To call launch market upstart Space Exploration Technologies (SpaceX) a change agent would not be an overstatement.

The company is bursting onto the scene with the stated goal of CEO Elon Musk to break the monopoly for U.S. national security launches now held by the United Launch Alliance's (ULA) Atlas V and Delta IV rockets. Air Force officials say they are already seeing ULA take measures to become more efficient and reduce cost (see page 43). And SpaceX is infusing the market with new manufacturing and design techniques.

But an oversight by SpaceX that resulted in an embarrassing upper-stage restart failure in September is revealing details about how different the company's closely held path to U.S. Air Force certification could be from that of its rival. And it is raising the question of just how much change could be too much for the Air Force, a notoriously conservative launch customer that is trying to embrace SpaceX's new commercial development and deployment model despite decades of institutional bias against it.

The upper stage failed to restart during the Falcon 9 v1.1's Sept. 29 maiden launch due to igniter fluid lines that froze in the cold vacuum of space. Though not critical to deliver a Canadian payload into its orbit—SpaceX declared the mission a success—the restart was added to the mission as a risk-reduction exercise. Perhaps the failure was a serendipitous event, as the design flaw revealed a shortcoming that was not found in pre-flight ground testing and, if allowed onto the second launch, would likely have caused a mission failure.

On the ground “ambient air kept the lines warm,” during testing, says Emily Shanklin, a spokeswoman for the company. “We've added insulation and made sure cold oxygen can't impinge on the lines” in future missions.

An upper-stage restart was properly executed during the Dec. 3 second fight of the Falcon 9 v1.1. The new Merlin ID vacuum engine burned twice in order to place the SES-8 payload into its geosyncronous transfer orbit. A similar launch to GEO for Thaicom is slated to follow soon. The restart will be critical for delivering national security payloads to GEO, as well. All of the 14 launches considered for competition in the next five years call for at least two restarts of the upper stage, says Air Force Program Executive Officer for Launch, Scott Correll.

Shanklin insists that the Sept. 29 mission will be the first of three—two of which must be consecutive successes—required for the company to gain certification. Air Force officials, however, say they are still assessing data from the mission and have not committed to using it for certification.

“Before they can be certified completely, we have to be comfortable that they can meet the requirements. This has to be done with the launch data results as well as our review of the technical data,” says Lt. Gen. Ellen Pawlikowski, Space and Missile Systems Center commander. “Getting into a GEO transfer orbit is a capability for which they will need to be certified. I just cannot say that because this was not done on the first launch means it does not count, because that was not necessarily what we had agreed they would demonstrate on the first launch.” Pawlikowski did not cite the specific criteria for success of each of the three missions required for certification. In the agreement signed last year by SpaceX and the Air Force, the company outlined the first Falcon 9 v1.1 missions as those eligible for certification; USAF listed specific success metrics. “We are very carefully looking at their processes because with only three launches—or frankly, if you have 10 launches—you cannot cover with absolute assurance every scenario. So every opportunity we have—as far as these three launches and the data they present—gives us the opportunity to observe and evaluate. For example, with this one—how do they handle anomalies?”

The restart failure is giving the service a front-row seat to observe SpaceX's anomaly-resolution process. But it also raises the question of whether the design flaw could—and perhaps should—have been identified on the ground. When space systems are put through thermal vacuum testing, operators expose them to an environment that as closely as possible mirrors the one found in space. Shanklin did not say whether the company executed a thermal vacuum test for the upper-stage system or whether that could have revealed the problem prior to launch. She did not respond to the question by press time.

But the shortcoming reveals the kind of issue that could arise as the Air Force and SpaceX set a precedent for the government to reap the benefits—but not take on the risk—of the commercial development model. Michael Gass, CEO of ULA, and typically an outspoken skeptic of SpaceX's ambitions, was uncharacteristically understanding about his rival's mistake on the igniter lines. The issue is “if you can do the thermovac testing and operate cryogenics at the same time. [With] many of these systems, you can't do both simultaneously” in testing, Gass says. “It should have been checked, [but] there are lots of things you can't test on the ground.”

There is no equivalent example for the Air Force in terms of development processes that establish a precedent for the right level of testing. The Atlas program did not conduct a vacuum test of the RL-10 engine, but that system already had decades of flight experience, says Col. Bob Hodgkiss, director of launch systems for the Air Force. “We were able to evaluate those decades of data and how the engine had been adapted into the Atlas V application and convince ourselves that our requirements were satisfied.”

By contrast, Boeing did conduct a thermal vacuum test of the RL-10B engine as it was being developed. Data from that test was used to support certification of the Delta IV's use of the RL-10B2, Hodgkiss says.

Pawlikowski, however, notes that while precedent is powerful on these matters owing to a long history of successful launches, she is open to new ideas.

“It is fun, but it is also kind of frightening from an engineer's perspective,” Pawlikowski says. “It is a very different approach. That is part of the challenge for my team. Just because it is different does not mean it is wrong. In fact, there are some things that SpaceX—because they have not been encumbered with 40 years of production of rockets—has been able to do more agilely.”

As an example, she points to the company's use of additive manufacturing. It was able to introduce this novel fabrication approach into the launch business unencumbered by long-established standards at ULA and other rocket makers. “Since SpaceX started without having [four decades] of infrastructure of all of those fixtures and . . . doing that kind of welding, they [could more easily] adopt some additive manufacturing where ULA and their subcontractors will take a more measured approach because they have [a] tried-and-true way of doing it,” Pawlikowski says.

But an open mind and an uncompromising standard of mission assurance will ultimately have to be blended to reduce launch costs. “We are asking for greater detail and insight than a commercial customer would ask from a vendor,” Pawlikowski says of SpaceX's certification process. “We are more involved in the decision cycle. . . . If we are going to get the savings that everybody talks about [it will be] based on being able to use this commercial model.”

The Pentagon is not likely to change its policy on self-insuring payloads that are being launched, however; if a costly national security payload is damaged in transit, the government pays for a replacement at a premium. By contrast, commercial launch customers have insurance underwriters that indemnify a payload in the event it is lost to a booster mishap.

This fact is likely to compromise just how much of the commercial model the Pentagon can adopt because it will always have paramount interest in protecting the payload and ensuring capability gets to orbit on time to support military needs around the globe.