Part 010 · Chapter 5: Node 6A | 1 of 2

CHAPTER 5:
NODE 6A

On August 10, Mason Kellerman received a list of everything Project Perseus had once decided not to fear.

It arrived at 06:12 in a secure incident-review room at NASA head­quar­ters. The list contained four hundred and eighty-six items. Software exceptions. Parts accepted after repair. Inspection waivers. Supplier deviations. Sensor disagree­ments. Materials substi­tu­tions. Test conditions that had not reproduced flight exactly. Every line repre­sented a question someone had asked before launch and an answer someone else had judged sufficient.

The instruc­tion above the list was simple.

IDENTIFY ANY CONDITION CAPABLE OF CONTRIBUTING TO COMPLETE SPACECRAFT COMMUNICATION LOSS.

Mason read it twice.

Complete commu­ni­ca­tion loss was no longer the full problem. Perseus had been silent for six days. Multiple antennas had failed to find it. Optical searches had produced no confirmed detection. The predicted trajectory continued to move across mission displays because math­e­matics did not require the spacecraft to answer.

The incident teams still used present tense.

Perseus is unre­spon­sive.

Search operations are continuing.

The crew is presumed alive unless evidence estab­lishes otherwise.

Each sentence had been reviewed by lawyers, mission officials and family liaisons. None of them altered what Mason saw when he closed his eyes: a white marker traveling through empty space while every channel remained blank.

He filtered the list by thermal systems.

Twenty-seven items remained.

He filtered again for conditions associated with the reactor interface, propulsion power conversion and aft heat rejection.

Six.

The third line carried a name he knew before he opened it.

TDS-6A TRANSIENT DISPERSION DURING HIGH-OUTPUT TRANSITION.

Status: accepted with monitoring.

Mason placed both hands flat on the table.

The room had no windows. Two other review teams worked behind soundproof partitions. The air-condi­tioning ran colder than necessary because the equipment racks along the wall produced more heat than the people. Someone had left a paper cup beside the secure printer. The coffee inside had formed a skin.

Mason opened the Node 6A record.

The first page showed the final dispo­si­tion signed in March.

NO TREND OUTSIDE QUALIFIED RANGE.

MONITOR DURING HIGH-OUTPUT TRANSITIONS.

NO MISSION CONSTRAINT.

His own signature sat beneath the final sentence.

Chie Nakamura’s was three lines above it.

He opened the last telemetry from Perseus.

Node 6A appeared in the thermal summary. The sensor split had risen during the post-maneuver restart, peaked below one degree and begun to fall. Flow remained stable. Pressure remained stable. No automatic isolation command had occurred. No overtem­per­a­ture warning had been generated.

By every rule they had used before launch, the node had behaved as expected.

Mason knew what the incident board would ask next.

Expected by whom?

He requested the complete Node 6A archive.

The system returned one hundred and seventeen files.

Test video. Raw sensor streams. Review-board minutes. Engi­neering comments. Thermal models. Supplier records. Message threads. A main­te­nance image of the opened junction assembly. A revision history showing how the final wording had changed during the forty-eight hours before acceptance.

The first draft had said:

UNEXPLAINED THERMAL DIVERGENCE REMAINS.

The accepted version said:

RESIDUAL SENSOR DISPERSION REMAINS WITHIN QUALIFIED RANGE.

Both sentences described the same data.

They did not mean the same thing.

Mason opened the March review recording.

The screen filled with Lunar Gate’s inte­gra­tion bay, five months younger and still occupied by a spacecraft everyone expected to return.

Perseus had been held in the outer assembly yard when Node 6A first misbehaved.

The ship was complete enough to resemble its flight config­u­ra­tion but still attached to Lunar Gate by service lines, structural braces and access corridors. Temporary sensor cables crossed the aft section. Inspection drones moved around the radiator roots. The reactor had been brought to power in controlled stages while the ion propulsion array remained in test config­u­ra­tion.

Mason watched from the Gate’s engi­neering control room.

The room had no direct view of the ship. Perseus existed there as diagrams, live video and thousands of numbers changing too quickly for any one person to follow. The test software reduced those numbers into expected ranges and exceptions. Green fields meant the machine behaved like the model. Amber meant somebody had to decide whether the difference mattered.

At 43 percent simulated cruise load, Node 6A turned amber.

Chie was at the thermal console.

“Hold the ramp,” she said.

The test director stopped the power increase.

The hum inside the control room did not change, but Mason could feel the pause move through the people around him. Everyone knew the schedule. Everyone knew how many tests remained before final certi­fi­ca­tion. Nobody mentioned either fact.

“What do you have?” the director asked.

Chie placed two temper­a­ture traces on the main display.

“Separation across Six-A downstream pair. Two-point-four degrees and increasing.”

“Pressure?”

“Nominal.”

“Flow?”

“Measured flow nominal.”

“Upstream temper­a­ture?”

“Following model.”

The two traces continued apart.

One repre­sented coolant temper­a­ture on the primary downstream path. The other came from a redundant sensor several centime­ters away, mounted after the junction divided flow between the aft power-conversion equipment and the radiator branch.

They were not supposed to match perfectly. No real system did. The question was how much disagree­ment the design allowed before the disagree­ment became evidence of something other than measure­ment.

“Two-point-nine,” Chie said.

“Limit?”

“Three.”

Mason looked at the test director. “Stop below limit.”

“I have stopped.”

“Bring reactor output down.”

Chie shook her head. “Hold.”

The director turned toward her. “Why?”

“I want to see whether it settles.”

“If it crosses three, we have an automatic test abort.”

“I know.”

The room waited.

The first trace flattened. The second continued rising for three more seconds, then stopped.

“Peak three-point-one,” Chie said.

The test system changed the node from amber to red.

The director ended the sequence.

Power decreased. Temper­a­tures fell. The two traces drew closer until they were nearly one line again.

Mason read the automatic fault summary. No loss of flow. No pressure transient. No electrical insta­bility. No temper­a­ture outside material limits. The only failed criterion was the disagree­ment between two sensors.

“What is the hazard?” he asked.

Chie was already rebuilding the event from raw data. “Unknown.”

“That isn’t a hazard.”

“It is not an expla­na­tion either.”

The test director ordered the node isolated for inspection.

Perseus remained attached to Lunar Gate for eleven hours while tech­ni­cians cooled the affected loop, relieved pressure and opened the access path. Node 6A sat behind a crowded section of power-routing hardware near the base of the aft radiator assembly. Reaching it required removing shielding panels and discon­necting equipment that had already passed inspection.

The assembly itself looked ordinary.

A junction housing. Flow channels. Sensors. Valves. Insulation. Fasteners marked after torque veri­fi­ca­tion.

Tech­ni­cians found no obstruc­tion, no damaged seal and no visible defor­ma­tion. Fluid samples showed no contam­i­na­tion. Both temper­a­ture sensors passed bench checks. The electrical paths were intact.

Chie asked for the sensor cluster to be replaced anyway.

The replace­ment added a day.

The repeat test produced a smaller divergence.

At 43 percent load, the sensors separated by eight-tenths of a degree. At 60 percent, the difference narrowed. During ramp-down, it widened again and then returned inside the expected band.

The node remained green.

The test director marked the issue corrected.

Chie did not.

She requested a full thermal-cycle series with the junction removed and examined under load-equivalent bench conditions. The work would require opening the aft loop again, taking out the assembly and sending it through a test facility on the inner ring. If the junction passed, it would have to be rein­stalled, pressure-tested and qualified in place.

Minimum schedule impact: twelve days.

Likely impact: eighteen.

Mason read the estimate in a conference room adjoining engi­neering control. Chie sat across from him with the thermal lead from the propulsion contractor and two repre­sen­ta­tives from mission assurance. Lunar Gate operations joined remotely. The program office attended through three names on a screen, all muted.

“Eighteen days takes us through integrated burn rehearsal,” Mason said.

“It moves the rehearsal,” Chie replied.

“It moves crew loading.”

“Yes.”

“It moves final reactor certi­fi­ca­tion.”

“Yes.”

“And if anything else slips?”

“We lose the June departure.”

The contractor repre­sen­ta­tive shifted in his chair. “That is the worst-case schedule.”

“It is the schedule if the assembly requires replace­ment,” Chie said.

“We have no evidence it requires replace­ment.”

“We have unex­plained dispersion at the same junction after replacing the sensors.”

“Within qualified range.”

“On the repeat.”

“Which is the valid test.”

“The first test was also valid.”

The contractor repre­sen­ta­tive opened the flow model. “The initial peak can be explained by temporary strat­i­fi­ca­tion after the ramp. The replace­ment sensors have different response curves.”

“The difference began before the peak,” Chie said.

“Within timing uncer­tainty.”

“The local clocks are synchro­nized.”

“Sensor response is not.”

Mason listened without inter­rupting.

He had spent four years watching qualified people disagree without anyone being incom­pe­tent or dishonest. Engi­neering decisions rarely arrived with one safe answer and one reckless answer. They came with models that did not match perfectly, evidence that could support more than one inter­pre­ta­tion, and schedules that converted delay into new risks somewhere else.

Missing June was not a matter of postponing a ceremony.

Perseus had been assembled around a departure window. Crew exposure limits, Lunar Gate occupancy, reactor servicing, propellant reserves and the receiving geometry at Mars had been planned against it. Cargo systems on the surface were already aging. Some could wait. Others would need revised main­te­nance cycles and replace­ment deliveries if the crew did not arrive on schedule.

A delay might move the mission by months.

A long delay might require removing the crew, partially decom­mis­sioning the ship and rebuilding public and political autho­riza­tion around a new date. Partner agencies would have to extend budgets. Contrac­tors would retain teams. Lunar Gate would lose assembly capacity promised to other programs.

None of that justified flying an unsafe spacecraft.

All of it belonged in the definition of risk.

“What failure are we protecting against?” Mason asked.

Chie brought up a cross-section of Node 6A.

“Flow mald­is­tri­bu­tion under transition.”

“Caused by what?”

“We do not know.”

“What would it do?”

“If one branch receives less cooling than indicated, local power-conversion equipment could exceed expected temper­a­ture before the upstream sensors show it.”

“There are local sensors.”

“Yes.”

“There is automatic isolation.”

“Yes.”

“There is a redundant loop.”

“Partial redundancy. Not full-load redundancy during cruise thrust.”

The propulsion contractor enlarged the model. “Even under the most conser­va­tive mald­is­tri­bu­tion case, local temper­a­ture remains below damage threshold long enough for isolation.”

“Your model assumes the flow split we are trying to verify,” Chie said.

“It assumes the worst split consistent with the measure­ments.”

“The measure­ments disagree.”

“By less than one degree after sensor replace­ment.”

Mason looked at Chie. “Do you believe Node 6A is unsafe?”

She did not answer imme­di­ately.

That mattered. Chie was exact even when exactness made people uncom­fort­able. She would not convert concern into certainty to strengthen her position.

“I believe we have not explained the first test,” she said.

“That is not what I asked.”

“No. I cannot demon­strate that the node is unsafe.”

“Can you demon­strate that it is safe?”

“No one can demon­strate that in the way you mean.”

The mission-assurance repre­sen­ta­tive spoke for the first time. “The assembly meets the qualified envelope on repeat testing. The initial exceedance was a sensor-agreement criterion, not a material or oper­a­tional limit.”

Chie turned toward him. “Why do we have the agreement criterion?”

“To identify possible measure­ment or flow anomalies.”

“And we identified one.”

“Then we replaced the measure­ment hardware and repeated the test.”

“And the dispersion remained.”

“Inside limit.”

The discussion continued for forty-three minutes.

They reviewed the node’s manu­fac­turing record. The supplier had produced seven assemblies from the same batch. Six had been installed elsewhere in orbital infra­struc­ture and showed no comparable behavior, though none operated under the exact Perseus profile. The Node 6A housing had passed imaging, pressure and vibration tests. Its valve response was normal. Its flow readings matched the system model within instrument accuracy.

Every piece of evidence weakened Chie’s concern.

None removed it.

The program office unmuted.

A deputy admin­is­trator appeared in one of the windows. “We need a dispo­si­tion today.”

Mason watched Chie react to the word need.

The deputy continued. “If the engi­neering recom­men­da­tion is removal, state it. If it is monitored acceptance, state that. We cannot hold inte­gra­tion on an undefined concern.”

“Undefined concerns are why you hold inte­gra­tion,” Chie said.

The deputy’s expression remained neutral. “Defined risks are why programs have review boards.”

Mason stepped in before the exchange hardened.

“We will provide a recom­men­da­tion after the afternoon model run.”

“The partner briefing is at sixteen hundred.”

“We’ll provide it before then.”

The program office muted again.

Chie closed the flow diagram.

“They have already decided.”

“No,” Mason said.

“They have scheduled the briefing before the analysis finishes.”

“They schedule briefings every day.”

“They asked for monitored acceptance before we gave them options.”

“They asked for a dispo­si­tion.”

“They named the dispo­si­tion they want.”

The others began gathering their files. Mason waited until they left.

Chie remained seated.

Through the conference-room wall, they could hear the low activity of engi­neering control. Perseus was dark on the main displays while tech­ni­cians restored the thermal loop.

Mason said, “Tell me what would make you sign.”

“Removal and bench test.”

“Nothing short of that?”

“A second full-power transition with inde­pen­dent flow measure­ment.”

“Can we install it without opening the assembly?”

“Not at the resolution I want.”

“Then it is the same schedule problem.”

“It is a spacecraft, Mason. It does not know we have a schedule problem.”

He looked at the frozen image of Node 6A on the screen.

“What is your prob­a­bility of a flight-critical failure?”

“I cannot calculate it.”

“Low?”

“Probably.”

“Very low?”

“I do not know.”

“Would you fly?”

Chie looked at him.

“That is not an engi­neering question.”

“It is the question eight people will live inside.”

“No. Eight people will live inside the answer to hundreds of questions like this. You cannot ask me to make the whole mission safe through one component.”

“I’m asking what you believe.”

She pushed her tablet across the table.

On it, she had written a draft recom­men­da­tion.

REMOVE NODE 6A FOR DESTRUCTIVE AND LOAD-EQUIVALENT INSPECTION BEFORE FLIGHT CERTIFICATION.

Mason read it.

“Destruc­tive inspection means replacing the assembly regardless of the result.”

“Yes.”

“We do not have a flight-qualified spare at Lunar Gate.”

“It can be brought from Earth.”

“Not without missing June.”

“I know.”

“You are recom­mending a mission delay.”

“I am recom­mending that we understand the thing we are certifying.”

He returned the tablet.

“Put the prob­a­bility problem in the report. Put the schedule impact beside it. Let the board decide.”

Chie’s eyes stayed on him.

“The board will accept.”

“Maybe.”

“You know they will.”

“Then make them accept your actual concern, not a cleaner version of it.”

She took back the tablet.

For the next six hours, the thermal team ran every model available. They simulated partial obstruc­tion, sensor drift, valve lag, transient strat­i­fi­ca­tion and local heat transfer variation. None reproduced the first test exactly. Several reproduced enough of it to support an ordinary expla­na­tion.

The review board met at 19:30 Lunar Gate time.

Eleven voting members attended. Engi­neering, operations, mission assurance, crew systems, propulsion, safety and program management. Chie presented the anomaly. The contractor presented the models. Mason presented the schedule and mission conse­quences.

Commander Varga joined for the final twenty minutes.

He listened without asking whether the mission would still launch.

“What would the crew see before this became dangerous?” Elias asked.

Chie answered. “A growing temper­a­ture disagree­ment, local overtem­per­a­ture, flow or pressure variation, possibly power-conversion insta­bility.”

“How much time?”

“Depends on failure mode. Minutes for the modeled cases.”

“And the unmodeled case?”

“I cannot answer.”

“What action do we have?”

“Reduce reactor output. Throttle or stop the ion array. Isolate the branch. Transfer heat load where possible.”

“Do we lose propulsion?”

“Tempo­rarily, yes.”

“Do we lose vehicle power?”

“Not from the modeled cases.”

Elias looked at the contractor repre­sen­ta­tive. “Can the modeled failure silence all commu­ni­ca­tions?”

“No.”

“Can it destroy the spacecraft without warning?”

“Not according to any case we can reproduce.”

He looked back at Chie. “Do you disagree?”

“I disagree with treating a failure we cannot reproduce as fully bounded by the cases we can.”

Elias accepted that without argument.

The board voted nine to two for monitored acceptance.

Chie was one of the two.

Mason was not.

The final dispo­si­tion required replace­ment of the sensor cluster, enhanced telemetry around Node 6A, automatic alert thresholds below material limits, and a full diagnostic after every high-output transition. The node would remain on the known-conditions list through Mars arrival.

The wording passed through four revisions.

UNEXPLAINED THERMAL DIVERGENCE became RESIDUAL SENSOR DISPERSION.

POTENTIAL FLOW MALDISTRIBUTION became NO VERIFIED FLOW ANOMALY.

FULL ASSEMBLY INSPECTION RECOMMENDED became ADDITIONAL INSPECTION NOT REQUIRED FOR FLIGHT CERTIFICATION.

Chie objected to each change.

Each change was tech­ni­cally defensible.

At 23:04, she signed the acceptance record.

Mason signed after her.

On the video, he looked relieved.

That was the part he could not forgive.