Starship failure/abort modes

[steveleach]

What is Elon's plan for an LAS for Starship?

Elon's plan is that starship IS the Launch abort system.

For the moonship, in theory the waist engines provide an independant  propulsion system that could be used for abort, but the system would be difficult to implement in any starship with a heat shield.

There have been a few threads that covered abort scenarios, but I haven't really seen any kind of structured discussion on what the current Starship design would do in various scenarios, so I thought I'd see if I can get that started.

Scenario	Prevention	Mitigation
===================	====================	====================
Pad abort	?	Release Starship & fire all 6 Raptors while dumping fuel; FTS on SH LOV/LOC
Max Q abort	Engine redundancy	Release Starship & fire all 6 Raptors while dumping fuel; SH FTS
Stage separation failure	Mechanical separation	Backup explosive separation mechanism
Starship ignition failure	Engine redundancy	Dump fuel and land
Fail to reach orbit	Engine redundancy	Dump fuel and land
De-orbit burn failure	Engine redundancy	Await orbital rescue
Hypersonic TPS failure	Small tiles, steel hull, inspect	None - LOV/LOC
Hypersonic control failure	Actuator redundancy	None - LOV/LOC
Subsonic control failure	Actuator redundancy	Passive stability?
Landing flip failure	Engine redundancy	Crew survival structures
Landing burn failure	Engine redundancy	Crew survival structures, vac raps
Landing leg failure	Leg redundancy	Crew survival structures

I haven't mentioned "huge amounts of testing" under "prevention" for any of this, as I'm taking that as a given.

For the purpose of this thread I'm talking about what the current design (to the best of our understanding) could/would do, and specifically want to avoid discussions of how a modified design would do it. I'm also going to focus on getting to and returning from Earth orbit. There are other threads for wider discussion.

Starship Safety Factors thread: https://forum.nasaspaceflight.com/index.php?topic=52559.0
Starship Launch Escape thread: https://forum.nasaspaceflight.com/index.php?topic=43438.140
Crash Survivability thread: https://forum.nasaspaceflight.com/index.php?topic=52537.80
Starship Safety thread: https://forum.nasaspaceflight.com/index.php?topic=52216.0

[Edit: remove pad abort as Starship T/W < 1]

[Jim]

the Starship has autonomous FTS.  There is nobody with a finger on a switch.   What are the abort parameters?
 What says the second stage has T/W>1 to do a pad abort?

What is so special about a max abort vs the rest of the booster ascent?

SpaceX isn't going to have anything explosive for backup systems.

[mikelepage]

I can't speak to the launch abort scenarios, (although I find it hard to see how any failures up until after stage separation would be survivable), but on re-entry it seems prudent to have some parachutes available for crew if there was any doubt about the functionality of the raptors on landing. Coming out of a leeward hatch once subsonic would certainly be a less risky bailout maneuver than jumping out a side hatch on shuttle, and since landing is automated you wouldn't be sacrificing the ship either.

[quasarquantum]

What says the second stage has T/W>1 to do a pad abort?

With 6 Raptor engines the T/W is a little below 1 for a fully fueled SS. Is it feasible to fuel it to say 50%, so it gets to LEO, and to enable a higher T/W?
Not sure if that would help with a SH exploding underneath, but thats the only option I see right now to improve chances.

[rakaydos]

Hypersonic TPS failure

Small tiles, steel hull

None - LOV/LOC

Hypersonic partial TPS failure mitigation involves the Hot Structure's saftey margin, wherein the hull under the TPS breach gets hot enough to annul the properties that make the mix of stainless so good as a booster, compromising it as a launch vehical, but not actually "melting steel" hot, and remaining structurally capable of landing.

See also that one shuttle who had a debris strike right on a steel antenna mount and survived reentry.

[steveleach]

What says the second stage has T/W>1 to do a pad abort?

With 6 Raptor engines the T/W is a little below 1 for a fully fueled SS. Is it feasible to fuel it to say 50%, so it gets to LEO, and to enable a higher T/W?
Not sure if that would help with a SH exploding underneath, but thats the only option I see right now to improve chances.

So under-fuel the Starship when launching crew so that it can (slowly) abort if necessary?

If there's a detonation in SH then presumably Starship is toast, but if its just a big messy conflagration then some chance is better than none, right?

[steveleach]

Hypersonic TPS failure

Small tiles, steel hull

None - LOV/LOC

Hypersonic partial TPS failure mitigation involves the Hot Structure's saftey margin, wherein the hull under the TPS breach gets hot enough to annul the properties that make the mix of stainless so good as a booster, compromising it as a launch vehical, but not actually "melting steel" hot, and remaining structurally capable of landing.

See also that one shuttle who had a debris strike right on a steel antenna mount and survived reentry.

Yeah, I was struggling with definitions of prevention/mitigation on this one. In the end I decided to go with defining those things as "prevention" (they can prevent the loss of a tile becoming a bigger problem), but leaving "no mitigation" to make it clear that there are scenarios here for which survival is simply not possible.

[steveleach]

the Starship has autonomous FTS.  There is nobody with a finger on a switch.   What are the abort parameters?

I wasn't suggesting it should be manual.

What says the second stage has T/W>1 to do a pad abort?

I replied to a reply on this one, but went for the strikethrough on the OP.

What is so special about a max abort vs the rest of the booster ascent?

Nothing particularly, it's just a simplification. If there's a better way of structuring the table, let me know.

SpaceX isn't going to have anything explosive for backup systems.

Do we know that? We know they have explosive FTS on the prototypes.

What other options do launch vehicles use to ensure that stage separation always occurs?

[Jim]

Do we know that? We know they have explosive FTS on the prototypes.

SpaceX abhors ordnance devices.  They can't get around two places:  A.  FTS and it is not their call   B.  NSI for commercial payload separation systems.  They used the industry standard but not for their own payloads (Starlink and Dragon)

What other options do launch vehicles use to ensure that stage separation always occurs?

Testing and not redundancy (except for redundant initiators).
 

[steveleach]

Do we know that? We know they have explosive FTS on the prototypes.

SpaceX abhors ordnance devices.  They can't get around two places:  A.  FTS and it is not their call   B.  NSI for commercial payload separation systems.  They used the industry standard but not for their own payloads (Starlink and Dragon)

What other options do launch vehicles use to ensure that stage separation always occurs?

Testing and not redundancy (except for redundant initiators).

But explosive bolts are also commonly used on launch vehicles, right? Falcon 1 had those I believe. And Dragon 2 replaced those valves with burst disks.

I know F9 uses a mechanical system as primary, but I'd always assumed that there was a backup explosive system. I guess stage sep failure is covered by the Dragon 2 abort options there.

Anyway, your view is that SpaceX will rely purely on prevention for this, yes?

Would stage attachment devices fail open or closed?

[Jim]

But explosive bolts are also commonly used on launch vehicles, right?

Not for years.  Frangible nuts or linear shaped charges.

[_MECO]

But explosive bolts are also commonly used on launch vehicles, right?

Not for years.  Frangible nuts or linear shaped charges.

What's the practical difference between an explosive bolt versus a linear shaped charge, anyway? Either way you're using detasheet or PBX plugs or whatever to permanently sever some structural connection. The only real difference is that one is for allowing stages to separate while the other is used for unzipping propellant tanks. The practical considerations of both is the long-term storage of explosive compounds.

What is Elon's plan for an LAS for Starship?

Elon's plan is that starship IS the Launch abort system.

For the moonship, in theory the waist engines provide an independant  propulsion system that could be used for abort, but the system would be difficult to implement in any starship with a heat shield.

There have been a few threads that covered abort scenarios, but I haven't really seen any kind of structured discussion on what the current Starship design would do in various scenarios, so I thought I'd see if I can get that started.

Scenario	Prevention	Mitigation
===================	==================	====================
Pad abort	?	Release Starship & fire all 6 Raptors while dumping fuel; FTS on SH LOV/LOC
Max Q abort	Engine redundancy	Release Starship & fire all 6 Raptors while dumping fuel; SH FTS
Stage separation failure	Mechanical separation	Backup explosive separation mechanism
Starship ignition failure	Engine redundancy	Dump fuel and land
Fail to reach orbit	Engine redundancy	Dump fuel and land
De-orbit burn failure	Engine redundancy	Await orbital rescue
Hypersonic TPS failure	Small tiles, steel hull	None - LOV/LOC
Hypersonic control failure	Actuator redundancy	None - LOV/LOC
Subsonic control failure	Actuator redundancy	Passive stability?
Landing flip failure	Engine redundancy	Crew survival structures
Landing burn failure	Engine redundancy	Crew survival structures
Landing leg failure	Leg redundancy	Crew survival structures

I haven't mentioned "huge amounts of testing" under "prevention" for any of this, as I'm taking that as a given.

For the purpose of this thread I'm talking about what the current design (to the best of our understanding) could/would do, and specifically want to avoid discussions of how a modified design would do it. I'm also going to focus on getting to and returning from Earth orbit. There are other threads for wider discussion.

Starship Safety Factors thread: https://forum.nasaspaceflight.com/index.php?topic=52559.0
Starship Launch Escape thread: https://forum.nasaspaceflight.com/index.php?topic=43438.140
Crash Survivability thread: https://forum.nasaspaceflight.com/index.php?topic=52537.80
Starship Safety thread: https://forum.nasaspaceflight.com/index.php?topic=52216.0

[Edit: remove pad abort as Starship T/W < 1]

I've got one. TPS damage on ascent. You should be able to inspect the belly of your own vehicle once parked in orbit before you perform a reentry burn. It would really suck if a crew lost their lives just because they had no EVA capability and therefore could not get out of the vehicle and snap new heat shield tiles in place. That's one of the huge advantages of mechanical TPS mounting.

[sebk]

I can't speak to the launch abort scenarios, (although I find it hard to see how any failures up until after stage separation would be survivable), but on re-entry it seems prudent to have some parachutes available for crew if there was any doubt about the functionality of the raptors on landing. Coming out of a leeward hatch once subsonic would certainly be a less risky bailout maneuver than jumping out a side hatch on shuttle, and since landing is automated you wouldn't be sacrificing the ship either.

Launch abort by separation from SH should work after ~10s of flight. After 10s of ~0.5g acceleration there's enough forward momentum to allow 2nd stage to keep flying long enough to burn excess fuel. You start at about 0.8TWR so if you kept at that you'd only came to a halt after 25s. But your TWR is improving all the time. After 25s your TWR is approaching 0.9 and you didn't come to a halt yet. You'd start losing altitude eventually, but after a minute you'd reach TWR = 1 and you'd slow down your descent.

[punder]

I've got one. TPS damage on ascent. You should be able to inspect the belly of your own vehicle once parked in orbit before you perform a reentry burn. It would really suck if a crew lost their lives just because they had no EVA capability and therefore could not get out of the vehicle and snap new heat shield tiles in place. That's one of the huge advantages of mechanical TPS mounting.

I think SpaceX should develop a little cold-gas camera drone that can be deployed and retrieved in orbit. Not only could it perform inspections, but it could provide some spectacular video. 

[Jim]

What's the practical difference between an explosive bolt versus a linear shaped charge, anyway? Either way you're using detasheet or PBX plugs or whatever to permanently sever some structural connection. The only real difference is that one is for allowing stages to separate while the other is used for unzipping propellant tanks. The practical considerations of both is the long-term storage of explosive compounds.

linear shaped charges were used for staging and not just for destruct.   explosive bolts were hardly (to never) used for staging.  Frangible nuts aren't until an NSI is installed.

[_MECO]

I've got one. TPS damage on ascent. You should be able to inspect the belly of your own vehicle once parked in orbit before you perform a reentry burn. It would really suck if a crew lost their lives just because they had no EVA capability and therefore could not get out of the vehicle and snap new heat shield tiles in place. That's one of the huge advantages of mechanical TPS mounting.

I think SpaceX should develop a little cold-gas camera drone that can be deployed and retrieved in orbit. Not only could it perform inspections, but it could provide some spectacular video. 

What I wouldn't give for third person 4K video of a Starship performing a TLI or TMI burn... do you think they would be okay with leaving one of those drones behind?

What's the practical difference between an explosive bolt versus a linear shaped charge, anyway? Either way you're using detasheet or PBX plugs or whatever to permanently sever some structural connection. The only real difference is that one is for allowing stages to separate while the other is used for unzipping propellant tanks. The practical considerations of both is the long-term storage of explosive compounds.

linear shaped charges were used for staging and not just for destruct.   explosive bolts were hardly (to never) used for staging.  Frangible nuts aren't until an NSI is installed.

I still don't see why any of the above wouldn't be handy to have as a backup system. Ideally over the service life of a single booster or Starship they would never have to be fired in the first place. Pyrotechnics can be extremely reliable. If I remember correctly, Perseverance and Curiosity both used pyrotechnically propelled mechanisms to cut their sky crane cables.

[Jim]

I still don't see why any of the above wouldn't be handy to have as a backup system. Ideally over the service life of a single booster or Starship they would never have to be fired in the first place. Pyrotechnics can be extremely reliable. If I remember correctly, Perseverance and Curiosity both used pyrotechnically propelled mechanisms to cut their sky crane cables.

Not SpaceX's MO to use ordnance and there never had been backup systems for stage separation.

[oiorionsbelt]

I think SpaceX should develop a little cold-gas camera drone that can be deployed and retrieved in orbit. Not only could it perform inspections, but it could provide some spectacular video. 

The ISS has these, albeit inside.
https://www.roboticsbusinessreview.com/content-from-our-sponsor/how-a-free-flying-camera-robot-supports-astronauts-on-the-iss/

[punder]

I think SpaceX should develop a little cold-gas camera drone that can be deployed and retrieved in orbit. Not only could it perform inspections, but it could provide some spectacular video. 

The ISS has these, albeit inside.
https://www.roboticsbusinessreview.com/content-from-our-sponsor/how-a-free-flying-camera-robot-supports-astronauts-on-the-iss/

Exactly. Seems like an external one could be very useful.

[punder]

What I wouldn't give for third person 4K video of a Starship performing a TLI or TMI burn... do you think they would be okay with leaving one of those drones behind?

Pick it up on the next launch. 

Just to tie back in to the point of this thread... the drone could inspect TPS, the engine bay, elonerons... anything that might need looking at. Suspected damage, mechanisms that aren’t behaving properly.