Abort options for Starship and Starship/SuperHeavy

[Robotbeat]

Air taxis also aren’t considered common carriers. SpaceX could and likely would operate under that kind of regime, like general aviation.

Non-scheduled or chartered flights would fit under that understanding. Sky diving and sightseeing is general aviation. I think for decades to come, people would fly on Starship even just as a sightseeing opportunity, so it’d be easy to count that under General Aviation.

I don’t see Starship flying often enough to do “regularly scheduled flights” just from basic math alone  (let’s say you have 10 city pairs, each would need at least 3 flights per day, each day… that’s over 10,000 flights per year… anything less is really more on-demand, chartered, or sightseeing flights) until it’s doing 10,000-100,000 flights per year, in which case proving high safety levels needed for scheduled aviation flights could become feasible.

10,000 cargo flights per year could be done without extreme safety, too. They can and would be totally uncrewed.

[TheRadicalModerate]

That's a wrong argument. People are paying in the order of $100k to  maybe climb Mount Everest which has chances of dying worse than taking part in a spaceflight like Inspiration 4.

Or even stay with aviation. People pay quite a lot for stuff like air taxi or helicopter rides. Both are incomparably more dangerous than regular transport planes. It's actually more dangerous than driving a car.

If an Everest guide company loses a client, they're only liable to the extent that they were negligent, i.e., to the extent that the risk they represented to the customer exceeded the informed consent risk due to their actions.  Same thing with an air taxi service.

But SpaceX not only provides the service, they also make the vehicles through which the service is provided.  That means that the informed consent they require has to include not just the inherent risks of spaceflight, but that they have also factored in the possibility that their product is defective in some unknown way.  If they lose a private crew, the heirs are going to demand proof that a known defect didn't cause the accident, rendering the advertised risk invalid, and they'll win in court if SpaceX can't provide that proof.

On top of that, SpaceX will have a much greater public relations problem than the Everest guide or the air taxi.  It may not be fair, but some yahoo getting himself killed while mountain climbing or even a family dying in a helicopter crash are the kind of background noise that the public understands.  A space mission, on the other hand, is new and exciting and will draw large amounts of public scrutiny even if it succeeds.  And if it fails, it's a news-cycle-spanning event that can threaten the company's other contracts, both private and governmental.

SpaceX can probably afford to lose the 100th crew they launch.  By then, the public interest will have worn off, and everybody will think, "Yeah, spaceflight is risky, it's not surprising that there was eventually an accident."  But if they lose the fifth crew they launch, that's another story.  As a result, they have to be extremely conservative at the beginning of the program, when it's hardest to be conservative.

[TheRadicalModerate]

I fail to see why Starship couldn’t reach that reliability level in principle. I’m really surprised Falcon 9 has achieved the reliability that it has, and that’s the first VTVL-based reusable rocket. Future iterations like Starship could do much better (if they can reach a higher flight rate, like 1000 per year).

That's not really the issue, though.  The issue is how they demonstrate that reliability.  Without a valid PRA model, that can only be done empirically, and it takes time.  It takes a longer amount of time if there are failures that extend deeper into the operational phase of the system, because they don't wash out of your results as soon.

So that begs the question:  Is the time it takes so long that it's worth doing the engineering for launch/landing escape?  Such an escape system will give you a simplified PRA that demonstrates reduced risk by chaining the probabilities of loss of both the primary and the abort system together.

[Robotbeat]

It’s hard to say, but the high reuse they’re hoping to achieve isn’t worth it unless they can do at least ~2000 flights between failures ANYWAY. Which is better than what conventional rockets plus LAS are capable of achieving.

[TheRadicalModerate]

It’s hard to say, but the high reuse they’re hoping to achieve isn’t worth it unless they can do at least ~2000 flights between failures ANYWAY. Which is better than what conventional rockets plus LAS are capable of achieving.

Two problems with that:

1) If it takes 2000 flights to prove that reliability, SpaceX will have to wait a long, long time for crew certification of launch/EDL.  That will eat into their Mars plans, and it may also pass up an opportunity for NASA to dramatically increase its BEO mission cadence.

2) Unless the LAS somehow compromises the basic architecture, any system + LAS has a lower pLOC than the system alone.  So if there's a simple way to graft on a LAS, it gets Starship launching crews a lot sooner.

There's clearly an argument to be made that a LAS will somehow compromise the architecture.  I don't buy it.  A LAS will obviously dramatically reduce the performance of Starship for crewed missions, but why should they care?  They have tens of tonnes of mass margin to play with.  The only real constraint that a heavy LAS imposes is the requirement that BEO crews transfer to a more mass-optimized Starship in LEO.

[Lee Jay]

Just to keep things in perspective, total global production of methane could support 10,000 SS flights per day if there were no other users of that fuel.  Another way to say that is every 100 flights per day that are added adds one percent to total global methane demand.

[Robotbeat]

Just to keep things in perspective, total global production of methane could support 10,000 SS flights per day if there were no other users of that fuel.  Another way to say that is every 100 flights per day that are added adds one percent to total global methane demand.

Correct, but the same argument applies about equally to regular passenger aviation, except that it's easier to synthesize methane than kerosene.

10,000 combination SS/SH flights. But point to point is supposed to use just Starship by itself (likely with some significantly different aerodynamic features to enable skip/glide and longer range in single-stage mode, as Elon has suggested in the past).

A single stage Starship point to point craft therefore only uses about a fourth the fuel, or about 250 tonnes.

That's the same as an Airbus A380, which has about the same volume and passenger capacity.

(And given that there are 129 A380s in service at the moment, that specific plane has approximately the same flightrate and annual fuel consumption as your 100 Starship point to point flights per day.... and over twice that many 747s... And note that 61 747s have been lost in flight, with 3,722 fatalities.)

So even this very high flightrate of 100 flights per day isn't a huge deal any more than similar capacity of regular long haul aviation is. The difference with Starship is it'll use a propellant that's much easier to synthesize using solar electricity and water and air, and this technology is essential to enable Mars (as well as pretty dang useful on Earth to fight climate change).

[Lee Jay]

Just to keep things in perspective, total global production of methane could support 10,000 SS flights per day if there were no other users of that fuel.  Another way to say that is every 100 flights per day that are added adds one percent to total global methane demand.

Correct, but the same argument applies about equally to regular passenger aviation, except that it's easier to synthesize methane than kerosene.

10,000 combination SS/SH flights. But point to point is supposed to use just Starship by itself (likely with some significantly different aerodynamic features to enable skip/glide and longer range in single-stage mode, as Elon has suggested in the past).

A single stage Starship point to point craft therefore only uses about a fourth the fuel, or about 250 tonnes.

That's the same as an Airbus A380, which has about the same volume and passenger capacity.

(And given that there are 129 A380s in service at the moment, that specific plane has approximately the same flightrate and annual fuel consumption as your 100 Starship point to point flights per day.... and over twice that many 747s... And note that 61 747s have been lost in flight, with 3,722 fatalities.)

So even this very high flightrate of 100 flights per day isn't a huge deal any more than similar capacity of regular long haul aviation is. The difference with Starship is it'll use a propellant that's much easier to synthesize using solar electricity and water and air, and this technology is essential to enable Mars (as well as pretty dang useful on Earth to fight climate change).

100% of global natural gas production can support 10,000 Starship flights per day.

6% of global oil production supports over 100,000 commercial aircraft flights per day.

[TheRadicalModerate]

Correct, but the same argument applies about equally to regular passenger aviation, except that it's easier to synthesize methane than kerosene.

10,000 combination SS/SH flights. But point to point is supposed to use just Starship by itself (likely with some significantly different aerodynamic features to enable skip/glide and longer range in single-stage mode, as Elon has suggested in the past).

A single stage Starship point to point craft therefore only uses about a fourth the fuel, or about 250 tonnes...

100% of global natural gas production can support 10,000 Starship flights per day.

6% of global oil production supports over 100,000 commercial aircraft flights per day.

Are you guys on the right thread?

[InterestedEngineer]

[
1) Probabilistic risk assessment, which will be what NASA wants eventually.  They can probably do this with launch after a few dozen launches, because Starship isn't a particularly weird platform on launch.  But I don't even know how you'd go about constructing a credible failure network for EDL, to say nothing of assigning failure probabilities to enough nodes to make PRA useful.

2) If PRA won't work, they'll have to do empirical measurements of reliability.  The traditional way to do this is to simply measure the successes and failures, develop a standard error for the instantaneous reliability success/(success+failure), and display a range that represents the confidence interval for the reliability.  The problem with this is that it weights past failures too heavily, especially considering that engineering improvements should largely fix whatever caused the early failures.

3) This is the point where my statistical knowledge fails me, but there is presumably some sort of quasi-bayesian way of improving our knowledge of the reliability over time, such that whatever we use as a not-very-well-informed prior (say, the reliability of the first 50 missions) gets washed away as we get new data.

Why not all three at once?

A credible failure network for re-entry is easy. In the course of 100 tanker missions, I'm quite sure tiles will be lost in a known hotspot.   That provides data for both a credible failure network, for empirical, and bayesian model all at once.

Not to mention all the data from the massive instrumentation on each flight (e.g. infrared camera inside the tanks to look for hot spots on re-entry)

Going back to my ancient Shainin Quality training, macro pass/fail data converges very slowly to confidence.   Continuous distribution data on all different critical areas of a device converges much more quickly.

[sebk]

2) Unless the LAS somehow compromises the basic architecture, any system + LAS has a lower pLOC than the system alone.  So if there's a simple way to graft on a LAS, it gets Starship launching crews a lot sooner.

There's clearly an argument to be made that a LAS will somehow compromise the architecture.  I don't buy it.  A LAS will obviously dramatically reduce the performance of Starship for crewed missions, but why should they care?  They have tens of tonnes of mass margin to play with.  The only real constraint that a heavy LAS imposes is the requirement that BEO crews transfer to a more mass-optimized Starship in LEO.

Let's start with "at extremis" case: what if you added ejection seats to a passenger transport airplane? Would it improve the safety or not? The answer is clear: it would be detrimental to the safety in multiple ways. For example consider a crash like 777 in Heathrow or in SF -- triggering ejections would kill more people than save. But also, ejection seats are sometimes tiggered inadvertently, or due a fault or due to improper maintenance (look up horror stories about maintenance tech bodies pinned to a hangar ceiling).

So it's clear LES would be an disadvantage for something as safe as transport plane.

The general agreement is it's an advantage for XX century tech rocketry, albeit the number of cases LES saved life and took life is actually equal. But there was also an accident (Challenger) where LES would save life were it present in the first place. Also the statistics are pretty thin (2 cases where it unequivocally could save life 1 of which it was actually present, vs 1 case it took life, and 1 case it was triggered but wasn't essential, i.e. regular separation would have the same end result).

LES means explosives / hypergolics close to the crew.


Somewhere between those two extremes is the point where LES is merely neutral, i.e. it would save people in some cases but would be detrimental in others, and the aggregate probabilities balance.

It's also that LES eats mass budget which could be used for more effective measures, like for example ECLSS redundancies, or double hull, or extra emergency supplies, or repair kits, or... The game is  minimizing total chanes of loss of life, not just one particular failure mode.

[Lee Jay]

Correct, but the same argument applies about equally to regular passenger aviation, except that it's easier to synthesize methane than kerosene.

10,000 combination SS/SH flights. But point to point is supposed to use just Starship by itself (likely with some significantly different aerodynamic features to enable skip/glide and longer range in single-stage mode, as Elon has suggested in the past).

A single stage Starship point to point craft therefore only uses about a fourth the fuel, or about 250 tonnes...

100% of global natural gas production can support 10,000 Starship flights per day.

6% of global oil production supports over 100,000 commercial aircraft flights per day.

Are you guys on the right thread?

If you're talking about thousands of launches to achieve safety certification, this matters.

[edzieba]

But there was also an accident (Challenger) where LES would save life were it present in the first place.

Point of order: Whilst it may be possible to design an abort system that would have survived Challenger, the ejection seats fitted would have been ineffective for the same reason an Aries I abort would have been unsurvivable: the cloud of solid propellant fragments would have precluded effective parachute use, even if proximity to those fragments was not directly fatal (as a suited ejection likely would have been).
Beyond nitpicking, this - and the case of Aries I in particular - highlights that vehicle design is as much a part of abort safety as the abort system itself.

[sebk]

But there was also an accident (Challenger) where LES would save life were it present in the first place.

Point of order: Whilst it may be possible to design an abort system that would have survived Challenger, the ejection seats fitted would have been ineffective for the same reason an Aries I abort would have been unsurvivable: the cloud of solid propellant fragments would have precluded effective parachute use, even if proximity to those fragments was not directly fatal (as a suited ejection likely would have been).
Beyond nitpicking, this - and the case of Aries I in particular - highlights that vehicle design is as much a part of abort safety as the abort system itself.

In the case of Challenger SRBs were intact for ~15s after disintegration and the were both quite a bit to the side then FTS was activated. Also there was a parachute (from SRB nosecone) which deployed and survived intact till ocean touchdown.

But the point is had Challenger proper LES it'd have likely worked to the extent it could (i.e. whole cabin LES was likely to save everyone while ejection seats would only save those who were sitting in them).

[steveleach]

Correct, but the same argument applies about equally to regular passenger aviation, except that it's easier to synthesize methane than kerosene.

10,000 combination SS/SH flights. But point to point is supposed to use just Starship by itself (likely with some significantly different aerodynamic features to enable skip/glide and longer range in single-stage mode, as Elon has suggested in the past).

A single stage Starship point to point craft therefore only uses about a fourth the fuel, or about 250 tonnes...

100% of global natural gas production can support 10,000 Starship flights per day.

6% of global oil production supports over 100,000 commercial aircraft flights per day.

Are you guys on the right thread?

If you're talking about thousands of launches to achieve safety certification, this matters.

Not really. They don't need hundreds of flights a day to get the safety record they need, and by the time they are at hundreds a day they will be synthesising the methane anyway.

This whole sub-thread is only vaguely related to abort options anyway. Does anyone other than Robotbeat and Lee Jay care about it?

[Hog]

But there was also an accident (Challenger) where LES would save life were it present in the first place.

Point of order: Whilst it may be possible to design an abort system that would have survived Challenger, the ejection seats fitted would have been ineffective for the same reason an Aries I abort would have been unsurvivable: the cloud of solid propellant fragments would have precluded effective parachute use, even if proximity to those fragments was not directly fatal (as a suited ejection likely would have been).
Beyond nitpicking, this - and the case of Aries I in particular - highlights that vehicle design is as much a part of abort safety as the abort system itself.

Emphasis mine
Are we talking about the nominal cloud of SRB exhaust, or a cloud of SRB products released following a SRB RUD?

That Ares-1 case IS certainly an interesting one.

At least with SS/SH the propellants are liquid/gas to begin with.

I also just wanted to highlight to the group that the mains of most parachute systems don't deploy until under 15,000 feet. I can't remember if the SR1 ejection seat used during STS-1 through STS-4(USAF Blackbird heritage)some sort of stabilization drogue until under 15,000 ft, but I'd guess that there was.  There's also the reserve chutes in cases an ejectee looks up and sees a bunch of "garbage" streaming from the chute risers.  The Shuttle Escape/Ejection Suits should have offered at least a bit better protection than those cotton flight suits used during STS operational missions.  They really went for broke when they made STS a Shirt sleeve crew environment. Breathable air and chutes at the minimum. Such a cluster.
The seats only improved LOC/V odds from 1/9 to 1/12.

[Lee Jay]

Correct, but the same argument applies about equally to regular passenger aviation, except that it's easier to synthesize methane than kerosene.

10,000 combination SS/SH flights. But point to point is supposed to use just Starship by itself (likely with some significantly different aerodynamic features to enable skip/glide and longer range in single-stage mode, as Elon has suggested in the past).

A single stage Starship point to point craft therefore only uses about a fourth the fuel, or about 250 tonnes...

100% of global natural gas production can support 10,000 Starship flights per day.

6% of global oil production supports over 100,000 commercial aircraft flights per day.

Are you guys on the right thread?

If you're talking about thousands of launches to achieve safety certification, this matters.

Not really. They don't need hundreds of flights a day to get the safety record they need, and by the time they are at hundreds a day they will be synthesising the methane anyway.

I doubt it.  Synthesizing a tank of methane will consume around 100TJ or 28GWh of energy.  Doing that once a day will take a 5 GW solar array, which is about 100 square kilometers in size.

[InterestedEngineer]

Please take fuel discussions to the facilities green fuel production thread:

https://forum.nasaspaceflight.com/index.php?topic=55965.msg2347753#new

[TheRadicalModerate]

2) Unless the LAS somehow compromises the basic architecture, any system + LAS has a lower pLOC than the system alone.  So if there's a simple way to graft on a LAS, it gets Starship launching crews a lot sooner.

There's clearly an argument to be made that a LAS will somehow compromise the architecture.  I don't buy it.  A LAS will obviously dramatically reduce the performance of Starship for crewed missions, but why should they care?  They have tens of tonnes of mass margin to play with.  The only real constraint that a heavy LAS imposes is the requirement that BEO crews transfer to a more mass-optimized Starship in LEO.

Let's start with "at extremis" case: what if you added ejection seats to a passenger transport airplane? Would it improve the safety or not? The answer is clear: it would be detrimental to the safety in multiple ways. For example consider a crash like 777 in Heathrow or in SF -- triggering ejections would kill more people than save. But also, ejection seats are sometimes tiggered inadvertently, or due a fault or due to improper maintenance (look up horror stories about maintenance tech bodies pinned to a hangar ceiling).

So it's clear LES would be an disadvantage for something as safe as transport plane.

Since I don't think ejection seats will work for more than 3-4 people, it's hard for me not to accept your argument as written.  (BTW, all ejection seats are an LES, but all LESes are not ejection seats.  Invalid generalization that's fairly important to the rest of your argument.)

But an abort capsule, encapsulated in a jettisonable fairing, is roughly as survivable as anything used for human spaceflight today.  It's also something that's relatively tractable to analyze using PRA and (I would assume) reduces pLOC substantially.

The general agreement is it's an advantage for XX century tech rocketry, albeit the number of cases LES saved life and took life is actually equal. But there was also an accident (Challenger) where LES would save life were it present in the first place. Also the statistics are pretty thin (2 cases where it unequivocally could save life 1 of which it was actually present, vs 1 case it took life, and 1 case it was triggered but wasn't essential, i.e. regular separation would have the same end result).

Is there a rocketry case where an LES killed somebody?  There are plenty in aviation, but that's not germane.

As for LES = XX century rocketry, that's not exactly true, is it?  F9/D2 and A5/Starliner both have LES, as does SLS/Orion.  It's certainly possible that they have them because somebody in NASA mission assurance has a bad case of groupthink, but these systems all have sophisticated PRA models, and it's easy enough to pull the LES nodes out of the failure tree to see what it does.  I find it hard to believe that somebody didn't perform that exercise and conclude that they had enough marginal utility to be worth it.¹

LES means explosives / hypergolics close to the crew.

LES--as well as every RCS system on every single human-rated spacecraft--has meant hypergolics close to the crew for decades and has only caused one accident (Apollo/Soyuz) that I know of.  As for pyrotechnics, they're a pain, but they're also an avoidable pain (cf. D2).

Somewhere between those two extremes is the point where LES is merely neutral, i.e. it would save people in some cases but would be detrimental in others, and the aggregate probabilities balance.

That's true, but omits the part of the argument where the probabilities are much closer to the "LES unequivocally saves lives" extreme.  Again, unless you're willing to argue that PRA is useless (a viable argument, but you'll have to make it), you should probably assume that reality lies somewhere in the "useful for its purpose albeit annoying and expensive" part of the distribution.

It's also that LES eats mass budget which could be used for more effective measures, like for example ECLSS redundancies, or double hull, or extra emergency supplies, or repair kits, or... The game is  minimizing total chances of loss of life, not just one particular failure mode.

The LES mass budget would be an important argument if all versions of Starship needed an LES or Starship didn't have an obscenely generous mass budget when it came to getting humans to/from LEO.  But neither of those things is true.

This whole sub-thread is only vaguely related to abort options anyway. Does anyone other than Robotbeat and Lee Jay care about it?

If it means we have to have a separate "to abort or not abort?" thread, then let's leave it here.

_____________
¹Marginal utility of course includes not only saving one or more crews, but also mitigating the PR disaster resulting from killing a crew.  Note that that's not solely a NASA problem.  Everybody's gonna wind up before Congress answering difficult/maybe unfair questions following a fatal accident, and serious money will be on the line.  There's more than one form of risk mitigation at work here.

[Robotbeat]

…]

Is there a rocketry case where an LES killed somebody?

there have only been 367 human spaceflight launches ever, so if LES has a fatal flight rate of 1/1000 (even on nominal flights), we wouldn’t expect anyone to have died so far.

There HAVE been major problems on LES systems during tests, including some that would have been fatal. Like the one that destroyed a Dragon capsule during a ground test of the abort system. I think Starliner’s engines have had explosive tests on the rocket stand (not a criticism… this sort of thing is common when developing engines.) Solids (common for abort) also have failures occasionally.

LES typically require parachutes, and there has been a failure of parachute that caused a fatality on Apollo 1.

The fact there has only ever been 367 crewed human spaceflights, a stretch of 400 consecutive successful uncrewed recovered Starship mission cycles seems more than sufficient for proving the system is at least as safe as heritage systems (even those with abort, like Soyuz).

There are plenty in aviation, but that's not germane.

It’s germane because we haven’t had enough crewed launches to really get good statistics on this.