Commercial Crew - Discussion Thread 1

[Brovane]

So what are you saying - remove the densified propellents, change the gse, change the loading procedures all for how many flights per year  - 1/2?

Wouldn't that INCREASE the chance of something bad happens as you now have a configuration you don't regularly fly?

The ability of the F9 and GSE to switch between densified and non-densified is a unknown.  Not sure if anyone has asked SpaceX directly this question.

Can you just switch off the GSE equipment that does the densification and upload different software into the F9 and it can work with non-densified propellant?  Or is the hardware changed in a fundamental way that the F9 can only use densified propellant.

There were reports from a SpaceX employee (on reddit IIRC) that they were tuning the engines differently for densified props. So there would appear to be hardware differences, which makes sense considering that turbopumps are sensitive to changes in density and viscosity.

Even if it's straightforward to make the changes, you're still introducing a new configuration that throws out 50+ flights worth of history and data (by the time crew flies), and you're only flying it twice a year. That increases risk, and there's no way around it.

Just because a Merlin engine is tuned differently doesn't mean there has to be a change in hardware.  The tuning differences could be all software.  Car engines are a great example of how software can change the power output/emissions even the exhaust noise of a engine. 

I am not saying that it is a good idea.  I agree with you that changing the configuration for 1 to 2 launches a year introduces more risk. 

However if NASA still insists on propellant load before the astronauts board.  Can SpaceX simply accommodate them by changing the software configuration and GSE configuration for the crew launches? 

[envy887]

So what are you saying - remove the densified propellents, change the gse, change the loading procedures all for how many flights per year  - 1/2?

Wouldn't that INCREASE the chance of something bad happens as you now have a configuration you don't regularly fly?

The ability of the F9 and GSE to switch between densified and non-densified is a unknown.  Not sure if anyone has asked SpaceX directly this question.

Can you just switch off the GSE equipment that does the densification and upload different software into the F9 and it can work with non-densified propellant?  Or is the hardware changed in a fundamental way that the F9 can only use densified propellant.

There were reports from a SpaceX employee (on reddit IIRC) that they were tuning the engines differently for densified props. So there would appear to be hardware differences, which makes sense considering that turbopumps are sensitive to changes in density and viscosity.

Even if it's straightforward to make the changes, you're still introducing a new configuration that throws out 50+ flights worth of history and data (by the time crew flies), and you're only flying it twice a year. That increases risk, and there's no way around it.

Just because a Merlin engine is tuned differently doesn't mean there has to be a change in hardware.  The tuning differences could be all software.  Car engines are a great example of how software can change the power output/emissions even the exhaust noise of a engine. 

I am not saying that it is a good idea.  I agree with you that changing the configuration for 1 to 2 launches a year introduces more risk. 

However if NASA still insists on propellant load before the astronauts board.  Can SpaceX simply accommodate them by changing the software configuration and GSE configuration for the crew launches?

I'm pretty sure it was changes on each individual engine, so it couldn't be done at the pad, but I can't find the exact quote right now. However, crew are going to fly on new boosters assigned well in advance, like B1051 is already assigned to the first uncrewed test flight. So SpaceX could qualify it specifically for non-subcooled propellant, and create new GSE and operational sequences.

But that would make no sense at all. It only adds risk and cost, and delays the schedule further to do so.

[Jim]

A. Fuel a rocket, then have people working around the fueled rocket installing the crew.

B. Install the crew without fuel in the rocket, turn on the Launch Abort System (LAS) so that it is ready to remove the crew from the rocket if needed, then fuel the rocket in preparation for launch.

To me "B" sounds inherently safer, especially since the LAS is designed to safely transport crew away from a rocket sitting on the launch pad.

As stated before

Risk management involves more than just outcomes or consequence.  The likelihood or probably of problem happening has a equal role.

Problems occurring during active propellant loading are much more likely to occur than during stable replenish.

And no, the LAS is not design to "safely" transport the crew away.  There is no guarantee that there will be 1005 or lack of injury.

[whitelancer64]

I can't find an answer for this, and it seems like an obvious question.

Was the sole reason for not flying crew on D1 the lack of a LAS - or were there other long poles?
Was the risk to crew formally studied officially, or was it just never considered because of the lack of the LAS?
Thanks.

Lack of a LAS, lack of life support systems, less redundancy, no seats, no crew controls, no docking system, etc.

Never considered.

[SWGlassPit]

I can't find an answer for this, and it seems like an obvious question.

Was the sole reason for not flying crew on D1 the lack of a LAS - or were there other long poles?
Was the risk to crew formally studied officially, or was it just never considered because of the lack of the LAS?
Thanks.

Lack of a LAS, lack of life support systems, less redundancy, no seats, no crew controls, no docking system, etc.

Never considered.

It's the spacecraft equivalent of riding down the interstate in the back of a Uhaul truck.  Sure, you might be okay, but you can't bank on that.

[envy887]

A. Fuel a rocket, then have people working around the fueled rocket installing the crew.

B. Install the crew without fuel in the rocket, turn on the Launch Abort System (LAS) so that it is ready to remove the crew from the rocket if needed, then fuel the rocket in preparation for launch.

To me "B" sounds inherently safer, especially since the LAS is designed to safely transport crew away from a rocket sitting on the launch pad.

As stated before

Risk management involves more than just outcomes or consequence.  The likelihood or probably of problem happening has a equal role.

Problems occurring during active propellant loading are much more likely to occur than during stable replenish.

And no, the LAS is not design to "safely" transport the crew away.  There is no guarantee that there will be 1005 or lack of injury.

What probability of failure and/or injury is the LAS designed to meet? 10%? 1%? 0.1%?

Also, injury is not the same as death. A risk analysis will combine both the probability of occurrence and the severity of the harm to determine the total overall risk.

A 10% chance of a harm that only results in injury may be more acceptable than a 0.1% chance of harm that results in death, depending on how the severity is weighted in the analysis.

[su27k]

So what else can SpaceX do to convince NASA that their launches are adequately safe?

How about just keep doing what they're doing right now: keep the steamroller going and avoid RUD. If they keep the current launch rate, by the time they launch crew for the first time they would have completed ~100 tanking operations post AMOS-6, and by the time they start flying post certification mission it would be close to 140, similar to the # of successful Soyuz missions. I think this together with their LoC calculation should be enough to convince NASA the procedure is safe.

[envy887]

So what else can SpaceX do to convince NASA that their launches are adequately safe?

How about just keep doing what they're doing right now: keep the steamroller going and avoid RUD. If they keep the current launch rate, by the time they launch crew for the first time they would have completed ~100 tanking operations post AMOS-6, and by the time they start flying post certification mission it would be close to 140, similar to the # of successful Soyuz missions. I think this together with their LoC calculation should be enough to convince NASA the procedure is safe.

They also do a lot of tankings at McGregor: all the qualification testing and all the flight acceptance testing requires tanking each stage. They will probably have completed over 200 propellant load sequences post-AMOS before a crew ever flies.

[leetdan]

An article from the Washington Post about NASA's reluctance to allow SpaceX to fuel F9 with astros aboard:

https://www.washingtonpost.com/business/economy/elon-musks-space-x-is-using-a-powerful-rocket-technology-nasa-advisers-say-it-could-put-lives-at-risk/2018/05/05/f810b182-3cec-11e8-a7d1-e4efec6389f0_story.html?utm_term=.7b6961856010

The only thing new or noteworthy in this article is a quote from a competing contract manager.  How is this anything but a hit piece?

[Ike17055]

I think we all understand that doing it the SpaceX proposed way does increase risk for the astronauts.

Do we? I don't. Let's compare some scenarios, shall we:

1) Board astronauts
2) Start fuelling
3) Something goes wrong with fuelling, leads to RUD
4) LAS activates, giving crew a very decent chance of survival (pad crew is miles away in safety already)

Or an alternative scenario:

1) Fuel
2) Start boarding astronauts
3) Rocket undergoes RUD during boarding
4) Both astronauts and pad crew have zero chance of survival.

Unless you assume the chance of killing the crew in a LAS abort is bigger than the chance of killing them during a incident while boarding on top of a fuelled vehicle, or can give a 100% guarantee nothing can go wrong with a fuelled vehicle, boarding first seems to me to always be the better option. Bottom line: crew on board during fuelling: abort option available during entire fuelling process. Crew boarding after fuelling: significant period without any abort option. On balance, fuelling after boarding likely less risky for astronauts, infinitely less risky for pad crew.

this and other posts make a huge mistake in establishing equivalency of the two scenarios. Besides the ease with which assumptions about safety are thrown around, the fact remains that current practice does have a 50 year process history of successful practice. The "new way" has zero experience (WITH CREW). While no one says that all things must remain unchanged forever, or that there is only one way to do things, the risks in allowing a change of this magnitude cannot be wished away or dismissed simply because the abort system is available. An abort has a high likleihood of resulting in serious injury or even death of crew. There is no "easy" ejection, and no "easy" abort.  Employing the LAS is not just an alternative way of deboarding the craft. It brings its own (substantial) risks.

[Ike17055]

I think we all understand that doing it the SpaceX proposed way does increase risk for the astronauts.

Do we? I don't. Let's compare some scenarios, shall we:

Do.  Don't.  Uncertain.

 Since Amos-6 (where SpaceX are now the premier COPV experts on the planet due to their investigation), have F9's and FH's experienced problems? Have they been blowing up? Have they had any tanking issues?

Unfortunately, this appears to be the same as the assertion that after three shuttle flights, the orbiter could be certified as "operational" simply because they hadn't "been blowing up." Or that since the first few O-ring burnthroughs or foam strikes didn't result in disaster, that it should not be a concern. 

[Ike17055]

If we were to formally depend on the LAS as our priMARY insurance policy against disaster from PAD incident, rather than risk mitigation, then NASA would likely require, probably justifiably, 6 or 8 or 10 pad abort tests prior to operational use.

No. NASA required NO pad abort tests for CCP. In fact, both CCP providers (SpaceX and Boeing) voluntarily offered to perform pad abort tests to validate the required pad abort MODELS.
The in-flight abort test that SpaceX will be performing is voluntary in nature as well.

...reduced interest in pad testing initially Because NASA assumed that the historic practice of "fuel-then astronauts" would remain in place. If we change this equation now to "count on LAS to provide our 'protection' against fire/explosion" suddenly, the need for more scrutiny and confidence in LAS becomes acute. Thus, a more robust testing regimen.
 

[joek]

this and other posts make a huge mistake in establishing equivalency of the two scenarios. Besides the ease with which assumptions about safety are thrown around, the fact remains that current practice does have a 50 year process history of successful practice. ...

OTOH, I would argue that the limited number of data points for that "50 year process history of successful practice" make the precedent dubious.  Given the limited number of data points, I challenge any conclusions.  I would also challenge "successful" in this context, given the loss of life based on that "successful practice".

[Ike17055]

A. Fuel a rocket, then have people working around the fueled rocket installing the crew.

B. Install the crew without fuel in the rocket, turn on the Launch Abort System (LAS) so that it is ready to remove the crew from the rocket if needed, then fuel the rocket in preparation for launch.

To me "B" sounds inherently safer, especially since the LAS is designed to safely transport crew away from a rocket sitting on the launch pad.

As stated before

Risk management involves more than just outcomes or consequence.  The likelihood or probably of problem happening has a equal role.

Problems occurring during active propellant loading are much more likely to occur than during stable replenish.

And no, the LAS is not design to "safely" transport the crew away.  There is no guarantee that there will be 1005 or lack of injury.

What probability of failure and/or injury is the LAS designed to meet? 10%? 1%? 0.1%?

Also, injury is not the same as death. A risk analysis will combine both the probability of occurrence and the severity of the harm to determine the total overall risk.

A 10% chance of a harm that only results in injury may be more acceptable than a 0.1% chance of harm that results in death, depending on how the severity is weighted in the analysis.

It's a crapshoot, more than not. every abort scenario would be different potentially. there is no way I am aware of to reliably model this, and thus my earlier comment that a steady regimen of pad abort tests would be needed, similar to the series of parachute tests done for all vehicles.  if you will rely on it often, you need to test in numerous potential scenarios.

[envy887]

I think we all understand that doing it the SpaceX proposed way does increase risk for the astronauts.

Do we? I don't. Let's compare some scenarios, shall we:

1) Board astronauts
2) Start fuelling
3) Something goes wrong with fuelling, leads to RUD
4) LAS activates, giving crew a very decent chance of survival (pad crew is miles away in safety already)

Or an alternative scenario:

1) Fuel
2) Start boarding astronauts
3) Rocket undergoes RUD during boarding
4) Both astronauts and pad crew have zero chance of survival.

Unless you assume the chance of killing the crew in a LAS abort is bigger than the chance of killing them during a incident while boarding on top of a fuelled vehicle, or can give a 100% guarantee nothing can go wrong with a fuelled vehicle, boarding first seems to me to always be the better option. Bottom line: crew on board during fuelling: abort option available during entire fuelling process. Crew boarding after fuelling: significant period without any abort option. On balance, fuelling after boarding likely less risky for astronauts, infinitely less risky for pad crew.

this and other posts make a huge mistake in establishing equivalency of the two scenarios. Besides the ease with which assumptions about safety are thrown around, the fact remains that current practice does have a 50 year process history of successful practice. The "new way" has zero experience. While no one says that all things must remain unchanged forever, or that there is only one way to do things, the risks in allowing a change of this magnitude cannot be wished away or dismissed simply because the abort system is available. An abort has a high likleihood of resulting in serious injury or even death of crew. There is no "easy" ejection, and no "easy" abort.  Employing the LAS is not just an alternative way of deboarding the craft. It brings its own (substantial) risks.

If NASA had boarded all those crews first, the record would be the same. That's basically just another way of saying "we've always done it this way", which is not a valid justification for anything.

[joek]

...reduced interest in pad testing initially Because NASA assumed that the historic practice of "fuel-then astronauts" would remain in place. If we change this equation now to "count on LAS to provide our 'protection' against fire/explosion" suddenly, the need for more scrutiny and confidence in LAS becomes acute. Thus, a more robust testing regimen.

Or maybe just more scrutiny-confidence-assurance for the fueling phase.  Or do you think it is impossible to provide more assurance for fueling than the LAS?  If not, why not?

[mme]

this and other posts make a huge mistake in establishing equivalency of the two scenarios. Besides the ease with which assumptions about safety are thrown around, the fact remains that current practice does have a 50 year process history of successful practice. ...

OTOH, I would argue that the limited number of data points for that "50 year process history of successful practice" make the precedent dubious.  Given the limited number of data points, I challenge any conclusions.  I would also challenge "successful" in this context, given the loss of life based on that "successful practice".

You go with the data you have and add error bars. SX did a pretty good job of proving that loading fuel can be dangerous. I believe they fixed it but it's seems OK to require SX prove it to NASA beyond a reasonable doubt.

What loss of life occurred based on the current practice of boarding after fueling? Certainly not Apollo 1,  STS-51-L nor STS-107.

[Ike17055]

...reduced interest in pad testing initially Because NASA assumed that the historic practice of "fuel-then astronauts" would remain in place. If we change this equation now to "count on LAS to provide our 'protection' against fire/explosion" suddenly, the need for more scrutiny and confidence in LAS becomes acute. Thus, a more robust testing regimen.

Or maybe just more scrutiny-confidence-assurance for the fueling phase.  Or do you think it is impossible to provide more assurance for fueling than the LAS?  If not, why not?

if I am planning to jump out of an airplane, I will be more concerned about checking how my chute is packed, rather than whether the ground crew remembered to put gas in the plane. One has a lot more appropriateness to the question at hand.  If everyone who supports new fueling wants to cite reliance on the LAS as their guaranteed safety net, then we better spend a lot more effort on testing the safety net.

[jak Kennedy]

envy887 pretty much hit the nail on the head. And I still don’t understand that if NASA has a problem with loading with crew onboard how they can justify fuel transfers in space. I know they are not the same but there is minimal historic data and it doesn’t appear to be a problem.

[Ike17055]

If NASA had boarded all those crews first, the record would be the same. That's basically just another way of saying "we've always done it this way", which is not a valid justification for anything.
[/quote]

uh, no, it really isn't saying that at all... there is a middle ground. continue testing densified fuels on uncrewed.

"fools rush in where angels fear to tread"