Abort options for Starship and Starship/SuperHeavy

[Lee Jay]

I suggest that we table the "Can Starship ever be as safe as aviation?" question.  It's off-topic. 

If that's off topic...then so is this:

What's on-topic is the question of whether Starship, under the commonly accepted standards for human spaceflight, can be made safe enough to be crew-rated in the number of launches likely available to it before lack of crew-rating becomes a serious problem for SpaceX.

[TheRadicalModerate]

I suggest that we table the "Can Starship ever be as safe as aviation?" question.  It's off-topic. 

If that's off topic...then so is this:

What's on-topic is the question of whether Starship, under the commonly accepted standards for human spaceflight, can be made safe enough to be crew-rated in the number of launches likely available to it before lack of crew-rating becomes a serious problem for SpaceX.

How so?  The former is about the distant future.  The latter is about how to meet a near-term requirement for crew-rating, which in turn informs the kind of abort options Starship needs.

[Lee Jay]

I suggest that we table the "Can Starship ever be as safe as aviation?" question.  It's off-topic. 

If that's off topic...then so is this:

What's on-topic is the question of whether Starship, under the commonly accepted standards for human spaceflight, can be made safe enough to be crew-rated in the number of launches likely available to it before lack of crew-rating becomes a serious problem for SpaceX.

How so?  The former is about the distant future.  The latter is about how to meet a near-term requirement for crew-rating, which in turn informs the kind of abort options Starship needs.

Both are about crew safety.  So both are on-topic.

Neither is an abort option.  So both are off-topic.

[Robotbeat]

Commercial Crew had a LoC requirement of 1:270. The divvying up of that requirement between ascent, EDL, and on orbit operations could maybe be negotiated, but that sounds like a good place to start.

The straightforward way to address that would be to just launch & recover Starship 270 times in a row. Arguably you can probably halve that and use analysis, but let’s just pick that.

Of course, SpaceX will need about that many Starship flights to launch the initial phase of Starlink gen2. The part they’ve already been approved for. Assuming they’ll likely have some failures in there, so let’s say 300-400 launches.

Very doable to meet NASA’s requirements without a LAS. Falcon 9 and Heavy together have done over 200 consecutive successful launches since AMOS-6 (which wasn’t technically a flight and wouldn’t have had crew on it), not to mention CRS-7.

Of course, Starship ALSO needs to do EDL successfully that many times in a row, which is more of a question mark at this point, but seems doable.

Need to go a little beyond that, however, to account from risk from micrometeorite and space debris, etc. so sure, let’s pick 400 flights.

[Lee Jay]

Very doable to meet NASA’s requirements without a LAS.

...

Of course, Starship ALSO needs to do EDL successfully that many times in a row, which is more of a question mark at this point, but seems doable.

Let's not pretend that both of those "doables" are anything but wishful thinking or conjecture.

[TheRadicalModerate]

Commercial Crew had a LoC requirement of 1:270. The divvying up of that requirement between ascent, EDL, and on orbit operations could maybe be negotiated, but that sounds like a good place to start.

The straightforward way to address that would be to just launch & recover Starship 270 times in a row. Arguably you can probably halve that and use analysis, but let’s just pick that.

Do you happen to know the confidence interval for the 1:270 number?

95% CI for 270 successful trials is 98.6% - 100%
90% CI is 98.9% - 100%

Of course, SpaceX will need about that many Starship flights to launch the initial phase of Starlink gen2. The part they’ve already been approved for. Assuming they’ll likely have some failures in there, so let’s say 300-400 launches.

The current license allows 7500 birds.  Starship is thought to be able to handle about 60 per launch.  That's 125 launches.

But this misses the most important point:  Where's the launch capacity coming from for this, and over what period?  I'm extremely skeptical that BC is going to ramp to more than 10 launches/year any time soon, if ever, and I'm also skeptical that NASA and DoD are going to allow launches from 39A until the reliability is already baked in.  It's a chicken-and-egg problem, and it'll throttle launch cadence early in the program.

Starship doesn't become an SLS-killer until it can send more than 4 people at a time to cislunar space, because it's private parties of 8 passengers or more that provide the utterly humiliating event that needs to happen before everybody gives up.  But there's a clock on when the SLS-killing window closes: it's when  EPOC Phase 2 gets signed.  After that, we're living with this turkey effectively forever, which probably kills Artemis.

EPOC Phase 1 isn't executed yet, for reasons that are mysterious to me, so there's some time.  But I'd be extremely surprised if Phase 2 wasn't signed some time in 2027.

I don't think there will have been 200 launches by 2027.  Therefore, a party of 8 around the Moon is unlikely.

Very doable to meet NASA’s requirements without a LAS. Falcon 9 and Heavy together have done over 200 consecutive successful launches since AMOS-6 (which wasn’t technically a flight and wouldn’t have had crew on it), not to mention CRS-7.

Of course, Starship ALSO needs to do EDL successfully that many times in a row, which is more of a question mark at this point, but seems doable.

Need to go a little beyond that, however, to account from risk from micrometeorite and space debris, etc. so sure, let’s pick 400 flights.

We're all of course guessing a lot.  My guess is that, if you're really going to do this empirically, the confidence intervals just aren't where they need to be--especially if there are a handful of failures.

Longer term, PRA will provide better results, and I do think that they'll have the system pretty well characterized after a hundred flights or so.  But "well characterized" isn't the same as "produces the result we want."  A perfectly reasonable outcome from an honest PRA may be that the architecture simply isn't reliable enough.  There are some really bushy spots in the failure tree, especially around landing.

[Robotbeat]

The confidence intervals can be established by additional analysis and certification. But if you’ve already got a long track record, that substantially reduces the uncertainty.

PRA from first principles probably wouldn’t have suggested that F9 can land over 100 times in a row. And yet…

[KilroySmith]

...I'm also skeptical that NASA and DoD are going to allow launches from 39A until the reliability is already baked in.  It's a chicken-and-egg problem, and it'll throttle launch cadence early in the program.

Seems unnecessarily negative here.  Once SS/SH has successfully launched once or twice from BC, I can't imagine NASA/DOD having significant objections to launching from 39A. 

[joek]

The confidence intervals can be established by additional analysis and certification. But if you’ve already got a long track record, that substantially reduces the uncertainty.
...

Nominally agree. That is what happened with CCP: it was all based on PRA as there was limited empirical evidence. Would also note that the 1:270 LOC was based on a 210 day ISS mission (vs. 1:500 ascent and decent). A major source of indigestion for ASAP was MMOD risk which drove no end of debates. (Oh, and let's not forget parachutes.)


p.s. And Kathy Leuders was a major force for that through the CCP processes. Glad to see she is now with the the SpaceX SS program.

[joek]

...I'm also skeptical that NASA and DoD are going to allow launches from 39A until the reliability is already baked in.  It's a chicken-and-egg problem, and it'll throttle launch cadence early in the program.

Seems unnecessarily negative here.  Once SS/SH has successfully launched once or twice from BC, I can't imagine NASA/DOD having significant objections to launching from 39A.

Agree. Hope-exect the prerequisites have already been worked out with NASA, DoD, KSC, whoever. The optics and logistics of launching HLS missions from Starbase because they would not allow to launch from KSC due to safety concerns would likely be weird and painful. Which suggests there is more in play, and whatever it is SpaceX needs to demonstrate fits within the current constraints of the Starbase EIS.

Think we can also take a page from the first F9 land landing at LZ-1. SpaceX had not demonstrated a successful ASDS landing, yet they were allowed to do perform an LZ-1 landing attempt. Presumably SpaceX had data to support that an LZ-1 landing was safe enough.

[TheRadicalModerate]

The confidence intervals can be established by additional analysis and certification. But if you’ve already got a long track record, that substantially reduces the uncertainty.

The confidence intervals are a mathematical construct, and are solely governed by the number of trials, the number of successes in those trials, and the confidence level you're looking for.

So, as usual, I stubbed my toe on the statistical rigor required to prevent any statement from evaporating into a cloud of confusion.  Let me try again: 

What is the confidence level required for the pLOC parameter, and what is the acceptable lower bound on confidence interval, given that confidence level?

If you simply set pLOC < 1:270 as the lower bound on the confidence interval, then the lower bound on the confidence interval for success is 99.63%. Note that this may or may not be a reasonable way of converting pLOC, which I strongly suspect is a concept that drops out of a PRA to an empirical measurement.  It might be reasonable to set the lower bound a bit lower, on the (mistaken) assumption that the pLOC ought to represent a kind of midpoint in the interval.

You can find a zillion binomial CI calculators online.  Make sure you use one that allows you to adjust the CL.  30 seconds of naive googling pointed me at this one, which is ancient.  Here's how many consecutive successful flights it shows would be required to get a 99.63% lower bound at various confidence levels:

95% CL: 1000
90% CL: 800
50% CL: 370 

Now:  This is the mother of all frequentist, empirical approaches, and it assumes that each mission is an independent event.  That's not true, because there's a real learning curve lurking behind that many launches, and some of that experience presumably makes the system safer in a way that raw statistics can't reflect.

This is where PRA comes in.  As you learn more about how to accurately characterize the system, you make modifications to structure of the failure trees.  This is equivalent to incorporating, "Oh, we'd had a failure of imagination that this could interact with that, we should probably account for that."  You also make modifications to the probabilities of failure for each node in the failure tree, which represents empirical experience with various components and subsystems.  Together, this makes your PRA model better and better, until you can eventually start relying on it as a predictor of actual safety, allowing you to abandon the empirical model.

It would require a much, much better statistician than I (not difficult, because I am a bad, mostly ignorant statistician) to quantify where you can jump off of one methodology and on to the other, but it's safe to say that the empirical numbers I wrote up above are over-conservative.  But exactly how over-conservative, I don't know.

PRA from first principles probably wouldn’t have suggested that F9 can land over 100 times in a row. And yet…

I don't know what "PRA from first principles" means.  If you ran PRA on the F9 right now, I suspect you'd come up with a probability of failure that would be considerably larger than 1:1000 for the EDL sequence.  Hence, NASA wouldn't certify that sequence for landing a crew.

That's obviously not the goal of the F9 EDL sequence, but it does give you a hint of the difficulty you'll encounter when trying to crew-certify the Starship EDL sequence.

...I'm also skeptical that NASA and DoD are going to allow launches from 39A until the reliability is already baked in.  It's a chicken-and-egg problem, and it'll throttle launch cadence early in the program.

Seems unnecessarily negative here.  Once SS/SH has successfully launched once or twice from BC, I can't imagine NASA/DOD having significant objections to launching from 39A. 

It's not a question of negativity.  It's a question of choosing some safety criteria and waiting until they're satisfied.  It's not horribly difficult to achieve, but it's more difficult than waving your arms and saying, "A couple of launches ought to do it."

Here's a guess at what would be close to what NASA and DoD would accept:  They'll allow launches from 39A when a series of launches demonstrates, at a confidence level of 50%, that the lower bound of the empirically-derived confidence interval for not generating widespread damage is >=90%.

That would be 14 consecutive launches with no pad damage.

[TheRadicalModerate]

...I'm also skeptical that NASA and DoD are going to allow launches from 39A until the reliability is already baked in.  It's a chicken-and-egg problem, and it'll throttle launch cadence early in the program.

Seems unnecessarily negative here.  Once SS/SH has successfully launched once or twice from BC, I can't imagine NASA/DOD having significant objections to launching from 39A.

Agree. Hope-expect the prerequisites have already been worked out with NASA, DoD, KSC, whoever. The optics and logistics of launching HLS missions from Starbase because they would not allow to launch from KSC due to safety concerns would likely be weird and painful. Which suggests there is more in play, and whatever it is SpaceX needs to demonstrate fits within the current constraints of the Starbase EIS.

Think we can also take a page from the first F9 land landing at LZ-1. SpaceX had not demonstrated a successful ASDS landing, yet they were allowed to do perform an LZ-1 landing attempt. Presumably SpaceX had data to support that an LZ-1 landing was safe enough.

I feel hopelessly under-qualified to be the advocate for some kind of statistical rigor here, but... arm-waving is not statistically rigorous.  Sit down with a confidence interval calculator, come up with some criteria for an acceptable confidence level and lower bound on the confidence interval, and figure it out!

I'm as susceptible to fan-think as the next guy, but fan-think is not how this stuff is going to be managed.  It's not horribly difficult to get to a level where NASA and DoD should be able to avoid freaking out, but it's certainly more difficult than "a couple of launches".

[spacenut]

SpaceX is getting Pad 40 ready for Falcon 9/Dragon crew launches in case Starship fails at pat 39A.  So, I don't see a problem with using 39A for multiple Starship launches a year.  Once pad at Boca Chica is proven to hold up under the Superheavy launches, pad 39A will be not problem.  Boca Chica will be the proving ground and test launch location.  Pad 39A initially will be the workhorse pad until other launch pads are built. 

[joek]

...
What is the confidence level required for the pLOC parameter, and what is the acceptable lower bound on confidence interval, given that confidence level?
...

Unknown. If you wade through the CCP docs, the only published LOC, LOV, LOM, whatever numbers are those 1:270, 1:500, etc. Confidence level and interval are not public to my knowledge. The details are not public; all we have is (to paraphrase): to NASA's satisfaction; and that a PRA was required.

...
I'm as susceptible to fan-think as the next guy, but fan-think is not how this stuff is going to be managed.  It's not horribly difficult to get to a level where NASA and DoD should be able to avoid freaking out, but it's certainly more difficult than "a couple of launches".

Most certainly. Bet your booties a rather exhaustive PRA will be required, along with as much empirical data as can be mustered to justify the PRA. The FAA already requires some level of that before issuing a launch or reentry license... and the higher the risk, the higher the bar with respect to analysis and evidence.

However, again, we have virtually no insight into the sausage-making behind the curtain. There are standards, but they are all generic and provide little-to-no insight into the details of a particular analysis; about all we get is scraps from the behind-closed-doors food fights.

Would be very interested if you locate details (as I'm sure would many others).

[CJ]

If a Starship is damaged and/or having control issues, landing back at the launch site on the chopsticks might not be feasible. One abort option that IMHO would be worth looking onto is a water landing, and also a land-landing mode.

As I recall, Elon mentioned the "bouncy castle" approach for a landing option a couple of years ago; my guess is it would be a large inflatable rectangle with blow-out panels, to allow a horizontal landing. That IMHO, if feasible, would be a good emergency option at the launch site (assuming it could be inflated very quickly, so only inflated in case of need). 

The second abort option *might* be a water landing. I suspect SpaceX might be thinking along these lines, and that might be one of the reasons why the test flight plan was for no landing burn off Hawaii; in part to see what a horizontal water landing (more likely at a very shallow angle to the water, not flat) does to a Starship. It it turns out that the damage and impact G forces are within a range that might make it plausible that a crew  would survive, then that's an emergency abort option if RTLS or a landing burn isn't possible (such as due to engine damage).

Would anyone happen to know the approximate speed of decent on the Starship hops just prior to the landing burn ignition?

Terminal velocity is 90m/sec, it is doubtful based that humans can survive a terminal velocity impact on the ocean based on basic physics and the limit of 40Gs of acceleration for humans.

Detailed analysis here:  https://forum.nasaspaceflight.com/index.php?topic=56632.msg2488438#msg2488438

OTOH, some additional, drag (e.g. parachutes) can get the terminal velocity down to 50m/sec, which is survivable at 40Gs.

Detailed analysis here:  https://forum.nasaspaceflight.com/index.php?topic=56632.msg2491893#msg2491893

Thanks for the data, and the link!

90m/s is considerably faster than I'd assumed, so... a belly flop at 90m/s is probably non-survivable. I do wonder, though, if it's survivable if impact is at a tail-first angle relative to the water. Say, 42 degrees tail-down. That ought (I don't know how to do the math to figure this out) to increase the deceleration time, and thus lower the impact G-load. It'd also impart some horizontal motion prior to crew compartment impact, so crew compartment water impact would be at an angle to the water rather then a straight-down hit. I wonder if those effects would be enough to have the same effect as reducing the vertical velocity by 30 m/s. 

[steveleach]

If a Starship is damaged and/or having control issues, landing back at the launch site on the chopsticks might not be feasible. One abort option that IMHO would be worth looking onto is a water landing, and also a land-landing mode.

As I recall, Elon mentioned the "bouncy castle" approach for a landing option a couple of years ago; my guess is it would be a large inflatable rectangle with blow-out panels, to allow a horizontal landing. That IMHO, if feasible, would be a good emergency option at the launch site (assuming it could be inflated very quickly, so only inflated in case of need). 

The second abort option *might* be a water landing. I suspect SpaceX might be thinking along these lines, and that might be one of the reasons why the test flight plan was for no landing burn off Hawaii; in part to see what a horizontal water landing (more likely at a very shallow angle to the water, not flat) does to a Starship. It it turns out that the damage and impact G forces are within a range that might make it plausible that a crew  would survive, then that's an emergency abort option if RTLS or a landing burn isn't possible (such as due to engine damage).

Would anyone happen to know the approximate speed of decent on the Starship hops just prior to the landing burn ignition?

Terminal velocity is 90m/sec, it is doubtful based that humans can survive a terminal velocity impact on the ocean based on basic physics and the limit of 40Gs of acceleration for humans.

Detailed analysis here:  https://forum.nasaspaceflight.com/index.php?topic=56632.msg2488438#msg2488438

OTOH, some additional, drag (e.g. parachutes) can get the terminal velocity down to 50m/sec, which is survivable at 40Gs.

Detailed analysis here:  https://forum.nasaspaceflight.com/index.php?topic=56632.msg2491893#msg2491893

Thanks for the data, and the link!

90m/s is considerably faster than I'd assumed, so... a belly flop at 90m/s is probably non-survivable. I do wonder, though, if it's survivable if impact is at a tail-first angle relative to the water. Say, 42 degrees tail-down. That ought (I don't know how to do the math to figure this out) to increase the deceleration time, and thus lower the impact G-load. It'd also impart some horizontal motion prior to crew compartment impact, so crew compartment water impact would be at an angle to the water rather then a straight-down hit. I wonder if those effects would be enough to have the same effect as reducing the vertical velocity by 30 m/s.

I thought that the pixel counters worked it out at around 68m/s terminal velocity for the early flight tests.

I know the Every Astronaut site says 90, but it doesn't explain where that came from.

[rsdavis9]

If a Starship is damaged and/or having control issues, landing back at the launch site on the chopsticks might not be feasible. One abort option that IMHO would be worth looking onto is a water landing, and also a land-landing mode.

As I recall, Elon mentioned the "bouncy castle" approach for a landing option a couple of years ago; my guess is it would be a large inflatable rectangle with blow-out panels, to allow a horizontal landing. That IMHO, if feasible, would be a good emergency option at the launch site (assuming it could be inflated very quickly, so only inflated in case of need). 

The second abort option *might* be a water landing. I suspect SpaceX might be thinking along these lines, and that might be one of the reasons why the test flight plan was for no landing burn off Hawaii; in part to see what a horizontal water landing (more likely at a very shallow angle to the water, not flat) does to a Starship. It it turns out that the damage and impact G forces are within a range that might make it plausible that a crew  would survive, then that's an emergency abort option if RTLS or a landing burn isn't possible (such as due to engine damage).

Would anyone happen to know the approximate speed of decent on the Starship hops just prior to the landing burn ignition?

Terminal velocity is 90m/sec, it is doubtful based that humans can survive a terminal velocity impact on the ocean based on basic physics and the limit of 40Gs of acceleration for humans.

Detailed analysis here:  https://forum.nasaspaceflight.com/index.php?topic=56632.msg2488438#msg2488438

OTOH, some additional, drag (e.g. parachutes) can get the terminal velocity down to 50m/sec, which is survivable at 40Gs.

Detailed analysis here:  https://forum.nasaspaceflight.com/index.php?topic=56632.msg2491893#msg2491893

Thanks for the data, and the link!

90m/s is considerably faster than I'd assumed, so... a belly flop at 90m/s is probably non-survivable. I do wonder, though, if it's survivable if impact is at a tail-first angle relative to the water. Say, 42 degrees tail-down. That ought (I don't know how to do the math to figure this out) to increase the deceleration time, and thus lower the impact G-load. It'd also impart some horizontal motion prior to crew compartment impact, so crew compartment water impact would be at an angle to the water rather then a straight-down hit. I wonder if those effects would be enough to have the same effect as reducing the vertical velocity by 30 m/s.

How about this:
we are in a passive skydiver reentry. Engines and other active stuff are not available.
So we are descending to water surface at 90m/s.
So solid rocket motors bow and stern to slow the last 5m?
Like boeing and soyuz soften the impact.

[BZHSpace]

Is there an issue with forcing the connection between Booster and Ship ?

[Barley]

...
What is the confidence level required for the pLOC parameter, and what is the acceptable lower bound on confidence interval, given that confidence level?
...

Unknown. If you wade through the CCP docs, the only published LOC, LOV, LOM, whatever numbers are those 1:270, 1:500, etc. Confidence level and interval are not public to my knowledge. The details are not public; all we have is (to paraphrase): to NASA's satisfaction; and that a PRA was required.

There appears to be undue concern over the confidence interval.  Unless they are weaseling it, pLOC is probability of loss of crew.  The same pLOC is the same risk to the crew, regardless of the confidence level.   The confidence interval is a measure of the amount of data, perhaps a stand in for the maturity of the program

[laszlo]

So do you all suppose that the Hazegrayart guy would be interested in animating all the silly Rube Goldberg designs proposed in the last 49 pages of this thread?