back to article SpaceX reveals chain of events that caused the unplanned disassembly of Crew Dragon capsule

SpaceX has posted an update on the investigation into the destruction of its Crew Dragon test vehicle in April. In short, it was a leak and a dodgy valve wot dunnit. The incident happened at 18:13 UTC on 20 April while SpaceX was conducting static fire engine tests atop a test stand at the company's Landing Zone 1 at Cape …

  1. PaulVD
    Mushroom

    That's why we do the test

    To explore how the real world differs from our understanding of it.

    (Icon shows test result in this case.)

    1. A Non e-mouse Silver badge

      Re: That's why we do the test

      For a successful technology, reality must take precedence over public relations, for nature cannot be fooled

      R. Feynman

      1. Mark 85 Silver badge

        Re: That's why we do the test

        That should apply always. Sadly, marketing rules.

        1. The Oncoming Scorn Silver badge
          Mushroom

          Re: That's why we do the test

          MARKETING GIRL: Yes which is precisely the sort of thing we need to know, I mean do people want fire that can be fitted nasally.

          1. dfsmith

            Re: That's why we do the test

            Splunge!

          2. Stoneshop Silver badge
            Mushroom

            do people want fire that can be fitted nasally.

            We techies do want fire that an be fitted (nasally or otherwise) to those marketing dorks.

            1. werdsmith Silver badge

              Re: do people want fire that can be fitted nasally.

              I for one would love to be able to impersonate a dragon.

              (the mythical fire breathing creature, not the space vehicle thing)

              1. Tom Paine Silver badge

                Re: do people want fire that can be fitted nasally.

                The explodey thing? hmmm

  2. Will Godfrey Silver badge
    Thumb Up

    Impressed

    Not only a thorough investigation, but highly detailed and public report on what went wrong.

  3. Peter Mount

    Going by this description of what happened the 3d printed components of the Super Draco actually survived - it was a lump of fuel that hit a non-return valve that then blew the poor thin to bits that caused a fire (burning the Titanium piping at that point)

    https://www.youtube.com/watch?v=6P063KnI5NI

    The thing is, this is why they test spacecraft & they used the already flown hardware because they wanted to know how it would cope when it's reused,

    It's good this happened as they know what went wrong & they have a fix - better than having a "bag of mostly water" (STTNG reference there) on board when it failed.

    1. Anonymous Coward
      Anonymous Coward

      Who knew

      that horses can pick locks and get out of the barn? Guess we need a better lock!

    2. phuzz Silver badge
      Boffin

      "it was a lump of fuel that hit a non-return valve"

      Close, it was oxidiser, that had previously leaked past that same non-return valve, and was shot back into it when they turned on the helium to pressurise the tank.

    3. MrXavia

      Long term, I don't think they will keep the burst disk idea, it reduces re-usability. but short term it makes sense to get crew dragon flying, it isn't like they are using the Super Dracos for landing, only abort.

      Obviously the non return valves/plumbing need re-engineering to avoid this issue in future when they do need re-usability.

      1. Sorry that handle is already taken. Silver badge

        The Superdracos are now only used for launch escape services, in which case restarting them won't be necessary anyway.

  4. Sorry that handle is already taken. Silver badge
    Mushroom

    I bet the moment they realised that high pressure NTO could ignite titanium that easily* was mildly hair-raising...

    It's probably a fair assumption that the Superdraco's feed systems weren't primed during Demo-1 but blimey, this thing was attached to the ISS!

    * For particular definitions of "easy".

    1. Tom Paine Silver badge
      Alien

      Doomed - doomed, I tell you

      Which is why ultra-large (crews much larger than a dozen people, tops) crewed space vehicles will never happen. As the size and complexity increase a combinataorial explosion will eventually lead to a literal one (or perhaps a literal decompression or loss of attitude control or similar total-loss-of-vehicle-and-crew event. There are just too many things that can go wrong which lead to everyone dying. If you only have, say, 30 thrusters attached to the ISS and they only go fatally bang once in 1000 years the MTBF is probably acceptable. What about when the vehicle's so huge it needs 30,000 thrusters? (For thrusters, read any other component that kills everyone in certain failure modes.)

      That's not an argument against crewed flight, btw, it's an argument against idea of vehicles or facilities with more than a certain threshold level of complexity, There are other arguments against having any crew at all :)

      Aliens because maybe they have magic fail-oroof technology.

      1. Anonymous Coward
        Anonymous Coward

        Re: Doomed - doomed, I tell you

        'Which is why ultra-large (crews much larger than a dozen people, tops) crewed space vehicles will never happen. [...] There are just too many things that can go wrong which lead to everyone dying.'

        And yet people still buy tickets to fly on commercial aircraft, despite so many of them having crashed with no survivors.

        My point being mostly that safety is not absolute: it's a relative thing. "Safe enough" - that's what it'll take for large space crews to be fielded. I wouldn't bet on that happening for another fifty years or so, mind.

  5. Gene Cash Silver badge

    Mars Observer

    There's good reason to believe this also explains the loss of Mars Observer in 1993.

    1. Saruman the White

      Re: Mars Observer

      Similar, but slightly different, scenario; the Wikipedia article on Mars Observer describes what they think happened (obviously they could not recover the wreckage to have a look at it, so it is all "best guess").

      1. Stoneshop Silver badge
        Boffin

        Re: Mars Observer

        s/could not /aren't yet able to/

        1. Saruman the White

          Re: Mars Observer

          I agree with your comment, but please note that I used a past tense that does not preclude the possibility of the event occurring the future. Actually there is probably a lot of wreckage on Mars that NASA (and ESA - think Beagle) would like to have a close look at!

  6. Wobbly World

    Accidental ~ Safety from testing...

    The replacement of the check valves by burst disks, which seal completely until opened by high pressure are a once only use solution but then the need to fire the SuperDraco thrusters, that are hopefully never needed, are to save the crew capsule, in the event that there is a failure of the launch vehicle.

    The use of check valves was because SpaceX was conducting multiple static fire engine tests, that the abort system does not require as the SuperDracos are designed to push the spacecraft away from a failing Falcon 9 and are only to be used in the event of a launch escape scenario.

    So we now have a much safer Crew Dragon capsule as the result of this fortunate unplanned disassembly of a Crew Dragon capsule and a system design, that should in retrospect of been used in the first place!!!

    Titanium is a metal that given the opportunity combines readily with many elements but I wander was it the titanium, or another substance in the check valve or plumbing, that reacted with the nitrogen tetroxide with such violence!!!

    1. Hans 1 Silver badge
      Headmaster

      Re: Accidental ~ Safety from testing...

      but I wander

      Oh there you are, now come back over here, we have to figure out what caused this rapid exothermic reaction.

    2. Richard 12 Silver badge

      Re: Accidental ~ Safety from testing...

      The most likely reason for not using burst disks in the first place is that SpaceX have a strong company preference for directly-testable, and thus re-usable, parts.

      A check valve can be physically tested to ensure it meets the spec before fitting it to the spacecraft.

      Burst disks can only be batch tested, as they're one-shot. So they can't be sure that any one disk is going to rupture in the right way, only that some percentage of a batch did work correctly.

      For example, one presumes that fragments of thin stainless steel are bad for the engine, so they'll want to be quite sure that the disks are going to keep hold of all the bits. Quite difficult to do when tearing metal.

      1. TechnicalBen Silver badge

        Re: Accidental ~ Safety from testing...

        Also, was there not partially hopeful "powered landing" designs? So adding on/off valves were a priority previously. As NASA have prefered parachute landing, then these can be used as emergency escape/separation rockets only. So now the design/scope has changed.

        1. Robert Sneddon

          Parasitic weight

          The original plan was to use the Super Draco thrusters for a powered landing on ground rather than a parachute-braked landing on water. They would also double up as escape rockets during a launch if things went wrong.

          To achieve this they had to put the Super Draco motors and the highly toxic fuel and oxidiser to power them in the capsule structure beside the crew. Existing capsule escape systems use a set of rockets on a tower mounted to the top of the capsule. It's usually jettisoned in a normal flight to reduce weight and free up the docking adapter in the nose of the capsule once the point in the launch where a powered escape isn't going to be successful has been reached.

          Now SpaceX has abandoned the powered landing concept they're stuck with lifting the mass of the entire Super Draco system plus fuel and oxidiser to orbit and returning to Earth with it, basically parasitic weight if things go right. It would require a major redesign to remove them from the capsule and add a disposable escape tower system like the Boeing capsule has.

          1. CliveS

            Re: Parasitic weight

            "add a disposable escape tower system like the Boeing capsule has."

            Pretty sure the Boeing CST 100 Starliner uses a similar approach as that adopted by SpaceX for the Dragon. It's the Orion capsule (Lockheed/EADS) that has a escape tower.

            1. phuzz Silver badge

              Re: Parasitic weight

              The Starliner has sort of a combination of both approaches. The thrusters are in the service module, so they're physically underneath the capsule, but the service module is jettisoned before re-entry and burns up.

      2. Robert Sneddon

        Tearing metal

        Burst disks are a very common technology in many systems like oil and gas refineries, steam boilers and compressed air plants etc. It's not rocket science, it's about on the level of a ring-pull can top which a burst disk closely resembles.

        1. Richard 12 Silver badge

          Re: Tearing metal

          They are indeed, however in most industrial applications they only have a "must not fail below" and "must fail below" spec, as they're emergency pressure relief to stop some piece of kit from actually exploding.

          Debris doesn't matter a jot, as long as it's not going to react with the material to hand.

  7. Anonymous Coward
    Anonymous Coward

    The reaction.... was simply not expected

    "The reaction between titanium and nitrogen tetroxide at high pressure was simply not expected."

    By whom ?

    1961 post event investigation.

    http://contrails.iit.edu/reports/6932

    1. bombastic bob Silver badge
      Devil

      Re: The reaction.... was simply not expected

      well the titanium part was in a HELIUM system, and the nitrogen-based oxidizer ended up in there. I expect that the helium system works very well for HELIUM, not explosive liquids like NTO.

      https://en.wikipedia.org/wiki/Dinitrogen_tetroxide

      apparently a small amount of NO is often mixed with the NTO to limit stress corrosion of titanium (it's in the article).

      So the real problem is HOW the *FEEL* did the NTO get into the helium system in the FIRST place?

      (worth pointing out, titanium is chemically and physically a LOT like aluminum but a lot of people probably do not know this)

      Anyway, that much is probably obvious. Captain Obvious definitely thinks so.

  8. hugo tyson
    Mushroom

    Freshly shattered titanium?

    Maybe, like aluminium, all the titanium anyone sees, or any chemical touches, is actually a thin layer of transparent titanium oxide already.

    It requires freshly-shattered titanium in an oxygen-free environment for the oxidiser to set it on fire, maybe?

  9. Anonymous Coward
    Anonymous Coward

    why is anybody surprised?

    You're combining a vicious oxidizer with a material that oxidizes easily. The fact that a physical fault probably *started* the whole mess is more important than a buttload of oxidizer reacting with a highly reactive metal that is freshly shattered and therefore not protected by an oxidized surface layer.

    I'm guessing (SWAG) that the oxidizer hit the valve much like water hammer and simply shattered it from physical violence akin to what we imagine doing to the screaming child on an airplane. The oxidizer does its job, and promptly (in an extreme exothermic fashion) oxidizes anything it touches.

    FFS, they're using a hypergolic fuel. Some mechanical part suffered a RUD and spewed shrapnel. The end result is far, far, FAR less important than the cause. Knowing that a match will burn is less important than knowing what conditions could cause it to. Especially when human lives hinge on whether or not that match burns.

    As far as burst disks, they are a solidly reliable technology. Installed in a manufacturer-approved fashion, in a manufacturer-approved fitting, they will burst at the manufacturer specified pressure (within reason) every time. If your system is so touchy that the safety margin is less than the rated margin of the safety device protecting it.... you are an idiot and should let someone smarter design it.

    At the very least, we can be thankful they weren't using a florine based oxidizer. Florine fires are really something to see. From a safe distance. In proper safety gear. Only once in your life. Because watching wood, steel, sand, concrete, and even a stream of halon gas burn really makes you re-evaluate the definition of "safe."

    1. Captain Zippy

      Re: why is anybody surprised?

      Reminds me of this article - every time I read it I'm not sure whether to be terrified, amused, or far far away.

      https://blogs.sciencemag.org/pipeline/archives/2008/02/26/sand_wont_save_you_this_time

    2. }{amis}{ Silver badge
      Flame

      From a safe distance. In proper safety gear

      I had to insert the obligatory xkcd for this comment.

      xkcd What If Pressure Cooker

      Also if you are mad enough to dare to explore fluorine / hypergloc chemistry or just want a good laugh take the time to read PDF: IGNITION! An Informal History of Liquid Rocket Propellants

      Flame icon for the toasty chemistry content ;-)

      1. hugo tyson
        Mushroom

        Re: From a safe distance. In proper safety gear

        Upvote for "Ignition!" - everyone should read Ignition! - it's terrifying what they tried in the Cold War.

      2. tea junkie

        Re: From a safe distance. In proper safety gear

        Ignition has recently been reprinted. Its an excellent tome, with an intro by Isaac Asimov.

        The fuel in a super draco system is one of the less hilarious fuels. Ignition details more, and some of the safety precautions and tests devised. Apparently the proper safety gear for handling chlorine triflouride is a good set of running shoes.

    3. navidier

      Re: why is anybody surprised?

      > At the very least, we can be thankful they weren't using a florine based oxidizer. Florine fires are really something to see. From a safe distance. In proper safety gear. Only once in your life. Because watching wood, steel, sand, concrete, and even a stream of halon gas burn really makes you re-evaluate the definition of "safe."

      I was once, very long ago and very far away, trying to assay the concentration of fluorine in an experiment where I was pretty sure that the fluorine was reducing in concentration due to its reaction with the stainless-steel containment vessel. In seeking to replicate the usual test for iodine, I decided to release the gas into a vessel containing methanol and, IIRC, sodium iodide, later to be titrated with a starch solution (OK, this was 30+ years ago, some details have evaporated over time). Let's leave aside the fact that my first attempt to de-oxygenate the methanol by boiling in an Erlenmeyer flask resulted in a fire because I'd forgotten about boiling chips and a rapidly boiling solution shot up into the air like Vesuvius erupting and landed back down on the hot-plate -- it was a Sunday and no-one else was around...

      Anyway, as I cracked open the valve that led to a small teflon tube immersed in the methanol solution, I noticed what seemed to be a spark at the end of the tube. I cautiously proceeded with the same result. Shut down, turn off...

      I then found a book on the halogens in the University library which noted "there have been no reports of the interaction of fluorine with methanol which haven't resulted in explosions"!

      1. Charles 9 Silver badge

        Re: why is anybody surprised?

        I wonder if a hydrogen fire would be even worse, given that it's NOT a sight to behold (a pure hydrogen fire burns OUTSIDE the visible spectrum).

        1. Anonymous Coward
          Anonymous Coward

          Re: why is anybody surprised?

          I'd take a hydrogen fire any day of the week. Heck, a hydrogen fire may be darn near invisible, it may burn at an insanely hot temperature, and it may gnaw its way through darn near any material.

          But cut off its oxygen, and it dies. Cut off the fuel, and it dies.

          A florine fire is a special beast. It reacts with nearly anything to release oxygen. Its reactions are insanely exothermic. And it reacts with nearly anything. That means it brings its own oxygen, heat, and fuel to the area it resides in. It's basically the devil's diarrhea, turning anything it touches into its own special little version of Hell.

          I don't honestly know of anything that would extinguish a florine fire. Chilled nitrogen may snuff it out, but as soon as the nitrogen is displaced it would start right back up. It seems to be one of those 'sit back and wait for it to burn itself out' deals. Not to mention the devil's fart of insanely dangerous by-products a florine fire produces.

          There's just some chemicals you just 'nope' right on past and start walking faster.

          1. Charles 9 Silver badge

            Re: why is anybody surprised?

            I hear, as as fluorine is, chlorine trifluoride is even worse, bring prompt hypergolic with nigh anything containing oxygen (which includes sand due to it usually having quartz in it).

  10. Conundrum1885 Bronze badge

    RE. Re. why is anybody surprised

    I'll take your fluorine and raise you FOOF. (otherwise known as "FOON!" because thats the sound it makes when converting eveything in range into its component oxides and fluorides)

    "Sand won't save you this time!"

    1. Charles 9 Silver badge

      Re: RE. Re. why is anybody surprised

      So which is worse: your O2F2 or my ClF3, seeing as how both of them are exceedingly dangerous? I would think ClF3 is worse because it's more stable at STP (O2F2 decomposes rapidly in STP).

      PS. I would love to know the particulars of A. G. Streng's attempt to mix the two.

  11. cortland

    Holy Doctor!

    They've made a space-going Dalek.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019