Statement of VADM Joseph W. Dyer: Hearing on ISS: Lessons from the Soyuz Rocket Failure and Return to Flight
October 12, 2011
Statement of
VADM Joseph W. Dyer, USN (Retired)
Chairman
National Aeronautics and Space Administration’s
Aerospace Safety Advisory Panel
Before the
Committee on Science, Space, and Technology
Subcommittee on Space and Aeronautics
U.S. House of Representatives
Chairman Palazzo, acting ranking member Costello, and distinguished Members, thank you for the opportunity to appear before you today. As requested, I would like to present the NASA Aerospace Safety Advisory Panel’s (ASAP’s) perspective regarding “The International Space Station: Lessons from the Soyuz Rocket Failure and Return to Flight.”
The Aerospace Safety Advisory Panel (ASAP) was originally established under Section 6 of the NASA Authorization Act, 1968 (42 U.S.C. S 2477). In 2005, the ASAP authority was modified under Section 106 of the NASA Authorization Act of 2005 (P.L. 109-155).
The ASAP’s charge is, among other things, to advise the NASA Administrator and the Congress with respect to the hazards of proposed or existing facilities and proposed operations with respect to the adequacy of proposed or existing safety standards, and with respect to management and culture related to safety.
The panel comprises individuals with deep knowledge and broad experience in the safety aspects of major technical undertakings. Membership includes individuals with backgrounds in government, commercial industry and some with combined leadership experience in both camps. The panel members’ biographies can be found via www.hq.nasa.gov/asap/bios.
I must first offer a caveat – while the panel follows safety aspects of joint Russian-U.S. space activities, we have had no direct contact with the Russian Space Program. Our insight and information comes from NASA and is by definition “second hand.” With that said, we view the information related to Russian operations we receive as creditable and high fidelity.
We do follow NASA’s analysis and decision making regarding the cooperative program with the Russians; this includes the activity relating to resumption of the Soyuz flights for U.S. astronauts’ transport to the International Space Station.
ASAP’s Role in Monitoring Safety Issues Arising from Cargo and Crew Resupply to the International space station (ISS)
The ASAP closely examines activities associate with the ISS and has addressed both crew and cargo commercial transport in our last two annual reports. I’ve included those reports in our written submission. Over the years, NASA has sharpened and improved its risk management processes. With the advent of commercial space, the ability of NASA to effectively understand and manage the total scope of risk becomes much more difficult. Timely insight in the face of contractual and intellectual property constraints will be critical moving to the future. To believe that commercial space flight removes risk from NASA’s programs is, at best, wishful thinking. Since the Shuttles’ last flight, commercial transport and associated risks have been the centerpiece of the panel’s focus. In our latest engagement, members of the panel visited the SpaceX facilities during the first week of October and we will spend this coming Friday with Orbital.
ASAP and the Soyuz Return to Flight
On 24 August, 2011, Russian Progress M-12M launched for the International Space Station (ISS). The third stage of Progress’ Soyuz-U rocket failed and prevented the rocket from achieving orbit. The failure grounded both the Soyuz-U rockets used to launch cargo, and the Soyuz-FG rockets used to launch crews to the ISS, since both rockets share very similar third stages.
NASA’s Human Exploration and Operations Missions Directorate has conscientiously communicated with the ASAP following the August incident. We’ve always found that communication to be forthright and transparent; NASA has shared their evolving understanding and has not been reluctant to share both what is known and unknown. We take faith in what we’ve heard and note the trusting relationship Mr. Gerstenmaier has built with the Russians. To a great extent this relationship building has enabled NASA’s timely understanding of the Russian Investigation status. It appears to the ASAP that the cause of the third stage failure has been identified, is being verified, and actions are underway for a safe return to flight in time to preclude a de-crewing of the ISS. The Russians plan to launch another Progress mission on or about 30 Oct. If successful in verifying fixes to the 24 August failure, NASA and the Russians anticipate a 13 November Soyuz to the ISS. A November success will put to rest the current predicament.
Our understanding of the third stage engine’s failure mode involves the normally fuel rich Gas Generator mixture which powers the engine turbine. A blockage in the fuel line appears to have reduced fuel flow by 30%, creating an oxygen-rich mixture that caused the Gas Generator to speed up and eventually burn through its exhaust duct. Engine controllers sensed the pressure dropping and opened the oxygen flow, further exacerbating the problem. We note that this engine was designed in the 1950s and uses a mechanical fuel balancing system that has advantages as well as disadvantages compared to digital systems used in engines being designed today.
The above failure mode is clearly a quality escapement, rather than a design flaw. We understand that the Russians have added significant quality control processes to prevent a fuel system contamination recurrence that was experienced on the last flight. They have two and three independent inspectors checking each operation and are videotaping every step in the process to ensure it is done correctly.
NASA sent a team to Russia to monitor the successful test of an engine returned from a third stage assembly. They will conduct a formal Flight Readiness Review before the next Progress and Soyuz launches to formalize the agency’s review of the investigation and readiness for flight. The ASAP will closely monitor these reviews.
We note that thankfully, unlike the Space Shuttle, Soyuz has an abort capability. This capability is available throughout its launch trajectory. While it would have been “exciting”, it is believed that this system is capable of recovering a crew in the event of an engine failure such as experienced on the last Progress launch. We’ve also been impressed with the contingency planning NASA and the Russian Space Agency have undertaken to mitigate the risk to the ISS and to the public if it is necessary to de-crew the station.
NASA Consultation with ASAP Following Flight Anomalies
Since the ASAP was reconstituted in 2003, the ASAP has been deeply involved with each grounding incident and closely engaged in all significant technical and programmatic issues affecting operations. You may recall that the Return to Flight Committee formed following the conclusion of the Columbia Accident Investigation Board handed off outside oversight to the ASAP prior to resuming Space Shuttle operations. Then, as now, we have been routinely invited to participate in the Flight Readiness Reviews and other decision forums. The panel has been included in the dialogue on all serious anomalies – sometimes via NASA’s invitation and sometimes at our own insistence. We have rarely found fault with NASA’s communications and on those rare occasions when information was slow in coming, we’ve had strong support from the Administrator to gain the access and insight we believe necessary. This has never been better than with the current Administrator Mr. Bolden. He was, after all, an ASAP member prior to his appointment.
Safety Concerns Resulting from Reduction in Crew Aboard the ISS
We are confident the ISS and crew aboard can operate safely with only three crew members and note this was the norm prior to life support system improvements which allowed the crew size to grow to six. During the time the Shuttle was grounded following the Columbia accident, the crew size was at two. While the day-to-day experimentation and work ancillary to operating the station may be impacted, a crew of three can safely fly.
Likewise, the necessary stores and supplies required for extended operation are aboard, and we believe the station could operate with a reduced crew of three until late calendar year 2012.
The Soyuz capsule left docked aboard the ISS provides the crew return mechanism and serves as a “life boat” for recovery in the event of emergency. It is not logistics but the 200 day “use by” requirement of the of the docked Soyuz capsule that is the critical factor in the potential necessity to remove the crew and to leave the ISS unmanned. (Specifically, it is Hydrogen Peroxide propellant which is running out of life.) The delay in the planned Soyuz flights means that the capsule docked at the ISS is at risk of aging-out before a replacement capsule can be transported to station. The US policy has been to never leave a crew on board Station without a recue vehicle that is fully certified and ready to use. This would require sending the last three crew members home and leaving Station without crew if a replacement Soyuz and crew is not launched before approximately mid-November.
It is a tribute to the Soyuz system’s usual reliability that the risk of running out of “shelf life” while docked to the ISS was not an active topic at NASA nor was it an ASAP focus. A more prophylactic and energetic risk assessment would have been helpful. To put that in simpler terms – we (the ASAP) miss it.
NASA’s ISS Contingency Plans
NASA and the Russian Space Agency have developed a number of plans which have potential to both protect the public from an unplanned and potentially uncontrolled de-orbit and sustain the ISS life on orbit.
Luckily, it would take multiple malfunctions to cause serious problems for an unmanned Station. An example would be loss of cooling on BOTH the US and Russian sides of the station, which could then cause loss of gyroscopes and the resulting loss of attitude control. NASA is working under the assumption that loss of attitude control would be catastrophic, but it may not be, as there are some recovery techniques that may be available, depending on the Station’s response. The Probabilistic Risk Assessment for the Station tells us that having crew on board is an important mitigator for such hypothetical failures.
NASA already has contingency plans in place that would respond to the first signs of loss of redundancy in the critical systems by boosting the ISS to a higher orbit. This would buy additional time to respond to a potential loss of the remaining critical systems. At the existing orbit, they believe they would have approximately one year to respond to a station anomaly before it reentered the atmosphere. With the additional orbit boost that would be implemented, they believe they can extend this window to somewhere from 18 to 24 months.
The ASAP has previously identified to NASA the desirability of formalizing the approaches that could be used in the future to safely deorbit the ISS whenever that might eventually become necessary, whether at end of mission or upon a anomaly before that time. NASA is working with the Russians to formalize plans for such an eventuality.
NASA and our Russian partners have spent over a month meticulously going over exactly how to leave the Station configured if they must de-crew. They have looked at all systems and maintenance issues. They have gone through each and every Orbital Replacement Unit and identified its condition and optimum configuration. They’re treating this as a real possibility. As AA Bill Gerstenmaier often says “they hope for the best, but plan for the worst”.
Summary
In summary:
* The ASAP has been, and continues to be actively engaged in safety issues arising from cargo and crew resupply to the ISS.
* Via NASA, the ASAP is monitoring the progress being made in returning the Soyuz to flight status and enabling the Russians to provide crew and logistics transport to the ISS.
* The ASAP, reconstituted in 2003, has been closely consulted regarding decisions on resuming missions following a flight anomaly
* The two prime safety concerns, potentially flowing from a disruption of Soyuz transport capability, are, 1.) Risk to the public from an unplanned and uncontrolled ISS deorbit and associated debris; and, 2.) Risk of loss of the Station due to stability control failure following de-manning and the lack of crew to provide maintenance support. Both risks are mitigated given the ability to position the station in a higher orbit (and thereby buying time to find a solution) and the nominal ability to control station stability from the ground.
* Information provided to the ASAP by NASA’s Human Exploration and Operations Missions Directorate indicates the Russians have been forthcoming with the engineering analysis, safety and mission assurance information related to the efforts to return Soyuz to flight status. If the sharing and transparency is sustained, it should be sufficient to support a decision to resume the astronauts’ transport to the ISS. Collectively, NASA and the Russians are hoping for the best but preparing for the worst. * The ASAP’s engagement with anomalies in the Russian System have been “second hand” via NASA’s Human Exploration and Operations Missions Directorate and not “first person” as is the case with NASA and commercial space contractors.
I thank you for the opportunity to testify today.
