Abort options for Starship and Starship/SuperHeavy

[TheRadicalModerate]

There are abort options using e.g. a capsule's service module on-board motors to escape a stage that gracefully fails (e.g. contained engine failure), but if the stage RUDs then you don't have a backup abort option. We accept that making the stage sufficiently reliable is an acceptable alternative. We do not demand adding abort-abort motors in the event of an abort motor failure, we just accept that abort motors can be made sufficient reliable.

Actually, the main reason why there were non-LES abort modes for Apollo is that the probability of an explosion generating an overpressure event that could damage the CM/SM dropped dramatically after max-q.  There is a horrible document that lays out the analysis in detail.  I assume that the same analysis, adapted for the size and explosiveness of various platforms, motivated the design of the abort modes for CCP systems.

The common theme is that if a system or component can be deemed to be sufficiently reliable, we are happy to accept that there is no abort mode.

This is not in dispute.  What's in dispute is the definition of "sufficiently reliable", and the determination of that reliability.  This is especially true when you have completely novel flight modes for the entirety of EDL.

Starship is not under that deadline: it can wait to fly enough to demonstrate reliability before launching or landing humans...

Two problems here:

1) There's a non-trivial probability that Starship simply can't be made reliable enough.  Flip-and-burn failures at a rate of 1/50 would be perfectly acceptable for Starship to be a fine cargo platform with excellent economics, but it would never get crew-certified.  Same thing with catch failures.  Same thing with rare hypersonic entry stability problems.

Before you scoff that SpaceX would be easily able to overcome a flip-and-burn failure rate of 1/50, remember that F9's current recovery failure rate is considerably larger than that.  We're in uncharted territory.

2) SpaceX doesn't have infinite time.  They can't retire F9/D2 until Starship is fully crew-certified.  They can't shame NASA into using Starship for end-to-end crew missions until it's crew-certified, which has the knock-on political effect of keeping SLS/Orion alive, which will likely kill Artemis.  All the buzz they get when they can demonstrate an end-to-end mission like DearMoon will eventually fade away if they can't deliver, which is a pretty good way of disabling what could otherwise be a lucrative tourist market.  And of course Elon wants lots of people on Mars before he dies.

So, given that, which is the better course of action?  Keep banging your head against the wall, hoping that everything'll work out OK, or planning to mitigate the obvious danger spots in the conops with escape?

[InterestedEngineer]

Before you scoff that SpaceX would be easily able to overcome a flip-and-burn failure rate of 1/50, remember that F9's current recovery failure rate is considerably larger than that.  We're in uncharted territory.

wut.  They are at about 140 landings in a row

[Lee Jay]

Before you scoff that SpaceX would be easily able to overcome a flip-and-burn failure rate of 1/50, remember that F9's current recovery failure rate is considerably larger than that.  We're in uncharted territory.

wut.  They are at about 140 landings in a row

No, we aren't. We're at 80 in a row since the failure February 2021.

Overall 151 successes and 11 failures after the first success, if I didn't screw up the count, which I might have slightly.  So, roughly 1 in 15 failures overall but on a streak of 80 in a row right now.

[Hyperus]

Before you scoff that SpaceX would be easily able to overcome a flip-and-burn failure rate of 1/50, remember that F9's current recovery failure rate is considerably larger than that.  We're in uncharted territory.

At this point we are at 80 successful landing attempts in a row, with the failure being the only one in the last 100.

Not that 1/100 would be deemed acceptable for Starship, but it should be pointed out that the current successrate is already substantially higher than the 1/50 figure and I don't think its unreasonable to assume that Falcon 9s landings will continue to become more reliable.

Additionally, I think something would need to be quite wrong with the concept of Starship itself for a high enough reliability to be out of the question. I think as with any system that isn't conceptually flawed, the sky is the limit when it comes to reliability.

[sebk]

Before you scoff that SpaceX would be easily able to overcome a flip-and-burn failure rate of 1/50, remember that F9's current recovery failure rate is considerably larger than that.  We're in uncharted territory.

No, we're already there with a continuous string of ~80 successful landings. Of course it could be a lucky strike, but this is improbable. The increasing uninterrupted success runs are compatible with models including learning curve, and incompatible with no-learning ones.

But what's also important, this run has been achieved with a system without redundancies in many critical systems, including propulsion and hydraulics (there's just one hydraulic system critical for all grid fins operation; the system was improved after B1050 landing failure but it remains single string).

Starship is going to have more redundancies.

[Robotbeat]

but it will never be safe enough for the general public, which is it's express reason to exist.

Never say never.

Starship is being built by the company which is regularly transporting people to orbit on the Crew Dragon. Nobody is afraid of flying that one. I think that bodes well for the future of Starship.

Dragon has abort modes and an inherently safe method of EDL (doesn't require a liquid propulsion system to work).  And it's still not safe enough for the general public.

Presence of absence of abort modes does not inherently confer or remove safety. All they do is reduce some specific risk that is not reducible any other way.

We do not care that solid motor abort towers are normally jettisoned just after the first stage burn completes leaving a capsule 'abortless' riding a fully fuelled second (or possibly third) stage. There are abort options using e.g. a capsule's service module on-board motors to escape a stage that gracefully fails (e.g. contained engine failure), but if the stage RUDs then you don't have a backup abort option. We accept that making the stage sufficiently reliable is an acceptable alternative. We do not demand adding abort-abort motors in the event of an abort motor failure, we just accept that abort motors can be made sufficient reliable.

We have demanded that trans-oceanic aircraft must have multiple engines, and have then happily compromised from requiring 4 engines with engine-out to accepting two engines of sufficient reliability without any engine out capability (ETOPS). We do not concern ourselves that aircraft have no abort-modes from wing failure (despite it being a failure mode that has occurred in flight) as long as we have deemed the structure sufficiently reliable and maintained.

No commercial car has an abort system in the event of a steering assembly failure, despite that being a single point of failure. We accept that the assembly can be made sufficiently reliable to not require one.


The common theme is that if a system or component can be deemed to be sufficiently reliable, we are happy to accept that there is no abort mode. In the early days of human spaceflight abort modes were a necessity because there was no avenue to system maturity within the timeframe required to start flying humans within. Starship is not under that deadline: it can wait to fly enough to demonstrate reliability before launching or landing humans, and the only deadline is whether Maezawa is willing to continue to push back the launch date (or willing to pay a little extra for EOR launch/land using Dragon).

I seriously doubt that SS will ever get to be reliable enough for the general public to justify having no abort system. Not without major changes.

In the sense of being in the same category as schedule passenger aviation, I agree. It'll take decades to get there. It'll be beyond 2050 even with the most optimistic assumptions to get to ~99.9999% reliability needed for that (100,000 consecutive successful flights WITH close call analysis and some level of PRA). I don't see Starship going 30 years with no major changes.

But there's a big gulf between where we are and that, where space (and hopefully deep space) becomes accessible to any of the sufficiently-motivated portion of the middle class (think similar to what the suborbital spaceflight folks were targeting, like XCOR and Virgin Galactic).

[Lee Jay]

but it will never be safe enough for the general public, which is it's express reason to exist.

Never say never.

Starship is being built by the company which is regularly transporting people to orbit on the Crew Dragon. Nobody is afraid of flying that one. I think that bodes well for the future of Starship.

Dragon has abort modes and an inherently safe method of EDL (doesn't require a liquid propulsion system to work).  And it's still not safe enough for the general public.

Presence of absence of abort modes does not inherently confer or remove safety. All they do is reduce some specific risk that is not reducible any other way.

We do not care that solid motor abort towers are normally jettisoned just after the first stage burn completes leaving a capsule 'abortless' riding a fully fuelled second (or possibly third) stage. There are abort options using e.g. a capsule's service module on-board motors to escape a stage that gracefully fails (e.g. contained engine failure), but if the stage RUDs then you don't have a backup abort option. We accept that making the stage sufficiently reliable is an acceptable alternative. We do not demand adding abort-abort motors in the event of an abort motor failure, we just accept that abort motors can be made sufficient reliable.

We have demanded that trans-oceanic aircraft must have multiple engines, and have then happily compromised from requiring 4 engines with engine-out to accepting two engines of sufficient reliability without any engine out capability (ETOPS). We do not concern ourselves that aircraft have no abort-modes from wing failure (despite it being a failure mode that has occurred in flight) as long as we have deemed the structure sufficiently reliable and maintained.

No commercial car has an abort system in the event of a steering assembly failure, despite that being a single point of failure. We accept that the assembly can be made sufficiently reliable to not require one.


The common theme is that if a system or component can be deemed to be sufficiently reliable, we are happy to accept that there is no abort mode. In the early days of human spaceflight abort modes were a necessity because there was no avenue to system maturity within the timeframe required to start flying humans within. Starship is not under that deadline: it can wait to fly enough to demonstrate reliability before launching or landing humans, and the only deadline is whether Maezawa is willing to continue to push back the launch date (or willing to pay a little extra for EOR launch/land using Dragon).

I seriously doubt that SS will ever get to be reliable enough for the general public to justify having no abort system. Not without major changes.

In the sense of being in the same category as schedule passenger aviation, I agree. It'll take decades to get there. It'll be beyond 2050 even with the most optimistic assumptions to get to ~99.9999% reliability needed for that (100,000 consecutive successful flights WITH close call analysis and some level of PRA). I don't see Starship going 30 years with no major changes.

But there's a big gulf between where we are and that, where space (and hopefully deep space) becomes accessible to any of the sufficiently-motivated portion of the middle class (think similar to what the suborbital spaceflight folks were targeting, like XCOR and Virgin Galactic).

The fact that it runs on a huge amount of methane may prevent enough flights from happening. Peter Beck and I agree on this.  Watch at 1:22:54 and for the next 90 seconds or so.

[Oersted]

Peter Beck is talking about a far-away future where we have an alternative to fossil fuels and ISP in the 1000's... Not relevant for the foreseeable future.

The methane Starship burns is negligible in Earth's carbon footprint.

- Also, regarding whether the Starship concept can ever be considered reliable enough to fly humans regularly: helicopters and Harriers also looked like crazy impossible unreliable concepts in the early years, yet here we are, nobody has second thoughts about flying them.   

[Lee Jay]

Peter Beck is talking about a far-away future where we have an alternative to fossil fuels and ISP in the 1000's... Not relevant for the foreseeable future.

But what's required to do Starship's stated mission.

The methane Starship burns is negligible in Earth's carbon footprint.

So is every other individual use.  Buy collectively, they add up to a lot.

- Also, regarding whether the Starship concept can ever be considered reliable enough to fly humans regularly: helicopters and Harriers also looked like crazy impossible unreliable concepts in the early years, yet here we are, nobody has second thoughts about flying them.   

Harriers are military where death is expected. Helicopters are way safer than rockets and I definitely know people who won't fly on some helicopters (ICE powered) or in some situations (over water).  I was in a Bell 206 and the pilot said he wouldn't fly in a helicopter that didn't have at least one working turbine engine and recommended I don't either. That resulted in a policy change at work where we were about to send some folks to an offshore platform (not oil) on a Robinson. They switched providers and went in a 407, with two working turbine engines.

[DanClemmensen]

The methane Starship burns is negligible in Earth's carbon footprint.

So is every other individual use.  Buy collectively, they add up to a lot.

For a single high-value use, you can make carbon-neutral methane using electricity instead of using fossil methane. You cannot do that cost-effectively for bulk uses like home heating.

[sebk]

The fact that it runs on a huge amount of methane may prevent enough flights from happening. Peter Beck and I agree on this.  Watch at 1:22:54 and for the next 90 seconds or so.

Huh? Sorry but you sound more and more like arguing for the sake of arguing.

That we're "burning dinosaurs"? The solution to that problem is known, it's called Sabatier reaction and Reverse Water Gas Shift.

Or that we have ISP what we have? Yeah, that's the reality. High thrust high ISP propulsion if either unacceptably risky, or plain out dangerous, or a pipe dream, or any combination thereof.

Planets large enough to hold atmosphere have escape velocity several times higher than the speed of sound in their thermospheres (i.e. ~1500K hot gasses) which means it's also a few times more than what chemical reactions could produce. And the only known means for having a higher energy density pose high risks (because they are nuclear or require exotic states of matter). The alternative of  transferring the energy externally also has tremendous difficulties.

Getting back to Earth (pun intended), actually the problem of loading enough methane (or other chemical fuel) and oxidizer is well understood and in fact solved. You could afford high propellant rations because you don't need heavy wings (about half dry mass of a large airplane are wings), tanks in tanks, strangely shaped tanks, low TwR heavy engines, etc.

 And economically liquid methane is cheap, its price per kg is between 30% to 100% of Jet A-1 depending on world events and economy. And liquid oxygen is about 5x cheaper. And when we eventually switch to synthetic zero-net-carbon fuels, methane will stay cheaper (because it's simpler to produce).

[sebk]

Peter Beck is talking about a far-away future where we have an alternative to fossil fuels and ISP in the 1000's... Not relevant for the foreseeable future.

But what's required to do Starship's stated mission.

Nope. This is pure nonsense. And off topic in this thread. This was discussed extensively in multiple other threads.

The methane Starship burns is negligible in Earth's carbon footprint.

So is every other individual use.  Buy collectively, they add up to a lot.

Even for doing the stated mission it's still negligible. Run the numbers for once:
Global yearly natural gas production: 4000B m^3 * 0.657kg/m^3 = 2628B kg = 2.628B t
Starship liquid methane load: 1050t
Target number of flights per year: 10000
Target yearly liquid methane demand: 1050t * 10000 = 0.0105B t
0.0105 / 2.628 = ~ 0.004 = 0.4%

- Also, regarding whether the Starship concept can ever be considered reliable enough to fly humans regularly: helicopters and Harriers also looked like crazy impossible unreliable concepts in the early years, yet here we are, nobody has second thoughts about flying them.   

Harriers are military where death is expected.

This is ridiculous.

Helicopters are way safer than rockets and I definitely know people who won't fly on some helicopters (ICE powered) or in some situations (over water).  I was in a Bell 206 and the pilot said he wouldn't fly in a helicopter that didn't have at least one working turbine engine and recommended I don't either. That resulted in a policy change at work where we were about to send some folks to an offshore platform (not oil) on a Robinson. They switched providers and went in a 407, with two working turbine engines.

You sound like the differnce is huge. But it's not.

The difference between reciprocating engine helicopters and single turbine is 1.15 accidents per 100k h vs 0.7 per 100k hours. Twin turbine is ~0.5.

[Robotbeat]

The amount of fossil fuel used by a Starship alone (ie for long haul point to point)  is comparable to an a380 jumbo jet, similar number of max passengers possible. With super heavy (ie for orbit), it’s about 4-5 a380 flights.

The difference is methane is a lot easier to make with clean electricity than jet fuel, and they’ll have to do that on Mars anyway.

[sebk]

I think some posters here (especially Lee Jay) have essentially fallen for: familiar = safe, unfamiliar = unsafe

Airplanes became famliar over the last century so everything that looks like a plane looks safe. That's reinforced by the undisputable fact that large commercial transport airplanes are indeed very safe. But it doesn't translate to all aircraft types (Profesionally operated small planes and helicopters are less safe than family cars, and those operated by amateur pilots are barely safer than riding motorbikes)!.

One then supposes that the only safe spacecraft would be a spaceplane powered by magic 2000s ISP high thrust propulsion.

But this is a mixture of familiarity fallacy and pure science fiction. It's not even remotely close to a real life recipe for a safe spacecraft.

In principle you get a safe vehicle not by going by (misleading) feelings of familiarity, but by actually designing the thing to cover operational variability of conditions with high enough confidence.

And there are known techniques to achieve those:

- One is design margins. In aviation structural design margins are 50%. With, careful, precisely controlled manufacturing, qualification, certified maintenance and certified professional operators and tighly regulated and controlled operations this allows to build extremely safe vehicles able to deal with a high variability of the environment they're operating in. But remove professional operators (replacing them with licensed amateurs) and less stringent certification and maintenance and more leeway in operations and you get barely acceptably safe general aviation. But at the same time in my part of the world simple devices for lifting and hauling (during construction, lumberjack works, etc) the mandated design margins are 600%. This is to make up for much more crude workmanship, poor (or lack of) maintenance, uncontrolled storage, and verification being "doesn it look OK", but primarily for operations like: "is this log 2t or 4t? Dunno!".

- Another technique is providing redundancy combined with isolation of failure modes. This one is pretty obvious in general. But also has flavors and degrees. It works the better the more isolation is provided and the less common failure modes remain. Thus sensibly designed unlike redundancy tends to be better than identical redundancy, but the former is not always possible.

- Yet another way is graceful degradation. This is stuff like crumple zones in cars. But it would also be reusable heatshield turning ablative in an emergency or vehicle structure made from a material which would get weakened to make another flight impossible, but still strong enough to survive reentry. Or things like relief vents failing open, isolation valves failing closed or elonerons failing locked (seizing at the current position rather than moving towards an extreme one).
But also the ability to "stop" or for the vehicle to become passive is also a good type of graceful degradation. In the case of spacecraft the obvious one is staying in orbit (it's unavailable for aircraft, as every aircraft must land before becoming passive).

- Then, there's also (obviously) the reduction of the variation itself, by various operational means. Like not flying into storms. Or checklists which includes checking out critical systems before committing to use them.

Any good safe complex system uses all four, choosing which one makes most sense at particular points. So aircraft don't have backup wings, it depends on 50% structural design margin, well repetitive and well qualified manufacturing and regular proper inspections by a certified personnel checking for cracks and other damage. So the accidents where aircraft lose wings are rare (albeit they do happen). But transport aircraft do have engine out redundancy.

So there's nothing making it impossible to implement safe powered landing. If there's a concern about ullage collapse or bubbles in the propellant, then the solution is to provide enough margin to cover 5 or 6 sigma variation (in normal distribution 5 sigma is about 1 in a million oddity while 6 sigma is approx. 1 per 0.5 billion). If there's a concern about the integrity of the plumbing, then the way is to do a leak check before executing deorbit burn. And for the engine out during the landing burn itself - use redundancy and also use the same engine(s) for deorbit burn. Etc.

[volker2020]

It should be clear, that the more we learn about materials, the better we understand the dynamics, using the great advances in sensor analysis and better and better computer analysis, a lot of the problems, that where impossible to predict, or impossible to detect, in fact become manageable. 
Starship has the great architectural advantage, that all parts come back to earth and could taken apart to analyze the stress levels. Acoustic analysis during startup, will tell you a lot about problems, and repeating that exercise again and again will gradually allow you to find the week spots.
Clearly there are a lot of critical areas, but than we are not in the 60th any more. I personally think that the heat shield is will be the most "dangerous" part of the star ship architecture, but even that could be migrated.

[Lee Jay]

I think some posters here (especially Lee Jay) have essentially fallen for: familiar = safe, unfamiliar = unsafe

No.

Intrinsically flies - safer than intrinsically falls.
Can land in a wide area - safer than must land at a specific spot.

SS falls, has to flip under power and then land at a very specific spot - unsafe.

[Robotbeat]

I think some posters here (especially Lee Jay) have essentially fallen for: familiar = safe, unfamiliar = unsafe

No.

Intrinsically flies - safer than intrinsically falls.
Can land in a wide area - safer than must land at a specific spot.

SS falls, has to flip under power and then land at a very specific spot - unsafe.

Not if they decide to use legs for the crewed starships. Airliners have very questionable safety if they lose all engines. The likely result is loss of airframe and everyone on board, not any different from Starship.

[TheRadicalModerate]

I think some posters here (especially Lee Jay) have essentially fallen for: familiar = safe, unfamiliar = unsafe

I'd put it somewhat differently:  unknown = not provably safe.  Due to its history, human spaceflight has had enough loss of life from unanticipated--or ignored--failure modes that the certification techniques rely heavily on a system being well understood in order to be deemed safe.

- Another technique is providing redundancy combined with isolation of failure modes. This one is pretty obvious in general. But also has flavors and degrees. It works the better the more isolation is provided and the less common failure modes remain. Thus sensibly designed unlike redundancy tends to be better than identical redundancy, but the former is not always possible.

It's the "isolation of failure modes" that I'm worried about, especially on landing.  There are so many systems, with complex interactions, that it'll be impossible to figure out redundancy strategies until the dust settles.

I'd also point out that an escape system is pretty much the ultimate in unlike redundancy.

[Robotbeat]

The only way to find the unknown unknowns is flightrate. Just fly it a ridiculous number of times. That beats any LAS.

[TheRadicalModerate]

The only way to find the unknown unknowns is flightrate. Just fly it a ridiculous number of times. That beats any LAS.

It's not flight rate; it's flights.  If SpaceX is willing to incur the negative cash flow to fly it with no payloads, and there are pads and range slots to do so, then they can set an arbitrarily high flight rate and get the number of flights needed to run down the curve.  But none of those conditions is likely to be true.

So (I ask again), which is the better strategy:  Wait however long it takes to get the flight heritage, or build an escape system, even if it's just a stopgap? 

This ought to be a fairly straightforward decision:  If the opportunity costs/lost profit you incur each year by not being able to launch and land crews, times the expected number of years to do a heritage-based certification, is less than the cost to design, build, and test the escape system, then standing pat is the right move.  But if that opportunity cost is larger than the escape DDT&E, then building the escape is the right approach.

Be careful not to let the perfect be the enemy of the good.  You can always get rid of a launch escape system if you have the data to prove that it isn't useful.  But missed opportunities are forever.