Falcon Safety Issues Persist Between NASA and SpaceX
Elon Musk’s SpaceX is using a powerful rocket technology. NASA advisers say it could put lives at risk, Washington Post
“… But in a 2015 letter to NASA, Thomas Stafford, a retired Air Force lieutenant general and then chairman of the agency’s space-station advisory committee, wrote that “there is a unanimous, and strong, feeling by the committee that scheduling the crew to be on board the Dragon spacecraft prior to loading oxidizer into the rocket is contrary to booster safety criteria that has been in place for over 50 years, both in this country and internationally.” At the hearing this year, William Gerstenmaier, NASA’s associate administrator for human exploration and operations, said the agency had not decided whether it would allow SpaceX to load crews before loading the fuel, but he did not rule it out. He vowed that the agency would “make sure that we’re really, really safe to go fly, and the system is ready for crew before we put them on board.”
And folks wonder why he is moving on beyond Falcon/Dragon to focus on BFR?
Also, if I recall, weren’t they topping off the tanks on the Saturn V until just a few minutes before launch due to boil off?
NASA has said they have not done fuel loading with crew onboard.
And I’m fairly sure that, on both the Shuttle and Saturn V, there were some pipes and hoses still connected until quite late in the process. (E.g. after the crew were on board.) Sometimes, NASA press statements are a bit vague and skip over some details. Without digging, we have no way to tell if “just topping off” counted as “fueling” to the person who made that statement.
I recall what I read is that you have boil-off/top-off going on while gazillions of folks are crawlin over the rocket loading crew with hatch doors open and all that sort of thing…vs doing all that with empty fuel tanks and then fueling while the crew are buttoned up inside the capsule with the launch abort system primed and ready and all those support personel shuttled off to a safe distance.
Keith? fcrary? Am I correct?
There are not “gazillions” of folks, but there are folks.
Well…gazillions…rounded down a bit. 😉
From what I remember, after the Shuttle was fueled only the astronauts and closeout crew were at the pad. I remember Shuttle astronauts commenting on this, that on their previous visits to the pad there would seem to be people all over the place, but on launch day when they arrived at the pad it was a ghost town except for them and the closeout crew, with everyone else at least three miles away. I remember one astronaut saying that it gave them an “everyone else seems to know something” feeling. The only exception that I am aware of is if something needed to be looked at, like checking for ice formation, etc., a very small number of pad personnel (like about three people) would drive out to the pad, look at whatever they needed to, then hightail it out of there. The only other exception was the firefighters sitting inside an armored personnel carrier just under a mile from the pad, wearing protective suits. Incredibly they stayed there during launch. Reportedly they didn’t see much of the launch but they sure felt and heard it.
Undoubtedly, the period of full initial fueling is more dangerous than the period of subsequent topping off, but conversely, crew buckled in with the Launch Abort System online are safer through the entire process than the crew and closeout team would be while loading the crew on a pre-fueled rocket.
Yes, and the you have the case of Soyuz T10-1 in 1983 to prove it works. The crew were in the capsule while fueling. It caught fire and exploded, but the launch abort system saved them.
https://www.youtube.com/wat…
P.O.O.: The failure occurred during the countdown and not the fueling. The stack is fueled prior to the crew boarding: They load from railcars and need to get them the hell away. The event happened close to a point in the timeline where they stop the O2 and N2 top off (~T-90s), so that could be driving the confusion there. AFAIR the abort was manually initiated from the control room and not FDIR induced. Given the ground cables were burned and they had to go to a back-up which took a hell of a long time to work. The OODA loop was very tight in reality: Top call if so.. maybe not quite up there with Stanislav Petrov’s.
So then the same type of accident could happen to a current Soyuz launch with astronauts aboard following the “safer” procedure of fueling before the crew is aboard.
Indeed but if you look at Soviet failures many are driven by scheduling pressures by passing due diligence . Third five year plan anniversary etc. Not a million miles from NASA and their normalization of deviance.
I checked with a space historian friend. Saturn V cryos – LOX on all three stages, and LH2 on the two upper stages – were continually topped off (to replace boiloff) until tank pressurization, a few minutes before launch. Also, the first stage kerosene fuel was for some reason overfilled, with surplus drained off late in the count. Also, some helium loading went on late in the count.
All happening while crew were on board.
The point here not so much being to play gotcha games over the definition of “loading”, but to point out that there is plenty of NASA precedent for doing multiple dynamic things with vehicle propellants while crew is on board.
In other words, SpaceX is clearly being called out here on a matter of degree, not a fundamental operational difference.
Fueling and topping off are considerably different environments. One is chilling down pipes and connections and considerably increasing the weight of the vehicle. The other is more a steady state activity.
Anything prone to go wrong specifically because of either chilldown or vehicle weight increase dynamics will likely have been found during the prior flight readiness engine firing.
At that point the main hazard left is a matter of moving propellants around rather than sitting there statically. And the remaining difference is one of degree.
Yes. Once again it is a double standard. Incidentally it looks like the Russians use a procedure similar to the Saturn V, topping off until 2:15 minutes before launch.
http://spaceflight101.com/s…
Just barely, because the unbilical to the blockhouse burned through and bizarrely the Russians did not give the crew the controls to fire the LAS themselves. They had to wait with flames rising around the rocket until personnel at the remote flight control center were alerted and went through the procedure to fire the abort by radio command.
Hopefully the Dragon2 will have a better Abort procedure 🙂
Dragon 2 has an extra simple process , a wire running the length of the vehicle , broken at anytime causes an Abort!
Overfilling the kerosene tanks was probably done to reduce or eliminate fuel vapor in the tank, which if any oxygen was present would be at risk of explosion if a spark occurred. They would still have that risk just prior to launch but at least for a shorter time period.
Chances are good they would have purged the tank with inert gas before filling anyway.
An alternate explanation is that they may have wanted the 1st stage kero filled exactly to a certain mark after all the various propellant loading stresses have settled in, and it was easier to drain off a bit extra fuel than to pump more in.
Also, I guess, they would have wanted to ensure that the pumps were consistently primed hard. Keeping a trickle flowing through the drains would be a simple way to ensure this. Doubt that there was any desaturation or cavitation risk there with the static head that they had and the pressurization prior to launch. Still bearings… tricksy things!
I was thinking that for simplicity they may have avoided using inert gas, similar to how on the original command module design they used pure oxygen to avoid the complexity of a dual gas system. But if they were using inert gas then your alternate theory seems valid. Perhaps besides being easier maybe draining was more accurate than filling.
I wonder if, back in the day, gasoline was considered equally dangerous.
In any case we can’t possibly have rocket launches approaching the safety of airline launches until fueling is as safe as loading AvGas (or whatever). Surely there are available loading and storage techniques.
RP-1 Is basically Kerosene , but alas they have LOX and Helium as well. A rocket launch can’t ever be as safe as a 747 etc because it requires and explosion by its nature to work
An internal combustion engine involves hundreds of small, contained explosions every second. Just because something involves explosions doesn’t make it an inherent and large risk. Nor do rockets involve explosions. It’s more like a fast, controlled burn of potentially explosive chemicals. The trick is doing that next to (and while pushing around) a big tank of those potentially explosive chemicals. I don’t see an obvious way to make that safe, but it couldn’t hurt to focus on the real problems.
Keith, is it relevant that the primary source cited for objections to the use of densified propellents on SpaceX rockets is “John Mulholland, who oversees Boeing’s contract to fly astronauts to the International Space Station”? Am I being too conspiratorial in associating that with Boeing’s anti-SpaceX pro-SLS ads?
Inquiring minds ….
SpaceX should gently remind everyone of the Nedelin disaster (1960). Maybe a video of it, titled with the casualty count, followed by an overlay mix of the D2 pad abort test and AMOS-6. Amateur overlays of those events show D2 well away before the fireball reached where it was.
Your point is well-taken. But it’s 58 years later. At some point this must be ‘safed’. There are enormous amounts of (potential) energy involved, I realize. But still. If very high frequency rocket launches are going to power us into space, it must be solved. A way to do this safely would surely reduce costs as well.
Doesnt the Block % redesign address this , I was under the impression they changed the tanks for Block 5. Also NASA should be reminded about flying Gemini Astronauts on a Titan II. That used Hypergolic Fuel or How bout not checking the heat shield on the shuttles after launch. Its a dangerous business not all the Danger will ever be removed.
Let’s put it this way: If NASA had an external advisory panel on the subject, Mr. Mulholland would be legally prohibited from serving on it. (He could be on a panel with a broader charter, but would have to recuse himself from anything involving Boeing or an obvious competitor.) Anyone can provide information to a newspaper, so there is nothing illegal about the statements in question. But I’m a little disappointed with the Washington Post. They used to be better at checking sources.
The race to firstness. Keep bringing the issue up and hope someone throws a wrench into SpaceX’s timeline. No one here would be surprised if Boeing played the game that way.
If it really IS a legitimate concern, then it needs to be corrected. If it really isn’t less safe in the overall scheme of things then how do you tell people to shut up about it? You really can’t and shouldn’t.
At the Bangabandhu 1 preflight phone presser Musk answered a question from Stephen Clark of Spaceflight Now,
“I think that issue’s been somewhat overblown. We certainly could load the propellant and then have the astronauts board Dragon. That’s certainly something we could do. But I don’t think it’s going to be necessary,”
https://gist.github.com/the…
Sounds like the breathless media talk is a tempest in a teapot.
NASA doesn’t have a say when none of their astronauts are involved? If so, Musk should just just launch a could of his crews and do flybys of ISS.
But the big question is if the FAA CST will license a launch that goes against NASA recommendations. Isn’t that exposing the FAA CST to risk if something went wrong?
That turf fight is going to happen sooner or later.
FAA’s OCST license is based on public safety, not astronaut safety. And the AMOS-6 static firing accident did not lead to any public injuries or property damage. But having a license doesn’t mean NASA will put its crew on board.
The bigger question is if Musk has a spacecraft that NASA disapproves of, then SpaceX won’t get paid. Who will pay for the launches and spacecraft development? And what will they do in space since they won’t be allowed to dock to the ISS?
I suspect Elon Musk has already written Dragon2 off in his mind. If someone like Bigelow wants to buy a ride on it he will sell it. And if NASA finally approves it fine. But he is focused on the Next big thing which is BFR, and NASA won’t be part of it.
Then there’s OSHA and workman’s comp…someone else, like the FAA, who doesn’t have enough up front space experience to build their own guidelines. They’d probably standardize on NASA guidelines…at least initially.
And how many of these missions will Musk pay for? NASA is the customer. They have a say in what they’re buying.
Hopefully commercial crew gets postponed again so that Russians get more money so that they can finally launch their telescopes. They’ve been postponed more times than JWST.
Huh? What Russian telescopes?
Exactly. Spektr RG and Spektr UV. And if you didn’t know the biggest space telescope in history is Russian Spektr R. They are great, they would be really great if they launched 10 years ago.
RADIO telescope….a HUGE different in complexity and cost vs. UV/Vis/IR
I have no idea why this came up, but the Russians have floated ideas for orbital telescopes. The one I paid the most attention to was a Hubble-class UV telescope. But they’ve never had the money to get beyond concept studies. It’s always been a search for international partners. But it did generate a memorable quote, to the effect that they were happy NASA and American astronomers weren’t interested; if they were, the hypothetical project would have had to deal with US export control laws and ITAR.
Spektr Roentgen- gamma is almost complete but it has been a year from launch a while now. Spektr UV is also being built with Germany as a partner. I was thinking that more American money for Soyuzs could help them get launch sooner. Couse realistically space exploration doesn’t really lose much if commercial crew is delayed.
Why would the U.S. want to pay Russia to fly Russian telescopes?
Presumably he refers to profits from launching NASA crew (Russia now charges $81 million per seat, I think?) being used to support other activity.
Another Jeff Bezos anti SpaceX bassing beating-up Elon Musk totally unfair without including whole story of September 2016 Falcon 9 Rocket Expioded on pad 40. Cause by filling LOX too fast and made COPV bottle heat-up explode inside the Second stage LOX tank to fail inflight. I would’ be surprized if Jeff Bezos and John Mulholland are Colluding against SpaceX in a Propaganda Hit Piece to discredit them before NASA. One last thing I Don’t Trust Washington Post because a lot of their news stores are not back up with real evidence or solid proof thus fake news.
The article seems to be somewhat detached from reality. I think it alludes to the safety board is evaluating the issue. I suspect that NASA wanting to understand the COP explosion better by developing the test stand is an indication that they will go with the board and fuel approach.
SpaceX also redesigned the liquid helium tanks in cooperation with NASA.
However the problem was procedural, the helium tank temperature was allowed to drop below the freezing point of LOX, and the problem was corrected in subsequent launches. The best way to identify deterministic failures is testing; ideally not with the payload in place.
True. And, SpaceX continued to fly Falcon 9 with the necessary procedural changes without further incident. But “the customer is always right”. NASA pretty much insisted the design needed to be changed in order for it to be “human rated”.
And my impression is the changes have or are being implemented and when they are, SpaceX will validate it and everyone will be happy.
I look at this as a reporter with limited knowledge of what’s going on wrote an article.
Or as a reporter, or news organization, with an axe to grind.
We already knew that they were reviewing it. I think few months ago NASA assured someone in Congress that they’d find the safest process for “all” (ie. astronauts and ground crew).
With the advanced materials and the matured software, the 21st
century’s manned spacecraft will be just as safe as the airplanes in the sky.
The future BFS vehicle’s city to city service will show one of the coming new space age utilization.
The 20th century’s educated engineers need the updated education for their brain.
Just as safe? We are a long way from that my friend.
“…safety criteria that has been in place for over 50 years, both in this country and internationally.” In other words we have to do it the way we have always done it in the past which is, by the way, expensive and dangerous not to mention contrary to making real progress. For example, NASA’s insistence on landing by capsule in the ocean instead of by rockets is frustrating. If NASA has a legitimate objection then I am all for considering it, but this is nonsense.
I wonder what the ‘heritage’ reasons are? I would be particularly interested in the Soyuz. Is the driving safety concern there the mass on the ‘pins’. Every thing on the Soyuz stack is pined together liked the fabled Mathematical bridge. The boosters are only held onto the core by dint of the core’s weight on the boosters thrust and the whole stack is similarly held down to the launch pad. How much of the fuel first for the Soyuz is driven by this need?
Safety criteria can be changed but you have to have data and logic to change it and usually, tests to validate the claim. I suspect this is all going on between NASA and SpaceX, but reporters for the WP aren’t aware of it or haven’t looked into it.
Can you tell me your definition of “safe”? Everyone’s definition is different than everyone else’s. None of us is correct. How do you define it? ‘i’m not sure” is an acceptable answer. Anyone else?
Your or my definition of safe isn’t the issue. For something like a launch vehicle, someone (or some committee) sits down and works the standards and requirements. There is supposed to be some logic behind that, even if the criteria is arbitrary (e.g. the one in 270 loss of crew requirement.)
Unless they were just using a random number generator, there was some reason it’s 270 not 260 or 280. Which means the requirement shouldn’t be waived at some later date, without going back and seeing what the original logic was and why it was wrong or doesn’t apply. And, if the logic was wrong, the criteria should be changed for everyone. Just waiving it on a case by case basis because it happens to be inconvenient doesn’t make sense. That’s the sort of decision making which was criticized after both Shuttle accidents.
Yes the 1/270 does have a reason, its 4x lower shuttle’s actual rate, and the lowest industry thought was achievable in 2011.
In other words, they wanted something significantly safer than the Shuttle while still being achievable (by some standard of achievable, which they probably had a consensus about.) Fine. So if SLS can’t do that, the right (logical and procedurally correct) thing to do is revisit choice, see if that balance today is 270 or 120 or what. Or if the underlying logic is flawed and should be changed. Then official change the requirement (not waive it on a case-by-case basis) and apply the new requirement to all launch vehicles carrying passenger.
Sls has different demands, and Orion’s heat shield has to take far more stress
Wouldn’t the newly-designed abort systems be part of this equation?
Yes, but abort systems are never 100% and carry their own risks. Ejecting from a fighter aircraft has been said to be “attempting suicide in order to avoid certain death”.
True, however most ejection fatalities are the result of aircraft speeds and attitudes outside the ejection envelope, as was the case with Robert W. Lawrence, the first astonaut to be killed in the line of duty, although of course he had no choice but to eject and doing so saved the life of the other crewmember. LAS abort from the pad is at least a very clearly defined and tested case, and in the Soyuz T-10 incident it was successful.
Lawrence’s accident occurred in December 1967 nearly eleven months after the Apollo 1 fire. And there had already been several astronauts killed in training flight accidents prior to Lawrence.
I had not heard of Lawrence’s ejection somehow saving the other pilot’s life. Both pilots ejected after their NF-104 slammed into the runway and became briefly airborne again, however when Lawrence ejected the plane had turned sideways so he didn’t reach a high enough altitude to trigger the parachute deployment.
More like attempting quick suicide in order to avoid burning to death while falling 10k feet.
And YET many Pilots have done it and avoided certain death and are quite happy to tell the Tale im sure ! I think I would rather have a compressed spine and a few bruises than be a crispy critter on the pad!
I don’t disagree. I’m just saying that abort systems aren’t 100%. Far from it. For crewed space vehicles, they’re tested few times, if any. Aside from ground tests, SpaceX Dragon 2 did a pad abort test and will do an in flight abort test at max-Q. Boeing Starliner will do fewer tests than that. It’s quite hard to have much confidence in a system that’s been tested so few times.
Quite true. With the traditional “fuel first” timeline the crew has not abort capability while they approach and board the fully fueled rocket. With “load and go” the rocket is relatively free of hazard during crew boarding and the LAS is active during propellant loading.
Solution: NASA Gets out of the Astronaut business, and hires SPace X to provide their own astronauts.
NASA human spaceflight safety rules have always been a work in progress, with all sorts of inconsistencies and impractical requirements relative to actual rocketry SOTA. This never stopped a Shuttle launch.
Every time Shuttle ever flew it did so with a stack of waivers to the official NASA safety rules. SLS at this point, if it ever does fly, looks like needing a stack of waivers taller than the rocket. (The Commercial Crew program has finally forced NASA to begin sorting the mess out, but there’s obviously still a long way to go.)
Densified propellants implying loading propellants with crew already on board has been a known issue for years, to which NASA should have said either “no” or “yes” years ago.
I thoroughly expect SpaceX will fly crew as planned, as long as the F9 block 5 gets through its probationary period without incident.
Either NASA’s HSF “safety” amoeba will then find some way to fudge or waffle this rule (an outright waiver would be too much like an explicit “this risk is acceptable, go for it” decision) or they’ll be overridden from above. Either way, crew will fly to Station on Dragon 2.
Because if the NASA HSF safety rules are used to stop SpaceX on this pretext at this late date, what is to prevent SpaceX from saying “so long and thanks for all the funding”, withdrawing from the Commercial Crew program, and flying with their own test pilots rather than NASA astronauts?
And before anyone tells me “but SpaceX would never fly another NASA mission till the end of time!”, keep in mind that the times are changing. There is a real chance that the final outcome of that confrontation could be NASA HSF (rather than SpaceX) ending up irrelevant. Better to let astronauts do what they do, take calculated risks to fly in space, than to take that risk with the entire NASA HSF institution.
We wouldn’t have dared presume such huberus two years ago, and we might actually be there soon, but the FAA and the Commerce Secretary are in there and would still bow to NASA experience. They wouldn’t be able to get a launch license without a NASA nod. That’s most of the point to Commercial Crew anyway. SpaceX might even be spending more money complying with NASA requirements than they are getting out of them in development funds at this point.
If FAA were to make a non-NASA civil launch license dependent on an explicit nod from NASA on such a contentious political/technical point, I would expect large numbers of people carrying pitchforks and torches to drop by FAA HQ shortly after.
Perhaps not literally – but giving NASA HSF a veto over the civil launches they see as competing with their (rapidly fading) HSF monopoly would be an extremely controversial political issue.
I’m long on record opposing NASA being allowed to micromanage Commercial Crew development to this extent in the first place – Commercial Cargo is a far better model – and this sort of thing is EXACTLY why.
As I said, though, I don’t expect this matter will ever go that far, as wiser heads will most likely prevail.
Agreed, and after the first shots I am quite sure that industry will develop and use their own safety protocols. However, NASA is the Internationally accepted leader in such things and venture-capital firms, insurance providers, the civil service workers at the FAA and OSHA, even some categories of investors, all need to start out on some kind of solid footing.
Sierra Nevada’s Dream Chaser is proof that we don’t need NASA to help move a program forward…but they are also proof that we still need NASA to help a program move forward authoritatively.
Also, I think that COTs-style Commercial partnerships are where NASA wants to go. It’s Congress and their influence and friends of their friends within NASA that keep getting in the way.
I read an article that says that NASA has an aging workforce. Would you like to retire with a pension AND a cushy “part time” job at Boeing?
Besides…the FAA is an unelected government agency. They have no reason to care about what anybody thinks except maybe lawmakers. So bring on the pitchforks. They have a thick hide.
“However, NASA is the Internationally accepted leader in such things…”
Hah. Not hardly. When NASA first started talking to the Russians about buying Soyuz seats, there was an abortive effort to get the Russians to document Soyuz compliance with NASA HSF safety rules. I’d love to have a recording of that conversation. “The Russians told you to take your paperwork and stick it WHERE?!”
The Chinese, the only other country flying people to space so far, seem to also be getting along fine without NASA HSF safety rules. Though I’m sure they have copies, along with everything else they’ve vacuumed up – perhaps they read them when they need a laugh on a slow day…
Well, I don’t mind if the safety rules are excessive, or even a little bit silly in some cases. That’s actually par for the course for the U.S. in general (and our space programs have not killed as many people as the countries that you just mentioned).
I’m saying that they are the accepted experts and other U.S. agencies who need to adopt standards will just look first to them for a template. That template is large and may need review for a good trimming in light of New Space.
Now, if there are silly things being added that NASA doesn’t do themselves, then I have a problem with that.
DOT is a regulatory agency .. NASA is not .. keep NASA away from regulating ANYTHING.
Exactly. But they aren’t willingly regulating. They are establishing a set of standards for use within their own circle of development that other agencies, lacking in knowledge/gumption/initiative, will end up boiler plating.
But not everything NASA recommends makes sense. The whole “lesson learned from the shuttle of separating crew and cargo” was always complete b.s. It was only created so that Administrator Mike Griffin could help justify the insane expense of developing and flying both Ares I (crew) and Ares V (cargo). When Ares was (justifiably) cancelled, suddenly that “lesson learned” went *completely* away since SLS could launch crew and cargo at the same time. In fact, SLS must launch crew and cargo at the same time in order to justify its existence.
Ya. Its always bugged me that these commercial launchers need *many* successful launches in order to qualify for a human rating when the SLS will rate after 1 (maybe two now) launches and the Space Shuttle flew crewed on its first flight.
What he said!
I understand that Block 5 is the answer to compliance for the most part. However it doesn’t resolve the fueling issue! Seems to me i would rather be sitting in the capsule with Launch Abort capability when it explodes then riding an elevator to get to the capsule !
As it is, the Loss Of Crew (LOC) number is supposed to be 1 in 270 or better, but will likely be reduced (waiver?) as both contractors are having trouble meeting it. I believe oribital debris is the main issue. They expect to be close to it which is a lot better than the shuttle’s number.
The one in 270 number includes six months exposure to orbital debris while docked at Station, yes, which doesn’t make sense on a number of fronts. (Will the crews be living on board the capsules? No. Will it be possible to replace a debris-damaged capsule in plenty of time to return the crew safely? In most cases, yes.)
Shuttle’s ultimate safety number was one Loss-Of-Crew per 67 flights, of course. And looking back on all the bullets they dodged on Shuttle’s very first flight that they didn’t even know about till later, I believe the number NASA retrospectively figured out for that flight was 1-in-12 LOC chance.
I agree. Specifically, delaying the initial flights of commercial crew due to the orbital debris danger would make very little sense. It would make more sense to fly the test flights as the orbital debris problem is worked. Even initial flights ought not be delayed given the ability to use ISS as a “safe haven” until a replacement crew vehicle could be launched (presumably either uncrewed or with minimal crew).
The orbital debris issue is real, but at the same time, the Russian modules on ISS didn’t meet NASA’s orbital debris standards. And I really doubt Soyuz would meet the commercial crew standards.
The double standard is a bit baffling.
The double standard as regards Russia is straightforward: Russia (like Shuttle before it) has been in a position to tell the NASA HSF safety bureaucracy to mind their own business, and make it stick. So Shuttle always got its waivers, and Soyuz and the Russian Station elements were quietly exempted.
The Commercial Crew contractors haven’t had that option. They have some leverage, mind, but not that much.
Boeing in any case seems to be going old school in these issues – go along with whatever NASA says, just as long as NASA gets billed for it eventually.
SpaceX meanwhile REALLY didn’t want to end up with two separate F9 versions, one hideously expensively redesigned to meet NASA safety’s full unrestrained wish-list, one affordable for commercial flights. Overall costs and headaches of such a bifurcation would be much higher.
So what we’ve been seeing these last few years is an ongoing, uh, negotiation between SpaceX and the HSF safety bureaucracy over what an F9 should look like to be both commercially affordable and NASA “human rated”. F9 Block 5 is the result.
I take this story as a strong indication that some on the NASA side of the table are still not happy with that result. I don’t think that will matter, because another major part of NASA, Station, really needs functioning Commercial Crew vehicles, soon. We’ll see.
I thought the late loading was because of the super chilled propellants. If SpaceX made the NASA flights expendable could they fuel earlier? Of course that would cut into SpaceX’s profits on the NASA crew flights since there wouldn’t be enough fuel to recover the first stage booster, but there may not be any choice if NASA doesn’t agree to allow the crew to board prior to fueling.
Not sure if the current Merlin engines can even work with un-densified propellants to begin with.
The F9 propellants only got a window of about 30 minutes before they got too warm to stay densified and the F9 losses a fraction of the propellants from broil-off. There wouldn’t be enough total impulse from the engines for the F9 to get anywhere close their current lift performance.
NASA is allowing the cargo Dragon flights with super-chilled propellants already. Along with no personnel at the pad during propellant loading. So that ship have sailed.
The previous NASA propellant loading scheme meant the any ground crew at the pad during propellant loading have a near zero chance of survival if there is a major pad incident.
The difficulty is that the Falcon has no system to maintain the LOX in a subcooled condition. With previous vehicles this was done by recirculation and venting, i.e. the LOX can be filled (at a lower temperature) and drained simultaneously, and the LOX can simply boil off at atmospheric pressure and carry away heat, since it is at its 1 ATM boiling point. The Falcon does not have a recirculation system as the same lines are used for both fill and drain, and boiloff will not keep the LOX at the required temperature, which is well below the boiling point.
Once the hatch is closed and the LAS is active, the crew can leave in a hurry. I might feel safer waiting until then to load propellant. However most major contingencies are the result of unanticipated failure modes, so “what-if” analysis is of limited value, and testing, with careful evaluation of each flight, is the most effective path to safety. The more flights the Block 5 has under its belt before boarding a crew the better.
One area that is unclear to me is the scrub procedure. Is it safer to drain the booster and second stage tanks before the crew secures the LAS and opens the hatch? Should fuel be drained as well as LOX? Can both be done simultanerously?
Could they fill with undensified RP-1 prior to boarding but still add LOX late in the count. It wouldn’t completely eliminate NASA’s concerns, but if NASA is on the fence about it that compromise might be enough to make it acceptable. Unless the new system, being designed to handle cold kerosene, now effectively requires it.
I believe that SpaceX cools the RP-1 as well as the LOX.
Yes they do chill the RP-1 which is why it is loaded late in the count like the superchilled LOX. RP-1 finishes loading about five minutes before launch, LOX about two minutes before launch. Prior to Falcon 9 FT the RP-1 wasn’t chilled, and the LOX was not superchilled it was just kept below boiling. This allowed loading of both to take place much earlier in the count.
What I was suggesting was if they didn’t chill the RP-1 on the crewed flights then it could be loaded prior to boarding the astronauts, perhaps satisfying NASA even though LOX would still have to be loaded after the astronauts have boarded. This however would result in a lower amount of RP-1 that could be loaded, but maybe still enough to land on a barge? Or worst case the first stage would have to be expended. However I’m not sure if my idea is even possible because the current system was designed for chilled RP-1. Using unchilled RP-1 would change temperatures, expansion and contraction in various places, perhaps outside of the parameters of the new system.
I doubt that would placate NASA. RP-1, which is essentially highly refined kerosene, in and of itself, is a quite safe liquid at ambient temperature and pressure (which is what you’re advocating loading first).
LOX, on the other hand, is one of those liquids that can be quite dangerous to work with. Not only is it cryogenic (even if it’s not sub-cooled), it can make just about anything burn. Pretty much anything organic that’s soaked in LOX literally becomes a contact explosive (e.g. asphalt).
NASA needs to finish evaluating the safety of this change and announce the results. My guess is they’ll eventually accept SpaceX’s propellant loading methodology.
I think you may be misreading that I am advocating something. I am just asking a question. I agree the signs are pointing towards NASA accepting late loading of propellants, however we don’t know that until they make a decision and announce it. The implications of NASA not accepting would be quite severe, possibly leading to SpaceX ending its participation in commercial crew. To avoid that SpaceX would have to redesign Falcon to be able to load the superchilled propellants earlier, which may not be possible without extensive modification if at all. More likely SpaceX would just drop out of commercial crew rather than go through all of that, as others have speculated.
My question is if it really came down to that does SpaceX have the option of not superchilling on commercial crew flights, at the cost of not being able to recover the first stage. Per comments from Daniel Woodard, for LOX the answer is no, at least not without extensive modification. So that leaves RP-1. To repeat my earlier comment “It wouldn’t completely eliminate NASA’s concerns, but if NASA is on the fence about it that compromise might be enough to make it acceptable.”
Or it might not. Let’s just hope it doesn’t come down to that.
Yes, my feeling is that hybrid approaches provide no safety advantage. The safety of the “load and go” procedure has nothing to do with the way things used to be done, and everything to do with repeated testing (with careful monitoring) in at least half a dozen unmanned launches to demonstrate reliability before the first human launch.
“Since it is at its 1 ATM boiling point”
I guess I thought the LOX tank was under-pressure, hence temperature control.
usually the vents are closed just before launch to bring the LOX to “flight pressure” typically about 1 atm above atmospheric pressure to provide adequate pressure at the pump inlet and preclude cavitation.
Hmm… this does smack a bit of trolling. Every baby engineer gets the brief on safe-life and fail safe concepts and their applicability across the engineering domains and scales. True the shuttle era NASA morphed from an engineering organization to an operations one. This and the inherent weaknesses of the shuttle as a concept, and the scar tissue, probably tilted the scales a little. Understanding the particular nature of the risk is still in the DNA. It would display a lack of due diligence not to have a conversation about the management of this risk, particularly in light of the F9 history. It would be slightly mendacious to extrapolate that to shading the entire concept, especially with the pad abort scenario in play, unlike shuttle.
Also FWIW….. how many times have we failed a stack during fueling? I can only recall the F9 at the moment. Everything else was during the launch. Please correct me if I am wrong.
There was the Soviet Nedelin disaster during fuelling, and there have actually been a fair number of US ones, too. The only safe rocket is one that never flies or gets near a launch pad. Tgat’s Why SLS is statistically the safest rocket ever built.
Yeah Nedelin and the Damascus Titan and others. They were hypergols/monoprops though I was filtering on LOX for some reason.
The Soyuz T-10 blew up on the pad because of leaking fuel (due to the premature spinup and failure of a turbopump) even though the booster had already been fueled before crew loading. In other words, a problem involving fuel did not manifest during initial fuel loading, but rather later when the crew was onboard. If the crew had not been buttoned up at the time of the failure, they would have been killed.
We’ve done it this way for 50 years sounds more to me like not invented here than it does sound engineering.
Does anyone have a report on the record of what the current roster NASA astronauts and SpaceX astronauts who will actually be strapped in might say about this ? Sure, Gemini-Apollo veteran Gen. Tom Stafford has been there done that … 42+ years ago. I would like to hear from the crew who will actually fly a Dragon and Falcon 9-B.5 , on the topics of launch abort confidence, risk aversion , bureaucratic obfuscations, etc. . Speaking to the so-called advisory committee , we may need to determine if densified brain tissue is also an impediment to manned space flight…
Are astronauts somehow experts on these engineering subjects? Even if they are qualified in a way similar to test pilots?
Is this analogous: asking an airline pilot about the entries of a modern 787? He’s got an opinion, sure, but wouldn’t we want to hear from design engineers instead?
I understand that we lionize astronauts- and in many cases, rightly so. But not all cases, and not on all subjects.
Ultimately it is up to the customer who has the ticket in their hand to be a passenger one what level of risk they are willing to accept. Personally you could not pay me enough to jump out of a plane with a parachute. But I would take a ride to space in a new york minute.
But in this case the customer is NASA, so they are the ones to decide the level of risk to their employees and to their program that they are willing to accept. No different than in the business world. Employees don’t make safety decisions, the employers do. Employees can certainly voice their concerns about a decision, even taking their concerns outside of the company if they feel that their concerns are not being addressed. But what you also see quite often is employees ignoring their company’s safety rules and the company has to reprimand, punish, or even fire the employee for ignoring safety rules. Even if the only person that the employee endangered was themselves.
“NASA” is not riding the rocket. A person is. Those people are out of the loop. You believe if you polled astronauts they would say it is to risky? We have to remember what is driving the “safety” issue. Is it not the true customers.
The person is an employee of NASA. They can choose not to fly if they think something is unsafe. They might experience repercussions but no one can make them fly. However that’s the only power they have, they don’t get to call the shots on safety decisions that are made by the program, unless that authority is given to them by NASA, which isn’t going to happen since NASA has other people designated for that role. That said, NASA does involve astronauts in the discussion more than they used to, or at least they were supposed to post Challenger. But again the purpose for that input is so that they can hear any concerns that the astronauts have. It’s not so that the astronauts can say “Yeah I know the MMT is being told that the risk is beyond the criteria, but I’m willing to take the risk so I say let’s go for it.” That input would be ignored.
The Astronaut Corps historically has been made up of individuals holding multiple degrees. New astronaut candidates (ASCANS) are assigned to numerous departments (engineering, life sciences, etc.) in addition to flight training.
In these roles, they provide input into the finished vehicle(s) design and research programs in addition to taking feedback from the manufacturers and researchers back to their NASA colleagues.
Excellent points. Which I knew when I made that comment but my brain was apparently poked somewhere for the morning 🙂
Not a morning person, myself.
I agree. I think astronauts should have input, since it’s their lives on the line. If the astronauts feel that something seems unsafe to them, their concerns should not be ignored.
However I don’t think the reverse is true. If the engineers think that something is unsafe, it doesn’t matter whether the astronauts are willing to accept the risk, because it’s not the astronaut’s multi-billion dollar space program on the line. As we saw with Apollo 1, Challenger and Columbia, besides the tragic loss of life, in each case the programs were set back one to two years, and also faced at least some risk of being cancelled outright.
Most early astronauts had Engineering Degrees and many oversaw the building of various components in the programs. Most of the current Astronaut Candidates are Qualified professionals in various fields and yes some are Engineers. So yeah they might have an informed opinion.
A significant number of astronauts over time have been engineers, and very well acquainted with the details of the rockets they hope to ride.
That said, people at NASA who hope to eventually get assigned a ride to space tend to keep any politically contentious thoughts to themselves. So you’re not likely to hear current NASA astronaut opinions either way on this one.
As for SpaceX, they seem to prefer to let Elon and Gwynne do the talking. And politically SpaceX does not want to rub NASA’s nose in the possibility of anyone other than NASA astronauts flying missions – it’s a sensitive point. So we’re not likely to hear much from SpaceX test pilots anytime soon.
FWIW, over the years I’ve talked with a number of retired-from-NASA astronauts, all seemed thoroughly aware of the historical more-or-less 1% odds of dying on a given flight, and none were deterred by that. About the same odds as a year combat tour of then-hot Afghanistan, was one comparison that came up.
This the same unfair type of article and issue that was brought up by anti-SpaceX groups and companies after the explosion from the helium tanks. The writer seems to make no effort to balance the story.
Falcon 9 Block 5 puts the helium tanks outside the oxygen tanks, I believe. Please correct me if I am wrong. Several Block 5 launches will be accomplished before a crew is put on one.
Let’s say you fill the tanks and THEN have the crew start to board the capsule. Note that this would mean that some pad crew members would also need to be right outside the capsule.
THEN, what if for some heretofore unknown reason, the rocket decides to blow up WHILE THE FLIGHT CREW IS GETTING INTO THE CAPSULE and while the pad crew is still there.
if the crew is already IN the capsule with the hatch closed, the escape system can yank the capsule away from the rocket as fast as the rocket can explode, saving them. It can react faster than a human can react.
Once the crew is in the capsule and the hatch closed and the pad crew who help them in have cleared the pad, the escape system can be armed BEFORE loading any propellant. If there is NO propellant in the rocket, it is VERY hard for it to blow up.
The logic of a rocket powered escape system is that TWO separate systems are very unlikely to fail at the same time. This is by FAR the safer way to do it and has been done that way for over 50 years.
This kind of propaganda relies on the IGNORANCE of the casual reader as to normal pad procedures. Most of the readers here will pick up on the unfairness immediately.
John
Careful, Man.
You are using a whole bunch of valid points.
🙂
Helium tanks are still inside the Oxygen tank. That’s not changing on block 5. I believe the issue is that SpaceX has incorporate improvements in the Helium tank design (maybe NASA driven?) in the block 5. With the F9 launch rate, they should easily get enough flights in before a manned mission.
the helium tank rupture was an operational issue; the temperature of the helium was allowed to drop below the temperature at which oxygen freezes solid.
“This is by FAR the safer way to do it and has been done that way for over 50 years.”
Just to clarify, if you are referring to the launch abort system, this was the case with Mercury and Apollo. Gemini and the four initial Shuttle missions used ejection seats, which the astronauts were somewhat skeptical about, and the operational Shuttle did not have a LAS. If you are referring to the loading sequence, SFAIK all previous human launch systems have loaded propellants first. SpaceX is the first to propose “load and go” driven not by safety (although it may indeed be safer) but rather because there is no practical way to maintain the LOX at the subcooled temperature needed to keep it densified for an extended period while the crew boards. In theory a LOX recurculation and cooling system could be added but ice accumlation could become a problem.
Wih the older rockets prolonged lanch holds were very common so some form of “stable replenish” with the tanks full for an extended period was needed and densified LOX was not used.
Still I would rather be safe in a capsule with an Abort system then riding the elevator to the capsule when my rocket blew up !!
As long as we’re following the money trail, who owns the Washington Post? Uhhhm, that might be Jeff Bezos, who also owns Amazon and Blue Origin. And where was this reported, uhhhm, the Washington Post.
“there is a unanimous, and strong, feeling by the committee that scheduling the crew to be on board the Dragon spacecraft prior to loading oxidizer into the rocket is contrary to booster safety criteria that has been in place for over 50 years, both in this country and internationally.”
Internationally? You mean the United States and Russia .. no one else was launching humans 50 years ago. Has china been sitting down in meetings with the US and Russia to establish these international norms?
SpaceX have been incrementally improving their technology and hardware ever since their inception. This has been just another step on that road and NASA has been aware of it for a long time. I fully expect to see it disappear as an issue.
Cheers
My opinion is that if the rocket suddenly blows up during or after fueling on the pad, you want the crew inside of the spacecraft and launching a pad abort and all support personal safely in bunkers. Waiting until the rocket is fully fueled and then loading the crew exposes them to extreme horrific danger, assuming it suddenly blows up simply because they and their support personnel are outside of the spacecraft. You can’t do a pad abort while standing or climbing the gantry. A pad abort is designed to take the crew safely away from a rocket blowing up on the pad. Just because safety experts have been doing it the old way for 50 years and comparing to historical pad catastrophes doesn’t necessarily mean we should keep doing the same old thing. If we keep doing the same old thing, innovation comes to a stand-still. For example, if innovation was disallowed, we would still be throwing completely good rockets into the ocean and driving the cost and launch schedule to the point of where we’re at now, which is a multi-billion dollar SLS that may not launch more than once or twice while reusable rockets corner the market and leave NASA in the dust.
I recall an article in Aviation Leak, PRIOR TO the first Shuttle launch that NASA stated “failure” of an SRB was regarded as UNSERVIVABLE! And, IT TURNED OUT TO BE! So why did they ever fly a shuttle? It would appear (there have been no more on-pad explosions during loading of super-cooled propellants) that SpaceX is taking steps to prevent a further event of that nature. What is the difference in risk-taking between those steps and the redesign of the Shuttle SRB’s after Challenger? You have a problem, you fix the problem and press on! Of course, in the case of the SRB’s, if joint leakage was fixed, there was always the possibility of a case-bond separation that could result in an in-flight burn-through, like we had on a Titan launch vehicle. That is, of course, if you have become so risk-adverse that you are terrified of getting out of bed in the morning! Eventually, NASA is going to have to come to grips with some degree of risk. Oh, and if they are looking for volunteers to climb aboard a Block 5 (and, if they’d take a 75+ year old astronaut who probably couldn’t pass the physical nowadays) just call me! I’d sooner take my chances of fueling a super-cooled launch vehicle than riding with a pair of firecrackers on either side of the core as with SLS!
Ad LEO! AD LUNA! AD Ares! AD ASTRA!
perhaps the headline should change from “safety issues” to “safety opinions” ? Can NASA explain the safety hazards, other than “we’ve never done it that way” ? Once these hazards are defined I’m sure SpaceX can put some mitigation words in place, maybe some actions too ? Presumably SpaceX have already done some sort of safety assessment expanding on “we’re doing this to save time and money” ?
The cause of the SpaceX pad explosion was understood within a couple of weeks of the event. Due to an unanticipated failure mode in an untested procedure, the temperature of the helium entering the COPV pressure vessels in the second stage LOX tank dropped below the freezing point of oxygen, causing the small amount of LOX that permiated through the composite tank windings to freeze solid, causing more oxygen to be pulled into the matrix. The corrective action, once the failure mode was understood, was simply to set a lower limit for the temperature of the helium entering the pressure vessels.
SpaceX’s fueling profile is different than NASA’s… got it. The last time I check however, NASA doesn’t close out fueling due to boil off until the tank pressurization event just prior to lift off with the crew onboard.
In both instances, the crew escape system is SUPPOSED to get them away from a pad incident.
So I’m failing to see the problem.
NASA… your CYA is getting old and tiring.