SpaceX's Musk Says Sabotage Unlikely Cause of Sept. 1 Explosion, But Still a Worry

PARIS — Statements attributed to SpaceX founder Elon Musk suggest he remains concerned that Falcon 9 rocket operations are vulnerable to attack by “a long list” of SpaceX adversaries even if it’s unlikely that such an event was behind the Sept. 1 explosion during preparations of a static fire test.

In comments leaked just hours after a Musk presentation Oct. 13 to the U.S. National Reconnaissance Office (NRO), Musk also said “a leading theory” for the Sept. 1 failure is the formation of solid oxygen on the carbon composite overwrapped pressure vessel (COPV) — the helium reservoir that is immersed in the liquid oxygen tank on the Falcon 9’s second stage.

“It might have been formation of solid oxygen in the carbon over-wrap of one of the [helium] bottles in the upper stage tanks,” according to an excerpt of Musk’s remarks. “If it was liquid, it would have been squeezed out. But under pressure it could have ignited with the carbon. This is the leading theory right now, but it is subject to confirmation.”

A spokesman for Hawthorne, California-based SpaceX on Oct. 14 declined to confirm or deny that the statements, published anonymously online, conformed exactly to what Musk said.

“We are not commenting on private conversations Elon has had,” the spokesman said in a statement. “We are continuing to make progress with the investigation and we are focused on safely and reliably returning to flight at the earliest opportunity.”

In the absence of a full text of the exchange, it is impossible to determine whether Musk was pushed to address the sabotage theory or brought it up on his own.

Here is the statement attributed to him:

“The other thing we discovered is that we can exactly replicate what happened on the launch pad if someone shoots the rocket. We don’t think that is likely this time around, but we are definitely going to have to take precautions against that in the future. We looked at who would want to blow up a SpaceX rocket. That turned out to be a long list. I think it is unlikely this time, but it is something we need to recognize as a real possibility in the future.”

SpaceX President Gwynne Shotwell on Oct. 5 defended the company’s right to consider every possible scenario in the ongoing investigation but downplayed the notion that someone intentionally destroyed the vehicle:

“The more than likely — the overwhelmingly likely — explanation is that we did something to that rocket,” Shotwell said. “And we’re going to find it and we’re going to fix it.”

Shotwell said the COPV design is an unlikely cause of the explosion, which destroyed a $200 million telecommunications satellite. “I think it probably is more focused on the operations, which is one of the reasons we believe we can get back to flight so quickly,” she said at the APSCC conference in Kuala Lumpur, Malaysia.

Pending the results of the SpaceX investigation, in which NASA, the U.S. Air Force and other industry experts are participating, multiple theories have developed for what happened to the Falcon 9, whose engines were not ignited on Sept. 1.

Independent experts weigh in on Falcon 9 explosion

SpaceNews solicited the assessment of several experts in the field, who agreed to analyze the event on condition that they would not be identified, and that their remarks would not be portrayed as coming from inside the Accident Investigation Team.

What follows is a summary of their conclusions.

SpaceX has said the Sept. 1 explosion followed the rupture of a pressurized helium tank inside the second-stage liquid oxygen reservoir during LOX filling. Is that credible?

Perfectly credible. The reaction between the oxygen and the kerosene is one that requires a very large source of energy. This is not a product that reacts on its own, instantaneously.

The kerosene needs to be pulverized, such as in a spray, to ignite. It doesn’t burn well in its liquid phase. Second, you need energy.

Some initially thought the most likely cause was the sudden deployment of the auto-destruct system. That would be located at the common wall between the LOX and the kerosene to bring a lot of energy where it would have the most effect, at the common bulkhead. But SpaceX has said there is no telemetry data supporting this.

So if it’s not the auto-destruct, where does the energy come from?

The sudden rupture of the helium tank pressurized at 5000 or 5500 psi, around there, is a source of energy that certainly could pierce the common LOX/kerosene bulkhead and put these two elements into communication. The energy released could vaporize the kerosene. LOX reaching kerosene temperature at its contact becomes instantaneously gaseous.

And the energy from the hot points caused by the rupture of both the helium tank and the bulkhead is also a plausible factor.

So this failure scenario is plausible. The problem is working back analytically, based on experimental history and crosschecked demonstrations, to the root cause. Without an identified root cause, without reproducing the phenomenon and cutting the branches in a fault-tree analysis, the problem could recur.

Is the use of Composite Overwrapped Pressure Vessels (COPVs), the material of construction of the helium tank, a new practice?

No, the technology isn’t new. It has been used at least since the 1980s on several launchers and spacecraft. But to my knowledge they have never been used in such a cryogenic, unsteady environment. In a cryogenic environment you have thermal gradients that are not always oriented in the same way from the interior to the exterior of a structure, or the exterior toward the interior.

The difficulty is reproducing the thermal demands applied to the wound exterior of the bottle against the interior side. If wound or wrapped layers slide even a little bit, you get shear de-lamination. This can cause a catastrophic result.

If a liner is used, the two elements must balance the thermo-mechanical constraints coming from the liner to the composite-wound “overwrapped” case, and vice versa. And in between the layers there is resin. These three products are of totally different natures. It’s not easy having the same differential contraction and expansion coefficients with respect to mechanics, thermic, elasticity, creeping and local plasticization.

An earlier manufacturer of these bottles, Cimarron Composites, in Huntsville, Alabama, specializes in this — but not in highly transient cryogenic environments such as in a LOX tank during filling process with several, variable and pulsed geyser cycling. They produce bottles and cylinders for which the “proof test” checks have lots of margin based on what stresses they are expected to encounter during actual use.

The problem is things don’t happen the same way in a highly transient cold environment as in another environment. In 2014 Cimarron Composites suffered an explosion which caused extensive damage. My understanding is that after this event,  SpaceX decided to bring in-house the production of these vessels.

Fiber- or tape-, or strip-wound “overwrapped” technology is not something you can learn in a day or two. But SpaceX did it. They have many good technicians and engineers and equipment.

But his kind of multilayer, resin-coated winding is never totally reproducible. The big problem in serial production of this kind of manufacturing is to be able to identify the drift and defects, during quality control inspections, in an operating mode that is representative of the intended use — with margin, as necessary. That is not easy for severe cryogenic uses.

In cryogenic geyser cycling environments, such as SpaceX’s rapid filling of a LOX tank at 66 Kelvin, you have violent variations of temperature between the interior and exterior. The thermal gradient is deeply heterogeneous from one location to another.

If you make a slight mistake — for example, if you perform a sharp cooling too rapidly — it can deform and cause a kind of fold in the geometry of the metal being contacted as it tries to follow the thermal gradients.

An overly brutal, sharp gradient can deform a metal’s elementary geometry. It’s the same for the composite vessels. A strong, abrupt gradient can cause a loss of the structure’s homogeneity.

SpaceX has said that while they have not yet determined the root cause for the Sept. 1 explosion, they know enough to conclude it is not related to the June 2015 Falcon 9 failure.

I read that to mean they cannot explain the Sept. 1 anomaly by the failure of a strut, which is understandable. Quality defects were found in the struts, and corrections were made. It seems logical that what happened Sept. 1 is not tied to a strut failure.

The question is whether the strut was really the origin of the June 2015 failure. The struts were of below-specified quality, but it was not demonstrated that this was the root cause of the failure.

It remains possible that a helium bottle burst in June 2015 and that, in parallel, the struts supporting it were of poor quality.

Is this COPV technology incompatible with high-pressure cryogenic environments?

It’s more subtle than that. Let’s say it’s not compatible with huge and scattered thermal variations that are required by the use of cryogenic LOX filling. It’s not the cold per se that raises issues, it’s the transition from heating up by helium compression to 66 Kelvin cycling. When the liquid oxygen hits the surface the transition occurs very quickly. You start at the bottom of the tank and finish by the top, and the gradient is very large and fully heterogeneous and scattered.

This is not easy to test for, by the way, given the range of physical variations. You need a test bed of a certain size. But this thermal gradient degrades the connection between the liner (if any) and the wound exterior of the bottle or between the composite layers.

Why is it difficult to test for this?

Because you need to reproduce the temperature profile variations and the scattered heat exchange coefficients. Believe me: This is easier said than done. It’s achievable in a laboratory, but a launcher is not a laboratory, it’s an operational factory with a lot of variable conditions.

And this testing is a dangerous operation as we saw with Cimarron Composites. You can have an explosion, or degrade the vessels without being able to identify the in-skin damage.

We have seen what appear to be been similar phenomena on other SpaceX flights, where helium leaks forced launch delays. But it was not yet in the cryo phase, because the design of this at the beginning was what’s called “leak before burst.” That’s not in a cryogenic environment. It’s a degraded environment where the sealing element of the liner is broken, and there is a leak between the compromised liner and the composite overwrap, or between the layers.

Weren’t composite tanks with cryogenic fluids used for some experimental vehicles?

NASA has had experience with ground test composite tanks and cryogenic fluids, as well as flight tests of composite tanks with liquid hydrogen. I should point out that liquid hydrogen is colder than liquid oxygen.

The DC-XA vehicle’s composite liquid hydrogen tank used internal insulation bonded to the composite tank inner wall. This tank survived approximately 50 fill and drain cycles. The X-33 composite liquid hydrogen tank did not have internal insulation. The insulation was bonded to the exterior wall. Analysis of the DC-XA design indicated that the internal insulation reduced the thermal gradient across the tank walls because gaseous hydrogen interacted with the composite matrix behind the insulation, rather than the cryogenic liquid hydrogen.

These experiments were not followed by use on operational launchers.

SpaceX said the entire Sept. 1 incident — from first indication to explosion — occurred in just 93 milliseconds.

That’s interesting, because 90 to 100 milliseconds is the middle of the range covering the ignition delay in a combustion chamber of a thruster with this kind of propellant.

When you send the two propellants into the combustion chamber, the reaction time is about this same length of time. When it’s very rapid it’s around 50 milliseconds, when it’s slower it is closer to 100-150 milliseconds.

So the Sept. 1 incident has the signature of a standard ignition delay before the steady combustion of the propellants that occurs in a thruster’s combustion chamber.

What the sensors might have shown is that the helium tank pressure was compromised and the helium had propagated into the LOX tank. The investigation will need to confirm this.

When the debris from a helium bottle like this, pressurized at 5000 to 5500psi, is released, it pulverizes everything in its path in no time. It would go through the common bulkhead between the LOX and the kerosene with more than enough energy to start combustion. Think of this debris as shrapnel to get a clearer picture.

It’s still surprising that a phenomenon like this can go from first indicator to loss of telemetry so quickly.

The shrapnel is traveling at supersonic speed. At 5500psi, you have about a third of what’s in a cannon to launch a projectile. Think of car tires exploding, but at much higher pressure.

Senior SpaceX officials have said they hoped to return to flight this year.

There are lots of ways they could proceed, depending on how acceptable risk is assessed. For example, they could launch a mission that does not need the rocket’s full performance, and so they can pressurize the helium tank to a much lower extent. But it’s difficult to move forward without demonstrating a root cause and corrective actions.

We’ve seen this in the past on other vehicles, where a couple of probable causes are found, with neither determined to be the root cause. Corrective measures re applied to cover both, and operations resume.

Of course you can do this as part of a kind of success-oriented approach. But there is always the risk of correcting things that are not the real cause, such as correcting a badly built strut, which might not have prevented the June 2015 failure and did not prevent the explosion at Cimarron in Huntsville. We don’t know if the helium bottles on the June 2015 flight were the same manufacturing batch as those that had  problems in earlier flights.