Abort options for Starship and Starship/SuperHeavy

[TheRadicalModerate]

…]

Is there a rocketry case where an LES killed somebody?

there have only been 367 human spaceflight launches ever, so if LES has a fatal flight rate of 1/1000 (even on nominal flights), we wouldn’t expect anyone to have died so far.

There HAVE been major problems on LES systems during tests, including some that would have been fatal. Like the one that destroyed a Dragon capsule during a ground test of the abort system. I think Starliner’s engines have had explosive tests on the rocket stand (not a criticism… this sort of thing is common when developing engines.) Solids (common for abort) also have failures occasionally.

There are plenty in aviation, but that's not germane.

It’s germane because we haven’t had enough crewed launches to really get good statistics on this.

An LES will only increase your pLOC if its passive existence, or the probability of an uncommanded malfunction, results in so large a degradation to the base probability of failure that it's not worth it.  But when it's actually needed, even if the probability of the crew surviving an LES-mediated abort is only 80%, it'll still dramatically reduce the pLOC of the overall system.

[Robotbeat]

Yes, so if the vehicle reliability is 1:10,000 but the abort motor or abort system causes a failure in 1:1000 even for otherwise nominal missions, this is obviously a losing situation.

In the case of Orion, this can occur in multiple cases. For instance, if the abort motor fires through accidental command. Or if the jettison motor fails to fire. Or if the jettison motor explodes. Or if the fairing fails to release. Or if the weight of the abort system causes a failure of the fairing.

There’s also the aspect of cost, which cannot be neglected. For a given cost, does the LES actually reduce overall risk compared to spending that cost on improved vehicle robustness, qualification/NDE, test flights, propellant margin, tanks factor of safety, engine-out? Especially consider that LES only tends to protect a relatively small part of the flight. You can’t just consider the cost of LEs as immaterial as it is just one method to reduce LOC probability. Also consider that test flights can be dual purpose, ie launching Starlink satellites or whatever, so the marginal cost of 400 test flights might be a tiny fraction of what doing no test flights but adding a LES would.

[TheRadicalModerate]

Yes, so if the vehicle reliability is 1:10,000 but the abort motor or abort system causes a failure in 1:1000 even for otherwise nominal missions, this is obviously a losing situation.

In the case of Orion, this can occur in multiple cases. For instance, if the abort motor fires through accidental command. Or if the jettison motor fails to fire. Or if the jettison motor explodes. Or if the fairing fails to release. Or if the weight of the abort system causes a failure of the fairing.

Again, it kinda sounds like you're expecting the people at MSFC who wrote the Orion requirements to have been actively incompetent.  If there's a 1:1000 chance of a failure in a nominal flight mode, then somebody needs to be fired.

And vehicle reliability isn't 1:10,000; it's 1:500.

I don't expect a Starship abort system to be needed for all time.  But I think there are better than even odds that it will accelerate the early crew-certification of launch/EDL enough to justify its development.  Then, when Starship actually does get to aircraft-like reliabilities, they can stop using it and have more flexible conops for human launches.

But don't let the perfect be the enemy of the good enough.

There’s also the aspect of cost, which cannot be neglected. For a given cost, does the LES actually reduce overall risk compared to spending that cost on improved vehicle robustness, qualification/NDE, test flights, propellant margin, tanks factor of safety, engine-out? Especially consider that LES only tends to protect a relatively small part of the flight. You can’t just consider the cost of LEs as immaterial as it is just one method to reduce LOC probability. Also consider that test flights can be dual purpose, ie launching Starlink satellites or whatever, so the marginal cost of 400 test flights might be a tiny fraction of what doing no test flights but adding a LES would.

That'll be very hard to quantify for EDL.  Do they know all of the different failure modes for header tank cavitation?  What wind conditions cause the suicide burn rotation to become unstable?  What are the modes that cause the chopsticks to miss the hard points during landing?

Some things, like potential nav errors, have pretty good existing models associated with them, and constitute "known unknowns".  But Starship is such a new system that there are almost certainly a fistful of "unknown unknowns" that can't be discovered without extensive flight heritage.  You can wait for that heritage to accumulate before launching crews, or you can find ways of mitigating the extent to which the unknown unknowns can impact crew safety.

And if you're going to do cost-benefit arguments against abort systems, then from a purely cold-blooded standpoint, you need to factor in the financial cost of killing a crew.  At the very best, it puts a huge notch in your cash flow while you do the post-accident analysis/mitigation and subjects you to all kinds of terrible PR.  At worst, it causes massive contract cancellations, making the cash flow notch an existential threat.

[eriblo]

[...]

The general agreement is it's an advantage for XX century tech rocketry, albeit the number of cases LES saved life and took life is actually equal. But there was also an accident (Challenger) where LES would save life were it present in the first place. Also the statistics are pretty thin (2 cases where it unequivocally could save life 1 of which it was actually present, vs 1 case it took life, and 1 case it was triggered but wasn't essential, i.e. regular separation would have the same end result).

Is there a rocketry case where an LES killed somebody?  There are plenty in aviation, but that's not germane.
[...]

Soyuz 7K-OK No.1
Launch aborted, LES activated after 27 minutes (due to the rotation of the Earth) setting the third stage on fire leading to the stack exploding with one person being killed in the aftermath.

[Lee Jay]

[...]

The general agreement is it's an advantage for XX century tech rocketry, albeit the number of cases LES saved life and took life is actually equal. But there was also an accident (Challenger) where LES would save life were it present in the first place. Also the statistics are pretty thin (2 cases where it unequivocally could save life 1 of which it was actually present, vs 1 case it took life, and 1 case it was triggered but wasn't essential, i.e. regular separation would have the same end result).

Is there a rocketry case where an LES killed somebody?  There are plenty in aviation, but that's not germane.
[...]

Soyuz 7K-OK No.1
Launch aborted, LES activated after 27 minutes (due to the rotation of the Earth) setting the third stage on fire leading to the stack exploding with one person being killed in the aftermath.

That was caused by shear stupidity in management of personnel with regards to safing a partially fired booster - in 1966.

[JayWee]

Are you guys on the right thread?

If you're talking about thousands of launches to achieve safety certification, this matters.

Not really. They don't need hundreds of flights a day to get the safety record they need, and by the time they are at hundreds a day they will be synthesising the methane anyway.

This whole sub-thread is only vaguely related to abort options anyway. Does anyone other than Robotbeat and Lee Jay care about it?

*TAPS THE SIGN* 
Check #1 in this thread. This thread is a spinoff of a locked thread which debated should-it/should-it not. This one is predicated on the idea that it should (after I asked whether one can do it without turning it into an airplane) and therefore what are the technical options.

[Barley]

The landing is still risky.   There are still too many single points of failure

Maybe it would be possible to preemptively deploy a small, short-ranged aircraft to offload the people before landing. Wouldn't be instant but could be used well before meeting up with the chopsticks.

Just like Gagarin.  Of course the FAI probably won't count it as a space flight.  Oh the humanity.

No, more like SpaceShipOne except instead of using a second aircraft to get you up, you use it to get you down.

Edit: A Cirrus Vision SF50 with folding wings might fit.

Well visions differ.

The only thing the aircraft would need to do is land, so IMHO you could leave off the SF50s wings and engines and rely on the Cirrus Airframe Parachute System.

Joking aside I'd expect a canopy system to be more than adequate and easier to implement.  Might be a light multi-person capsule with a powered paraglider.  But I do not insist on it.  The trickiest part would be separation from the SS, once you separate from SS and get the speed down to 100mph or so there are lots of choices.

I could even see crew bailing out using individual parachutes if for some strange reason they needed crew on an early test flight, although that risks them pulling a "wrong way" Corrigan and "forgetting" to depart.

[Negan]

The landing is still risky.   There are still too many single points of failure

Maybe it would be possible to preemptively deploy a small, short-ranged aircraft to offload the people before landing. Wouldn't be instant but could be used well before meeting up with the chopsticks.

Just like Gagarin.  Of course the FAI probably won't count it as a space flight.  Oh the humanity.

No, more like SpaceShipOne except instead of using a second aircraft to get you up, you use it to get you down.

Edit: A Cirrus Vision SF50 with folding wings might fit.

Well visions differ.

The only thing the aircraft would need to do is land, so IMHO you could leave off the SF50s wings and engines and rely on the Cirrus Airframe Parachute System.

Joking aside I'd expect a canopy system to be more than adequate and easier to implement.  Might be a light multi-person capsule with a powered paraglider.  But I do not insist on it.  The trickiest part would be separation from the SS, once you separate from SS and get the speed down to 100mph or so there are lots of choices.

I could even see crew bailing out using individual parachutes if for some strange reason they needed crew on an early test flight, although that risks them pulling a "wrong way" Corrigan and "forgetting" to depart.

I would rather land on a runway than parachute into the ocean.

Edit: If I can avoid it.

[Robotbeat]

Yes, so if the vehicle reliability is 1:10,000 but the abort motor or abort system causes a failure in 1:1000 even for otherwise nominal missions, this is obviously a losing situation.

In the case of Orion, this can occur in multiple cases. For instance, if the abort motor fires through accidental command. Or if the jettison motor fails to fire. Or if the jettison motor explodes. Or if the fairing fails to release. Or if the weight of the abort system causes a failure of the fairing.

Again, it kinda sounds like you're expecting the people at MSFC who wrote the Orion requirements to have been actively incompetent.  If there's a 1:1000 chance of a failure in a nominal flight mode, then somebody needs to be fired.

…

How would anyone ever find out? Orion will fly at most, say, 20 times. At the high end.

But yeah, I don’t buy the PRA which claim extreme reliability without having done anywhere near that much testing, not even within a few orders of magnitude. The same hyper-optimism was done with Shuttle. (I’m not calling on anyone to be fired or claiming Orion has the same LOC probability as Shuttle, just… I don’t believe the extremely low probability of LES failure or loss of crew figures.)

I actually know those people, FWIW.

[Barley]

LES means explosives / hypergolics close to the crew.

LES--as well as every RCS system on every single human-rated spacecraft--has meant hypergolics close to the crew for decades and has only caused one accident (Apollo/Soyuz) that I know of.  As for pyrotechnics, they're a pain, but they're also an avoidable pain (cf. D2).

Hypergolics have killed ground crew.  Not sure if they've killed ground crew for HSF if not that's probably due to the small number of HSF.

The question is if hypergolics* are an avoidable pain?  We can use them safely if we have eternal vigilance, evacuate the area and wear hazmats suits does not cut it if you can safely not use them.  I expect there is some historical contingency here.  If hypergolics had not been adopted during the cold war they would not have been adopted.

* Meaning nitric acids and hydrazines and such.  There could be safer hypergolics.  Rocket fuels are likely to be explosive, but they don't have to be more toxic than kerosene.

[Barley]

The landing is still risky.   There are still too many single points of failure

Maybe it would be possible to preemptively deploy a small, short-ranged aircraft to offload the people before landing. Wouldn't be instant but could be used well before meeting up with the chopsticks.

Just like Gagarin.  Of course the FAI probably won't count it as a space flight.  Oh the humanity.

No, more like SpaceShipOne except instead of using a second aircraft to get you up, you use it to get you down.

Edit: A Cirrus Vision SF50 with folding wings might fit.

Well visions differ.

The only thing the aircraft would need to do is land, so IMHO you could leave off the SF50s wings and engines and rely on the Cirrus Airframe Parachute System.

Joking aside I'd expect a canopy system to be more than adequate and easier to implement.  Might be a light multi-person capsule with a powered paraglider.  But I do not insist on it.  The trickiest part would be separation from the SS, once you separate from SS and get the speed down to 100mph or so there are lots of choices.

I could even see crew bailing out using individual parachutes if for some strange reason they needed crew on an early test flight, although that risks them pulling a "wrong way" Corrigan and "forgetting" to depart.

I would rather land on a runway than parachute into the ocean.

Parachutes can land on runways.  They can land on the small cross on the 35-yard line.  Not sure why you need much cross range from a SS returning to Boca Chica or Kennedy but the record flight for a powered parachute is over 1000 km.

[Robotbeat]

Powered parachutes are non-trivial, huge fan (dangerous blades) and motor on your back. Paraglider makes more sense.

[TheRadicalModerate]

Are you guys on the right thread?

If you're talking about thousands of launches to achieve safety certification, this matters.

Not really. They don't need hundreds of flights a day to get the safety record they need, and by the time they are at hundreds a day they will be synthesising the methane anyway.

This whole sub-thread is only vaguely related to abort options anyway. Does anyone other than Robotbeat and Lee Jay care about it?

*TAPS THE SIGN* 
Check #1 in this thread. This thread is a spinoff of a locked thread which debated should-it/should-it not. This one is predicated on the idea that it should (after I asked whether one can do it without turning it into an airplane) and therefore what are the technical options.

I was confused (and still am, kinda) about the discussion about how much methane things took.  I think you guys were driving at the idea that high-cadence flights aren't limited by methane production or emissions, which is true.

But they're limited by demand.  SpaceX can probably run a modest test program with dummy payloads, but if the goal is to find the corner cases of EDL and therefore likely crash the test Starships, it would cost a lot.

Back when we had the 400 flights vs. thousands of flights confusion (for which I'm at least partially responsible), I tried to count likely flight rates.  Maybe that's a good thing to do more rigorously.

Here's a guess at launch slot supply and Starship demand for ten years.  (Screenshot below.)  Lots to argue about, but unless the Eastern Range gets a much, much higher cadence, it's probably the bottleneck.

Update:  Oops, forgot to tail off the F9 launch slots.  Fixed, along with the screenshot below.  Makes things better, but you're still not going to get thousands sooner than ten years.

[InterestedEngineer]

How would anyone ever find out? Orion will fly at most, say, 20 times. At the high end.

But yeah, I don’t buy the PRA which claim extreme reliability without having done anywhere near that much testing, not even within a few orders of magnitude. The same hyper-optimism was done with Shuttle. (I’m not calling on anyone to be fired or claiming Orion has the same LOC probability as Shuttle, just… I don’t believe the extremely low probability of LES failure or loss of crew figures.)

I actually know those people, FWIW.

This.   PRA is hopium packaged up in fancy statistical analysis.

Doing something 100 times beats PRA always

[TheRadicalModerate]

How would anyone ever find out? Orion will fly at most, say, 20 times. At the high end.

But yeah, I don’t buy the PRA which claim extreme reliability without having done anywhere near that much testing, not even within a few orders of magnitude. The same hyper-optimism was done with Shuttle. (I’m not calling on anyone to be fired or claiming Orion has the same LOC probability as Shuttle, just… I don’t believe the extremely low probability of LES failure or loss of crew figures.)

I actually know those people, FWIW.

This.   PRA is hopium packaged up in fancy statistical analysis.

Doing something 100 times beats PRA always

Ideally, and as you said up-thread, you do both, and the two together catch more problems than PRA or empirical would on their own.

But my argument was that empirical is gonna take a long time, and that SpaceX may not want to wait that long, for a variety of good, market-developing and political reasons.

Just to further unwind from the rabbit hole:  most of the PRA argument had to do with current LES systems reducing or increasing pLOC.  And there, I'm pretty sure that PRA is perfectly fine at showing that they dramatically decrease pLOC.  I'm far from an expert in this area, but I know enough to trust the actual experts, and to be sure that they and their managers don't think they're wasting their time while simultaneously making human launch systems cost a lot more.  PRA certainly has its limits, but we're not anywhere close to them on this particular topic.

That doesn't mean that there won't eventually be a system that's so reliable that having an LES will be silly, and maybe Starship will (eventually) be that system.  But I'm pretty sure the burden of proof lies with those arguing that it's not needed for human-rating launch and EDL.

[Negan]

Parachutes can land on runways.  They can land on the small cross on the 35-yard line.  Not sure why you need much cross range from a SS returning to Boca Chica or Kennedy but the record flight for a powered parachute is over 1000 km.

I would want to know what weather conditions SS would be flying in before I committed to parachuting. Of course than I would have to commit myself to learn how to parachute which I don't see as a plus, but I have never shied away from flying in small aircraft.

Edit: I think the big hesitation here is thinking aircraft deploying aircraft is pure science fiction when in fact it was done by the US Navy in the 1930's. Not only were aircraft deployed, but they were also recovered.

[TheRadicalModerate]

This is probably a stupid idea, but that's never stopped me before:  What if you had an abort system based directly on the D2, with the following modifications:

1) No or dramatically reduced heat shield.  (If all of the abort cases are subsonic or low supersonic, you don't need much TPS.  For supersonic and hypersonic aborts, the Starship is its own escape system--at least until it gets close to the ground and has no chopsticks to land on.)

2) Propulsive landing only, no parachutes.  (So there's no parachute or landing jerk issue, requiring couches inclined through the load axis of the parachutes.)

3) Add in the landing feet, per the old design, to make things relatively safe for landings in rough terrain.

4) No storage for non-crew payload.

5) Remove ECLSS from the D2 and put it in the Starship payload bay, connected via a QD of some kind.

You could go back to at least seven crew, since all significant loads would go through the axis of symmetry again.  The question is whether, by ripping out additional storage, you could go to ten crew?  How 'bout eight (i.e., two vanilla Crew Dragons' worth of passengers)?

It'd be a pretty miserable ride, but it only lasts from launch to RPOD, and RPOD to landing.¹

Note that this still requires carrying the D2 inside the Starship payload bay, with a fairing that can blow away and take the canards safely with it.  That's a non-trivial bit of work there,² but it's a lot less total work if you don't have to build the abort capsule from scratch.

It may be a stupid idea, but it's a stupid idea with artwork!

____________
¹Since there's no heat shield, I suppose you could put a hatch in the bottom that led to a secondary crew space, for use only while on-orbit.  That would also allow you to place the docking port and tunnel someplace where it wasn't in the escape path.  Might that allow you to add an extra seat in the nose? (This may be an even stupider idea than the original...)

²Two very difficult things:
1) The separation plane has to work through the ventral TPS tiles.
2) The separation plane has to bear all canard loads during reentry, but still be able to jettison.

[Nevyn72]

Well for one thing you probably don't require the trunk on D2 do you?

[TheRadicalModerate]

Well for one thing you probably don't require the trunk on D2 do you?

Yes, you do.  It's not aerodynamically stable during escape without it.

[Lee Jay]

Powered parachutes are non-trivial, huge fan (dangerous blades) and motor on your back. Paraglider makes more sense.

As I recall, the world's largest parafoil supported the 25,000 pound x-38.  Quite a way to go to something this size