SpaceX F9 / Crew Dragon : Crew-2 : 22 April 2021 - DISCUSSION

[lenny97]

Not saying this issue is necessarily at the same level of importance [...]

In my honest opinion it's obviously necessary to do an in-depth review of data and analysis. But i think also that it is creating more chaos than it should.
And I'm not minimizing, mind you. I'm just saying that the system was originally designed with 3 parachutes. And it would have been safe anyway...

They requested four and got them. The behavior seen the other night had already been noticed during the tests, so nothing new.
It did not impact the mission in any way.
It was not a total failure of the parachute (eg detachment) that could have caused much more concern.
They carried out post-landing checks.
Personally, I am amazed how everyone cares that much about a (redundant) parachute that takes one minute longer to inflate, nearly as much as an ISS module that goes crazy and activates thrusters. 
I repeat: carrying out the checks is always and in any case necessary. But analyzing the words too, no, it seems excessive to me...

[Lee Jay]

Not saying this issue is necessarily at the same level of importance [...]

In my honest opinion it's obviously necessary to do an in-depth review of data and analysis. But i think also that it is creating more chaos than it should.
And I'm not minimizing, mind you. I'm just saying that the system was originally designed with 3 parachutes. And it would have been safe anyway...

They requested four and got them. The behavior seen the other night had already been noticed during the tests, so nothing new.
It did not impact the mission in any way.
It was not a total failure of the parachute (eg detachment) that could have caused much more concern.
They carried out post-landing checks.
Personally, I am amazed how everyone cares that much about a (redundant) parachute that takes one minute longer to inflate, nearly as much as an ISS module that goes crazy and activates thrusters.  
I repeat: carrying out the checks is always and in any case necessary. But analyzing the words too, this no, it seems excessive to me...

The concern is, could this situation lead to something more dire?  Could it cause a line-twist or could the non-inflated chute get wrapped around the other chutes?  I'm making up random stuff not to highlight these specific things but rather to point out that when something happens that's not as-planned, you have to look at the next thing that could happen, and the next to see if the system is *really* safe, given the occasional slow-opening chute.

[lenny97]

I'm making up random stuff not to highlight these specific things but rather to point out that when something happens that's not as-planned, you have to look at the next thing that could happen, and the next to see if the system is *really* safe, given the occasional slow-opening chute.

And that's why I stressed the importance of testing, data reviews, and all necessary inspections.
But it gets a bit snooty to analyze words in such a situation...
And, btw, we know NASA and its close ties: if they weren't confident (and then if it weren't true that this behavior has already been seen during testing) they wouldn't have proceeded with tonight's launch.

And also the risks associated with this phenomenon: if it was seen in tests, they were analyzed.
I doubt SpaceX and NASA don't delve into what-if scenarios resulting from any kind of parachute failure...

[AS_501]

SpaceX's Bill Gerstenmaier says the slow opening parachute was returned to KSC, suspended from a crane and inspected in detail; no problems were found and "we don't see anything that's off nominal;" he said the Crew Dragon can safely land with just 3 chutes

https://mobile.twitter.com/cbs_spacenews/status/1458289899778478081

In fact, Dragon's 4 chutes seems overkill.  Remember that Apollo 15 landed fine with just 2 of 3 chutes.  Same during Starliner's abort test.  Then there is Soyuz......

What matters is not the number of parachutes, but their canopy, aerodynamics and the load's weight. AFAIK Dragon doesn't have backup parachutes, so its redundancy with four is actually its nominally-built-in redundancy. I believe it is designed to be fail-safe with three, and survivable with just two, but it could as easily be designed so that four are essential. Comparing it with Soyuz, which for starters is lighter and has a backup parachute that nominally doesn't need to deploy, is quite fallacious.

Interesting.  I didn't know Soyuz had a backup.  Thanks eeergo.

[alugobi]

but rather to point out that when something happens that's not as-planned,

Or not as expected, we're accustomed to NASA hunkering down, putting everything on hold, and paralyzing by analyzing.

What a happy surprise that, in the current case, they didn't overreact, but came right out and said that it's been modeled and seen before and no big deal, let's launch the next one.

[Vettedrmr]

It's more than that they've seen it before, but also that they had data from those flights, and data from this flight, plus inspections of the suspect chute post-flight.

[CameronD]

Crew-2: Astronauts Safely Return to Earth at 10:33 p.m. EST

It occurs to me that perhaps the only people not that happy about this might be the Starliner Crew astronauts.. I guess they picked the wrong horse??

Huh? You really think they would have preferred if they did not return safely? Care to elaborate?

I'm merely pointing out that Dragon Crew-2 have successfully launched, completed their mission, landed safely and we're onto Crew-3 already... whilst Sunita Williams and her Starliner Crew colleagues are still sitting on their tails, going through the training, waiting, waiting to even get as far as a test launch!

Heck, we may even see Cosmonauts getting into orbit on Dragon before the queue of Starliner astros starts moving. I feel sorry for them.
 

[Steven Pietrobon]

...together with normalization of deviance in the analysis being a pervasive issue within the Shuttle program. I might be mistaken, but I seem to remember Gerst testimony was in there too.

That was my first reaction when I heard NASA's response. Just because this time they got away with it, doesn't mean that next time there could be a bigger problem. To me this is a design problem that need's to be fixed as soon as possible.

[Comga]

...together with normalization of deviance in the analysis being a pervasive issue within the Shuttle program. I might be mistaken, but I seem to remember Gerst testimony was in there too.

That was my first reaction when I heard NASA's response. Just because this time they got away with it, doesn't mean that next time there could be a bigger problem. To me this is a design problem that need's to be fixed as soon as possible.

It's only "normalization of deviance" if it is a deviance.
If it is behavior seen in tests and within the range of variance expected from testing and modeling and seen by hardware inspection after the event that no damage was done, then it's not deviance.

[kevinof]

...together with normalization of deviance in the analysis being a pervasive issue within the Shuttle program. I might be mistaken, but I seem to remember Gerst testimony was in there too.

That was my first reaction when I heard NASA's response. Just because this time they got away with it, doesn't mean that next time there could be a bigger problem. To me this is a design problem that need's to be fixed as soon as possible.

On the press call last night they talked about the chutes and they say it's unique to this type if chute. In their testing of 3 chutes only the slow opening never happens.

When you go to 4 chutes and one is initially a little behind the others then it falls further behind as the air flow reduces as the load on this chute is much smaller.
 
They also said that once you get to lower altitude it always opens.

[su27k]

Some details regarding the parachute issue in a reply to Wayne Hale:

https://twitter.com/DutchSatellites/status/1458476708315766784

NASA forced SpaceX to do a extensive series of drop tests to characterise the behaviour of a 4-chute system, given that every prior system had 3 chutes. From those drop tests (over 30 of them) it was determined that 1 parachute opening slow is characteristic for 4-chute systems.


In other words: one of four parachutes sometimes opening slower than the other three is not discrepant behaviour.
Discrepant behaviour would be the parachute staying closed all the way to splashdown. Or the chute failing to deploy at all. Or failing to reef.
2/2.

[eeergo]

...together with normalization of deviance in the analysis being a pervasive issue within the Shuttle program. I might be mistaken, but I seem to remember Gerst testimony was in there too.

That was my first reaction when I heard NASA's response. Just because this time they got away with it, doesn't mean that next time there could be a bigger problem. To me this is a design problem that need's to be fixed as soon as possible.

On the press call last night they talked about the chutes and they say it's unique to this type if chute. In their testing of 3 chutes only the slow opening never happens.

When you go to 4 chutes and one is initially a little behind the others then it falls further behind as the air flow reduces as the load on this chute is much smaller.
 
They also said that once you get to lower altitude it always opens.

If I'm not mistaken, they had pretty mixed results in the 3-parachute configuration (not necessarily due to slow openings), with old inadequate "Mark" designs that got superseded by the current canopy only tested in the 4-parachute configuration. Not sure anyone can say slow openings "never happen" with three chutes with the available data, or that it "always opens" at low altitude for that matter.

Once again, the issue is probably moot and benign. Still, it sends red flags flying when the condition seems not to be well understood but is stamped as "in family" from a finite, relatively small subset of tests, in such a dynamic system. I want to believe a team is already working on improving the system in order to design the issue out so that it moves from "probable but benign, we hope" to "very rare and quite confidently benign".

After all, seal burnthroughs were a known in-family condition, thoroughly tested and observed in recovered hardware, that never resulted in actual danger (until you threw in another confounding factor: temperature). Actually, if you took a special subset of launch and processing conditions that might not reflect the operational, nominal system, it never happened!

Foam shedding was also well characterized and happened in every flight. It was not well understood in terms of mechanism, mitigations or impacts to heat shields in the case of rare events (large pieces reaching sweet spots), but it was widely accepted foam was too fluffy to worry about, also based on "in-family" records of hundreds of flights and ground tests. In fact, if you considered the acreage foam and not the few ramps and embellishers making up a tiny percentage of the foam content of the tank, no large pieces were shed at all!

Not to mention the insignificant issue of bent contact pins in boosters caused during integration, that hadn't been cause lf concern or given visible trouble for thousands of flights, and certainly wouldn't give trouble in such a robust staging system that independently severed the aft booster attachment struts while shutting down the engines. Surely the upper LOX vent valve operation was just an extra layer of safety that couldn't really affect the launch much, certainly not by ripping the core open!

You see what I mean...

[Lee Jay]

but rather to point out that when something happens that's not as-planned,

Or not as expected, we're accustomed to NASA hunkering down, putting everything on hold, and paralyzing by analyzing.

What a happy surprise that, in the current case, they didn't overreact, but came right out and said that it's been modeled and seen before and no big deal, let's launch the next one.

Which is what they said about seal burn through and foam liberation as well.

[kevinof]

Right so instead of a FUD post why don't you impart your wisdom and let us all know what they should be doing?  They have done 30 tests so is it more testing that (in your opinion) should be done? if so how many tests are needed? 40, 50 or maybe 100 tests? Love to know what your magic number is?

Or maybe you think Dragon isn't safe at all. So, in your opinion, should it be grounded? And if so then what? A new magic chute design that doesn't behave this way. Again love to know of your wisdom on this.

FUD posts are easy. Coming up with solutions or real fixes are hard.

but rather to point out that when something happens that's not as-planned,

Or not as expected, we're accustomed to NASA hunkering down, putting everything on hold, and paralyzing by analyzing.

What a happy surprise that, in the current case, they didn't overreact, but came right out and said that it's been modeled and seen before and no big deal, let's launch the next one.

Which is what they said about seal burn through and foam liberation as well.

[Jimmy10]

Question unrelated to parachutes...  I'm wondering if there is a planned order for crew to exit the capsule.  It seems to be at best random and at worst sexist?  Ladies always seem to go first (except Crew 1)?  Might it be medically influenced?

[eeergo]

Right so instead of a FUD post why don't you impart your wisdom and let us all know what they should be doing?  They have done 30 tests so is it more testing that (in your opinion) should be done? if so how many tests are needed? 40, 50 or maybe 100 tests? Love to know what your magic number is?

Or maybe you think Dragon isn't safe at all. So, in your opinion, should it be grounded? And if so then what? A new magic chute design that doesn't behave this way. Again love to know of your wisdom on this.

FUD posts are easy. Coming up with solutions or real fixes are hard.

but rather to point out that when something happens that's not as-planned,

Or not as expected, we're accustomed to NASA hunkering down, putting everything on hold, and paralyzing by analyzing.

What a happy surprise that, in the current case, they didn't overreact, but came right out and said that it's been modeled and seen before and no big deal, let's launch the next one.

Which is what they said about seal burn through and foam liberation as well.

Please don't dismiss with the all-encompassing, insulting "FUD" fanboi expression what instead is a measured and constructive critique - unless you're willing to explain how that's qualitatively different from similar dismissals in the historic situations above.

NASA's winning approach (and generally, the sector's too) has been for known "funnies" to be designed out, so that they become rare or even impossible occurrences - especially when the risk to encounter the "funny" will be incurred for an indeterminate amount of missions for an unbounded amount of time. This is true in general, but particularly so when the root cause isn't known beyond phenomenologically (i.e. "it happens from time to time with unknown frequency due to reasons too complicated to study deterministically").

Given the extensive test data they have, we're acknowledging that the issue might be truly moot in the first place, or even that Dragon can just continue operating for as long as necessary while the redesign is leisurely implemented.

What people are getting spooked about is that (1) there is a known "funny" (2) that is assumed to be a "funny" based on a handful of four-parachute Mk-3 design low-altitude drop tests (3) whose root cause is not deterministically understood (4) that may or may not be representative of the conditions seen during operational flights (packing storage time, temperatures, pressure changes, other non-obvious things...), and (5) doesn't publicly appear to be prompting a redesign effort, but rather seems to be heading to the archive as an "in family" "funny".

The combination of (1-5), and its possible consequences, have been empirically seen before. Thousands of operational launches, hundreds of ground tests and analysis cycles, mitigated short-term failures BUT were NOT enough to foresee the catastrophic implications of most of the causes of LOV/C events in history - it was rather long-term acceptance of known "funnies" which eventually proved to be something more.

[LouScheffer]

Another point about the parachutes is that failures are anti-correlated, which is unusual.

For example, if you hold things together with 4 bolts, and one fails, then the other 3 are under higher load and more likely to break.  This exact behavior was demonstrated in the Arecibo collapse, where a failed cable put more strain on the others.

But if the parachute problem is insufficient aerodynamic forces, then the problem will more likely occur precisely because the other parachutes worked correctly. In fact the more other parachutes worked correctly, the less the forces, and the more likely a failure to inflate promptly will happen to the last chute.

On the other hand, there is also a human pride explanation that is not so re-assuring.  IIRC, Dragon originally had 3 chutes, as did Apollo before that.  It was NASA that asked (demanded) that SpaceX switch to 4 chutes, at the cost of delay, expense, more tests, etc.   To then say oops, 4 chutes has this slow-opening problem, our demand was actually counter-productive, and we should go back to three chutes would be embarrassing to both NASA and the people involved.  So there is psychological pressure to say this is not a serious problem, and four chutes is in fact safer.

[soltasto]

What people are getting spooked about is that (1) there is a known "funny" (2) that is assumed to be a "funny" based on a handful of four-parachute Mk-3 design low-altitude drop tests (3) whose root cause is not deterministically understood (4) that may or may not be representative of the conditions seen during operational flights (packing storage time, temperatures, pressure changes, other non-obvious things...), and (5) doesn't publicly appear to be prompting a redesign effort, but rather seems to be heading to the archive as an "in family" "funny".

Except it is an understood phenomenon, as reported here:

Former SpaceX lead confirming this is not a failure but a "lagging" parachute which can happen on occasion

https://twitter.com/SpaceAbhi/status/1458144778692927494

https://twitter.com/SpaceAbhi/status/1458144980527042565

So looks like everybody above was on point.

The non deterministic part that causes either the "normal" behavior or this behavior is not the system itself but the aerodynamics behind the capsule. If some turbulence causes one parachute to push on another as it is deploying thus slowing down its full inflation, which will occur anyways a bit later, it is not an issue if the parachute system is designed to take that into account. You can't remove the uncertainty from a variable you can't control, you can only make sure that the system behaves well under all circumstances in that uncertainty range.
Making an example, this is like having your car brakes and tires working normally on a dry road and thinking that it is an issue when it takes longer to brake on a wet road. Since car manufacturers can't control if the road is wet or not, they can only verify that the car can still stop while maintaining control and within a reasonable time. The physics dictate that the tires grip will be worse on a wet road, and while for sure car manufacturers could engineer a complex and expensive system that fixes "the issue", the added design would just not be worth it as if you just drive your car within the limits it is perfectly safe to do so.

[kevinof]

So first off, I ain't no SpaceX amazing people so my post was nothing to do with defending SpaceX but more about getting people to drop the easy one-liners and instead back up their opinion (right or wrong) with their arguments and let everyone debate, support or refute.

Your post quote here is substantive and lays our your position and view and that's great. The other post not so much.

Now back to the cutes - This interaction of 4 chutes is well known and also understood. So long as there was no external damage that caused the slow opening it appears that the delayed opening is not a safety issue. SpaceX brought the chute back to NASA, hoisted it on a crane and did an inspection to check for just this.

The alternative is to go back to 3 chutes where this problem will not happen but then you lose the added bonus of a 4th backup chute which still works even with a delayed opening.

Right so instead of a FUD post why don't you impart your wisdom and let us all know what they should be doing?  They have done 30 tests so is it more testing that (in your opinion) should be done? if so how many tests are needed? 40, 50 or maybe 100 tests? Love to know what your magic number is?

Or maybe you think Dragon isn't safe at all. So, in your opinion, should it be grounded? And if so then what? A new magic chute design that doesn't behave this way. Again love to know of your wisdom on this.

FUD posts are easy. Coming up with solutions or real fixes are hard.

but rather to point out that when something happens that's not as-planned,

Or not as expected, we're accustomed to NASA hunkering down, putting everything on hold, and paralyzing by analyzing.

What a happy surprise that, in the current case, they didn't overreact, but came right out and said that it's been modeled and seen before and no big deal, let's launch the next one.

Which is what they said about seal burn through and foam liberation as well.

Please don't dismiss with the all-encompassing, insulting "FUD" fanboi expression what instead is a measured and constructive critique - unless you're willing to explain how that's qualitatively different from similar dismissals in the historic situations above.

NASA's winning approach (and generally, the sector's too) has been for known "funnies" to be designed out, so that they become rare or even impossible occurrences - especially when the risk to encounter the "funny" will be incurred for an indeterminate amount of missions for an unbounded amount of time. This is true in general, but particularly so when the root cause isn't known beyond phenomenologically (i.e. "it happens from time to time with unknown frequency due to reasons too complicated to study deterministically").

Given the extensive test data they have, we're acknowledging that the issue might be truly moot in the first place, or even that Dragon can just continue operating for as long as necessary while the redesign is leisurely implemented.

What people are getting spooked about is that (1) there is a known "funny" (2) that is assumed to be a "funny" based on a handful of four-parachute Mk-3 design low-altitude drop tests (3) whose root cause is not deterministically understood (4) that may or may not be representative of the conditions seen during operational flights (packing storage time, temperatures, pressure changes, other non-obvious things...), and (5) doesn't publicly appear to be prompting a redesign effort, but rather seems to be heading to the archive as an "in family" "funny".

The combination of (1-5), and its possible consequences, have been empirically seen before. Thousands of operational launches, hundreds of ground tests and analysis cycles, mitigated short-term failures BUT were NOT enough to foresee the catastrophic implications of most of the causes of LOV/C events in history - it was rather long-term acceptance of known "funnies" which eventually proved to be something more.

[eeergo]

What people are getting spooked about is that (1) there is a known "funny" (2) that is assumed to be a "funny" based on a handful of four-parachute Mk-3 design low-altitude drop tests (3) whose root cause is not deterministically understood (4) that may or may not be representative of the conditions seen during operational flights (packing storage time, temperatures, pressure changes, other non-obvious things...), and (5) doesn't publicly appear to be prompting a redesign effort, but rather seems to be heading to the archive as an "in family" "funny".

Except it is an understood phenomenon, as reported here:

Former SpaceX lead confirming this is not a failure but a "lagging" parachute which can happen on occasion

https://twitter.com/SpaceAbhi/status/1458144980527042565

So looks like everybody above was on point.

The non deterministic part that causes either the "normal" behavior or this behavior is not the system itself but the aerodynamics behind the capsule. If some turbulence causes one parachute to push on another as it is deploying thus slowing down its full inflation, which will occur anyways a bit later, it is not an issue if the parachute system is designed to take that into account. You can't remove the uncertainty from a variable you can't control, you can only make sure that the system behaves well under all circumstances in that uncertainty range.
Making an example, this is like having your car brakes and tires working normally on a dry road and thinking that it is an issue when it takes longer to brake on a wet road. Since car manufacturers can't control if the road is wet or not, they can only verify that the car can still stop while maintaining control and within a reasonable time. The physics dictate that the tires grip will be worse on a wet road, and while for sure car manufacturers could engineer a complex and expensive system that fixes "the issue", the added design would just not be worth it as if you just drive your car within the limits it is perfectly safe to do so.

The issue is known, but the root cause does not appear not be entirely under control, which is what's being argued. In fact, you say the non-deterministic cause is the capsule's wake flow, while the very tweet you quote (by an biased party, being SpaceX's former director) states it's understood to be a consequence of parachute crowding, not of turbulence directly.

Not being an expert on this, I decided to have a shallow look at what we're talking about here. Turns out that the "lead-lag" term he employs is actually a generic one referring to "undesirable frequency responses" (as per Wikipedia's definition), which has a whole field of "compensators" to mitigate them. In fact, if you google "lead lag parachute" you get some papers such as this one: https://airborne-sys.com/wp-content/uploads/2016/10/aiaa-1999-1700_evolution_of_the_ringsail.pdf or this one from old-friend Kistler https://airborne-sys.com/wp-content/uploads/2016/10/aiaa-1999-1707_design_and_testing_of_the.pdf that talk about many efforts to minimize lead-lag effects, as a variable you can't *null out* but definitely *can control*.

The comparison with car tyres is not really handsome, since heritage issues in fact prevent them to be as safe as their inherent design would allow, and many people "unnecessarily" die on the road worldwide because of it. Anyway, here we're not talking about the equivalent of a car manufacturer "controlling whether the road is wet or dry", which would translate into variable weather conditions for Dragon causing the parachute problems. An actual equivalent to a car scenario would be the acceptance of a significantly reduced factor of safety in braking action depending on a relatively frequent sloshing pattern of the brake fluid, which is known, classed as "in family" and not acted upon because it won't lead to a crash during a few hours of test driving - while summarily ruling out infrequent jamming of the other brakes because of possible one-in-a-thousand-times interactions.