NASA evaluating CCP Loss Of Crew and Mishap procedures

[Chris Bergin]

http://www.nasaspaceflight.com/2015/05/nasa-evaluating-commercial-loss-crew-mishap/

Saturday night was a choice between pub, more outstanding (non-corrupt) FIFA 15 victories for my team on the PS4 or write this up. So I wrote this up (Pub tomorrow night).

I personally find this interesting as much as it could be argued LOC ratios are a bit nonsensical. But I remember this being hammered into people's faces during the Shuttle extension debates and then those crazy "Ares I is so safe!!" claims, so when I saw references to that I thought I could write around the main references from the ASAP for an article.

[A_M_Swallow]

NASA learnt to give the Space Shuttle a hull inspection before it docked to the ISS. Will the Commercial Crew vehicles be required to undergo a similar inspection?

We may be able to patch a hole at the ISS. We can certainly launch a replacement vehicle.

[NaN]

Good choice! Interesting article on an important topic - I didn't realize MMOD was such a large factor in the estimated risk.

Is it possible to add captions or tooltips to the images? I don't always know what I'm looking at or the context to the article. Is the mouse-cursor-hand in image #6 (STS EVA) pointing out anything? Looks inadvertent, but I'm not sure.

[Hog]

NASA learnt to give the Space Shuttle a hull inspection before it docked to the ISS. Will the Commercial Crew vehicles be required to undergo a similar inspection?

We may be able to patch a hole at the ISS. We can certainly launch a replacement vehicle.

Commercial Crew TPS isn't exposed during launch like STS was.  Shuttle vs. capsule.

[guckyfan]

It is a great article, thanks for the valuable information.

I too am surprised that MMOD is considered a significant risk for capsules which protect their heat shields quite well. I would have expected the biggest risk might be to the windows during long stay at the station. Any problem there would easily be detected.

[darkenfast]

I don't understand why the possibility of LOC is as high as it is.  We've had five LOC events in the history of manned spaceflight (I'm including Apollo 1).  None of those are at all likely to be repeated, because the vehicles are too different. 

The possibility of LOC during pad and launch phases is very low, because there will be a robust escape system on both spacecraft.  I would think that a person would have a much better chance of surviving an escape in a capsule than in a jet fighter ejection seat.

The possibility of LOC on re-entry is much reduced because the heat shield is mostly protected during the rest of the flight and is (yes, I'm assuming), stronger and smaller than the shuttle's tile system.  Multiple parachutes and (in the case of Dragon), Super Dracos offer more options to save a crew.

MMOD remains a possibility, but what sort of incident would actually cause an LOC?  It simply hasn't happened yet, so how do you predict it?  I think it would be harder than we might think to get to a small hole and patch it, so here's a question: can a depressurized capsule safely re-enter in an emergency with the crew in suits?  Of course, something big enough to punch through the various layers and penetrate people and equipment would be a real scary situation, but even then, would it result in loss of the whole crew?  Also, the area involved is smaller, which reduced the risk of being hit.  The pressurized volume is smaller and the rest of the vehicle is way smaller than the Orbiter.

Glad you wrote this up, Chris.  Good to think about.

[Chris Bergin]

Thanks for the kind words folks!

Good choice! Interesting article on an important topic - I didn't realize MMOD was such a large factor in the estimated risk.

Is it possible to add captions or tooltips to the images? I don't always know what I'm looking at or the context to the article. Is the mouse-cursor-hand in image #6 (STS EVA) pointing out anything? Looks inadvertent, but I'm not sure.

Heh, the mouse cursor was a mistake on my part - stupid Greenshot Corrected.

Captions - never been a fan as much as it doesn't really work on Wordpress. I aim to provide an image that relates to the text it is surrounded by. When that's not the case it's generic enough to work most of the time.

[mtakala24]

The Shuttle had relatively huge oxygen/N2 tanks, and the ECLSS was designed to cope with a rather large hole, giving the crew enough time to deorbit. Someone must remember that hole size, I don't..  square inches just do not stay in my head long enough vs. cm^2

I don't think these commercial crew taxi vehicles have as big reserve capabilities, but they do fly shorter missions too. I wonder what the end effect is....

[Robotbeat]

The MMOD thing for CC is very odd. Surely this must be an overly conservative estimate or ISS, Mir, Skylab, or the various Salyuts would've no doubt been punctured in their pressurized sections by now (considering they've been nearly permanently in orbit since the early 1970s). Even Shuttle didn't receive a fatal strike to its enormous heat shield from MMOD.

[spacenut]

Does anyone think they may move up the time frame for the commercial crews due to recent events with the Russian failures? 

[Rocket Science]

Thanks for the article Chris on an important and still controversial topic...

[psloss]

Even Shuttle didn't receive a fatal strike to its enormous heat shield from MMOD.

True; however, the program started flying the orbiters in attitudes to minimize exposure time of critical systems like the radiator cooling loops and the belly TPS.  Even with complex attitude tradeoffs while docked to station, the Shuttle-Station mated attitude was changed for missions after STS-107 to mitigate MMOD risk to the orbiter.

Assuming that the station attitude will not be changed for the new USOS crew vehicles, the primary docking port on Node 2 forward points the heat shield for both CCP vehicles into the velocity/ram vector.  The Soyuz vehicles are shielded to varying degrees by the Station structure, but much better than the CCP vehicles will be in the normal station attitude.

I would also assume that Shuttle orbiter MMOD risk was based on a much shorter mission duration of ~2 weeks, versus the much longer 25 or more weeks planned for these crew transport vehicles.

It would be interesting to see any information on how effectively the structure covering the heat shield for the two CCP providers mitigates the MMOD risk.

[MattMason]

Great article. Glad that there's a clear program that's analyzing this for both crew vehicles and thinking ahead.

As for LoC events I can imagine, the two worst are a serious MMOD hit that vents the cabin and cannot be patched or a sudden LV explosion that moves too fast for LES.  Current designs, debris mapping and safeguards are far more refined than in the Apollo days (last time we used a capsule) and modes of abort with high probabilities to save the crew are all over the map for both CC. In a perfect world, it would be good for each CC to have their next LV ready as a rescue to the other. But this would require a docking adapter between the IDA types, and odds are that if you're in orbit, your spacecraft can either reenter or make it the ISS oasis. But I'm sure I'm oversimplifying.

[rcoppola]

Does anyone think they may move up the time frame for the commercial crews due to recent events with the Russian failures?

I'll hazard a guess over here:

http://forum.nasaspaceflight.com/index.php?topic=35717.msg1382581#msg1382581

[TrevorMonty]

Have any of the recovered Dragon V1s received any MMOD of note.?

[Coastal Ron]

Just about anything can be rationalized, which NASA has proven numerous times regarding safety.  And the Shuttle showed that even though it had fatal flaws, like no realistic way to survive an inflight failure, people still took the chance to fly on it.

So what I would propose is a system that simply determines if a new system is potentially more safe than the previous system, and then make sure to quantify what the dangers still are (both known and and potential) such as MMOD.

For instance, what if the crew is in the vehicle on the launch pad and something goes wrong, is there a system that can get them to safety?  During the ascent phase when the vehicle is not yet in orbit and is attached to the 1st stage, is there a system that can get them to safety in the event of a 1st stage failure?  And a 2nd stage failure?  And then what happens if they do get a hull breach in orbit?

Shuttle crews knew the answers to those questions, but they had no alternative way to orbit.  Now that we have two crew transportation systems that are likely to start service, there is choice.  And going forward as more transportation systems get added the free market forces will guide what levels of safety are acceptable.

What could stifle that though is the NASA Authorization Act of 2005 and it's requirement to impanel a Presidential Commission to investigate inflight failures.  We don't do that for any other modes of transportation, so this legacy from the Shuttle days needs to be changed - government employees are killed while working all the time, so obviously this was more about the cost of failure, not that people died per se.

If given the chance I would probably have flown on a Shuttle, but I would have been concerned for my safety.  I would have few concerns if I was going to ride on either a CST-100 or Crew Dragon, and I'm so glad we're finally making some good progress on the safety front.

[edkyle99]

... the Shuttle showed that even though it had fatal flaws, like no realistic way to survive an inflight failure ...

Only a catastrophic failure of an SRB during the first two minutes of flight presented this hazard.  Everything else to my knowledge had an abort mode or modes to provide a means of crew survival.  One orbiter actually did an abort-to-orbit when it lost an SSME.

But yes, those first two minutes were hard to watch, every time. 

And let's not forget that CST-100 will also be lifted by two powerful solid motors during the first 90 seconds of flight, which have some of the same failure modes present in SRBs.

 - Ed Kyle

[Robotbeat]

... the Shuttle showed that even though it had fatal flaws, like no realistic way to survive an inflight failure ...

Only a catastrophic failure of an SRB during the first two minutes of flight presented this hazard.  Everything else to my knowledge had an abort mode or modes to provide a means of crew survival.  One orbiter actually did an abort-to-orbit when it lost an SSME.

But yes, those first two minutes were hard to watch, every time. 

And let's not forget that CST-100 will also be lifted by two powerful solid motors during the first 90 seconds of flight, which have some of the same failure modes present in SRBs.

 - Ed Kyle

....Thankfully, CST-100 has abort thrusters. But good point.

[A_M_Swallow]

NASA learnt to give the Space Shuttle a hull inspection before it docked to the ISS. Will the Commercial Crew vehicles be required to undergo a similar inspection?

We may be able to patch a hole at the ISS. We can certainly launch a replacement vehicle.

Commercial Crew TPS isn't exposed during launch like STS was.  Shuttle vs. capsule.

Good.

The primary TPS across the underneath of the capsules is covered but the side walls, top and windows are exposed permitting MMOD.

[Elmar Moelzer]

How catastrophic would the effect of a small (mm size) puncture "wound" to the TPS be for
1) the Dragon and 2) the CST100
and for A) the main TPS at the bottom and B) the TPS on the side?
I am no expert but looking at the cargo dragon, with various small ridges and attachment points that are not fully covered in TPS, I have trouble seeing a small puncture that is surrounded by the relatively thick TPS to automatically result in a LOC event. But I am curious about what those with more expertise have to say about it.
Also, don't the trunks/SMs give some protection to the main TPS while the capsules are in orbit?

[Coastal Ron]

...And let's not forget that CST-100 will also be lifted by two powerful solid motors during the first 90 seconds of flight, which have some of the same failure modes present in SRBs.

My assumption is that no transportation system will be perfect, and certainly the far more mature mass transit systems we have today are not perfect either.

Which is why I suggested that each new system should be compared to the last, not some made up number.  And if they are more safe then that's good.  CST-100 on Atlas V sure looks more inherently safe than the Shuttle.

[Jarnis]

... the Shuttle showed that even though it had fatal flaws, like no realistic way to survive an inflight failure ...

Only a catastrophic failure of an SRB during the first two minutes of flight presented this hazard.  Everything else to my knowledge had an abort mode or modes to provide a means of crew survival.  One orbiter actually did an abort-to-orbit when it lost an SSME.

Well, some of those abort modes had asterisks to footnotes with something like "* requires a metric ton of good luck and some acts of god". Also before Challenger any abort mode that did not land on a runway was... umm... unlikely to result in a happy ending. Those scenarios did get better once pressure suits and bailout procedures were added.

[woods170]

... the Shuttle showed that even though it had fatal flaws, like no realistic way to survive an inflight failure ...

Only a catastrophic failure of an SRB during the first two minutes of flight presented this hazard.  Everything else to my knowledge had an abort mode or modes to provide a means of crew survival.  One orbiter actually did an abort-to-orbit when it lost an SSME.

Well, some of those abort modes had asterisks to footnotes with something like "* requires a metric ton of good luck and some acts of god". Also before Challenger any abort mode that did not land on a runway was... umm... unlikely to result in a happy ending. Those scenarios did get better once pressure suits and bailout procedures were added.

Emphasis mine.
Notably, the Return To Lauch Site abort mode (RTLS)

[muomega0]

...And let's not forget that CST-100 will also be lifted by two powerful solid motors during the first 90 seconds of flight, which have some of the same failure modes present in SRBs.

My assumption is that no transportation system will be perfect, and certainly the far more mature mass transit systems we have today are not perfect either.

Which is why I suggested that each new system should be compared to the last, not some made up number.  And if they are more safe then that's good.  CST-100 on Atlas V sure looks more inherently safe than the Shuttle.

The capsule is on top, has an abort system and parachutes (which do not like solids), but will be certified on a LV configuration that will be retired and replaced by another LV that uses solids in non common configurations.  So would CST-100 or Orion or Dragon look inherently safer on Atlas V or other LVs?  Does actual flight rate and number of flights in a common configuration matter?  Is ascent/reentry an actual driver in LOC?

So what I would propose is a system that simply determines if a new system is potentially more safe than the previous system, and then make sure to quantify what the dangers still are (both known and and potential) such as MMOD.

For instance, what if the crew is in the vehicle on the launch pad and something goes wrong, is there a system that can get them to safety?  ...    And going forward as more transportation systems get added the free market forces will guide what levels of safety are acceptable.

LOC during ascent represents just a few percent of the total--while the addition of an abort system without solids should improve safety, the likelihood of it being used is very small.  A common configuration for cargo and crew provides likely pays much larger dividends since the unknown failure mode has a chance to happen on the cargo flight.

As far as MMOD and total LOC, for missions to the Moon, L2, or elsewhere, the risk will need to be assessed for time period spacecraft resides mainly in 'LEO'.  For ISS, 'debris' represents approximately 2/3rds of the MMOD risk.  The meteroid risk far from Earth is generally less than the risk in LEO.  So why stage *mission* hardware in LEO?

The best way to improve safety is to shift funds to the main safety drivers.  The only way to reduce launch costs is to provide a stable number of government launches..adding more providers will not help--the providers need more payloads.   Funding LV capacity to meet demand would benefit budgets too.

Stage the propellant (70%+ of the per mission mass) in a LEO depot designed to survive MMOD to reduce launch costs by providing 'commercial' payload instead of having the LVs sit idle.  Take risks with dirt cheap propellant delivery in a *common* configuration.  Stage all the transient mission hardware at L2 and minimize its stay in LEO. Have multiple tugs.

The US however will spend the next decade certifying LVs and multiple capsules for government missions and not spend cash on the things that make up the other 90+ percent of LOC.   'Commercial' may also create "voluntary consensus standards" but it appears they need a law to do this voluntarily and to reach a consensus (is re-use more safe than expendable? land vs water landing?).  Are not costs and safety conflicting requirements?

[Jim]

NASA learnt to give the Space Shuttle a hull inspection before it docked to the ISS. Will the Commercial Crew vehicles be required to undergo a similar inspection?

No, that was a shuttle unique

[Ben the Space Brit]

To me, the obvious first step is to have at least one level of failure tolerance allowing ATES (Abort to Earth Surface) for all critical systems where this is practical.

For example, there has yet to be a spacecraft designed with a redundant re-entry TPS. However, some kind of lamination of view-ports to increase their resistance to MMOD and redundant flight controls are an obvious step.

Both the CCP finalists are heavily-automated with touch-screen controls. I was glad to see that SpaceX had installed alternate physical controls (including, hopefully, at least one redundant control data path) in Dragon v.2. This is the sort of thinking that shows the contractors are taking potential faults and maximising crew survivability seriously.

[MattMason]

To me, the obvious first step is to have at least one level of failure tolerance allowing ATES (Abort to Earth Surface) for all critical systems where this is practical.

For example, there has yet to be a spacecraft designed with a redundant re-entry TPS. However, some kind of lamination of view-ports to increase their resistance to MMOD and redundant flight controls are an obvious step.

Both the CCP finalists are heavily-automated with touch-screen controls. I was glad to see that SpaceX had installed alternate physical controls (including, hopefully, at least one redundant control data path) in Dragon v.2. This is the sort of thinking that shows the contractors are taking potential faults and maximising crew survivability seriously.

I was thinking that, too. Physical switches and redundant and independent controls that still allow vehicle control if that central panel has a failure is important. It's actually one of the design elements of Crew Dragon that give me the willies.

[guckyfan]

I remember a very old comment about the parachutes of Dragon. It was said, they have a fully manual release mechanism as backup. Dragon can reenter on pure aerodynamic stability without any control though the g-forces would be much harsher than on a controlled entry. If this is still true and why would it not, then from the moment after reentry burn they can lose electronics completely and still get the crew safely to the ground.

[Hog]

NASA learnt to give the Space Shuttle a hull inspection before it docked to the ISS. Will the Commercial Crew vehicles be required to undergo a similar inspection?

We may be able to patch a hole at the ISS. We can certainly launch a replacement vehicle.

Commercial Crew TPS isn't exposed during launch like STS was.  Shuttle vs. capsule.

Good.

The primary TPS across the underneath of the capsules is covered but the side walls, top and windows are exposed permitting MMOD.

Referring to the inspection Shuttle performed before it docked to ISS.  While I'm sure that MMOD(Micrometeroid and Orbital Debris) was a small factor for the RPM and the OBSS inspections(using its 4 sensor systems), these were largely done to mitigate the TPS damage risk caused by launch debris, being sidemount to the ET.

The risk of a MMOD strike between launch and docking is smaller, due to the time period being shorter. Of course the risk is greater when referring to the entire orbital mission.

[baldusi]

[..]
And let's not forget that CST-100 will also be lifted by two powerful solid motors during the first 90 seconds of flight, which have some of the same failure modes present in SRBs.

Consider the weight of the stack at SRB separation and you'll note that without the RD-180 the T/W will never go above 1.6. And the two SRB are not on the same plane, so the capsule can sort of safely turn on the other side. Note that for Balance reasons the Shuttle was closer to the SSRB than the mid plane. So while it does introduces a slight complication (nothing like all liquid in this regard). The degree of danger is much less.

[erioladastra]

The MMOD thing for CC is very odd. Surely this must be an overly conservative estimate or ISS, Mir, Skylab, or the various Salyuts would've no doubt been punctured in their pressurized sections by now (considering they've been nearly permanently in orbit since the early 1970s). Even Shuttle didn't receive a fatal strike to its enormous heat shield from MMOD.

models have been updated based on more data and a lot, LOT more debris.  Recall ISS is now flying lower to mitigate risk of MMOD.  Yes, the capsule heat shields are protected but they are going to be up there for 6 months with their butts into the debris wind so to speak for Node 2 forward.  A lot can happen.

[erioladastra]

Does anyone think they may move up the time frame for the commercial crews due to recent events with the Russian failures?

Very desirable but won't happen.  While 2 companies is great for redundancy it slows things down (spreads the money out and ties up the NASA resources), the money does not appear to be coming as needed for this (and as predicted), the companies are scrambling as hard as they can and they will be very hard pressed to make 2017 as it is.  Not going to be able to reduce the time unless a LOT more $$$$ comes now.

[RonM]

Does anyone think they may move up the time frame for the commercial crews due to recent events with the Russian failures?

Very desirable but won't happen.  While 2 companies is great for redundancy it slows things down (spreads the money out and ties up the NASA resources), the money does not appear to be coming as needed for this (and as predicted), the companies are scrambling as hard as they can and they will be very hard pressed to make 2017 as it is.  Not going to be able to reduce the time unless a LOT more $$$$ comes now.

I agree. CC could have been sooner if Congress had fully funded the project from the start. More resources could have shorten the development time. Now it is too late to throw money at it.

[newpylong]

The MMOD thing for CC is very odd. Surely this must be an overly conservative estimate or ISS, Mir, Skylab, or the various Salyuts would've no doubt been punctured in their pressurized sections by now (considering they've been nearly permanently in orbit since the early 1970s). Even Shuttle didn't receive a fatal strike to its enormous heat shield from MMOD.

It isn't odd at all. Space Stations don't have to reenter.

[Sesquipedalian]

On the subject of MMOD...

Discovery suffered a MMOD strike on STS-128 which would have led to Loss of Mission (land within 24 hours) if not for modifications and hardening in the late 1990s:
http://research.jsc.nasa.gov/BiennialResearchReport/2011/265-2011-Biennial.pdf

A pretty good overview of ISS MMOD considerations (109 slides):
https://tfaws.nasa.gov/files/MMOD_Course_TFAWS_2014.pdf

[psloss]

Discovery suffered a MMOD strike on STS-128 which would have led to Loss of Mission (land within 24 hours) if not for modifications and hardening in the late 1990s:
http://research.jsc.nasa.gov/BiennialResearchReport/2011/265-2011-Biennial.pdf

Nice find, thanks for posting it.  This reference also notes when the Shuttle program instituted that change in flying attitudes for MMOD protection: after STS-50 in 1992, or about a third of the way into the flight history:

After STS-50, new flight rules were implemented that required the shuttle to fly with the payload bay to the Earth and the tail toward the velocity vector "unless payload or orbiter requirements dictate otherwise."

And there it is in the flight rules: "A2-131 ATTITUDE RESTRICTIONS FOR ORBITAL DEBRIS."  (L2 has one or two revisions; public reference to generic flight rules, PDF circa STS-107.)

[DAZ]

Some years ago I read an Air Force safety report on the use of solid rocket motors on launch vehicles.  The report came out after all the Shuttle, Delta, and Titan accidents.  I wish I could find the report again but I have had no luck.  The report read like unsafe at any cost.  The report did not come right out and say this as it was trying to be PC but any engineer reading it would have under stood what they were saying.

From memory.

The first part of the report was about economics of using solid rocket motors.  The report indicated that it was cheaper at first to build a LV using SRBs but that the recurring costs for SRBs and there safe use would at some point exceed the cost of just building an all liquid LV.  This number could be 5, 10 or 20 but at some point depending on your safety requirements it would happen.  It could be as low as 1 if the cost/uniqueness of the payload was high enough.  This was for expendable LV system.  I can’t see that this get better for reusable system as it has to do with the catastrophic modes of failures for solid rocket motors.  Pick your cost numbers to get your system.  It is only money for the most part.

Some things made the system much less safe and upped the costs.  More SRBs, larger, more segments and the big one composite cases.  The way to mitigate was more margins, safer handling (kid gloves) and lots and lots and lots of inspection with their entailed paper work.  You could never drive the safety to the same level as liquid boosters, just to a level that would match your cost to risk goals.

Next the report talked about the use of SRBs for manned system.  On this the report said NO.  There was no way to make a manned system safe at any cost if it used SRBs.  Unlike an all liquid LV that you could build a LAS to save the crew when you use SRBs it is not possible.  The report distinguished between possible but not economical and not possible.  Any LAS to escape from all the possible catastrophic modes of failures for solid rocket motors would result in the crew being used as red paint on the floor of the crew vehicle thus defeating the reason for a LAS.

This is what the Air Force was practically jumping up and down about saying that the Ares 1 was unsafe and that the NASA LAS would not work for a system with SRBs.  For something like the “Black Knights” on the SLS the question becomes not if but will the system have enough lunches to lose a crew.

If you believe the Air Force safety report (and the report looked correct to me) then the only crewed lunch system that looks to be reasonably safe is the SpaceX system.  Not because they are somehow better or have better safer systems but it is the only one without solid rocket motors.  Not looking at this is just looking the other way for expediency like on the Space Shuttle, not out of necessity.

[Jarnis]

Well, Senate Launch System can still be a fine (if expensive) heavy lift vehicle. Just ditch the LAS (more room for cargo!) and deliver the crew to on-orbit Orion using a safe and cheap commercial crew vehicle.

Doubt it will happen, but...

[Zed_Noir]

Well, Senate Launch System can still be a fine (if expensive) heavy lift vehicle. Just ditch the LAS (more room for cargo!) and deliver the crew to on-orbit Orion using a safe and cheap commercial crew vehicle.

Doubt it will happen, but...

If you use a commercial crew vehicle anyway, you don't need the Orion since some sort of hab module will be required for any mission beyond the Moon. IIRC the Orion got enough life support for about 21 days. Just use the commercial crew vehicles as taxis between the Earth surface and a long mission duration spacecraft.

[Jarnis]

Supposedly Orion has all these BEO things modded in (comms, radiation shielding, electronics) which mere commercial crew vehicles do not have.

Of course you could have all those things in the hab module and keep the commercial crew vehicle powered down until it is again needed for re-entry.

[yg1968]

The discussion about safety has me wondering. Will commercial crew have some kind of flip maneuver or other visual inspection to see if the heatshield of the capsule is fit for reentry (i.e. that there hasn't been any micrometeorite damage to its heatshield during its stay at the ISS)?

[Graham]

The discussion about safety has me wondering. Will commercial crew have some kind of flip maneuver or other visual inspection to see if the heatshield of the capsule is fit for reentry (i.e. that there hasn't been any micrometeorite damage to its heatshield during its stay at the ISS)?

The heat shields won't be visible, they're protected by the trunk/ SM so MMOD damage/ damage on ascent isn't a concern like it was for the orbiters who had an exposed TPS

[yg1968]

The discussion about safety has me wondering. Will commercial crew have some kind of flip maneuver or other visual inspection to see if the heatshield of the capsule is fit for reentry (i.e. that there hasn't been any micrometeorite damage to its heatshield during its stay at the ISS)?

The heat shields won't be visible, they're protected by the trunk/ SM so MMOD damage/ damage on ascent isn't a concern like it was for the orbiters who had an exposed TPS

I wasn't thinking about damage during ascent. I was thinking more of the damage to the capsule while it is docked to the ISS (which is for a six month period). But you are right that the SM or trunk would protect the heatshield to a certain extent. Thanks.

[Comga]

The MMOD thing for CC is very odd. Surely this must be an overly conservative estimate or ISS, Mir, Skylab, or the various Salyuts would've no doubt been punctured in their pressurized sections by now (considering they've been nearly permanently in orbit since the early 1970s). Even Shuttle didn't receive a fatal strike to its enormous heat shield from MMOD.

models have been updated based on more data and a lot, LOT more debris.  Recall ISS is now flying lower to mitigate risk of MMOD.  Yes, the capsule heat shields are protected but they are going to be up there for 6 months with their butts into the debris wind so to speak for Node 2 forward.  A lot can happen.

(emphasis mine)
At the risk of going off topic, the ISS originally orbited around 390 km, dropped back as low as ~330 km, and then went up to ~440 km when the Shuttle retired.  It has now sunk to just over 400 km.  Is it trying to keep a constant drag/density to balance the MMOD risk with reboost fuel usage?

Back on topic, do we have a numerical breakdown of the 1/270 LOC number into its components? 
Saying that MMOD is the third biggest risk without quantifying them is like saying that Three Mile Island is the third worst nuclear plant release while ignoring the many orders of magnitude between it and Chernobyl. 

[mtakala24]

At the risk of going off topic, the ISS originally orbited around 390 km, dropped back as low as ~330 km, and then went up to ~440 km when the Shuttle retired.  It has now sunk to just over 400 km.  Is it trying to keep a constant drag/density to balance the MMOD risk with reboost fuel usage?

Discussed here: http://forum.nasaspaceflight.com/index.php?topic=37234.0
edit: and here: http://forum.nasaspaceflight.com/index.php?topic=36322.0

[vt_hokie]

I'm surprised I haven't seen more mention of Soyuz in the reliability and safety discussions, given that it has set the benchmark for human spaceflight over several decades. Does anyone happen to know what its estimated LOC probability is?

[erioladastra]

The discussion about safety has me wondering. Will commercial crew have some kind of flip maneuver or other visual inspection to see if the heatshield of the capsule is fit for reentry (i.e. that there hasn't been any micrometeorite damage to its heatshield during its stay at the ISS)?

NASA is looking into various inspection options.  as noted elsewhere the heat shields are protected so can't do that and a flip doesn't get you much (before docking risk is near zero, after undocking you don't have time to analyze the photos, could only eyeball a huge hit).  Probably will be some combo of SSRMS and hope.

[yg1968]

Thanks! The ASAP also made some interesting comments on this topic. See this post in a different thread:

http://forum.nasaspaceflight.com/index.php?topic=35717.msg1424626#msg1424626

[MP99]

The discussion about safety has me wondering. Will commercial crew have some kind of flip maneuver or other visual inspection to see if the heatshield of the capsule is fit for reentry (i.e. that there hasn't been any micrometeorite damage to its heatshield during its stay at the ISS)?

The heat shields won't be visible, they're protected by the trunk/ SM so MMOD damage/ damage on ascent isn't a concern like it was for the orbiters who had an exposed TPS

CST-100 looks OK with the SM protecting until reentry.

Dragon could have cameras in the trunk to perform checks. Or a shield if no unpressurized cargo.

Cheers, Martin

[guckyfan]

CST-100 looks OK with the SM protecting until reentry.

Dragon could have cameras in the trunk to perform checks. Or a shield if no unpressurized cargo.

Dragon has Kevlar shields inside the trunk. It does protect the heat shield.

Edit: The cargo Dragon has. No doubt the Crew Dragon will have it too.

[MP99]

Many thanks for that.

Cheers, Martin

[the_other_Doug]

I will also note that the Russians, and before as the Soviets, have been keeping Soyuz on-station in LEO for up to six months at a time for, well, more than 30 years, going back to Salyut 6.  They haven't lost any of them, not one of the dozens upon dozens, to TPS damage.  And they have nothing more or less than Starliner or Dragon will have, a module covering the main TPS.

None have ever been holed by MMOD to the extent they lost pressure or critical systems, either.

Shuttle was different because its TPS was always fully exposed to MMOD, and it had a far more fragile TPS than Dragon or Starliner will.  The Shuttle-style TPS inspections will not be needful for the new commercial crew vehicles.

[guckyfan]

I will also note that the Russians, and before as the Soviets, have been keeping Soyuz on-station in LEO for up to six months at a time for, well, more than 30 years, going back to Salyut 6.  They haven't lost any of them, not one of the dozens upon dozens, to TPS damage.  And they have nothing more or less than Starliner or Dragon will have, a module covering the main TPS.

None have ever been holed by MMOD to the extent they lost pressure or critical systems, either.

My thougts as well. It is a concern of NASA but I don't understand where that concern comes from.

Shuttle was different because its TPS was always fully exposed to MMOD, and it had a far more fragile TPS than Dragon or Starliner will.  The Shuttle-style TPS inspections will not be needful for the new commercial crew vehicles.

If I remember correctly the TPS inspections were introduced because of possible damage on start, not because of possible MMOD. It would cover MMOD as well though. While the SpaceShuttle heat shield would be exposed for a much shorter time it is much shorter and probably more sensitive.

[MP99]

I will also note that the Russians, and before as the Soviets, have been keeping Soyuz on-station in LEO for up to six months at a time for, well, more than 30 years, going back to Salyut 6.  They haven't lost any of them, not one of the dozens upon dozens, to TPS damage.  And they have nothing more or less than Starliner or Dragon will have, a module covering the main TPS.

None have ever been holed by MMOD to the extent they lost pressure or critical systems, either.

My thougts as well. It is a concern of NASA but I don't understand where that concern comes from.

To achieve an overall 1:270, the chance of any individual failure must be lower than that. Even 1:1000 would be a large contribution.

What is the confidence level that the evidence listed translates to 1:1000 or better?

Cheers, Martin

[the_other_Doug]

If I remember correctly the TPS inspections were introduced because of possible damage on start, not because of possible MMOD. It would cover MMOD as well though. While the SpaceShuttle heat shield would be exposed for a much shorter time it is much shorter and probably more sensitive.

Actually, we're both right.  On post-Columbia missions, there were two full TPS inspections using the RMS boom extension.  The first happened during the transfer orbits prior to rendezvous with the ISS, and that one checked for launch damage.  The second was done after the Shuttle undocked from ISS and separated, and that one was to look for MMOD.