deep divisions in how the different engineering teams assessed risk and interpreted incomplete data.

Recommendations for Future Operations

The investigation team issued numerous recommendations to address the vulnerabilities uncovered during the mission. A primary focus is the requirement to conduct comprehensive ground testing of the propulsion systems in their fully integrated flight configurations. This testing must accurately replicate the thermal environments, duty cycles, and dynamic operations expected during a mission.

Modifications to the thruster hardware or the flight software algorithms will be necessary to prevent the two-phase oxidizer flow and poppet extrusion from recurring. The helium system requires a redesign of the seals using materials that are fully compatible with the hypergolic propellants, along with tightened manufacturing tolerances for the O-ring glands.

Upgrades to the data collection systems are recommended to provide higher sample rates for important propulsion parameters. This will ensure that ground controllers have the insight needed to accurately assess system health and diagnose anomalies in real time. Programmatic changes are also required to establish clear lines of authority, improve transparency in data sharing, and rebuild trust across the joint engineering teams.

Summary

The flight test provided a wealth of data that exposed significant vulnerabilities in the spacecraft propulsion systems and the organizational processes used to certify them. The thermal degradation of the thruster valves, combined with the material incompatibilities in the helium pressurization system, created an unacceptable level of risk for human transport. The decision to bring the astronauts home on an alternate vehicle ensured their safety while preserving the spacecraft for a controlled reentry and subsequent physical inspection. The extensive testing and analysis conducted during and after the mission have laid the groundwork for targeted redesigns. By addressing the specific hardware failures and implementing a more rigorous approach to integrated testing and anomaly resolution, the aerospace community can enhance the reliability of commercial spaceflight systems for future orbital missions.

Appendix: Top 10 Questions Answered in This Article

What caused the service module thrusters to fail during the approach to the space station?

The thrusters failed due to a combination of two-phase oxidizer flow and mechanical deformation. Elevated temperatures caused the liquid nitrogen tetroxide to vaporize, while the Teflon poppets inside the valves extruded and restricted the flow path.

How did the flight control team regain control of the spacecraft after the thruster failures?

The flight control team recovered four of the five disabled thrusters by commanding individual hot-fire tests. This allowed the thrusters to cool slightly and clear the flow restrictions, providing enough thrust to complete the docking maneuver.

Why did one specific service module thruster fail to recover during the troubleshooting process?

Thruster B1A3 did not recover, recording chamber pressures less than ten percent of normal operating levels. The investigation suggests it likely suffered a severe and permanent extrusion of the Teflon poppet that completely blocked the oxidizer line.

What is the leading theory for the crew module thruster failure during the descent phase?

The leading theory points to corrosion caused by the formation of carbazic acid within the thruster mechanism. This acid forms when residual propellant interacts with carbon dioxide, creating particulates that prevent the valve from opening.

What was the primary cause of the helium manifold leaks in the service module?

The helium leaks were caused by the degradation of seal materials that were incompatible with the oxidizer vapors. Improper sizing of the O-rings and insufficient gland fill also contributed to the inability of the seals to maintain pressure.

Why did the deorbit propulsion system fail to meet safety requirements?

The system lacked the necessary two-fault tolerance for deorbit burns due to an early design flaw. This vulnerability went unnoticed through multiple reviews because the program relied on manual schematic inspections rather than automated evaluation tools.

How did inadequate ground testing contribute to the propulsion anomalies?

Ground testing failed to envelope the true thermal conditions of a spaceflight mission. Tests used active cooling that masked the effects of heat soakback and did not account for the integrated heating from adjacent maneuvering engines.

How did data limitations hinder the engineering teams during the mission?

The telemetry system recorded pressure data at a much lower sample rate than the thrusters were being commanded to fire. This resulted in fragmented data that led engineers to misdiagnose early hardware degradation as simple sensor errors.

What cultural issues impacted the partnership between the government and the commercial provider?

A poorly understood shared accountability model led to misaligned expectations regarding oversight and safety enforcement. Mistrust grew due to perceived selective data sharing and a clash between the commercial emphasis on autonomy and traditional rigorous technical reviews.

What must be done to ensure the propulsion system is safe for future missions?

The propulsion hardware must undergo comprehensive ground testing in a fully integrated configuration that replicates actual mission conditions. Hardware and software modifications are required to resolve the poppet extrusion and material incompatibility issues before the vehicle flies again.