Ten weeks to name a valve

On 28 May a New Glenn rocket was destroyed at Cape Canaveral. On 5 August, more than two months later, Blue Origin said what had gone wrong: the main oxygen valve on one of the first stage's seven BE-4 engines. Dave Limp said the origin was "confirmed by hardware recovery and inspections", after component-level tests and engine hotfires. The fix is small modifications to the valve that can be retrofitted to engines already built, with updated hardware targeted for the end of August (SpaceNews, 2026; Aviation Week, 2026).

The obvious read is the one everyone took: a valve took out a 98-metre rocket. True, and not very useful. The number worth staring at is ten weeks. That is the distance between the failure and the sentence that explains it, and on any system that matters, that distance is the thing you actually design for.

Diagnosis time is a design property

Nobody chooses to have a failure. Everybody chooses, in advance and usually by accident, how long it will take to explain one. That choice is made months earlier, in decisions that feel like housekeeping at the time: what gets logged, what gets timestamped against what, whether the physical hardware survives in a state you can inspect, whether you can rebuild the exact conditions on a test stand.

Blue Origin could recover hardware from a pad explosion and inspect it. They could hotfire an engine repeatedly to reproduce a failure mode. That capability is why ten weeks was ten weeks and not a shrug. A team without recoverable hardware and a test stand does not get a slower answer, it gets no answer, and then it changes three things at once and hopes.

"

You do not get to choose whether you have an incident. You already chose how long it will take to understand one.

What this looks like in our work

We build things that run unattended in awkward places: check-in systems at the door of a live event, installations in retail units, operational software that a small team leans on all day. When one of those goes wrong it is almost never at a convenient moment, and the person on site is not an engineer. The window to gather evidence is the window before someone reboots it.

• 01Log the inputs, not just the errors. An error tells you the thing failed. The payload that caused it tells you why, and it is the part people forget to keep.
• 02Timestamp everything against one clock. Two subsystems with drifting clocks turn a five-minute investigation into a two-day one, and the fix costs nothing on day one.
• 03Keep the failing state, do not clear it. Auto-recovery that wipes the evidence is how a fault repeats for six months without ever being explained.
• 04Be able to replay. If you cannot reproduce a failure on a bench with the real inputs, you are guessing, and a guess ships as a fix and comes back.
• 05Write down what you changed. Half the incidents we get called into are not mysteries, they are undocumented changes.

The retrofit is the other half

The second thing in that announcement deserves as much attention as the first. The fix is a small modification that can be quickly retrofitted to existing engines. That is not luck. It is a consequence of the valve being a serviceable component rather than something fused into an assembly you would have to scrap.

The same question applies to software, and it is a better test of an architecture than most: when you find the fault, how much has to come apart to fix it. If a bad decision in one module means a rewrite of three others, you did not build a system, you built a casting. We take that seriously on client work because the second year is where the cost lives. Nobody is paying us to make year one feel fast.

There is a wider point in this one too. The BE-4 also flies on another operator's vehicle, so a valve modification on one programme lands on someone else's schedule. Shared components spread both the efficiency and the failure. Anyone who has had a dependency go bad two levels down the tree knows the feeling.

What we would take from it

Blue Origin has said it intends to rebuild Launch Complex 36 and return New Glenn to flight, without a firm date attached to the root-cause announcement (SpaceNews, 2026). Whether that holds is their problem. The transferable part is cheap and most teams skip it anyway.

Decide now what evidence a failure will leave behind. Decide now which components you would need to swap without touching anything else. Then, when it goes wrong at four in the afternoon on the day of the event, the answer takes an hour rather than a season. That is not process for its own sake. It is the difference between fixing a fault and living with it.