FAILURE: Firefly Alpha 1st flight - Vandenberg SLC-2W - 3 Sep 2021 (01:59 UTC)

[jdon759]

I'm going to ask something that is probably a stupid question.....

Wouldn't you want to use valves/servos that only move when power is supplied to keep something like this from happening?  This sounds like a power must be applied to keep open kinda system.  If their FTS was engine shutdown based I could see it(small charge to blow the power board and all engines then shut off for example)....but since it is explosive termination based...what's the point of having valves that can electrically fail closed?

There is probably good reason....I just don't see it.  Any insights?

The principle reminds me of a safety design. I work with a telescope that has unpowered spring breaks that, by default, when the telescope is not powered, clamp down onto the structure to prevent movement. Only when the telescope is under power (magnetic drives) are the brakes hydraulically pushed into an open position (commanded open) to allow movement (commanded movement). This prevents uncommanded movement of 11 tons.

This is what "fail safe" means -- when a component fails, it should do so in the least dangerous manner possible.

Having a propellant valve fail closed is safer than failing open -- the valve doesn't know whether it's in flight or is sitting on the ground, and having it close upon an electrical failure is safer than sticking in whatever the last commanded position was.

Are there any valves or actuators that could be used in this situation which can be commanded to switch from "normally closed" to "normally open?"

[TrevorMonty]

I'm going to ask something that is probably a stupid question.....

Wouldn't you want to use valves/servos that only move when power is supplied to keep something like this from happening?  This sounds like a power must be applied to keep open kinda system.  If their FTS was engine shutdown based I could see it(small charge to blow the power board and all engines then shut off for example)....but since it is explosive termination based...what's the point of having valves that can electrically fail closed?

There is probably good reason....I just don't see it.  Any insights?

The principle reminds me of a safety design. I work with a telescope that has unpowered spring breaks that, by default, when the telescope is not powered, clamp down onto the structure to prevent movement. Only when the telescope is under power (magnetic drives) are the brakes hydraulically pushed into an open position (commanded open) to allow movement (commanded movement). This prevents uncommanded movement of 11 tons.

This is what "fail safe" means -- when a component fails, it should do so in the least dangerous manner possible.

Having a propellant valve fail closed is safer than failing open -- the valve doesn't know whether it's in flight or is sitting on the ground, and having it close upon an electrical failure is safer than sticking in whatever the last commanded position was.

Are there any valves or actuators that could be used in this situation which can be commanded to switch from "normally closed" to "normally open?"

I don't think planned for any failure modes, regardless of failure its likely result in loss LV.

Sent from my SM-T810 using Tapatalk

[Slatye]

I'm going to ask something that is probably a stupid question.....

Wouldn't you want to use valves/servos that only move when power is supplied to keep something like this from happening?  This sounds like a power must be applied to keep open kinda system.  If their FTS was engine shutdown based I could see it(small charge to blow the power board and all engines then shut off for example)....but since it is explosive termination based...what's the point of having valves that can electrically fail closed?

There is probably good reason....I just don't see it.  Any insights?

The principle reminds me of a safety design. I work with a telescope that has unpowered spring breaks that, by default, when the telescope is not powered, clamp down onto the structure to prevent movement. Only when the telescope is under power (magnetic drives) are the brakes hydraulically pushed into an open position (commanded open) to allow movement (commanded movement). This prevents uncommanded movement of 11 tons.

This is what "fail safe" means -- when a component fails, it should do so in the least dangerous manner possible.

Having a propellant valve fail closed is safer than failing open -- the valve doesn't know whether it's in flight or is sitting on the ground, and having it close upon an electrical failure is safer than sticking in whatever the last commanded position was.

Are there any valves or actuators that could be used in this situation which can be commanded to switch from "normally closed" to "normally open?"

I don't think planned for any failure modes, regardless of failure its likely result in loss LV.

Yes. If the valve fails to a permanently-open condition then when you shutdown the engines for staging ... one doesn't. And now you have the Falcon 1 Flight 3 situation where the stages collide, and the mission fails.

Fundamentally, they had a valve there because they needed to be able to open and close it (and possibly hold intermediate positions too for throttling). If they only needed to open it for launch, they would have used a burst disc on the basis that it's cheaper, lighter, and more reliable.

The risk mitigation for this is not "allow the engine to continue running even if power is lost to the valve" - it's "make sure that power to the valve is always maintained". After all, if power to a valve can fail - what's stopping power failing for TVC, or avionics, or communications, or the stage separation mechanism?

[cscott]

Video also shows the engine tried to relight at T+39s and flames out about ~5 seconds later, although a small flame is visible out the bell for the rest of the flight.

Edit: Although they use TEA-TEB, don't they, so I'm not sure that's a "relight" proper...

Pretty sure that's just exhaust recirculation, esp combined with the tentative "valve power failed" root cause.

[JEF_300]

Why on Earth are you guys assuming that the valve closing was directly because of the electrical failure? They've already said that closing that valve is how an inflight engine shutdown is supposed to be done, so I'd just assumed that the computer detected the failure, and chose to shut down Engine 2 because of it. That makes way more sense to me than the valve needing power to remain open.

[Bananas_on_Mars]

amidst all those "system X nominal" calls how is "shutdown, engine 2" not called out?

I know, right?  Specifically:

T+0:00  Ignition.
T+0:03  The vehicle has lifted off.
T+0:05  Liftoff time is 1:59:01.00 Zulu.
T+0:10  RC transition operation procedures to PRC LP 14-35.  IT commence LP 14-57.  Report anomalies.
T+0:19  Please confirm I have no fires on the pad.  I have no visual.  Please confirm no fires on the pad.  Moving to ground.
T+0:34  Stage two pressure's up.
T+0:35  Prop call?
T+0:39  Prop is nominal.
T+0:46  GNC?
T+0:48  I'm seeing a dip in V_Mag.
T+0:54  There's no fires on the pad.
T+0:56  Avionics?
T+0:59  Responding AVI.
T+1:08  S1 pressure profile nominal.
T+1:11  Avionics / Power nominal.
T+1:15  Telemetry is nominal.
T+1:24  Plus 1:30.
T+2:15  Vehicle is supersonic.
T+2:32  Anomaly.
T+2:33  V class anomaly.
T+2:34  Move the anomaly team to procedure MLP 1499.

Link to T+0:30  ("Prop" = Propulsion.)

There were people making lengthy broadcasts for over 20 seconds during a critical period of T+10s to T+32s - the engine shutdown happening early in that time range. They should have been on a ground channel (per 'moving to ground') but may have stomped on or prevented flight-related callouts that people were trying to make. It didn't affect any outcome but they will definitely want to tighten this up in the future.

There are a few callouts missing in the Firefly video that you were looking at. From Tim Dodd's you can hear these additional:

T+0:25: I'm looking [garbled] the sweep... cameras are sweeping the pad
T+0:32: plus 32 seconds
T+1:47: Not yet supersonic

A much simpler explanation could be that they indeed have different com nets, it might just be that the wrong one ended up in the stream.

[AJW]

A much simpler explanation could be that they indeed have different com nets, it might just be that the wrong one ended up in the stream.

That would surprise me, but it certainly isn't the first time important messages were left off different com channels.   In this case, the APC safety crews were told over their com channel that the Shuttle countdown was stopped, but someone failed to announce when the clock was restarted.  It is over 100 degrees sitting there in the Florida sun so the crews waited outside for the announcement that the clock had resumed, but without the info on their channel, they were caught outside their vehicle when the launch did happen.   This was the most requested photo from the launch, and some Admin wanted to punish the APC crews, but they simply requested the logs for their com channel which proved that there was no announcement of the clock restart.

[TrevorMonty]

Firefly website has vanished….

Didn't work me either. Wouldn't read to much into it. If Firefly owners hadn't budgeted for failure on maiden launch they are in wrong business. Even 2nd failure isn't unexpected. After 3rd failure in row people will start questioning their competence.

Sent from my SM-G570Y using Tapatalk

[FutureSpaceTourist]

https://twitter.com/djsnm/status/1435464491920101376

This is the best video following the engine section of Firefly Alpha falling towards the ground:

twitter.com/djsnm/status/1435464500837187584

Keavon, who shot the video, did this analysis trying to figure out where the engine section landed.

https://twitter.com/djsnm/status/1435464507422244869

The engine landed less than a mile from the pad, there was almost no downrange motion.
More interestingly, the rocket's launch azimuth was to the southwest, but it moved slightly to the northeast instead.

[trimeta]

Ah.  It’s back now.

The Firefly website wasn’t dead, it was just pining. 

I’d say that bird has got some beautiful plumage.

Hardly the first time their website has had issues, it took them months to update the mobile version of the Firefly Beta page to reflect the change from tri-core to single-core. I've come to respect their web dev team only slightly more than X-Bow System's web dev team.

[meekGee]

https://twitter.com/Free_Space/status/1434969410062725120

How did this hardware come down on land? After length of flight, shouldn’t it have been many miles down range? Or did it depart the launch trajectory significantly because of the underthrust to the point where it climbed far more vertically because trying to get back on course?

Truss, engines landed about 3/4 mi. from SLC-2 in the desert. Don't know why there.

Maybe that spin, before FTS detonated, could have had the tip of the rocket moving reasonably fast, and given the time it takes to fall from 50,000', maybe a heavy object can travel some...

It's about a minute of fall down from there (w upwards speed it had).  The rocket was spinning at 1/sec, it is 30 m long, so the tip speed is 15*6 let's say 100 m/s.. (wow!!!)) So tip could travel 6 km.

Honestly that tip speed is huge... Amazing that the structure held up for as long as it did.

I also doubt everything would line up so nicely, so probably a lot less than 6 km.

[Jeff Bingham]

Loren's article from few years ago has comeback to light after Alpha's failure.

https://www.theverge.com/2015/6/29/8863121/spacex-falcon-9-rocket-explosion-excuses?utm_campaign=lorengrush&utm_content=chorus&utm_medium=social&utm_source=twitter

The reason space especially LVs is hard is that faults typically result in mission failure. Faults occur all the time in testing of earlier prototypes of other forms of transport but very rarely result in vehicle destruction. With land and sea vehicle we just turn engine off and stop. Aircraft less forgiving but allow flight envelope to be expanded up over dozens of flights. We don't expect a aircrafts maiden flight to be across Alantic but that is case with most LVs.

In case of SLS +Orion 2nd launch will be crew mission around moon. Any volunteers for cheap transAlantic flight on a new aeroplane's 2nd flight.




Sent from my SM-G570Y using Tapatalk

Space Shuttle had no unmanned test flights; first launch on April 12 1981 carried John Young and Bob Crippen as Commander and Pilot, respectively.

[Comga]

Truss, engines landed about 3/4 mi. from SLC-2 in the desert. Don't know why there.

Maybe that spin, before FTS detonated, could have had the tips of the rocket moving reasonably fast, and given the time it takes to fall from 50,000', maybe a heavy object can travel some...

It's about a minute of fall down from there (w upwards speed it had).  Rocket was spinning and at 1/sec, rocket is 30 m long, tip speed is 15*6 let's say 100 m/s.. (wow!!!)) So tip could travel 6 km.

Honestly that tup speed is huge. Amazing structure held up for as long as it did.

I also doubt everything would line up so nicely, so probably a lot less than 6 km.

Nice estimation

So after flying for two minutes plus hardware with significant mass lands at a random position near the launch site.
This has got to get the base pretty upset.

If the cause really is the rotation, they may need FTS rules that trigger at some smaller rotation.
Could they be required to modify their trajectory to head downrange at some fixed time, rather than along a predetermined trajectory?

[ugordan]

If the cause really is the rotation, they may need FTS rules that trigger at some smaller rotation.

Wouldn't that pretty much mandate an AFTS?

[Chuck Cage]

This does point out a pretty significant designed-In limitation of the Firefly: with the cross-gimbaling configuration, loss of any of the four engines during ascent results in a mission failure, yes? Or am I missing something?


Sent from my iPhone using Tapatalk

[gmbnz]

This does point out a pretty significant designed-In limitation of the Firefly: with the cross-gimbaling configuration, loss of any of the four engines during ascent results in a mission failure, yes? Or am I missing something?

It was in control for most of the (admittedly slow and low Q) flight, so I'd assume that if the engine-out happens before or near Max Q then they'll be toast - but if it happens in the last minute of the S1 burn they could be fine from a control standpoint.

I actually suspect that they'd run out of propellant margin before they run out of control margin in terms of overall success probability, although they'd probably be quite close (which arguably is the optimal design, except for the FTS/rocket-confetti aspect when it does fail)

[JEF_300]

Nice estimation

So after flying for two minutes plus hardware with significant mass lands at a random position near the launch site.
This has got to get the base pretty upset.

Lot's of different people for the base to be upset at too. Firefly for having these problems, the FAA for approving the AFTS and this flight inspite of the potential for debris coming down on land, and themselves for not thinking of these problems and for not classifying the upper level winds (which ended up carrying debris into residential areas miles away) as a problem.

The most noteworthy part, to me, is that none of this would have happened if they had merely shut the engines off instead of blowing the thing up.

It was in control for most of the (admittedly slow and low Q) flight, so I'd assume that if the engine-out happens before or near Max Q then they'll be toast - but if it happens in the last minute of the S1 burn they could be fine from a control standpoint.

I actually suspect that they'd run out of propellant margin before they run out of control margin in terms of overall success probability, although they'd probably be quite close (which arguably is the optimal design, except for the FTS/rocket-confetti aspect when it does fail)

I just wanted to express total agreement with all of this.

[Jim]

The most noteworthy part, to me, is that none of this would have happened if they had merely shut the engines off instead of blowing the thing up.

I just wanted to express total agreement with all of this.

Wrong on both accounts.  The vehicle would have still broken up and exploded send parts everywhere.
Can't say it would still be stable after max q.  You have no data to support that claim.

The vehicle probably has constraining wind placards and reduced launch availability compared to other vehicles.

[matthewkantar]

No FTS is going to keep debris from coming down on the base in all cases. The vehicle was popped, nobody was injured. Find something more substantive to be vexed about.

[trimeta]

Even assuming the vehicle didn't explode (let's say its tumbling slowed it down enough such that its max q stresses were survivable), wouldn't it still have landed on the base? It doesn't really make sense to me that with explosive FTS, the engines landed 3/4 miles away from the launch site, but without it, the whole thing would have made it off the coast.

Of course, in that hypothetical the whole thing would have landed in one piece, rather than scattering carbon fiber fragments to the wind, but it seems like the engines were the most dangerous debris in any event.