Abort options for Starship and Starship/SuperHeavy

[Barley]

One issue with this, though, is that it may not suffice for a flip-and-burn failure, which arguably is the highest-risk regime. If Starship is plummeting belly-first and fails to flip, then activating the abort will send the crew capsule straight forward relative to the horizon. Potential problem there.

Escape during the flip and burn is very hard.  You maximize performance by doing the flip and burn maneuver at the highest possible acceleration and the last possible moment.  That's why people call it a suicide burn.  Escape requires really fast reactions and even higher acceleration.

That's why I* suggest considering always separating the crew during the belly flop and landing separately.  This is a far easier task in a far more benign environment than escaping at the last minute.  Jumping out of a perfectly good airplane is orders of magnitude safer than the 1/160 or so that has been suggested as the requirement for a "sufficiently safe" landing.

The best place to be in a crash is somewhere else, you don't have to wait until a crash is imminent to do that.

* and probably Negan (credit is due, but I don't want to put words in his mouth)

[Robotbeat]

Or you sacrifice some performance to do the flip early.

Separating the crew every mission sounds like a recipe for cost and unreliability.

[TheRadicalModerate]

Escape during the flip and burn is very hard.  You maximize performance by doing the flip and burn maneuver at the highest possible acceleration and the last possible moment.  That's why people call it a suicide burn.  Escape requires really fast reactions and even higher acceleration.

Low altitude flip and burn is only necessary if you need to optimize for delta-v.  If you're just doing ground-LEO ferrying of crews, you don't have to do that.  Flipping much higher for crewed flights seems like an eminently sensible thing to do, even if it costs a few hundred extra m/s.

There's always the possibility of a failure after engine start and flip, so the escape system needs to be able to work all the way down, through capture on the chopsticks and safe engine shutdown.  But everything's pointed in the right direction if there's a failure in this case.

[Robotbeat]

I think engine out capability during landing addresses a lot of this risk, as does using legs instead of chopsticks for crew.

[chopsticks]

I think engine out capability during landing addresses a lot of this risk, as does using legs instead of chopsticks for crew.

If it lands using legs instead of chopsticks, do the crew have to wait for hours inside while the residual prop boils off?

[DanClemmensen]

OK, let's increase the insanity. Use the reaction wheel and RCS to keep Starship balanced on its tail as long as possible. This should take less energy than a controlled topple. Open valves in the LOX tank to let gas out at the top and water in at the bottom to slowly sink the ship into the water. Vent the methane tank down to about 2 atm to reduce the CoM. When it gets low enough, shut the OX and float like a spar buoy, nice and stable.

Think about what happens when you let seawater @ 290K into a tank filled with LOX @ 90K.  If you're flooding to keep from toppling, you have to do it at a tonne or two per second.  I don't know if a big block of ice freezes off your inlets or if there's vaporization overpressure that does you in, but there are some problems.

And remember that you've got at least three contingencies for EDL abort:

1) Nav failure over water (vertical floating might work).
2) Nav failure over land (might be avoidable as long as you don't allow interplanetary direct EDL).
3) Suicide burn abort (no solution other than an escape system).

You need to burn off nearly all the LOX (and Liquid methane) by hovering just above the surface before opening the water inlet "valve". That valve is more likely a blowout panel. This is an abort to save the crew so the ship does not need to be salvageable. The top valve is a gas vent for the gaseous O₂, and must be re-closeable if we need to keep some gas in the LOX tank, but "should" be able to release the remaining O₂ fast enough to prevent overpressure. Since we can control fill rate using the gas valves, the blowout panels can be as large as needed to overcome the freezing problem.

This system only works if there is deep enough water. I was thinking mostly about (some types of) launch abort.

[TheRadicalModerate]

You need to burn off nearly all the LOX (and Liquid methane) by hovering just above the surface before opening the water inlet "valve". That valve is more likely a blowout panel. This is an abort to save the crew so the ship does not need to be salvageable. The top valve is a gas vent for the gaseous O₂, and must be re-closeable if we need to keep some gas in the LOX tank, but "should" be able to release the remaining O₂ fast enough to prevent overpressure. Since we can control fill rate using the gas valves, the blowout panels can be as large as needed to overcome the freezing problem.

This system only works if there is deep enough water. I was thinking mostly about (some types of) launch abort.

I like the blowout panels at the top of the LOX tank, and you're right that you can manage to minimize the prop--to a certain extent.

You can avoid the hover, because in all the abort modes, you'd engineer your prop level to be almost empty at landing.¹

Even with the LOX tank almost empty, you may have problems.  If you flood from the top, water landing on even a couple of tonnes of LOX is going to freeze while the LOX vaporizes.  The dynamics of that process are... interesting.  Do you get a big enough ice plug that vaporized O2 gets trapped underneath it until the tank pops?  Do you get hunks of ice blown upwards and outwards as projectiles against the tank walls?  Or does everything fizzle nicely, with the ice behaving itself and the vapor harmlessly venting?

Sounds almost like an xkcd-like question:  What happens when you dump a couple hundred tonnes of seawater onto 1-2t of LOX?  Maybe we can make it into What If? Vol. 3.

____________
¹Assuming you put only 255t of prop in a Starship with a 20t crew module/payload, Starship has a T/W of about 6 (5 gee acceleration away from the pad), and you'd need every m/s² of it for a pad abort.  For comparison, the Apollo LES, which was designed to escape from a comparable worst-case explosion with reflected shockwave, had a T/W of 12, with a much faster startup time.  And it didn't need blowout panels to start its engines while mated to a SuperHeavy.

[sebk]

This is probably a stupid idea, but that's never stopped me before:  What if you had an abort system based directly on the D2, with the following modifications:

1) No or dramatically reduced heat shield.  (If all of the abort cases are subsonic or low supersonic, you don't need much TPS.  For supersonic and hypersonic aborts, the Starship is its own escape system--at least until it gets close to the ground and has no chopsticks to land on.)

2) Propulsive landing only, no parachutes.  (So there's no parachute or landing jerk issue, requiring couches inclined through the load axis of the parachutes.)

3) Add in the landing feet, per the old design, to make things relatively safe for landings in rough terrain.

4) No storage for non-crew payload.

5) Remove ECLSS from the D2 and put it in the Starship payload bay, connected via a QD of some kind.

You could go back to at least seven crew, since all significant loads would go through the axis of symmetry again.  The question is whether, by ripping out additional storage, you could go to ten crew?  How 'bout eight (i.e., two vanilla Crew Dragons' worth of passengers)?

It'd be a pretty miserable ride, but it only lasts from launch to RPOD, and RPOD to landing.¹

Note that this still requires carrying the D2 inside the Starship payload bay, with a fairing that can blow away and take the canards safely with it.  That's a non-trivial bit of work there,² but it's a lot less total work if you don't have to build the abort capsule from scratch.

It may be a stupid idea, but it's a stupid idea with artwork!

____________
¹Since there's no heat shield, I suppose you could put a hatch in the bottom that led to a secondary crew space, for use only while on-orbit.  That would also allow you to place the docking port and tunnel someplace where it wasn't in the escape path.  Might that allow you to add an extra seat in the nose? (This may be an even stupider idea than the original...)

²Two very difficult things:
1) The separation plane has to work through the ventral TPS tiles.
2) The separation plane has to bear all canard loads during reentry, but still be able to jettison.

This is very heavy modification which means it'd be appropriately costly.

Moreover you want to use capsule shaped for hypersonic re-entry for subsonic or at most low supersonic operations.  That's a kludge at best.

You could fit 7 maybe 10 people there.

Really, use zero-zero ejection seats instead.

You could seat 12 people in Starship in 2 lines and 6 rows or 4 lines and 3 rows (or asymmetric 3 lines and 4 rows). And while one poster claimed that those ejecting later in ejection sequence would be fried, they missed the obvious fact that every next person would be protected inside the hull while waiting (fraction of a second) for their ejection turn. The sequence for each line would be: blow hull panel, eject occupant from the rear, blow away the next pane, eject the next up occupant, and so on. And the sequence could alternate between the lines for extra clearance.

It's an already solved problem. So less development cost, sooner readiness for use, and better capacity.

[DanClemmensen]

You need to burn off nearly all the LOX (and Liquid methane) by hovering just above the surface before opening the water inlet "valve". That valve is more likely a blowout panel. This is an abort to save the crew so the ship does not need to be salvageable. The top valve is a gas vent for the gaseous O₂, and must be re-closeable if we need to keep some gas in the LOX tank, but "should" be able to release the remaining O₂ fast enough to prevent overpressure. Since we can control fill rate using the gas valves, the blowout panels can be as large as needed to overcome the freezing problem.

This system only works if there is deep enough water. I was thinking mostly about (some types of) launch abort.

I like the blowout panels at the top of the LOX tank, and you're right that you can manage to minimize the prop--to a certain extent.

You can avoid the hover, because in all the abort modes, you'd engineer your prop level to be almost empty at landing.¹

Even with the LOX tank almost empty, you may have problems.  If you flood from the top, water landing on even a couple of tonnes of LOX is going to freeze while the LOX vaporizes.  The dynamics of that process are... interesting.  Do you get a big enough ice plug that vaporized O2 gets trapped underneath it until the tank pops?  Do you get hunks of ice blown upwards and outwards as projectiles against the tank walls?  Or does everything fizzle nicely, with the ice behaving itself and the vapor harmlessly venting?

Sounds almost like an xkcd-like question:  What happens when you dump a couple hundred tonnes of seawater onto 1-2t of LOX?  Maybe we can make it into What If? Vol. 3.

____________
¹Assuming you put only 255t of prop in a Starship with a 20t crew module/payload, Starship has a T/W of about 6 (5 gee acceleration away from the pad), and you'd need every m/s² of it for a pad abort.  For comparison, the Apollo LES, which was designed to escape from a comparable worst-case explosion with reflected shockwave, had a T/W of 12, with a much faster startup time.  And it didn't need blowout panels to start its engines while mated to a SuperHeavy.

Blowout panels are at the bottom. Rate of fill of the tank is controlled by controlling the flow of gas out the top valves. This is like the ballast tanks on a submarine. Yes, I know you compute your EDL to end up with almost empty tanks. I'm proposing a brief hover about a meter above the surface to empty the LOX tank all the way. If you blow the blowout panels while they are still at or just above the sea surface (or within a foot of the surface from below) the final bit if LOX will blow out before the water begins to flow in. The only remaining cooling in capacity in the system is in the stainless steel, and cannot create an ice plug if the blowout panel is big enough.

So now we have our ship vertical with the engines just in the water, engines off, and just beginning to fall by gravity into the water. The panels blow and the last LOX blows out across the surface and the panels become submerged, so water begins to flow in. As gravity accelerates the drop into the water, the remaining O₂ begins to compress (and heat) as water flows in, and the rate of drop eventually decreases as buoyancy counteracts gravity. The magical control system regulates the flow of gas out of the top valves to achieve the correct amount of bouyancy, bringing the whole system to a halt just before it would begin to rebound toward the surface.

If at this point we are still topheavy, we are still being held vertical by the reaction wheel and RCS, and we can begin dumping methane since we are no longer spewing O₂ all over the place.

[InterestedEngineer]

You need to burn off nearly all the LOX (and Liquid methane) by hovering just above the surface before opening the water inlet "valve". That valve is more likely a blowout panel. This is an abort to save the crew so the ship does not need to be salvageable. The top valve is a gas vent for the gaseous O₂, and must be re-closeable if we need to keep some gas in the LOX tank, but "should" be able to release the remaining O₂ fast enough to prevent overpressure. Since we can control fill rate using the gas valves, the blowout panels can be as large as needed to overcome the freezing problem.

This system only works if there is deep enough water. I was thinking mostly about (some types of) launch abort.

I like the blowout panels at the top of the LOX tank, and you're right that you can manage to minimize the prop--to a certain extent.

You can avoid the hover, because in all the abort modes, you'd engineer your prop level to be almost empty at landing.¹

Even with the LOX tank almost empty, you may have problems.  If you flood from the top, water landing on even a couple of tonnes of LOX is going to freeze while the LOX vaporizes.  The dynamics of that process are... interesting.  Do you get a big enough ice plug that vaporized O2 gets trapped underneath it until the tank pops?  Do you get hunks of ice blown upwards and outwards as projectiles against the tank walls?  Or does everything fizzle nicely, with the ice behaving itself and the vapor harmlessly venting?

Sounds almost like an xkcd-like question:  What happens when you dump a couple hundred tonnes of seawater onto 1-2t of LOX?  Maybe we can make it into What If? Vol. 3.

____________
¹Assuming you put only 255t of prop in a Starship with a 20t crew module/payload, Starship has a T/W of about 6 (5 gee acceleration away from the pad), and you'd need every m/s² of it for a pad abort.  For comparison, the Apollo LES, which was designed to escape from a comparable worst-case explosion with reflected shockwave, had a T/W of 12, with a much faster startup time.  And it didn't need blowout panels to start its engines while mated to a SuperHeavy.

Blowout panels are at the bottom. Rate of fill of the tank is controlled by controlling the flow of gas out the top valves. This is like the ballast tanks on a submarine. Yes, I know you compute your EDL to end up with almost empty tanks. I'm proposing a brief hover about a meter above the surface to empty the LOX tank all the way. If you blow the blowout panels while they are still at or just above the sea surface (or within a foot of the surface from below) the final bit if LOX will blow out before the water begins to flow in. The only remaining cooling in capacity in the system is in the stainless steel, and cannot create an ice plug if the blowout panel is big enough.

So now we have our ship vertical with the engines just in the water, engines off, and just beginning to fall by gravity into the water. The panels blow and the last LOX blows out across the surface and the panels become submerged, so water begins to flow in. As gravity accelerates the drop into the water, the remaining O₂ begins to compress (and heat) as water flows in, and the rate of drop eventually decreases as buoyancy counteracts gravity. The magical control system regulates the flow of gas out of the top valves to achieve the correct amount of bouyancy, bringing the whole system to a halt just before it would begin to rebound toward the surface.

If at this point we are still topheavy, we are still being held vertical by the reaction wheel and RCS, and we can begin dumping methane since we are no longer spewing O₂ all over the place.

What problem are you trying to solve by filling up the tank and adding blowout panels?

Keeping in mind "best part is no part"?

[DanClemmensen]

You need to burn off nearly all the LOX (and Liquid methane) by hovering just above the surface before opening the water inlet "valve". That valve is more likely a blowout panel. This is an abort to save the crew so the ship does not need to be salvageable. The top valve is a gas vent for the gaseous O₂, and must be re-closeable if we need to keep some gas in the LOX tank, but "should" be able to release the remaining O₂ fast enough to prevent overpressure. Since we can control fill rate using the gas valves, the blowout panels can be as large as needed to overcome the freezing problem.

This system only works if there is deep enough water. I was thinking mostly about (some types of) launch abort.

I like the blowout panels at the top of the LOX tank, and you're right that you can manage to minimize the prop--to a certain extent.

You can avoid the hover, because in all the abort modes, you'd engineer your prop level to be almost empty at landing.¹

Even with the LOX tank almost empty, you may have problems.  If you flood from the top, water landing on even a couple of tonnes of LOX is going to freeze while the LOX vaporizes.  The dynamics of that process are... interesting.  Do you get a big enough ice plug that vaporized O2 gets trapped underneath it until the tank pops?  Do you get hunks of ice blown upwards and outwards as projectiles against the tank walls?  Or does everything fizzle nicely, with the ice behaving itself and the vapor harmlessly venting?

Sounds almost like an xkcd-like question:  What happens when you dump a couple hundred tonnes of seawater onto 1-2t of LOX?  Maybe we can make it into What If? Vol. 3.

____________
¹Assuming you put only 255t of prop in a Starship with a 20t crew module/payload, Starship has a T/W of about 6 (5 gee acceleration away from the pad), and you'd need every m/s² of it for a pad abort.  For comparison, the Apollo LES, which was designed to escape from a comparable worst-case explosion with reflected shockwave, had a T/W of 12, with a much faster startup time.  And it didn't need blowout panels to start its engines while mated to a SuperHeavy.

Blowout panels are at the bottom. Rate of fill of the tank is controlled by controlling the flow of gas out the top valves. This is like the ballast tanks on a submarine. Yes, I know you compute your EDL to end up with almost empty tanks. I'm proposing a brief hover about a meter above the surface to empty the LOX tank all the way. If you blow the blowout panels while they are still at or just above the sea surface (or within a foot of the surface from below) the final bit if LOX will blow out before the water begins to flow in. The only remaining cooling in capacity in the system is in the stainless steel, and cannot create an ice plug if the blowout panel is big enough.

So now we have our ship vertical with the engines just in the water, engines off, and just beginning to fall by gravity into the water. The panels blow and the last LOX blows out across the surface and the panels become submerged, so water begins to flow in. As gravity accelerates the drop into the water, the remaining O₂ begins to compress (and heat) as water flows in, and the rate of drop eventually decreases as buoyancy counteracts gravity. The magical control system regulates the flow of gas out of the top valves to achieve the correct amount of bouyancy, bringing the whole system to a halt just before it would begin to rebound toward the surface.

If at this point we are still topheavy, we are still being held vertical by the reaction wheel and RCS, and we can begin dumping methane since we are no longer spewing O₂ all over the place.

What problem are you trying to solve by filling up the tank and adding blowout panels?

Keeping in mind "best part is no part"?

The original problem:After a vertical emergency water landing,  a Starship may not survive a topple to a horizontal floating position.
Proposed solution: land vertically and stay vertical using RCS and/or reaction wheel while sinking vertically to a "spar buoy" position by flooding the LOX tank. Starship will not topple at all: it will float vertically.
Objection: inrushing seawater will freeze when it hits the LOX, blocking the valve
Solution: use large blowout panels at the base instead of simple valves to allow dump of residual LOX and seawater ingress.
 

[InterestedEngineer]

The original problem:After a vertical emergency water landing,  a Starship may not survive a topple to a horizontal floating position.
Proposed solution: land vertically and stay vertical using RCS and/or reaction wheel while sinking vertically to a "spar buoy" position by flooding the LOX tank. Starship will not topple at all: it will float vertically.
Objection: inrushing seawater will freeze when it hits the LOX, blocking the valve
Solution: use large blowout panels at the base instead of simple valves to allow dump of residual LOX and seawater ingress.

There is a video demonstration of F9 surviving a topple, even though it was not designed for it.

Look and see if first order equations prohibit survival from a topple.  They don't.   It looks pretty reasonable in fact.  Which is why that F9 survived despite there being zero design intent and in general having a much weaker construction and pressurization than a Starship.

Next step is to try and see if toppling will destroy (meaning explode) a Starship IRL.  Hopefully we get to find this out within the next month or two.

Then keep repeating IRL.  I suspect we'll see a couple of repeats of water landings.

The chain of causation I see you citing for why you are doing the design sets off every system design engineer alarm bell my brain has.   The alarm bell connected to "best part is no part".

[DanClemmensen]

The original problem:After a vertical emergency water landing,  a Starship may not survive a topple to a horizontal floating position.
Proposed solution: land vertically and stay vertical using RCS and/or reaction wheel while sinking vertically to a "spar buoy" position by flooding the LOX tank. Starship will not topple at all: it will float vertically.
Objection: inrushing seawater will freeze when it hits the LOX, blocking the valve
Solution: use large blowout panels at the base instead of simple valves to allow dump of residual LOX and seawater ingress.

There is a video demonstration of F9 surviving a topple, even though it was not designed for it.

Look and see if first order equations prohibit survival from a topple.  They don't.   It looks pretty reasonable in fact.  Which is why that F9 survived despite there being zero design intent and in general having a much weaker construction and pressurization than a Starship.

Next step is to try and see if toppling will destroy (meaning explode) a Starship IRL.  Hopefully we get to find this out within the next month or two.

Then keep repeating IRL.  I suspect we'll see a couple of repeats of water landings.

The chain of causation I see you citing for why you are doing the design sets off every system design engineer alarm bell my brain has.   The alarm bell connected to "best part is no part".

I happen to agree with you, and I think the topple is likely to just work. I was looking for the simplest alternative if the topple does not work, since there are several posts here that raise this concern. Upthread you will see that I also think there is a trajectory that brings Starship in to zero velocity at water level but already at an angle, so the topple does not start at vertical. This is also a "best part is no part" improvement.

[Negan]

Or you sacrifice some performance to do the flip early.

Separating the crew every mission sounds like a recipe for cost and unreliability.

Technically some might be crew, but really, they are all just passengers sort of like Paratroopers are passengers in a C130.

[TheRadicalModerate]

Blowout panels are at the bottom. Rate of fill of the tank is controlled by controlling the flow of gas out the top valves. This is like the ballast tanks on a submarine. Yes, I know you compute your EDL to end up with almost empty tanks. I'm proposing a brief hover about a meter above the surface to empty the LOX tank all the way. If you blow the blowout panels while they are still at or just above the sea surface (or within a foot of the surface from below) the final bit if LOX will blow out before the water begins to flow in. The only remaining cooling in capacity in the system is in the stainless steel, and cannot create an ice plug if the blowout panel is big enough.

Blowouts anywhere pretty much imply pyros to blow them, don't they?  Pyros aren't necessarily bad, especially if the number of crewed flights is fairly modest compared to the number of robotic ones (a good assumption).  But pyros in a LOX tank don't sound wonderful, especially if the probability of an uncommanded blow-out is >0.01%.

You can't run the engines until the lines go dry; it'll make the turbopumps explode, which is a bad property during a landing--even a crash-landing.  The question is whether the sump holds 100-200kg of LOX, or whether it holds 1-2t.  The former isn't a big problem, the latter is.

Blow-out while still in the air might work, but you have to have the engine turbopumps shut down (i.e. preburners off) before you can depressurize the tank, and that doesn't leave much time for LOX to drain out away from the blow-out inlets.  Also, you want the tank pressurized on impact, even from a meter or two, because you don't want it to crumple or break open.

So now we have our ship vertical with the engines just in the water, engines off, and just beginning to fall by gravity into the water. The panels blow and the last LOX blows out across the surface and the panels become submerged, so water begins to flow in. As gravity accelerates the drop into the water, the remaining O₂ begins to compress (and heat) as water flows in, and the rate of drop eventually decreases as buoyancy counteracts gravity. The magical control system regulates the flow of gas out of the top valves to achieve the correct amount of bouyancy, bringing the whole system to a halt just before it would begin to rebound toward the surface.

I think you want an uncontrolled vent that pops at the same time as blow-out, because the goal is to get seawater in as quickly as possible.

If at this point we are still topheavy, we are still being held vertical by the reaction wheel and RCS, and we can begin dumping methane since we are no longer spewing O₂ all over the place.

Is the issue that you need to flood the methane tanks as well?  Because dumping methane into an atmosphere with oxygen in it, at what's more-or-less a crash site, doesn't sound like a great plan, LOX or no LOX.

However, don't put heavy payloads on crewed flights.  I haven't done the math, but I suspect that your CoG is now underwater if the crew module is the only payload and weighs <20t, the LOX tanks are flooded and the thrust structure and engines are dangling down.

So:  Not to give you a hard time, but how does this help pad abort?  For that matter, how does it help survive a failed flip maneuver?  You have to cover all the survivable abort contingencies, or it's not worth it.

[TheRadicalModerate]

This is very heavy modification which means it'd be appropriately costly.

Moreover you want to use capsule shaped for hypersonic re-entry for subsonic or at most low supersonic operations.  That's a kludge at best.

It's the cheapest kludge I could think of, reusing as much tech as possible.  Yeah, it's fairly costly.  But the alternative is to wait for enough empirical data to prove, probably at a 95% confidence level (or a 95% credible interval, as the bayesian cool kids say), that Starship has a pLOC<1/1000 on both ascent and EDL, and therefore doesn't need an abort system for those regimes.  It only takes a couple of failures deep into the program to make that take a long time,¹ and time is money. 

Really, use zero-zero ejection seats instead.

You could seat 12 people in Starship in 2 lines and 6 rows or 4 lines and 3 rows (or asymmetric 3 lines and 4 rows). And while one poster claimed that those ejecting later in ejection sequence would be fried, they missed the obvious fact that every next person would be protected inside the hull while waiting (fraction of a second) for their ejection turn. The sequence for each line would be: blow hull panel, eject occupant from the rear, blow away the next pane, eject the next up occupant, and so on. And the sequence could alternate between the lines for extra clearance.

It's an already solved problem. So less development cost, sooner readiness for use, and better capacity.

You'll have to explain how this helps in a pad abort, where the ejection path is horizontal, not vertical, and you're ejecting the crew into an environment that's quite likely to be flamey and/or explodey. Ejection seats are just barely steerable, and their purpose is to get the occupant into the slipstream safely, not to blow them clear of an explosion.  And if you're on or near the ground, the assumption is that they're pointed more-or-less up.

______________
¹This is why PRA is good.  If you have late-program failures but your PRA model can account for the failures, you can certify faster than a purely empirical approach.  But your PRA model has to be trustworthy, which means that your spacecraft has to look a lot like previous spacecraft.  That's not going to be true for Starship without a lot of flight heritage.

[sebk]

The original problem:After a vertical emergency water landing,  a Starship may not survive a topple to a horizontal floating position.
Proposed solution: land vertically and stay vertical using RCS and/or reaction wheel while sinking vertically to a "spar buoy" position by flooding the LOX tank. Starship will not topple at all: it will float vertically.
Objection: inrushing seawater will freeze when it hits the LOX, blocking the valve
Solution: use large blowout panels at the base instead of simple valves to allow dump of residual LOX and seawater ingress.

There is a video demonstration of F9 surviving a topple, even though it was not designed for it.

Look and see if first order equations prohibit survival from a topple.  They don't.   It looks pretty reasonable in fact.

Look at that F9's interstage. It was in a bad shape.

I don't care about tanks, tanks don't contain the crew. First order equations require crew quarters to have resiliency of a tank pumped to 3 bar, while the crew would be generally at no more than 1.1 bar. And you'd have all the plumbing for thrusters, header tanks and stuff all around the cabin.

[sebk]

This is very heavy modification which means it'd be appropriately costly.

Moreover you want to use capsule shaped for hypersonic re-entry for subsonic or at most low supersonic operations.  That's a kludge at best.

It's the cheapest kludge I could think of, reusing as much tech as possible.  Yeah, it's fairly costly.  But the alternative is to wait for enough empirical data to prove, probably at a 95% confidence level (or a 95% credible interval, as the bayesian cool kids say), that Starship has a pLOC<1/1000 on both ascent and EDL, and therefore doesn't need an abort system for those regimes.  It only takes a couple of failures deep into the program to make that take a long time,¹ and time is money. 

It was already done for F9. And it was done even before 100 flights mark. The LOCM calculations for Dragon missions didn't include LES (source: Hans Koenigsmann). It was determined to the satisfaction of NASA folks that the Falcon+Dragon meet's NASA LOCM requrements for LEO ops (1:270 for 6-months ISS sortie or 1:500 for launch and descent sortie). Of course it was done using PRA. But NASA is satisfied.

And the kludge is counter-productive because its badly space inefficient, has tons of unused features, requires ton of new features, it's crew capacity is inferior to plain ejection seats.

Really, use zero-zero ejection seats instead.

You could seat 12 people in Starship in 2 lines and 6 rows or 4 lines and 3 rows (or asymmetric 3 lines and 4 rows). And while one poster claimed that those ejecting later in ejection sequence would be fried, they missed the obvious fact that every next person would be protected inside the hull while waiting (fraction of a second) for their ejection turn. The sequence for each line would be: blow hull panel, eject occupant from the rear, blow away the next pane, eject the next up occupant, and so on. And the sequence could alternate between the lines for extra clearance.

It's an already solved problem. So less development cost, sooner readiness for use, and better capacity.

You'll have to explain how this helps in a pad abort, where the ejection path is horizontal, not vertical, and you're ejecting the crew into an environment that's quite likely to be flamey and/or explodey. Ejection seats are just barely steerable, and their purpose is to get the occupant into the slipstream safely, not to blow them clear of an explosion.  And if you're on or near the ground, the assumption is that they're pointed more-or-less up.

Zero-zero ejection seats are designed to work from a stopped craft at zero elevation, and rolled at a 60° angle. To do so the must be able to gain about 100m altitude from such a badly rolled attitude. In the case of Starship on a pad you already have ~130m elevation to begin with. The seat's would be preprogrammed to exit at about 45° to the vehicle's sides and ~30° towards the nose. They'd clear both sides of the launch tower and send escapees few hundred meters into the Boca or Cape marsh.

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

[Lee Jay]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

[chopsticks]

Moreover, launch is the safer part and it's already well understood in general. The seats are the most needed for descent and landing, and there seats operational conditions are even more airplane-like. They'd have the easiest job in the most risky part of the flight which is good as it maximizes pLOC reduction.

I don't understand. The riskiest part of EDL is, I thought, the point near max heating which is at high altitude and hypersonic Mach number.

I think it's generally understood that there are no abort options during this regime.