Boeing Starliner – Key Anomalies Analysis

Mishap classification

Retroactive Type A mishap (NPR 8621.1D)

Loss of controlled flight on docking axis

Control regained via in-situ troubleshooting

61 formal recommendations issued

All RCCA efforts req. before next crewed flight

Mission outcome

Originally: 8–14 day mission

Extended to 93 days on ISS

Starliner returned uncrewed

1. The four hardware anomalies

The most dangerous was the SM RCS loss of 6DOF control — five Service Module Reaction Control System thrusters triggered their fail-off fault detection logic during ISS rendezvous, temporarily leaving the vehicle unable to control all six degrees of freedom on the docking axis. Four thrusters were recovered through in-situ troubleshooting, enabling docking. The most probable causes were two-phase oxidizer flow (vaporization and cavitation of the nitrogen tetroxide at elevated temperatures) combined with Teflon poppet extrusion inside the oxidizer valves, restricting flow. GNC pulse-train firing patterns also amplified the thermal stress on the valves.

The CM RCS jet failure during descent is arguably the most alarming from a crew safety standpoint. A design variance (CCTS-VR-0001) had already accepted one-fault tolerance instead of the required two-fault tolerance — and when this thruster failed on CFT, the system dropped to zero fault tolerance. Loss of the single remaining redundant thruster on that control axis would have meant loss of crew. The leading theory is carbazic acid corrosion of the stainless steel valve, formed by residual propellant reacting with CO₂.

Seven of eight helium manifold seals leaked during the mission, traced to material incompatibility of O-ring seals with the oxidizer (NTO), compounded by poor gland fill and squeeze tolerances in the O-ring sizing.

Finally, the deorbit capability fault tolerance gap — the propulsion system lacked required two-fault tolerance for deorbit burns — was a design flaw present since early development that was not caught until CFT pre-launch. This is particularly damning from a systems engineering standpoint.

What is carbazic acid?

Carbazic acid (also called carbazinic acid) is a chemical compound that forms when two substances come into contact: the rocket fuel MMH (monomethylhydrazine) and CO₂ (carbon dioxide). Inside the spacecraft cabin and propulsion lines, small residual amounts of propellant can be present, and CO₂ is everywhere in a crewed environment. When they meet, they react and produce this acid.

What does it do to steel?

Stainless steel is normally very resistant to corrosion — that’s the whole point of it. But carbazic acid is aggressive enough to attack it anyway. The corrosion process creates tiny solid particles — essentially rust-like debris — that build up inside the thruster’s propellant valve.

Why is that a problem?

The valve that feeds propellant into the thruster needs to open and close with very precise, small movements. If you have corrosion debris building up inside it, the valve mechanism can get stuck or partially blocked. On CFT, the theory is that this is exactly what happened — the valve couldn’t open fully (or at all), so the thruster didn’t fire when commanded.

Why is it particularly tricky to catch?

A few reasons. First, the quantities of residual propellant involved are very small — not enough to obviously contaminate anything, but enough for the chemistry to happen slowly over time. Second, corrosion happens gradually, so the valve might test fine early on and only fail after extended exposure. Third, the Service Module is discarded during re-entry, so engineers can never inspect the actual hardware post-flight to confirm what happened — which is why the report calls this a “leading theory” rather than a confirmed proximate cause.

2. The systemic technical failures

Several patterns ran across all four anomalies. Qualification testing was not mission-representative — RCS thruster testing didn’t reflect actual duty cycles, and active cooling between tests masked thermal effects that appeared in flight. Low telemetry sample rates on chamber pressure made anomaly diagnosis nearly impossible in real time and in post-flight analysis. Most critically, unexplained anomalies from OFT1 and OFT2 were accepted and closed without root cause, allowing the same systemic thruster issue to carry forward into CFT.

4. Classification and path forward

The investigation team recommends the event be retroactively classified as a Type A mishap — NASA’s most serious category — representing a loss of controlled flight. The report issued 61 formal recommendations across technical, organizational, and cultural domains. All Root Cause/Corrective Action investigations must be completed before any next crewed Starliner flight.

3. Organizational and cultural breakdown

The report is unusually frank on this. NASA’s Commercial Crew Program adopted a hands-off contracting model (firm fixed price under CCtCap) where Boeing owned the hardware and NASA provided “insight” rather than oversight — but in practice this meant NASA had restricted access to subcontractor-level data and couldn’t independently verify system readiness. Boeing, in turn, relied heavily on subcontractors without sufficient oversight of their qualification activities.

The cultural analysis found overlapping authority between NASA CCP, ISSP, and Boeing leading to unclear governance; systematic erosion of trust through selective data sharing; and leadership on both sides perceived as dismissive of dissenting technical views. The report uses the term “risk-acceptance posture” to describe a culture where concerns were downplayed under schedule pressure.