Reliability and Crew Safety Assessment for a Solid Rocket Booster/J-2S Launcher

Transcription

1 Reliability and Crew Safety Assessment for a Solid Rocket Booster/J-2S Launcher Joseph Fragola, Science Applications International Corporation J.D. Baum, Science Applications International Corporation Don Sauvageau, ATK Thiokol Scott J. Horowitz, ATK Thiokol Key Words: crew exploration vehicle, NASA, expendable launch vehicle, solid rocket booster SUMMARY AND CONCLUSIONS NASA's Exploration Mission Directorate is currently developing plans to carry out the President's Vision for Space Exploration. This plan includes retiring the Space Shuttle by 2010 and developing the Crew Exploration Vehicle (CEV) to transport astronauts to/from Low Earth Orbit (LEO). There are several alternatives to launch the CEV, including Evolved Expendable Launch Vehicles (EELVs) and launch vehicles derived from new and existing propulsion elements. In May, 2003 the astronaut office made clear its position on the need and feasibility of improving crew safety for future NASA manned missions indicating their "consensus that an order of magnitude reduction in the risk of human life during ascent, compared to the Space Shuttle, is both achievable with current technology and consistent with NASA's focus on steadily improving rocket reliability". The astronaut office set a goal for the Probability of Loss of Crew (P LOC ) to be better than 1 in 1,000. This paper documents the evolution of a launch vehicle deign to meet the needs for launching the crew aboard a CEV. The process implemented and the results obtained from, a top-down evaluation performed on the proposed design are presented 1. NEEDS In a memo entitled: Astronaut Office Position on Future Launch System Safety dated May 4, 2004 [2], the astronaut office made clear their expectation for future launch vehicle safety. Although flying in space will always involve some measure of risk, it is our consensus that an order-of-magnitude reduction in the risk of loss of human life during ascent, compared to the Space Shuttle, is both achievable with current technology and consistent with NASA s focus on steadily improving rocket reliability, and should therefore represent a minimum safety benchmark for future systems. The Astronaut Office recommends that the next humanrated launch system add abort or escape systems to a booster with ascent reliability at least as high as the Space Shuttle s, yielding a predicted probability of or better for crew survival during ascent. The system should be designed to achieve or exceed its reliability requirement with 95% confidence. The Astronaut Office believes that the next human-rated spacecraft must include a robust full-envelope abort or escape system. The safety of the overall system depends on the reliability of both the booster and the abort or escape system. As with the rocket itself, the abort or escape system reliability must be proven through flight-testing. In summary: NASA needs a safe, reliable, affordable method of transporting astronauts to/from Low Earth Orbit separate from major cargo elements. In order to support exploration class missions, the Crew Exploration Vehicle (Command Module and Service Module) is estimated to weigh between 20 and 25 MT. Also, the launch vehicle must be capable of flying ascent trajectories that are compatible with the crew full-envelope abort or escape system. The simplest designs of the EELV variants, which offer the greatest inherent reliability, are the single core versions. These single core launchers, when combined with an effective crew escape system provide the greatest promise of crew safety. Unfortunately, the single core EELVs are unable to meet the performance needs for the CEV mission, so the higher performance, more complex, less reliable multi-core "heavy" variants are required to launch the CEV. This fact, plus the fact that the EELVs were optimized for high orbital insertion altitudes, thus reducing the effectiveness of a crew escape system without modification, makes it difficult to achieve the ascent risk goal proposed by the astronaut office of 1 crew loss mission in This dilemma motivated the search for a launch vehicle that could preserve the simplicity of a single core propulsion system that utilizes highly reliable human-rated heritage components with sufficient performance to meet the CEV mission needs. The result of this effort is a 2-stage launch vehicle utilizing a single Space Shuttle Solid Rocket Booster (SRB) for the first stage, and a single J-2S engine for the second stage. This paper describes the evolution of the SRB/J- 2S based launch vehicle design. 2. THE DESIGN Since current rocket propulsion methods do not support Single Stage to Orbit launch vehicles, the simplest vehicle is a

2 two-stage design. Starting with the performance requirements and simply relating those to existing launch vehicles reveals that the first stage needs a thrust of between 2-3 million pounds. It is also important to note that thrust is much more important in the first stage of a launch vehicle while Isp is more important in the upper stages. The required thrust can be achieved using 4-6 Space Shuttle Main Engines, 2 F1s (used on the 1 st stage of the Saturn V), or a single Space Shuttle Solid Rocket Booster. The simplest and most reliable of these is the Space Shuttle Solid Rocket Booster (which is also human-rated), so it was chosen as the starting point for this design. The next step was to look at different combinations of propellant types and loadings to size the second stage of the launch vehicle. Again in the upper stage Isp becomes more important so solid propulsion is not nearly as desirable as liquid propellants (LOX/RP or LOX/H2). To get the desired performance LOX/H2 was selected for the second stage and optimization runs determined the second stage should have between 250, ,000 lbs of LOX/H2. In order to fly a launch trajectory that would be compatible with a full-envelope abort or escape system, the thrust-to-weight (T/W) of the second stage at staging was determined to be approximately 0.7. T/W values much less than this result in lofted trajectories which have dead man zones where the crew module would be subjected to excessive reentry g s during aborts. Therefore the second stage requires approximately 200,000 lbs of thrust. The required thrust can be achieved using 8 RL-10Bs, a single Space Shuttle Main Engine (although somewhat high), or a single J-2S developed at the end of the Apollo program to replace the J-2 engine used on the 2 nd and 3 rd stages of the Saturn V. The simplest and most reliable of these is the J-2S (which like the SSME and SRB was designed and tested to be human-rated), so it was chosen as the second stage engine for this study. The result is a two-stage in-line configuration with a single engine for each stage. The first stage uses a standard Space Shuttle SRB, and the second stage has 255,000 lbs of LOX/H2 and uses a single J-2S engine. The resultant launch vehicle can place approximately 50,000 lbs into Low Earth Orbit (28.5 deg inclination, 220 nm circular orbit). 3. CREW RISK FORECAST The proposed crew SRB/J-2S launcher s risk to crew was forecasted by SAIC through a top-down evaluation [1] of the vehicle s conceptual design. The risk analysis approach used was engineering focused as opposed to other approaches to risk assessment that are more statistically focused. SAIC used this top-down approach because of the conceptual nature of the design, the significant heritage from which it was derived and the complex phenomenology of the initiation of potential adverse events and their subsequent progression. The analysis began with the quantification and characterization of the system s potential failures using phenomenological and engineering based analysis in a fashion similar to a detailed quantitative hazard or vulnerability assessment. To perform this analysis ATK Thiokol Engineers and SAIC Team members met to postulate and formulate the credible failures that create the most hazardous resulting environments. These failures were then modeled using first principles physics-based computer codes in order to quantify and understand the environments resulting from these decided worst-case failures. The physical parameters that were extracted from this analysis were used to direct the emphasis of the probabilistic risk assessment. Figure 2.1. SRB / J-2S Configuration Steady State Run Surface Mesh Details Figure 3.1. Surface Mesh Details To conduct an accurate numerical simulation, the SAIC

3 Team first constructed a virtual model of the physical geometry of the proposed SRB/J-2S vehicle. Once this model was created, SAIC generated a mesh over the surface of the vehicle geometry. The virtual vehicle model was then placed in a virtual box (an exterior, far-field numerical boundary), and a volume mesh was generated using the surface mesh and the defined exterior boundary. Figure 3.1 shows the surface mesh details for this model. As with any other flow in which a steady flow condition is perturbed by an event (here, a case burst), it was necessary first to establish the steady flow around the vehicle during a given time in the vehicle ascent. Figure 3.2 shows the predicted steady flow around the vehicle for the Max-Q flight conditions. Shown are the pressure contours on a planar cut and the surface of the vehicle, as well as magnification of flow details and the steady shock waves about the vehicle. All shocks are nicely captured due to the highly resolved mesh placed at these locations. Steady State Run Pressure Contour Field Figure 3.2. Steady State Pressure Contours Once a faithful structural geometry had been properly represented by the grid and the steady flow fields observed during the ascent environment were converged, the perturbation caused by the case burst was introduced. To establish the accident burst conditions SAIC analysts were provided with the results of a burst test that had been conducted by ATK Thiokol as well as a summary of that test [2]. The gas conditions determined in this test were then used as stagnation conditions for modeling the high-pressure, hightemperature combustion products ejection into the external flow and the resulting addition loads on the crew escape vehicle. The solution of this ejection process was then integrated in time to determine the effect of the burst field on the vehicle. Figure 3.3 indicates a case burst field propagating from the forward segment of the vehicle as it sits on the pad. This particular picture shows the burst propagation at 43.3ms after initiation. As it turns out the forward segment on the pad is the worst case scenario. Due to the static state of the vehicle and no environmental aero pressure the burst field is able to propagate equally in all directions thus the hemispherical nature of the field. Forward Failure Pad (Mach 0.0) Pressure Contours Time=43.3ms Figure 3.3. Forward Failure Pad The data at over 1200 locations on the surface of the rocket were saved during the simulation. This data, saved at every time step, include the pressure, density, velocities and energy at that point. Post processing of this data allowed for the valuation of the pressure at this point (and hence the structural response, when conducting a coupled fluid-structure simulation), as well as the force on surfaces covered by an assembly of points. In addition, the post-processing procedure allows us to compute the maximum pressure and forces observed at this point at any given time during the simulation, during the time the transient shock wave passed through this point. In the case represented in Figure 3.4 the burst occurred in the forward element on the pad. As can be seen the pressure at the second stage interface appears to be in excess of 10 psi and at the CEV is negligible. Numerical simulations were conducted with four scenarios: forward and aft burst incident on the pad, and both forward and aft incidences at the Max-Q flight condition, 42.5 seconds into the flight at M= The results showed that: Pad Forward Failure OverPressure (p Pad - Forward Failure - (Pmax-Pstatic) vs. Length Rocket Vehicle Nose -2.0 Rocket Axis (cm) Figure 3.4 Forward Failure Pmax-Pstatic (psi) Rocket Location Points 1. The symmetric shock wave expansion from the lower

4 case burst location on the pad will expand a very low overpressure by the time it engulfs the CEV. The overpressure for the worst credible case condition was the upper segment burst on the pad. At the CEV location the pressure is still negligible but at the interstage it was in excess of 10 psi. Therefore further analysis would need to be performed to evaluate the impact of the shock on the second stage in this case. 2. Both the lower and upper bursts for the Max-Q conditions show that the expanding shock wave propagation upstream (toward the CEV) has stalled. Thus, under these flight and burst conditions, the CEV will experience no overpressure loading from the expanding hot combustion products. 3. The simulations for the staging/burnout conditions were not conducted. The high Mach number (about 6.5) will make it very unlikely that the shock front will reach the CEV from either the upstream or downstream bursts. The results of the phenomenological analysis were used to guide the quantitative risk assessment from the time of crew arrival at the launch pad, through liftoff, Q max, to burnout and orbit insertion. This assessment addressed the development of a crew risk forecast of the new design by combining design heritage, flight and test experience of the historical elements of the design, expert knowledge of the design, the production process implemented in the production of its elements and control of this process for these elements, with an understanding of design vulnerability expected resulting accident initiation conditions and progression physics described above. This entire engineering based information set was integrated into the logical probabilistic structure of a quantitative risk assessment. The results of this analysis have indicated that the proposed design may have a significant potential of meeting, and possibly exceeding, the 1 in 1000 mission crew risk goal proposed by the crew for future US crew launch vehicles even when conservative accident failure criteria were applied and even with significant further conservative variation in key risk driving parameters. The resulting risk forecast suggests that the proposed design offers significant, as much as an order of magnitude, improvement in crew survival during ascent as compared to the current shuttle system. In the case of LOV failure, reliability of the escape system, re-entry and recovery options are taken into account as well. The ATK Thiokol launch system SRB was found to be a small contributor to risk of loss of crew compared to the upper stage and interaction of various elements of the shuttle tandem stack. The SRB s inline design and inclusion of a crew escape capability offers crew survival possibilities that are unavailable to shuttle. The fact that only one SRB is used cuts the SRB catastrophic failures by more than half, as shown in figure 3.5. Launcher reliability has a large impact on crew safety. Regardless of the launcher type, assuring crew safety after a failure is very uncertain. Given the limited number of test and flight opportunities it will be difficult to gain sufficient understanding of the dynamics to create an escape system that can provide high assurance of escape. Unknown -unknowns may well dominate the reliability of crew escape systems. Figure 3.5. J2-S vs. Shuttle survivability probabilities Since there will be significantly more launch experience than abort experience, the uncertainty in the likelihood of launch failure is always much less than the uncertainty in abort reliability. Furthermore, a good design is focused on achieving safety inherently, and by relying on added safety systems only when inherent safety is inadequate. Since the operating environment for the safety system is unknown (and therefore cannot be counted on to be highly reliable), safety must be achieved by having the highest possible reliability in the first place. This principle is demonstrated in Figure 3.6 below: Probability of LOC (1/Y) Log Scale 10,000 1, Effect of Alternative Abort Reliabilies 1/483 Launch Vehicle (Baseline) 1/200 Launch Vehicle 1/100 Launch Vehicle 1/50 Launch Vehicle 1/20 Launch Vehicle 1/1000 goal can be met with 50% Survivable This study's results 1/483, 85% Survivable Sensitivity result if all SRB failures are fatal, 71% Survivable 0% 10% 20% 30% 40% 50% 60% 70% 80% 90% Integrated Abort Effectiveness Figure 3.6. Effect of Alternative Abort Reliabilities on Overall System Probability of LOC 4. CONCLUSIONS The SRB/J-2S launch vehicle concept was developed

5 using human-rated components in the simplest configuration that could meet the safety, reliability, and performance needs for launching the Crew Exploration Vehicle. The SRB/J-2S launch vehicle is forecasted to have Crew Survival performance well in excess of the goals suggested by the astronaut office in their memo of 4 May 2005 [2]. In particular the forecasted crew safety level, as measured in terms of missions with the crew being lost in a total number of missions, is likely to be 1 in 3145 at the mean of the estimated uncertainty distribution with associated uncertainty bounds at the 5th %ile level of, 1 in 11,500, and 95th %ile, 1 in 1287, and the median or 50th %ile, at 1 in This significant crew safety performance forecast is enabled by the following features exhibited in this design, as demonstrated by the heritage data analyzed and phenomenological simulation analysis completed. 1. Simple Inherently Safe Design - The SRB/J-2S design is based upon a simple single solid rocket booster system that has matured throughout years of experience and over a hundred shuttle crew launches, combined with a simple J-2S single engine upper stage, an engine system whose heritage performed flawlessly on the Saturn program from a crew safety relevant launch ascent perspective [3]. These stages have been combined in an inline configuration with the suggested Apollo Command Module based CEV and escape rocket tower so as to benefit from the natural safety distance advantages and broad escape corridors provided inherently by the inline design. 2. Design Robustness - The SRB/J-2S design has been shown by a combination of historical test results and 1st principles physics based simulation to be robust, that is, to be resistant to crew adverse catastrophic failure for the most severe failure mode, (i.e. case burst) that has been postulated by the ATK Thiokol designers6. In fact, although it has been assumed here that all case bursts result in crew loss, the physical similarities of the consequences of most case burst events indicate a potential high degree of survivability from most of these events. 3. Non-Catastrophic Failure Mode Propensity - Solid rocket booster history, and specific design features suggest a significant propensity towards failures, if they did occur, which would lead to a gradual thrust augmentation phenomena [5], such as the field joint soft goods failure observed in the 51-L. These failures, while potentially relatively immediately catastrophic when they interact with other elements of a launch stack, present a delayed challenge to the safety of the crew in a single motor configuration and therefore provide for enhanced crew escape opportunities if they were to occur. 4. Historically Low Rates of Failure - The reliability of solid boosters in general has rivaled that of the best liquid boosters. In the shuttle system only the 51-L event has marred a perfect record in 226 booster launches (since the 51-L event and the resulting redesign the RSRMs have flown 178 successful launches). This 1 in 228 history, or launch success record is perhaps the best of the best in launcher history. 5. Process Control - Human Error has proven to be a significant contributor to risk [7], and these errors can never be completely eliminated. However the occurrence of human errors can be significantly reduced by minimizing the touch labor tasks involved in the process, thereby minimizing the opportunities for error, and instituting stringent process control to monitor those that remain. The SRB/J-2S proposed design offers the benefits of a mature in-plant process control system to minimize human error occurrence on the solid rocket portion of the design thereby significantly reducing the at the launch site and on-the-pad touch labor. 6. Failure Precursor Identification and Correction - ATK Thiokol has seen significant failure precursor identification and elimination benefit from the recovery, and in-factory inspection of the returned shuttle boosters [7]. While the proposed design does not call for reuse of the boosters, it does call for continuation of the recovery and inspection process. It is the combination of these six factors, and not any one alone, which suggest a design that is forecasted to have a noteworthy launch reliability, a preferentially escapable environment given an unlikely failure, and when this is combined with the crew survival aspects of a reasonably reliable launch escape system has produced the significant crew safety performance as assessed by the analysis. REFERENCES [1] Fragola, J.R. 2005, Reliability and Crew Safety Assessment for Solid Rocket Boost/J-2S-Based Launch Vehicle, SAIC, New York, April 2005 [2] McCaskey, R.M., SRM Lightweight Cylinder Segment Burst Test Report, 11, December 1980 Joseph R. Fragola SAIC Suite Sunrise Highway Rockville Centre, NY Fragola@prodigy.net BIOGRAPHIES Mr. Fragola has over 35 years of experience working in reliability and risk technology in both the aerospace and nuclear industries and for other industries in the US and throughout Europe. Mr. Fragola is a Professional Engineer and received his B.S. and M.S. degrees in Physics from the Polytechnic Institute of New York. In the past he has worked for Grumman Aerospace Corporation, and IEEE at their Headquarters in New York. He is currently a Principal Scientist at SAIC and a visiting professor at the University of Strathclyde in Glasgow, Scotland. He has published almost 50 papers and two books. He has been awarded the P.K. McElroy RAMS best paper award, the IEEE Region I award, and has been named an IEEE Fellow for his contributions to the theory and practice of risk, safety, and reliability. He was awarded the 1995 SAIC Publication Prize in Engineering and Applied Mathematics.

6 Mr. Fragola has lectured widely throughout the US, South America and in Europe. He has also given workshops and lectures in Japan, Russia, and Israel. He is an internationally recognized expert in the fields of risk analysis, risk and reliability database development, and human reliability analysis. He has participated in several dozen risk assessments, and was the Principal Investigator of the landmark, NASA sponsored, 1995 launch to landing risk assessment of the space shuttle, which still remains the only published work on the subject of integrated shuttle risk. Mr. Fragola was recently served, by selection of the NASA Administrator as one of the 15 core members of the NASA Exploration Architecture Study (ESAS) Team. J.D. Baum, SAIC 1710 Solutions Drive, MS 2-6-9, McLean, VA, 22102, USA Don Sauvageau, ATK Thiokol M/S UT40-A10 P.O. Box 707 Brigham City, UT USA Scott J. Horowitz, ATK Thiokol M/S UT40-A10 P.O. Box 707 Brigham City, UT USA