Chapter 6

6.1 Overview of Launch Vehicle Reliability

A launch vehicle is one of the most complex machines humanity has ever built. Millions of parts must work flawlessly, and a single critical defect can lead the entire mission to failure.

6.1.1 Launch Success Rate

The launch success rate is the most direct indicator of launch vehicle reliability.

6.1.2 Major Failure Modes

An analysis of past launch failures shows that several principal causes recur. Propulsion problems are the most frequent category; the remaining categories are listed in no particular order.

Propulsion System Failures

• Engine malfunction: turbopump breakage, combustion instability
• Propellant feed problems: valve failure, line rupture
• Examples:
  • Falcon 9 CRS-7 (2015): second-stage LOX tank rupture
  • Antares (2014): first-stage engine explosion

Structural Failures

• Aerodynamic loads: structural failure in the Max Q region
• Stage separation problems: incomplete separation, collision
• Examples:
  • Space Shuttle Challenger (1986): SRB O-ring failure → external tank rupture

Guidance/Control Failures

• Software bugs: incorrect trajectory calculation
• Sensor malfunction: IMU, GPS errors
• Examples:
  • Ariane 5 maiden flight (1996): software overflow

Electrical/Electronic Systems

• Loss of power supply
• Loss of communications
• Wiring short circuits

Other

• Ground system errors: incorrect propellant loading
• Environmental factors: lightning (Apollo 12), upper-level winds
• Human error: incorrect assembly, missed inspections

6.2 Reliability Engineering Techniques

6.2.1 Redundancy

Critical systems are equipped with backups to eliminate single points of failure (Single Point of Failure, SPOF).

Types of Redundancy

• Parallel Redundancy:
  • Multiple systems operate simultaneously; if one fails, another takes over
  • Example: Falcon 9's nine engines (an engine failure can be tolerated in many phases of flight)
• Standby Redundancy:
  • A backup system is activated when the primary system fails
  • Example: emergency batteries, backup computers
• Functional Redundancy:
  • The same function is performed by a different method
  • Example: GPS + INS (inertial navigation) combination

Engine-Out Capability

An innovative feature of Falcon 9:

• Nine-engine configuration: one failure → can be compensated by the remaining eight
• CRS-1 (2012) case:
  • One first-stage engine shut down early
  • Burn time of the remaining eight engines extended
  • Primary payload (Dragon) reached its nominal orbit
  • Secondary payload placed in a lower orbit (than planned)

6.2.2 Failure Mode and Effects Analysis (FMEA)

A technique for systematically analyzing every possible failure mode.

FMEA Process

1. System decomposition: list every component
2. Failure mode identification: how each component can fail
3. Effects analysis: the effect of a failure on the higher-level system
4. Risk assessment:

   Risk Priority Number (RPN) = Severity × Occurrence × Detection difficulty
   (each on a 1-10 scale)
   
   Example:
   - Turbopump bearing failure:
     Severity = 10 (mission failure)
     Occurrence = 3 (rare but possible)
     Detection = 4 (can be detected early by vibration sensors)
     RPN = 120 → medium priority
   

5. Mitigation: design changes, redundancy, more rigorous inspection

6.2.3 Fault Tree Analysis (FTA)

A top-down analysis that starts from the top-level failure (e.g., mission failure) and traces its causes backward.

Example: "Loss of rocket thrust" fault tree

Loss of rocket thrust
├── OR
    ├── Engine shutdown
    │   ├── OR
    │   │   ├── Loss of propellant feed
    │   │   │   ├── OR
    │   │   │   │   ├── Turbopump failure
    │   │   │   │   ├── Valve closure
    │   │   │   │   └── Line rupture
    │   │   ├── Ignition failure
    │   │   └── Combustion chamber failure
    └── Loss of thrust vector control
        └── ...

Probabilities can be calculated using Boolean logic (AND, OR)

6.2.4 Thorough Testing

Test, test, and test again. Debugging is impossible in space.

Types of Testing

• Component level:
  • Individual testing of each valve, sensor, and controller
  • Environmental testing (vibration, temperature, vacuum)
• Subsystem level:
  • Standalone engine tests (tens to hundreds of runs)
  • GNC simulator testing
• System level:
  • Static fire tests (actual engine ignition before launch)
  • Integrated testing
• Verification flights:
  • Demo missions (without payload)
  • WIA-SPACE-004 §8.2 requires a static fire before each re-flight of a reusable propulsion stage

6.3 Launch Escape System

This is the most important safety device on a crewed launch vehicle. If the rocket explodes, it safely separates the crew capsule.

6.3.1 Tower-Type LES (Launch Escape Tower)

This is the traditional approach, used by Apollo, Soyuz, and others.

Configuration

• Escape Tower: a rocket mounted on top of the capsule
  • Height: several meters
  • Thrust: very high (maximum acceleration in a short time)
• Jettison motor: separates the tower from the capsule
• Attitude control nozzles: control the capsule's orientation during escape

Operating Scenario

1. Emergency abort signal: triggered automatically or manually by the crew
2. Escape rocket ignition: pulls the capsule up/sideways away from the rocket
3. Acceleration: 12-20 g for several seconds
4. Tower jettison: the tower is dropped once the capsule is far enough away
5. Parachute deployment: the capsule descends safely
6. Landing: on land or at sea

Examples of Use

• Soyuz T-10-1 (1983): the escape tower pulled the capsule clear seconds before the launch vehicle exploded on the pad
  • Both crew members survived
  • The only crewed pad abort to date
• Soyuz MS-10 (2018): booster separation failure during launch → successful escape
  • Both crew members returned safely

6.3.2 Integrated LES (Integrated Abort System)

This is the modern approach used by SpaceX Dragon and Boeing Starliner.

Differences

• No tower: the escape engines are integrated into the capsule
  • More aerodynamic
  • Weight savings
• SuperDraco engines (Dragon):
  • Eight SuperDraco engines
  • Mounted on the sides
  • Thrust: 73 kN each, 584 kN total
• Push vs. Pull:
  • Traditional LES: the tower "pulls" from above (Pull)
  • Integrated LES: "pushes" from the sides of the capsule (Push)

Dragon Abort Tests

• Pad Abort Test (2015): successful simulation of a launch pad abort
• In-Flight Abort Test (2020): abort during flight
  • Capsule intentionally separated in Falcon 9's Max Q region
  • SuperDraco ignition → moves away from the rocket
  • Falcon 9 broke up in the air (as planned)
  • Dragon splashed down safely under parachutes

6.4 Range Safety

The mechanics of range safety are covered in Chapter 4, Section 4.6; this section summarizes them from a reliability perspective.

6.4.1 Flight Termination System (FTS)

• Purpose: destroy the rocket if it deviates from its trajectory and heads toward populated areas
• Operation:
  • The Range Safety Officer (RSO) transmits the command
  • Or an Autonomous FTS (AFTS) decides automatically
  • Linear Shaped Charges rupture the tanks
  • Rocket propellant is dispersed → falls as small debris
• Dual safety:
  • Two independent FTS channels
  • Encrypted radio commands
  • Ground and onboard monitoring

6.5 Quality Assurance

6.5.1 Manufacturing Quality Control

• Clean-room manufacturing: zero dust and foreign matter
  • Class 100,000 (ISO 8) or better
  • Especially for propellant system assembly
• X-ray inspection: detection of internal defects in welds and castings
• Non-Destructive Testing (NDT):
  • Ultrasonic testing
  • Magnetic particle testing
  • Penetrant testing
• Part traceability: manufacturing records maintained for every part

6.5.2 Assembly and Integration

• Clean-room assembly: mandatory for payload integration
• Torque verification: every bolt tightened to the exact torque (recorded)
• FOD (Foreign Object Debris) prevention:
  • Ensure that no small parts, tools, etc. are left behind
  • Thorough inspection after every task
  • Space Shuttle Columbia accident: falling insulation debris

6.5.3 Final Checks

• Flight Readiness Review (FRR):
  • Launch proceeds only when every team declares "GO"
  • Confirmation that there are no open issues
  • Confirmation that past problems will not recur
• Launch Readiness Review (LRR):
  • Immediately before launch (T-1 day)
  • Final confirmation of weather, ground systems, etc.

6.6 Accident Investigation and Lessons Learned

6.6.1 Major Accident Cases

Challenger (1986)

• Cause: the SRB O-ring lost its elasticity at low temperature → hot gas leak
• Lessons:
  • Strict adherence to temperature limits
  • Listening to engineers' concerns
  • Improving organizational culture (safety vs. schedule)

Columbia (2003)

• Cause: insulation debris struck the wing leading edge during launch → heat penetration during reentry
• Lessons:
  • Stronger FOD control
  • In-flight damage assessment capability
  • Re-establishing a safety culture

Falcon 9 AMOS-6 (2016)

• Cause: rupture of a second-stage helium tank (COPV) during propellant loading ahead of a static fire (attributed to solid oxygen forming in the subcooled LOX)
• Lessons:
  • Redesign of the cryogenic helium system
  • Changes to propellant loading procedures
  • The payload is no longer mated to the vehicle before the static fire

6.6.2 Accident Investigation Process

1. Immediate response: suspend all launches, secure the data
2. Formation of an investigation board: an independent panel of experts
3. Data analysis: analysis of telemetry, video, and debris
4. Cause determination: find the Root Cause
5. Corrective action: design changes, procedural improvements
6. Verification: confirm through testing that the problem is resolved
7. Return to flight: after all recommendations have been implemented