SpaceX F9 : Crew Dragon In-Flight Abort Test : Jan. 19, 2020 : Discussion

[soltasto]

You can also watch the webcast, it was clearly visible there:
https://youtube.com/watch?v=mhrkdHshb3E&t=1078

Edit (mod): Fixed a youtube embed error.

[hpras]

Elon... please take us out of our misery....  it moved..

[TheRadicalModerate]

This sorta-kinda reconciles the two conflicting pieces of information:  Yes, this will definitely be a "loss of thrust" trigger, but in reality it's just reconfiguring the thrust criterion to a ridiculous number once your target speed is hit.

Here's a paragraph from a Spaceflight Now article on how they did this:

The Crew Dragon began its launch escape maneuver at 10:31:25 a.m. EST (1531:25 GMT) — initiated by a low setting of an on-board acceleration trigger — when the Falcon 9 was traveling at a velocity around 1,200 mph (536 meters per second), according to SpaceX.

Eight SuperDraco thrusters immediately pressurized and ignited as the Falcon 9 rocket’s first stage engines were commanded to shut down as part of the abort sequence.

So:  No, they didn't initiate an engine shutdown to trigger the abort, and no, they didn't patch the mission rules.  Instead, they simply overwrote (or otherwise twiddled) the acceleration reading.  But the abort system shut the F9 engines down, not the test harness.

[clongton]

So:  No, they didn't initiate an engine shutdown to trigger the abort, and no, they didn't patch the mission rules.  Instead, they simply overwrote (or otherwise twiddled) the acceleration reading.  But the abort system shut the F9 engines down, not the test harness.

Emphasis mine: So I guess you are saying that Doug misled everyone when he said the trigger was "loss of thrust".

Once again.
SpaceX had chosen "loss of thrust" to be the trigger that would then cause the abort event.
Dragon's abort sequencer had been de-tuned to a very low level so it would react as soon as thrust began to drop. Otherwise it would simply recognize the loss of an engine, which the F9 is designed to still be able to fly with, and not abort the spacecraft.
 
First the flight avionics - located in the F9 Upper Stage (not in the Dragon) commanded the Merlin engine shutdown at a predetermined altitude/velocity/AOA. The F9 obeyed its own flight avionics command and shut down its own engines - unaided in any way, shape or form by Dragon or Dragon's abort sequencer.
THEN (milliseconds later) the abort sequencer - located inside the Dragon (not on the F9) - sensed the resulting loss of thrust and executed the abort sequence in reaction to that condition - completely by itself. It did not shut down the Merlin engines. It was the loss of thrust resulting from the F9 shutting down it's own engines which created the condition that the Dragon abort sequencer then sensed and recognized as a Get-Out-of-Dodge condition.

The ONLY way to actually test Dragon's ability at the system level (which this test was) to react to an already existing anomaly and execute an abort is for the Dragon itself to sense the anomaly, created by some condition over which it had no control, and execute the abort to save itself. Any other means of initiating the abort does not test Dragon's system level abort capability, which this flight did.

Dragon did not shut down the Merlin engines. It is CRITICAL to understand that. Dragon had to CORRECTLY REACT to the condition (loss of thrust) ON ITS OWN, not create the condition to which it needed to independently react.

[quagmire]

So:  No, they didn't initiate an engine shutdown to trigger the abort, and no, they didn't patch the mission rules.  Instead, they simply overwrote (or otherwise twiddled) the acceleration reading.  But the abort system shut the F9 engines down, not the test harness.

Emphasis mine: So I guess you are saying that Doug misled everyone when he said the trigger was "loss of thrust".

Once again.
SpaceX had chosen "loss of thrust" to be the trigger that would then cause the abort event.
Dragon's abort sequencer had been de-tuned to a very low level so it would react as soon as thrust began to drop. Otherwise it would simply recognize the loss of an engine, which the F9 is designed to still be able to fly with, and not abort the spacecraft.
 
First the flight avionics - located in the F9 Upper Stage (not in the Dragon) commanded the Merlin engine shutdown at a predetermined altitude/velocity/AOA. The F9 obeyed its own flight avionics command and shut down its own engines - unaided in any way, shape or form by Dragon or Dragon's abort sequencer.
THEN (milliseconds later) the abort sequencer - located inside the Dragon (not on the F9) - sensed the resulting loss of thrust and executed the abort sequence in reaction to that condition - completely by itself. It did not shut down the Merlin engines. It was the loss of thrust resulting from the F9 shutting down it's own engines which created the condition that the Dragon abort sequencer then sensed and recognized as a Get-Out-of-Dodge condition.

The ONLY way to actually test Dragon's ability at the system level (which this test was) to react to an already existing anomaly and execute an abort is for the Dragon itself to sense the anomaly, created by some condition over which it had no control, and execute the abort to save itself. Any other means of initiating the abort does not test Dragon's system level abort capability, which this flight did.

Dragon did not shut down the Merlin engines. It is CRITICAL to understand that. Dragon had to CORRECTLY REACT to the condition (loss of thrust) ON ITS OWN, not create the condition to which it needed to independently react.

Are we assuming loss of thrust being engine shutdown? “Loss of thrust” could simply be an ever so slight throttling of the engines or engine and Dragon was programmed to say that amount of thrust loss was unacceptable and trigger the abort sequence which is to also send a signal for engine shut down?

[clongton]

Are we assuming loss of thrust being engine shutdown? “Loss of thrust” could simply be an ever so slight throttling of the engines or engine and Dragon was programmed to say that amount of thrust loss was unacceptable and trigger the abort sequence which is to also send a signal for engine shut down?

SpaceX had chosen "loss of thrust" to be the trigger that would then cause the abort event. Dragon's abort sequencer had been de-tuned to a very low level so it would react as soon as thrust began to drop. Otherwise it would simply recognize the loss of an engine, which the F9 is designed to still be able to fly with, and not abort the spacecraft.

For THIS test only, yes and no. Dragon did not send a shutdown command. The F9 shut itself down at the predetermined altitude/velocity/AOA. Note what I highlighted above.
F9 is designed to continue its mission with the loss of an engine, and even 2 if it went out further up the trajectory. Dragon would normally ignore that amount of loss of thrust, until it dropped below a specified threshold. In this case, SpaceX engineers de-tuned the abort sequencer so that even a slight loss of thrust would trigger the abort. SpaceX had no intention for the vehicle to continue up and wanted to make sure that once the engines were shut down, the drop in thrust would almost immediately go beyond the sequencer's de-tuned threshold and trigger the abort. If it worked they way they hoped it would, that would validate the loss of thrust threshold trigger, at any level specified in the sequencer. It worked, as we all saw. Dragon sensed the minute loss of thrust. Under normal flight regimes Dragon would have ignored it until the loss of thrust went further and passed the normal threshold. But - for this test only - the sequencer was de-tuned to abort as soon as it sensed any loss of thrust, which happened as soon as the engines were commanded to shut down by the flight avionics in the F9 upper stage.

[TheRadicalModerate]

Emphasis mine: So I guess you are saying that Doug misled everyone when he said the trigger was "loss of thrust".

No, I think Doug probably simplified things for his audience.  The trigger was "loss of thrust", but the loss was simulated by marking the acceleration low.

I'd also note that we have multiple sources, including Musk in the press conference, that have said that the abort sequence shuts the engines down--which makes perfect sense.  You seem to be putting an awful lot of stock in something that Hurley said in an off-the-cuff remark to a gaggle of reporters.  Is that what you're basing this on, or do you have other sources?

Once again.
SpaceX had chosen "loss of thrust" to be the trigger that would then cause the abort event.
Dragon's abort sequencer had been de-tuned to a very low level so it would react as soon as thrust began to drop. Otherwise it would simply recognize the loss of an engine, which the F9 is designed to still be able to fly with, and not abort the spacecraft.

De-tuned to what low level?  And on what parameter?  Thrust?  Or acceleration, as numerous sources have claimed?  It's pretty clear that the abort sequence was initiated well before thrust was at an extremely low level, but I'd be surprised if it wasn't still above 50% of max at initiation.

First the flight avionics - located in the F9 Upper Stage (not in the Dragon) commanded the Merlin engine shutdown at a predetermined altitude/velocity/AOA. The F9 obeyed its own flight avionics command and shut down its own engines - unaided in any way, shape or form by Dragon or Dragon's abort sequencer.
THEN (milliseconds later) the abort sequencer - located inside the Dragon (not on the F9) - sensed the resulting loss of thrust and executed the abort sequence in reaction to that condition - completely by itself. It did not shut down the Merlin engines. It was the loss of thrust resulting from the F9 shutting down it's own engines which created the condition that the Dragon abort sequencer then sensed and recognized as a Get-Out-of-Dodge condition.

I'm prepared to believe that the low acceleration value was poked on the F9 side instead of the Dragon side but, as I'll argue below, I don't think a real loss of thrust is the best condition under which to test launch escape.

The ONLY way to actually test Dragon's ability at the system level (which this test was) to react to an already existing anomaly and execute an abort is for the Dragon itself to sense the anomaly, created by some condition over which it had no control, and execute the abort to save itself. Any other means of initiating the abort does not test Dragon's system level abort capability, which this flight did.

Dragon did not shut down the Merlin engines. It is CRITICAL to understand that. Dragon had to CORRECTLY REACT to the condition (loss of thrust) ON ITS OWN, not create the condition to which it needed to independently react.

Let's think about this for a minute.  There are lots of criteria that will trigger an abort sequence.  Off the top of my head:

1) Loss of structural integrity (aka explosions and breakups).
2) Loss of pressure in propellant tanks.
3) Overpressure in propellant tank, a la CRS-7 helium tank failure.
4) High angle of attack, either in pitch or yaw.
5) Deviation from trajectory.
6) GN&C failure
7) Avionics crashes.
8) Loss of thrust.

Now, you obviously can't do an end-to-end test of all of these and frankly, I don't think that any particular one gives you a better end-to-end validation of the system.  However, you don't want to test one of the ones where abort has a low probability of success, because that's likely to result in a test failure, where you don't get good data about the  cases where abort is likely to succeed as long as it's working near, but still within, the envelope of expected success. 

That implies a case where the abort is triggered at full acceleration.  And that in turn implies that you don't want to actually trigger a loss of thrust before the sequence begins.

However, simulating a loss of thrust by poking a low value into the acceleration system is simple, doesn't require risking the test on the more extreme failure modes, and is guaranteed to initiate the abort while the F9 is still at max acceleration, proving that the sweet spot in launch escape works properly.

Again, I'm confused about what you're citing as sources (other than Hurley) and what you're asserting here.  I'm using Musk and the Spaceflight Now article as my sources.

[TheRadicalModerate]

For THIS test only, yes and no. Dragon did not send a shutdown command. The F9 shut itself down at the predetermined altitude/velocity/AOA. Note what I highlighted above.
F9 is designed to continue its mission with the loss of an engine, and even 2 if it went out further up the trajectory. Dragon would normally ignore that amount of loss of thrust, until it dropped below a specified threshold. In this case, SpaceX engineers de-tuned the abort sequencer so that even a slight loss of thrust would trigger the abort...

One other thing here:  If you're asserting that the Dragon abort system was de-tuned, then you're contradicting yourself, because this guarantees that the Dragon production code isn't actually handling the abort, which pretty much invalidates your "end-to-end" argument.

If you're willing to de-tune it, then there's a much simpler way of doing it:  simply insert a criterion that the abort occurs at nominal F9 acceleration for the proper MET and dynamic pressure.  Then you don't need to monkey with the F9 avionics at all, and the only change in the D2 code is one dummy abort criterion.

[CorvusCorax]

you could look at it this way.

1. If Dragon aborts for whatever reason (could be manually triggered by astronauts, upper stage issue, propellant leak, ...) you want the F9 engines to shut down to maximize separation

2. On the other hand, F9 loss of thrust is one of many triggers for an abort sequence

both of those you would want to test before manned flight to make sure they work

Best way to test 1:
trigger an abort in a real flight test, see if F9 engines shut down correctly
Best way to test 2:
run the abort system ins "disarmed" mode - as it did in DM-1 - and monitor the triggers during flight - then you can see during the entire flight if thrust levels were measured correctly - from slight loss of thrust (throttle down around Max-Q) to complete loss of thrust (during stage separation)

it would make relatively little sense to trigger a complete loss of thrust before Dragon aborts, because that deprives you of the one chance to see if Dragon can *order* an engine shutdown as part of its abort sequence - this is a relatively complicated thing since it involves inter-vehicle communication AND needs to be timed right (there is no comm channel after Dragon detached itself physically) and the only way you can test that in flight conditions IS an in-flight abort.
the other way around you can test on more or less every single flight (during regimes where the trigger is told not to respond, such as stage sep, before vehicle release on the pad, etc...)

[clongton]

...

You really seem to be assuming that Musk wasn't being straightforward when he specifically stated that the abort sequencer had been de-tuned to a very low level to ensure that it would detect the loss of thrust right away. You also seem to be assuming that there are better ways to test the abort system so it must have been one of them instead of the one that they actually flew. And my sources are the statements by Doug and Musk. And Musk did not say the Dragon commanded the engines to shut down. He said the engines would be shut down and then the abort sequence would start.

You don't get to decide how to test the system. SpaceX does that and they decided to have the F9 shut down its engines and then see if the Dragon abort sequencer would independently detect that instantaneous loss of thrust and react the way it was designed to.

[meekGee]

...

You really seem to be assuming that Musk wasn't being straightforward when he specifically stated that the abort sequencer had been de-tuned to a very low level to ensure that it would detect the loss of thrust right away. You also seem to be assuming that there are better ways to test the abort system so it must have been one of them instead of the one that they actually flew. And my sources are the statements by Doug and Musk. And Musk did not say the Dragon commanded the engines to shut down. He said the engines would be shut down and then the abort sequence would start.

You don't get to decide how to test the system. SpaceX does that and they decided to have the F9 shut down its engines and then see if the Dragon abort sequencer would independently detect that instantaneous loss of thrust and react the way it was designed to.

Those statements made on public occasions are often misleading not because someone is trying to mislead, but because it's not what was important at the time they were said, to that audience.

For example in this case the emphasis was that Dragon would not be attempting to escape a rocket that's accerating at full thrust. (Which is a harsher test).

The engines would first be shut down (never mind by whom) and then Dragon would fire and separate.

I agree wth the radical that having Dragon command and communicate the shut down is such a deviation from normal flight that it requires testing.

[soltasto]

The engines would first be shut down (never mind by whom) and then Dragon would fire and separate.

This could be slightly misleading. When abort criteria is met Dragon sends the command to shut down the Falcon 9 engines and in parallel it fires the SuperDraco engines and as soon as they provide enough thrust the separation command is issued.

Dragon doesn't wait for the Merlins to stop as it could potentially not happen.

[meekGee]

The engines would first be shut down (never mind by whom) and then Dragon would fire and separate.

This could be slightly misleading. When abort criteria is met Dragon sends the command to shut down the Falcon 9 engines and in parallel it fires the SuperDraco engines and as soon as they provide enough thrust the separation command is issued.

Dragon doesn't wait for the Merlins to stop as it could potentially not happen.

Agreed, and because of all this fine detail, I don't think we should read too much into what was said at press conferences.

But yes, IMO as well, Dragon commanded the F9 shutdown as part of the abort sequence and then got out ASAP irrespective of what F9 did next.

[gongora]

We really don't know from public statements exactly which flight computer (Stage 1/Stage 2/Dragon) started the sequence of events during the test that led to Dragon aborting from the vehicle.  There is too much slightly differing information.  This conversation is just going in circles.

[joek]

Think it is safe to say that regardless of what initiated the abort sequence, the results were indistinguishable from being simultaneous-instantaneous--at least to any observer.  In the end Dragon performed as required.  Awesome.

[TheRadicalModerate]

Do we all agree that, if an abort is triggered, part of the abort sequence will be to shut down whatever F9 engines aren't already shut down?

[Semmel]

So:  No, they didn't initiate an engine shutdown to trigger the abort, and no, they didn't patch the mission rules.  Instead, they simply overwrote (or otherwise twiddled) the acceleration reading.  But the abort system shut the F9 engines down, not the test harness.

Emphasis mine: So I guess you are saying that Doug misled everyone when he said the trigger was "loss of thrust".

Once again.
SpaceX had chosen "loss of thrust" to be the trigger that would then cause the abort event.
Dragon's abort sequencer had been de-tuned to a very low level so it would react as soon as thrust began to drop. Otherwise it would simply recognize the loss of an engine, which the F9 is designed to still be able to fly with, and not abort the spacecraft.
 
First the flight avionics - located in the F9 Upper Stage (not in the Dragon) commanded the Merlin engine shutdown at a predetermined altitude/velocity/AOA. The F9 obeyed its own flight avionics command and shut down its own engines - unaided in any way, shape or form by Dragon or Dragon's abort sequencer.
THEN (milliseconds later) the abort sequencer - located inside the Dragon (not on the F9) - sensed the resulting loss of thrust and executed the abort sequence in reaction to that condition - completely by itself. It did not shut down the Merlin engines. It was the loss of thrust resulting from the F9 shutting down it's own engines which created the condition that the Dragon abort sequencer then sensed and recognized as a Get-Out-of-Dodge condition.

The ONLY way to actually test Dragon's ability at the system level (which this test was) to react to an already existing anomaly and execute an abort is for the Dragon itself to sense the anomaly, created by some condition over which it had no control, and execute the abort to save itself. Any other means of initiating the abort does not test Dragon's system level abort capability, which this flight did.

Dragon did not shut down the Merlin engines. It is CRITICAL to understand that. Dragon had to CORRECTLY REACT to the condition (loss of thrust) ON ITS OWN, not create the condition to which it needed to independently react.

Your description fits the facts. However, Dragon could still have commanded the engines to shut down. This command would have had no effect as it was already send by the flight avionics. But it could have been registered by the telemetry and send back with the data. So that ground could confirm that Dragin indeed tried to shut down the engines. In a real abort scenario, I can only imagine that Dragon would attempt to shut down the engines. Thus, in this test, it would do the same.

That changes nothing in the observed events though, but would confirm to all statements that I am aware of.

[Pete]

In a real abort scenario, I can only imagine that Dragon would attempt to shut down the engines. Thus, in this test, it would do the same.

Nonsense. Absolute utter nonsense.

Why do I say this with such confidence?
Because shutting down the engines take a LOOOOOOOOOOOOOOOOOOOOOOOOOOOONG time, at least as abort scenarios go. Having the Dragon perform a Merlin engine shutdown would require the Dragon loitering around without leaving the stack, for several hundred milliseconds.
It also introduces an enormous amount of complexity in the abort parameters and sequences.
Time and complexity which would be insane to waste on neatening its house, when the house is on fire.

[gongora]

Do we all agree that, if an abort is triggered, part of the abort sequence will be to shut down whatever F9 engines aren't already shut down?

Yes.  That command may have been redundant in the IFA test.

[gongora]

In a real abort scenario, I can only imagine that Dragon would attempt to shut down the engines. Thus, in this test, it would do the same.

Nonsense. Absolute utter nonsense.

Why do I say this with such confidence?
Because shutting down the engines take a LOOOOOOOOOOOOOOOOOOOOOOOOOOOONG time, at least as abort scenarios go. Having the Dragon perform a Merlin engine shutdown would require the Dragon loitering around without leaving the stack, for several hundred milliseconds.
It also introduces an enormous amount of complexity in the abort parameters and sequences.
Time and complexity which would be insane to waste on neatening its house, when the house is on fire.

It isn't nonsense.  It's what multiple documents and people have said happens in an abort.  There's no need to stick around after the command has been sent.