Abort options for Starship and Starship/SuperHeavy

[Lee Jay]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.

Oh, okay, so the idea is that abort is needed most during landing because we simply can't do anything about entry.

[Robotbeat]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.

Oh, okay, so the idea is that abort is needed most during landing because we simply can't do anything about entry.

There are lots of things that can be done to improve the survivability of off-nominal reentry, such as making your structure out of a high temperature metal like stainless steel instead of aluminum (or conventional composites).

[TheRadicalModerate]

There are lots of things that can be done to improve the survivability of off-nominal reentry, such as making your structure out of a high temperature metal like stainless steel instead of aluminum (or conventional composites).

I agree that there are some design things that will help.  But abort options in hypersonic reentry are extremely limited.

Maybe not totally limited, though:  Is there any possibility of a Starship being able to restart its engines in hypersonic glide to abort back to orbit?  It probably makes thermal issues temporarily worse, but you could engineer a trajectory that gets you to low-density air very quickly, especially if Starship is designed for extremely high angles of attack (which I think is the plan).

[Lee Jay]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.

Oh, okay, so the idea is that abort is needed most during landing because we simply can't do anything about entry.

There are lots of things that can be done to improve the survivability of off-nominal reentry, such as making your structure out of a high temperature metal like stainless steel instead of aluminum (or conventional composites).

If the stainless could handing a NOMINAL entry, they wouldn't need tiles, to say nothing of an off-nominal entry, which is what would take place after a burnthrough.

[LouScheffer]

Meanwhile, NASA has regulations for its professional astronauts:

pLOC <1/500 during ascent
pLOC <1/500 during EDL
pLOC <1/270 during a six-month mission, after factoring in MMOD and other on-orbit hazards.

1/500 for each of launch and EDL is almost certainly what NASA would expect, and I'd be surprised if SpaceX didn't hold itself to the same standard for private missions.  There's too much downside and not enough upside to do anything else.

SpaceX might be able to reach these numbers without massive re-design, basically taking advantage of all the low hanging fruit.

For SH failures, use the second stage as an escape pod.  This should work except in those cases where the SH quickly goes KA-BOOM.  But a more gentle failure should be more likely - liquid engines seem to fail less violently, and SpaceX should have significant data on Raptor failures from their testing program, and as long as one steerable engine is running the first stage can cooperate by keeping stable and not instantly disintegrating from aero forces.  For example, this approach would have worked fine on the recent New Shepard failure.  Various relatively minor changes might be required - stronger stage separation pneumatics, better shields between the booster's steerable engines (to keep one engine running for stage stability after second stage departure), new software for both stages, and so on.  But no major design effort.

Similarly, many second stage boost failures, and landing failures, could be addressed by (a) trying to make sure an engine failure does not take out all the engines, and (b) a serious software effort, and testing, to make sure the second stage does the best it can with whatever engines remain, and (c) always have legs on crewed missions, so any dry land will do (and even a gentle water landing might be OK - this can be tested).

If SpaceX can get the raw reliability to 99% (about where F9 is now), and handle 4 out of 5 failures without loss of crew, then they could meet the above requirements without huge changes. 

[TheRadicalModerate]

For SH failures, use the second stage as an escape pod.  This should work except in those cases where the SH quickly goes KA-BOOM.

We're kinda covering stuff that's fairly close up-thread, but don't forget pad aborts, which are a high-runner set of failures.  You can get Starship to escape the pad, but it requires:

1) Reducing payload and prop to an absolute minimum.  And even then, you only get a T/W of 6.  For comparison, the Apollo LES used T/W=12 for a stack with a bit less potential explosive energy.  On the other hand, D2 gets away with a T/W of about 4.6, but it has a lot less explosive energy.

2) The Starship's Raptors need to start while still mated the the SH.  This almost certainly would require some redesign of the SH.

[chopsticks]

For SH failures, use the second stage as an escape pod.  This should work except in those cases where the SH quickly goes KA-BOOM.

We're kinda covering stuff that's fairly close up-thread, but don't forget pad aborts, which are a high-runner set of failures.  You can get Starship to escape the pad, but it requires:

1) Reducing payload and prop to an absolute minimum.  And even then, you only get a T/W of 6.  For comparison, the Apollo LES used T/W=12 for a stack with a bit less potential explosive energy.  On the other hand, D2 gets away with a T/W of about 4.6, but it has a lot less explosive energy.

2) The Starship's Raptors need to start while still mated the the SH.  This almost certainly would require some redesign of the SH.

Just Kerbal it and stick some SRBs in the skirt for pad aborts.

[InterestedEngineer]

For SH failures, use the second stage as an escape pod.  This should work except in those cases where the SH quickly goes KA-BOOM.

We're kinda covering stuff that's fairly close up-thread, but don't forget pad aborts, which are a high-runner set of failures.  You can get Starship to escape the pad, but it requires:

1) Reducing payload and prop to an absolute minimum.  And even then, you only get a T/W of 6.  For comparison, the Apollo LES used T/W=12 for a stack with a bit less potential explosive energy.  On the other hand, D2 gets away with a T/W of about 4.6, but it has a lot less explosive energy.

2) The Starship's Raptors need to start while still mated the the SH.  This almost certainly would require some redesign of the SH.

Just Kerbal it and stick some SRBs in the skirt for pad aborts.

You joke, but there is room for 3 solid rocket boosters on Starship with a burn time of a few seconds.   Instead of adding 3 vacuum raptors, add 3 solid rocket boosters of the same dimensions.

The diameter would need to be 2.7m (diameter of Raptor Vacuum bell), the diameter of SRBs is about 3.5m.  So can't be the exact same design. 

The dimension that would fit would be 2.7m diameter and 4m length, which is a volume of 22.9 m^3 or say 40t of propellant plus a nozzle (1900kg/m^3 for ammonium perchlorate).   At a burn rate of 4t / second that's 10 seconds of burn.  (same burn rate as SRB)

If you could get a similar thrust of the SRBs for 10 seconds the TWR would be 2.7, that's 17m/s² or a final velocity of 170m/s.

the TWR of the 6 raptors is 1.0 so it maintains that velocity of 170m/sec until enough fuel is burned.  (they probably run at full thrust for 8+ seconds of the boost out so the final velocity might be 27*8 = 216m/s)

Alas, it's a dead weight of 120t in the tail of the Starship.   Not ideal at all.   But that's the kind of craziness needed to do a pad abort of the entire fuel-filled Starship.

[sebk]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

Not necessarily (maybe yes, maybe not). Don't confuse most extreme conditions with most risk.

The design seems to have at least double string redundancy for the most likely failures:

* Heatshiled tiles are backed by another layer of heat resistant material which in turn is placed on top of heat resistant skin.
* Even heavy-moderate skin overheat doesn't mean immediate disintegration. It means the vehicle requires significant repairs or even it could be a write-odd, but that doean't mean is immediately in small pieces. During descent the tank pressure would be reduced form ascent 6bar to something much lower. Annealed steel wouldn't hold ascent loads, but descent loads are much less.
* If one of the flaps seizes (and stops moving), the other three provide basic control authority, enough to pass through the hypersonic part of ED. Yes, you'd be likely badly off track afterwards and would have a contingency of the vehicle descending over some patch of land or sea 100km off target, but terminal descent abort options (for example ejection seats) would work for that.
* Nav errors are not an issue for hypersonic part the very same way as the above point. You pass through the hypersonic part and deal with the trouble later.
* Even if there's hull breach it's not necessarily immediately deadly, although the ship is likely unable to land

Staying with the ship until it's subsonic and bailing out only then sounds like a sensible strategy.

At the same time the landing flip has more single points of failure. And some of them are consequences of earlier failures (see above) rather than a problem with the flip itself.  If you're 50km off target in the middle of the Gulf you already have contingency on your hands.

PS. No space vehicle ever had an abort option for the hypersonic part of EDL.

[sebk]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.

Oh, okay, so the idea is that abort is needed most during landing because we simply can't do anything about entry.

There are lots of things that can be done to improve the survivability of off-nominal reentry, such as making your structure out of a high temperature metal like stainless steel instead of aluminum (or conventional composites).

If the stainless could handing a NOMINAL entry, they wouldn't need tiles, to say nothing of an off-nominal entry, which is what would take place after a burnthrough.

Nope.

There is such thing as material annealing. The steel the ship is made from was hardened (it's cold rolled -- it's a type of work hardening; 300 series stainless hardens very well and its yield strength gets increased a few times). Stainless starts to slowly lose this strength above 700K and does so practically immediately above 1200K. But it's not melting point. 304 stainless steel melts at 1570K to 1630K. Shuttle tiles were to withstand 1530K. As far as we know Starship tiles are the same.


The vehicle needs its full strength primarily on ascent when its tanks are pressurized to 6bar while it faces ~35kPa max-q loads or 3.5g late booster burn load, all the while filled with 1200t of ascent propellant (so for example its skirt has to handle about 5000t load; 3.5g * ~1400t). But during EDL the vehicle is an order of magnitude lighter, dynamic loads are ~20kPa, tanks don't need high pressurization and likely are pressurized as little as possible because ullage gas has non-trivial mass. Suddenly skin doesn't have to survive stress of a 6bar, when the pressure is 2bar. Your skin structural margin increased from 40% to over 400%. The thing could become 4x weaker and it would still hold.


But after such overheating the vehicle would be a write-off (unless the overheating affected only a small patch, then a repair is an option). 300 series remains annealed after it's annealed, it doesn't heal (it doesn't age harden appreciably). You need to work harden it again (this is one of the reasons SpaceX had some initial trouble with popping tanks: weld's anneal the base material; they implemented a better controlled welding process and they also planish many welds which restores some of the strength, and they use weld doublers where fixing up seams is not feasible).

[Negan]

I think engine out capability during landing addresses a lot of this risk, as does using legs instead of chopsticks for crew.

Is engine out capability already something pretty much proven out at this time? I assume if not, it could be done safely enough without risking SS or having to do special test launches for it. Next question would be how many test landings will need to be done for the legs? I would think as few as possible because between the extra mass and the extra SS handling, you would want the leg test on the least amount of satellite missions as possible.

Edit: I'm also assuming the legs will have some effect on the heatshield design so you couldn't go to lean on testing as far as EDL which would be good anyway because of Mars.

[Lee Jay]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.

Oh, okay, so the idea is that abort is needed most during landing because we simply can't do anything about entry.

There are lots of things that can be done to improve the survivability of off-nominal reentry, such as making your structure out of a high temperature metal like stainless steel instead of aluminum (or conventional composites).

If the stainless could handing a NOMINAL entry, they wouldn't need tiles, to say nothing of an off-nominal entry, which is what would take place after a burnthrough.

Nope.

There is such thing as material annealing. The steel the ship is made from was hardened (it's cold rolled -- it's a type of work hardening; 300 series stainless hardens very well and its yield strength gets increased a few times). Stainless starts to slowly lose this strength above 700K and does so practically immediately above 1200K. But it's not melting point. 304 stainless steel melts at 1570K to 1630K. Shuttle tiles were to withstand 1530K. As far as we know Starship tiles are the same.


The vehicle needs its full strength primarily on ascent when its tanks are pressurized to 6bar while it faces ~35kPa max-q loads or 3.5g late booster burn load, all the while filled with 1200t of ascent propellant (so for example its skirt has to handle about 5000t load; 3.5g * ~1400t). But during EDL the vehicle is an order of magnitude lighter, dynamic loads are ~20kPa, tanks don't need high pressurization and likely are pressurized as little as possible because ullage gas has non-trivial mass. Suddenly skin doesn't have to survive stress of a 6bar, when the pressure is 2bar. Your skin structural margin increased from 40% to over 400%. The thing could become 4x weaker and it would still hold.


But after such overheating the vehicle would be a write-off (unless the overheating affected only a small patch, then a repair is an option). 300 series remains annealed after it's annealed, it doesn't heal (it doesn't age harden appreciably). You need to work harden it again (this is one of the reasons SpaceX had some initial trouble with popping tanks: weld's anneal the base material; they implemented a better controlled welding process and they also planish many welds which restores some of the strength, and they use weld doublers where fixing up seams is not feasible).

I don't buy this.

The RCC was for entry temperatures *above* 1530K.  You're equating that with a *melting* temperature in the same range.  These are NOT the same thing.  A material just below its melting point has lost most of its strength and will fail soon, if not immediately.  At 1000C 304 is 8 times weaker (lower yield stress) than at 600C.

We're talking about what to do in an off-nominal entry.  Off-nominal likely means damage (tiles or other) or loss of control.  I suspect in either case the assumption that there's nothing you can do is actually correct.  Damage will likely lead to burn through from loss of strength or full blown melting and that's worse on this vehicle than on Shuttle simply because burn through is on a pressurized tank you have to have to land safely.  Loss of control is probably worse.  So I seriously doubt that the intrinsic design of this vehicle makes it more robust against off-nominal entry conditions, and I certainly don't know of an abort option for that situation.

[meekGee]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.

Oh, okay, so the idea is that abort is needed most during landing because we simply can't do anything about entry.

There are lots of things that can be done to improve the survivability of off-nominal reentry, such as making your structure out of a high temperature metal like stainless steel instead of aluminum (or conventional composites).

If the stainless could handing a NOMINAL entry, they wouldn't need tiles, to say nothing of an off-nominal entry, which is what would take place after a burnthrough.

Nope.

There is such thing as material annealing. The steel the ship is made from was hardened (it's cold rolled -- it's a type of work hardening; 300 series stainless hardens very well and its yield strength gets increased a few times). Stainless starts to slowly lose this strength above 700K and does so practically immediately above 1200K. But it's not melting point. 304 stainless steel melts at 1570K to 1630K. Shuttle tiles were to withstand 1530K. As far as we know Starship tiles are the same.


The vehicle needs its full strength primarily on ascent when its tanks are pressurized to 6bar while it faces ~35kPa max-q loads or 3.5g late booster burn load, all the while filled with 1200t of ascent propellant (so for example its skirt has to handle about 5000t load; 3.5g * ~1400t). But during EDL the vehicle is an order of magnitude lighter, dynamic loads are ~20kPa, tanks don't need high pressurization and likely are pressurized as little as possible because ullage gas has non-trivial mass. Suddenly skin doesn't have to survive stress of a 6bar, when the pressure is 2bar. Your skin structural margin increased from 40% to over 400%. The thing could become 4x weaker and it would still hold.


But after such overheating the vehicle would be a write-off (unless the overheating affected only a small patch, then a repair is an option). 300 series remains annealed after it's annealed, it doesn't heal (it doesn't age harden appreciably). You need to work harden it again (this is one of the reasons SpaceX had some initial trouble with popping tanks: weld's anneal the base material; they implemented a better controlled welding process and they also planish many welds which restores some of the strength, and they use weld doublers where fixing up seams is not feasible).

I don't buy this.

The RCC was for entry temperatures *above* 1530K.  You're equating that with a *melting* temperature in the same range.  These are NOT the same thing.  A material just below its melting point has lost most of its strength and will fail soon, if not immediately.  At 1000C 304 is 8 times weaker (lower yield stress) than at 600C.

We're talking about what to do in an off-nominal entry.  Off-nominal likely means damage (tiles or other) or loss of control.  I suspect in either case the assumption that there's nothing you can do is actually correct.  Damage will likely lead to burn through from loss of strength or full blown melting and that's worse on this vehicle than on Shuttle simply because burn through is on a pressurized tank you have to have to land safely.  Loss of control is probably worse.  So I seriously doubt that the intrinsic design of this vehicle makes it more robust against off-nominal entry conditions, and I certainly don't know of an abort option for that situation.

The idea is that when the heat shield is partly compromised, an underlying steel structure will last a lot longer than an underlying aluminum one.

The temperature at the structure will not be that of the outer skin, so the ability to withstand elevated temperatures really matters.

Similarly if for whatever reason the peak temperature reached is higher than planned, temperatures will rise on the inner side of tge heat shield, and again Stainless will perform much better than Aluminum.

[Lee Jay]

The idea is that when the heat shield is partly compromised, an underlying steel structure will last a lot longer than an underlying aluminum one.

Which is irrelevant if they both fail.

The temperature at the structure will not be that of the outer skin, so the ability to withstand elevated temperatures really matters.

Since the skin is the structure, I don't know what this means.

Similarly if for whatever reason the peak temperature reached is higher than planned, temperatures will rise on the inner side of tge heat shield, and again Stainless will perform much better than Aluminum.

Which, again, doesn't matter since neither one will survive entry temperatures if the heat shield is compromised or if the entry is otherwise off-nominal.

[eriblo]

The idea is that when the heat shield is partly compromised, an underlying steel structure will last a lot longer than an underlying aluminum one.

Which is irrelevant if they both fail.

Yes, obviously. I assume the discussion is about the cases where details means one or the other has a larger chance of surviving.

The temperature at the structure will not be that of the outer skin, so the ability to withstand elevated temperatures really matters.

Since the skin is the structure, I don't know what this means.

Not on the side covered in TPS, the glass coating on the TSP is the outer skin with regard to heating.

Similarly if for whatever reason the peak temperature reached is higher than planned, temperatures will rise on the inner side of tge heat shield, and again Stainless will perform much better than Aluminum.

Which, again, doesn't matter since neither one will survive entry temperatures if the heat shield is compromised or if the entry is otherwise off-nominal.

This is the same as saying that reentries are impossible and meteorites do not exist since temperatures during reentry are far above the vaporization temperature of all known materials...

[greybeardengineer]

Similarly if for whatever reason the peak temperature reached is higher than planned, temperatures will rise on the inner side of tge heat shield, and again Stainless will perform much better than Aluminum.

Which, again, doesn't matter since neither one will survive entry temperatures if the heat shield is compromised or if the entry is otherwise off-nominal.

One of the shuttles lost a tile and survived reentry (STS-27) because it happened to be over an antenna mounting plate rather than the normal aluminum skin. The loss of a tile isn't necessarily fatal if the underlying substrate is robust enough. Stainless steel is much better than aluminum in this regards as evidenced by the lack of need for lee side TPS on SS.

[TheRadicalModerate]

We're talking about what to do in an off-nominal entry.  Off-nominal likely means damage (tiles or other) or loss of control.  I suspect in either case the assumption that there's nothing you can do is actually correct.

I still think that the fact that Starship can hold some non-trivial amount of propellant and has working engines during hypersonic flight means that there might be a portion of that regime where an abort back to orbit might be viable.  This is really the first spacecraft with main propulsion capability during reentry.

Off-hand, I'd think that the proper trajectory was pretty much at whatever the steepest viable angle of attack was.  Then, once clear of the atmosphere, you'd burn tangential at apogee until you'd raised your perigee to the necessary altitude.

I doubt this works below a certain speed/altitude, but it would likely work deep enough into reentry that you'd get diagnostics of something going wrong.  But there's a mass penalty, because you need to hang on to more prop than you need to land.

[TheRadicalModerate]

One of the shuttles lost a tile and survived reentry (STS-27) because it happened to be over an antenna mounting plate rather than the normal aluminum skin. The loss of a tile isn't necessarily fatal if the underlying substrate is robust enough. Stainless steel is much better than aluminum in this regards as evidenced by the lack of need for lee side TPS on SS.

Having a stainless structure probably helps somewhat.  That could turn a marginally fatal situation into one that was marginally survivable, which ain't nuthin'.

On the other side, I've been trying to figure out what the implications of a pinned tile with a heat-resistant underblanket are vs. directly-bonded RCC or TUFI.  It seems like a small chip might allow the flow to generate more lift on the chip, making it more prone to snapping off using the pin(s) as a fulcrum.

[TheRadicalModerate]

Just Kerbal it and stick some SRBs in the skirt for pad aborts.

You joke, but there is room for 3 solid rocket boosters on Starship with a burn time of a few seconds.   Instead of adding 3 vacuum raptors, add 3 solid rocket boosters of the same dimensions.

The joke is probably applicable.  First of all, this is a new engine.  SRBs aren't particularly complicated, but still, if you're comparing the amount of work to something like the enshrouded D2 escape system, they're within shouting distance of one another.

Also, this makes the mass-flow problem in the skirt worse.  If you're going to start any engines on the Starship while still mated to the SH, you're going to have to engineer blowout panels at the very least.  But at some point, there's so much mass flow, irrespective of blowout panels, that you're going to destroy the top of the SH LCH4 dome, which will be game over.  Since SRBs derive their thrust from insane amounts of mass flow, they'll make things a lot worse.

A quick note:  The T/W=6 with the most lightly loaded crewed Starship possible to orbit already assumes 9 engines.

[InterestedEngineer]

Just Kerbal it and stick some SRBs in the skirt for pad aborts.

You joke, but there is room for 3 solid rocket boosters on Starship with a burn time of a few seconds.   Instead of adding 3 vacuum raptors, add 3 solid rocket boosters of the same dimensions.

The joke is probably applicable.  First of all, this is a new engine.  SRBs aren't particularly complicated, but still, if you're comparing the amount of work to something like the enshrouded D2 escape system, they're within shouting distance of one another.

Also, this makes the mass-flow problem in the skirt worse.  If you're going to start any engines on the Starship while still mated to the SH, you're going to have to engineer blowout panels at the very least.  But at some point, there's so much mass flow, irrespective of blowout panels, that you're going to destroy the top of the SH LCH4 dome, which will be game over.  Since SRBs derive their thrust from insane amounts of mass flow, they'll make things a lot worse.

A quick note:  The T/W=6 with the most lightly loaded crewed Starship possible to orbit already assumes 9 engines.

If solid rockets don't work then there is no pad abort for a Starship loaded up to 1400t with fuel.  your same arguments apply to having a crew dragon in the cargo compartment.

So if there is no pad abort, and ascent abort works with current design, and there is no ELD abort, I'm flummoxed as to what abort system there needs to be at all.

The above 3 stages of flight are the highest risk stages.

Landing abort is all that's left.   "can't get to catch tower" means water abort, which works with a robust cargo compartment.

Failure to ignite or correctly use engines due to the remaining single points of failure (which is tank pressurization and gimbaling) happens at such a low altitude abort would be difficult.   Blasting a crew dragon horizontally won't be useful, and neither will solid rockets in the base.

I suspect gimbaling can be made redundant barring frozen parts¹, so really we are just left with inadequate pressure in the header tanks as the remaining single point of failure.



(1) There are still single points of failures in commercial airplanes, e.g. the jack screw on the 737 which has killed people