7 ms·

>> People want to see 100% success in all things. But that isn't very economical. That sounds logical, but isn't really a thing in aerospace/space. Complicate

>> People want to see 100% success in all things. But that isn't very economical. That sounds logical, but isn't really a thing in aerospace/space. Complicated high-energy systems have thousands of failure points. So to have any chance of success each failure point needs to be engineered below, by way of example, a 0.0001% chance of failure. That costs lots of money. But say one decides to accept more risk for less cost. Ok. So you switch from 0.0001 to 0.001 failure rates. You risk is now 10-fold higher at each failure point, but with thousands of failure points adding up you are now essentially doomed. And you haven't saved anything. The cost of 0.001 components isn't fundamentally different than the 0.0001 components were. SpaceX can save money though different business practices, by trimming people/money/contracts/compliance and such, but if you look at their rockets they are not fundamentally any less-perfect than anyone else's. They cannot afford to be. This is why rocket failures, like aircraft failures, are taken so seriously. There is an extremely fine line between "works ever time" and "never worked twice" with very little money to be saved between the two. Across many areas, risk-v-cost math never really happens. It is either go or no go. Take CPU production. Intel spends billions at each of hundreds of fabrication step to push down miniscule error rates because any of a million errors can destroy a chip. There is no money to be saved by allowing any one process to become less than as perfect as it can possibly be. A detected slip from 0.0001 to 0.001 at any step would result in an entire fab being shut down in order to diagnose the problem. The marginal savings of a less-than-perfect process isn't worth the exponential increase in the risk of total system failure.

mabbo 4y ago
I'm not proposing something, I'm describing it. This is what SpaceX is doing, and it's quite successful. And you can look all the way back to their little hopper version of the Falcon 9 and see that this strategy has been the key to them undercutting the launch market significantly. My prediction: SpaceX will have a 5th 100% successful launch of Starship before the SLS has a 5th successful launch. They'll just have ten not-100%-success launches before then.
- bumby 4y ago
  >My prediction: SpaceX will have a 5th 100% successful launch of Starship before the SLS has a 5th successful launch. They'll just have ten not-100%-success launches before then. I'm not the best way to frame this is "first one to a single successful launch". Reliability matters when you're dealing with high-risk scenarios, so a better measure is "probability of a given launch being successful".
  - ralusek 4y ago
    They meant "will have worked out enough of the kinks by their 5th successful launch so as to be operating at a high success rate." Lots of falcons failed, but you don't see anybody worried about their payload or crew on Falcon 9 these days.
    - bumby 4y ago
      >will have worked out enough of the kinks by their 5th successful launch so as to be operating at a high success rate." I agree with the first part, but the second half extrapolates too far IMO. One successful launch tells us very little about operational reliability.
      - frumper 4y ago
        And SLS is that much further behind
        bumby 4y ago
        No doubt, but operational tempo is a different issue than system reliability.
      - ethbr0 4y ago
        But the apples to oranges here is >1 launches (SpaceX, some successful and some unsuccessful) vs 1 successful launch (traditional modern aerospace). From an outcome perspective, it's hard to ever see the lower launch rate dominating from any perspective. You don't have economies of manufacturing scale, because your assembly rate is so low it doesn't make sense not to treat each as exquisite. You don't have rapid iteration on manufacturing improvements, because the tyranny of safety checks on manufacturing time balloons {time from fix to flight}, after a proposed fix is identified. And most importantly, you leave yourselves extremely vulnerable to unknown-unknowns, that you can't imagine in the design phase. For example, if NASA had been launching the shuttle more rapidly, with the bulk of those being uncrewed launches, they probably would have picked an uncrewed launch to test expanding the temperature bounds at Cape Canaveral, and Challenger would have exploded without a crew. As was, NASA's shuttle launches were so rare that there wasn't acceptable launch rate and weren't low-impact launch opportunities to do so. So they tested it on a crewed mission with disastrous results. Point being: they backed themselves into a low-volume/high-risk corner of their own strategic design SpaceX's most brilliant achievement was using Starlink to artificially boost launch demand and give them a minimally-profitable/break-even place to sink higher-risk launches.
pas 4y ago
SpaceX is doing the classic statistic thing[0], making spacecraft stronger where they explode until they don't. It's more like a hyperparameter search and less like QA for individual parts. [0] https://upload.wikimedia.org/wikipedia/commons/b/b2/Survivorship-bias.svg https://upload.wikimedia.org/wikipedia/commons/b/b2/Survivor... :)
- mempko 4y ago
  SpaceX is just doing what the Soviets did. The Soviets preferred to launch and learn just like SpaceX does today. Soviets also ran on a much smaller budget than NASA and preferred simplicity over complexity and constant tweaking. The Soviets proved that methodology works and SpaceX continues it to this day. I have a feeling most that follow SpaceX think they are trying a new revolutionary approach here.
  - arethuza 4y ago
    What is your view on where the Soviets went wrong with their N1? https://en.wikipedia.org/wiki/N1_(rocket) https://en.wikipedia.org/wiki/N1_(rocket)
    - dotnet00 4y ago
      The N1 didn't really fit the testing driven development approach, they couldn't static fire the flight engines, they ended up relying on test firing extra engines from the same batch and assuming all in a batch were the same.
    - baq 4y ago
      Not op but this isn’t hard: they couldn’t test the thing. They could only test parts. Also, engines were single use, couldn’t be tested at all.
    - ethbr0 4y ago
      They were working with 1960s Soviet computing capabilities. They were working with 1960s material science. They were working with 1960s understanding of rocketry. Korolev died. We've come a long way in the last 50+ years, and sometimes you can use materials with substantially higher limits to paper over design risks.
cpleppert 4y ago
That doesn't really apply here. The dynamics of stage separation on Starship are orders of magnitude more complex than anything used on any previous rocket. If you want to look at what failure looks like for a super large rocket compare it to the failed Soviet N1. This flight demonstrated better performance in a single test flight than every N1 test flight over years. The N1 suffered catastrophic failure after catastrophic failure. Starship was pushed way past its design tolerance and showed its design is technically sound. Failure is unavoidable, the Saturn V almost failed its first test flight way earlier than Starship did here.
- gridspy 4y ago
  I feel like the N1 is unfairly demonized. They didn't have the benefit of modern closed loop computer flight controls that we have now. Detailed fluid dynamics simulations. Modern manufacturing techniques and production accuracy. N1 might have simply been before its time.
- JKCalhoun 4y ago
  I feel like you danced around the wild success of the Saturn V a bit.
CydeWeys 4y ago
You're talking about failure rates per rocket, but we're talking about the overall development program. Falcon 9 certainly has very low failure rates on its individual components now (below your suggested 0.0001 number). But the way they got there was via a higher risk iterative development process, same as what we're seeing with Starship. The Falcon is the most reliable rocket on the planet at this point, so clearly it's working!
deelowe 4y ago
Your intel example doesn't fully hold water. Chip design has taken a binning approach for decades at this point. The silicon is designed for failure in such a way that yield is maximized assuming there will be a variance in quality. Launch and iterate happens for silicon just like anything else. During the initial product launch, there is a lot of waste, but as processes are improved, microcode updated, rework procedures defined, and value engineering efforts completed, yields go up and costs go down.
- sandworm101 4y ago
  It depends on what you count as a chip. Modern "chips" are actually a great many things all one one slab of silicon. Failure then knock out single components, resulting in the final chip going into one bin or another. And each of those components can be as complex as an entire "chip" from a few years ago. That is really creating reliability through numbers. Within every component any slight error will still brick that component. The binning process is really a edge case where the fab is playing at the margins. Any slight increase in error rate would quickly see every chip going into a "bad" bin, with the entire processing becoming uneconomical. Intel, and everyone else building chips, strives for perfection with a zero tolerance mantra.
  - Taniwha 4y ago
    But binning is largely binning against performance curves: "we doped this side of the wafer just a little too much and it's a little slow, but this one from the other side is just right" - while checking for faults (full chip scan and other manufacturing tests) result in dies being thrown out.
valine 4y ago
Evaluating the reliability of every component is extremely expensive. If you had perfect knowledge of the reliability of every component, then sure. It would be cheaper to build a perfect rocket first, then launch it. The cost saving comes because it’s cheaper to launch the rocket and see where it fails than it is to exhaustively evaluate the reliability of every component.
- szoszon 4y ago
  But you still need to do it for something like a rocket that is supposed to carry people in the future. In to long term, it's better to evaluate reliability of every component at the beginning, than do it after if fails.
  - valine 4y ago
    You actually don’t. With a high launch cadence you can make statistical inferences about the reliability of the system as a whole. This isn’t the 80s where you launch one disposable rocket every 6 months. Starship is fully reusable and will likely fly multiple times a week carrying non human payloads.
    - szoszon 4y ago
      Have you heard of instances where airplanes failed due to something as basic as a nut or a screw not meeting the required specifications? It's difficult to trust the reliability of a rocket, which is largely based on statistics, when you're putting hundreds of people on it. How can we be certain that NASA/FAA and other organizations will permit such a risk?
      - valine 4y ago
        You can’t verify the reliability of an aircraft by flying it 1000 times because you’d be putting the life of the pilots at risk. Autonomous rockets have no such constraint. You could launch starship an unlimited number of times without putting a single person at risk.
RC_ITR 4y ago
Tbf, even before launch, no-one expected a full trip. The 'baseline' was lift-off and the rest was upside [0] Sometimes in aerospace you need to collect data, and sometimes that means explosions. [0] https://www.space.com/spacex-starship-first-space-launch#:~:text=The%20goal%20was%20to%20get,about%2090%20minutes%20after%20liftoff https://www.space.com/spacex-starship-first-space-launch#:~:....
intrepidhero 4y ago
Maybe you're trying to make the point that for very complicated systems with many failure points, the reliability of a single component is less impactful than redundancy and there is some truth to that but I must point out that risk vs cost calculations are definitely happening in both industries you mention. Triple redundancy is not a thing in general aviation while, for some systems, it is in commercial. That's a risk vs cost calculation. Semiconductor manufacturers do risk vs cost calculations through the entire development and manufacturing process. Source: I've worked in semiconductor, doing those calculations.
RetpolineDrama 4y ago
> That sounds logical, but isn't really a thing in aerospace/space. Your authoritative tone doesn't make any sense when Falcon 9 exists and has been actively dominating the entire industry for half a decade.
scythe 4y ago
>So to have any chance of success each failure point needs to be engineered below, by way of example, a 0.0001% chance of failure. That costs lots of money. But say one decides to accept more risk for less cost. Ok. So you switch from 0.0001 to 0.001 failure rates. You risk is now 10-fold higher at each failure point, It seems like a strawman to suggest that you would let failure probability increase by a factor of ten as the first step. >but with thousands of failure points adding up you are now essentially doomed. And it was an easy one to tear down. >And you haven't saved anything. The cost of 0.001 components isn't fundamentally different than the 0.0001 components were. There is no reason to believe that at all. Invert the question: if a system is 99.999% reliable, does that mean it should be free to make it more reliable? And why? >It is either go or no go. Take CPU production. Intel spends billions at each of hundreds of fabrication step to push down miniscule error rates because any of a million errors can destroy a chip. There is no money to be saved by allowing any one process to become less than as perfect as it can possibly be. This is completely wrong. Chip factories do produce chips with defects; those chips are sold for cheaper, since they still work, but not as fast. IIRC most of TSMC's modern processes are designed to sell the good chips at a high price and the bad ones cheaper.
nostrademons 4y ago
Only if the failure points are arranged in series - A AND B AND C must happen to have a successful outcome. If the failure points are arranged in parallel - X OR Y OR Z must happen to have a successful outcome, with multiple redundant paths to success, your total failure rate is the chance that ALL of X, Y, and Z fail. This is a much lower number than when they are in series. To use concrete math - say that Starship has 33 raptor engines with a failure rate of 0.01%, 3 grid fins with a failure rate of 0.05%, and a fuel tank with a failure rate of 0.001%. If it's engineered so that all 33 raptor engines, all 3 grid fins, and the fuel tank all need to work for a successful launch, the success rate of the whole system = 0.9999^33 * 0.9995^3 * 0.99999 = 0.9952 = ~0.5% chance of failure. If it's engineered so that it can get to orbit on 28 out of the 33 raptor engines, 2 out of the 3 grid fins, and there is a double-hull to the fuel tank with a failure rate of 0.005%, then the chance of failure for each subsystem is 0.0001^5 = 10^-20, 0.0005^2 = 2.5 * 10^-7, and 0.00001 * 0.00005 = 5 * 10^-10, and when you multiply out those subsystem failure rates you get 1 - (1 - 10^-20) * (1 - 2.510^-7) * (1 - 510^-10) = 0.9999997495 = ~0.000025% chance of failure. Moreover, lets look what happens if you take the multiply-redundant design above and then increase the chance of failure of each component 100x. Raptor engines are now 99% reliable, grid fins are now 95% reliable, and fuel tanks are now 99.9% reliable. The overall failure rate for each subsystem becomes 0.01^5 = 10^-10, 0.05^2 = 2.5 * 10^-3 and 0.001 * 0.005 = 0.000005. When you multiply out those subsystem failure rates you get 1 - (1 - 10^-10) * (1 - 2.510^-3) * (1 - 510^-6) = 0.00250498759 = ~0.2% chance of failure. The multiply-redundant system, even with component failure rates 100x higher, still has better reliability than the perfectly-engineered system where every component must perform exactly to spec. This principle is used all the time in practical engineering. It's why Google builds server farms out of thousands of commodity PCs, hooked up in primary/replica clusters with replication and transparent failover. It's why ships have watertight compartments and double-hulls. It's why passenger jets have multiple engines, multiple hydraulic control systems, and multiple flight computers. Any engineer worth their salt is going to avoid SPOFs and assume that components will fail, then build redundancies into the design so that a partial failure does not endanger overall mission success.
hackernewds 4y ago
> risk is now 10-fold higher at each failure point, but with thousands of failure points adding up you are now essentially doomed. And you haven't saved anything. The cost of 0.001 components isn't fundamentally different than the 0.0001 components were. exactly. optimizing for an acceptable risk for space launches, esp space travel, seems still to be leading to $2B launches. at which point, what's the difference?
JumpCrisscross 4y ago
> you switch from 0.0001 to 0.001 failure rates. You risk is now 10-fold higher at each failure point, but with thousands of failure points adding up you are now essentially doomed Our ex ante ability to estimate these probabilities is lacking. Especially when they’re coupled. And redundancy, instead of tighter tolerances, is often cheaper than the classic approach. These are proven lessons from SpaceX.
DuckFeathers 4y ago
Before the anti-Musk cats get too wet, Elon Musk has said, and I quote, "If we get far enough away from launch pad before something goes wrong, then I think I would consider that to be a success. Just don't blow up the pad.": https://edition.cnn.com/2023/04/16/world/starship-spacex-launch-test-orbit-scn https://edition.cnn.com/2023/04/16/world/starship-spacex-lau...
- kortex 4y ago
  Right. The criteria for this test was "Failure = CATO (catastrophic at takeoff)". It took off, it didn't CATO, it even hit max Q, therefore success. That's not "partial success". That's 100% success, you won the game show, but you didn't get all the points in the sudden death bonus round.
sterlind 4y ago
but like, SpaceX's whole thing has been blowing up test rockets over and over as they experiment, iterating quickly. once they've nailed the design down, the result is pretty reliable, but look at how many booster recovery fails they had before they got successful. your logic works more for defect rates on parts than on the design itself.
gridspy 4y ago
What you've missed here is that failure points can only be guessed or simulated prior to testing. That analysis is often more expensive than the cost of a test and test article. So SLS does a LOT of analysis and manages to find and rectify failure points prior to flight. They pay a lot in analysis and inflexible design to do this. SpaceX does some analysis, but then flies to confirm the analysis early. That way they identify actual failure points and can use sensors to see how close they got to failure. For instance today I'm sure they learnt a lot from each failed engine, parts on the booster that stopped working, detailed telemetry on ship behavior on flight and sensors for the non-separation of booster from ship. SpaceX builds to the same high tolerances as other rocket manufacturers, but they don't try to avoid testing through overly rigorous analysis. They also don't gold-plate their manufacturing, instead making tradeoffs to allow cheaper volume production with recovery instead.

mabbo 4y ago

I'm not proposing something, I'm describing it. This is what SpaceX is doing, and it's quite successful. And you can look all the way back to their little hopper version of the Falcon 9 and see that this strategy has been the key to them undercutting the launch market significantly. My prediction: SpaceX will have a 5th 100% successful launch of Starship before the SLS has a 5th successful launch. They'll just have ten not-100%-success launches before then.

bumby 4y ago
>My prediction: SpaceX will have a 5th 100% successful launch of Starship before the SLS has a 5th successful launch. They'll just have ten not-100%-success launches before then. I'm not the best way to frame this is "first one to a single successful launch". Reliability matters when you're dealing with high-risk scenarios, so a better measure is "probability of a given launch being successful".
- ralusek 4y ago
  They meant "will have worked out enough of the kinks by their 5th successful launch so as to be operating at a high success rate." Lots of falcons failed, but you don't see anybody worried about their payload or crew on Falcon 9 these days.
  - bumby 4y ago
    >will have worked out enough of the kinks by their 5th successful launch so as to be operating at a high success rate." I agree with the first part, but the second half extrapolates too far IMO. One successful launch tells us very little about operational reliability.
    - frumper 4y ago
      And SLS is that much further behind
      - bumby 4y ago
        No doubt, but operational tempo is a different issue than system reliability.
    - ethbr0 4y ago
      But the apples to oranges here is >1 launches (SpaceX, some successful and some unsuccessful) vs 1 successful launch (traditional modern aerospace). From an outcome perspective, it's hard to ever see the lower launch rate dominating from any perspective. You don't have economies of manufacturing scale, because your assembly rate is so low it doesn't make sense not to treat each as exquisite. You don't have rapid iteration on manufacturing improvements, because the tyranny of safety checks on manufacturing time balloons {time from fix to flight}, after a proposed fix is identified. And most importantly, you leave yourselves extremely vulnerable to unknown-unknowns, that you can't imagine in the design phase. For example, if NASA had been launching the shuttle more rapidly, with the bulk of those being uncrewed launches, they probably would have picked an uncrewed launch to test expanding the temperature bounds at Cape Canaveral, and Challenger would have exploded without a crew. As was, NASA's shuttle launches were so rare that there wasn't acceptable launch rate and weren't low-impact launch opportunities to do so. So they tested it on a crewed mission with disastrous results. Point being: they backed themselves into a low-volume/high-risk corner of their own strategic design SpaceX's most brilliant achievement was using Starlink to artificially boost launch demand and give them a minimally-profitable/break-even place to sink higher-risk launches.

pas 4y ago

SpaceX is doing the classic statistic thing[0], making spacecraft stronger where they explode until they don't. It's more like a hyperparameter search and less like QA for individual parts. [0] https://upload.wikimedia.org/wikipedia/commons/b/b2/Survivorship-bias.svg https://upload.wikimedia.org/wikipedia/commons/b/b2/Survivor... :)

mempko 4y ago
SpaceX is just doing what the Soviets did. The Soviets preferred to launch and learn just like SpaceX does today. Soviets also ran on a much smaller budget than NASA and preferred simplicity over complexity and constant tweaking. The Soviets proved that methodology works and SpaceX continues it to this day. I have a feeling most that follow SpaceX think they are trying a new revolutionary approach here.
- arethuza 4y ago
  What is your view on where the Soviets went wrong with their N1? https://en.wikipedia.org/wiki/N1_(rocket) https://en.wikipedia.org/wiki/N1_(rocket)
  - dotnet00 4y ago
    The N1 didn't really fit the testing driven development approach, they couldn't static fire the flight engines, they ended up relying on test firing extra engines from the same batch and assuming all in a batch were the same.
  - baq 4y ago
    Not op but this isn’t hard: they couldn’t test the thing. They could only test parts. Also, engines were single use, couldn’t be tested at all.
  - ethbr0 4y ago
    They were working with 1960s Soviet computing capabilities. They were working with 1960s material science. They were working with 1960s understanding of rocketry. Korolev died. We've come a long way in the last 50+ years, and sometimes you can use materials with substantially higher limits to paper over design risks.

cpleppert 4y ago

That doesn't really apply here. The dynamics of stage separation on Starship are orders of magnitude more complex than anything used on any previous rocket. If you want to look at what failure looks like for a super large rocket compare it to the failed Soviet N1. This flight demonstrated better performance in a single test flight than every N1 test flight over years. The N1 suffered catastrophic failure after catastrophic failure. Starship was pushed way past its design tolerance and showed its design is technically sound. Failure is unavoidable, the Saturn V almost failed its first test flight way earlier than Starship did here.

gridspy 4y ago
I feel like the N1 is unfairly demonized. They didn't have the benefit of modern closed loop computer flight controls that we have now. Detailed fluid dynamics simulations. Modern manufacturing techniques and production accuracy. N1 might have simply been before its time.
JKCalhoun 4y ago
I feel like you danced around the wild success of the Saturn V a bit.

CydeWeys 4y ago

You're talking about failure rates per rocket, but we're talking about the overall development program. Falcon 9 certainly has very low failure rates on its individual components now (below your suggested 0.0001 number). But the way they got there was via a higher risk iterative development process, same as what we're seeing with Starship. The Falcon is the most reliable rocket on the planet at this point, so clearly it's working!

deelowe 4y ago

Your intel example doesn't fully hold water. Chip design has taken a binning approach for decades at this point. The silicon is designed for failure in such a way that yield is maximized assuming there will be a variance in quality. Launch and iterate happens for silicon just like anything else. During the initial product launch, there is a lot of waste, but as processes are improved, microcode updated, rework procedures defined, and value engineering efforts completed, yields go up and costs go down.

sandworm101 4y ago
It depends on what you count as a chip. Modern "chips" are actually a great many things all one one slab of silicon. Failure then knock out single components, resulting in the final chip going into one bin or another. And each of those components can be as complex as an entire "chip" from a few years ago. That is really creating reliability through numbers. Within every component any slight error will still brick that component. The binning process is really a edge case where the fab is playing at the margins. Any slight increase in error rate would quickly see every chip going into a "bad" bin, with the entire processing becoming uneconomical. Intel, and everyone else building chips, strives for perfection with a zero tolerance mantra.
- Taniwha 4y ago
  But binning is largely binning against performance curves: "we doped this side of the wafer just a little too much and it's a little slow, but this one from the other side is just right" - while checking for faults (full chip scan and other manufacturing tests) result in dies being thrown out.

valine 4y ago

Evaluating the reliability of every component is extremely expensive. If you had perfect knowledge of the reliability of every component, then sure. It would be cheaper to build a perfect rocket first, then launch it. The cost saving comes because it’s cheaper to launch the rocket and see where it fails than it is to exhaustively evaluate the reliability of every component.

szoszon 4y ago
But you still need to do it for something like a rocket that is supposed to carry people in the future. In to long term, it's better to evaluate reliability of every component at the beginning, than do it after if fails.
- valine 4y ago
  You actually don’t. With a high launch cadence you can make statistical inferences about the reliability of the system as a whole. This isn’t the 80s where you launch one disposable rocket every 6 months. Starship is fully reusable and will likely fly multiple times a week carrying non human payloads.
  - szoszon 4y ago
    Have you heard of instances where airplanes failed due to something as basic as a nut or a screw not meeting the required specifications? It's difficult to trust the reliability of a rocket, which is largely based on statistics, when you're putting hundreds of people on it. How can we be certain that NASA/FAA and other organizations will permit such a risk?
    - valine 4y ago
      You can’t verify the reliability of an aircraft by flying it 1000 times because you’d be putting the life of the pilots at risk. Autonomous rockets have no such constraint. You could launch starship an unlimited number of times without putting a single person at risk.

RC_ITR 4y ago

Tbf, even before launch, no-one expected a full trip. The 'baseline' was lift-off and the rest was upside [0] Sometimes in aerospace you need to collect data, and sometimes that means explosions. [0] https://www.space.com/spacex-starship-first-space-launch#:~:text=The%20goal%20was%20to%20get,about%2090%20minutes%20after%20liftoff https://www.space.com/spacex-starship-first-space-launch#:~:....

intrepidhero 4y ago

Maybe you're trying to make the point that for very complicated systems with many failure points, the reliability of a single component is less impactful than redundancy and there is some truth to that but I must point out that risk vs cost calculations are definitely happening in both industries you mention. Triple redundancy is not a thing in general aviation while, for some systems, it is in commercial. That's a risk vs cost calculation. Semiconductor manufacturers do risk vs cost calculations through the entire development and manufacturing process. Source: I've worked in semiconductor, doing those calculations.

RetpolineDrama 4y ago

> That sounds logical, but isn't really a thing in aerospace/space. Your authoritative tone doesn't make any sense when Falcon 9 exists and has been actively dominating the entire industry for half a decade.

scythe 4y ago

>So to have any chance of success each failure point needs to be engineered below, by way of example, a 0.0001% chance of failure. That costs lots of money. But say one decides to accept more risk for less cost. Ok. So you switch from 0.0001 to 0.001 failure rates. You risk is now 10-fold higher at each failure point, It seems like a strawman to suggest that you would let failure probability increase by a factor of ten as the first step. >but with thousands of failure points adding up you are now essentially doomed. And it was an easy one to tear down. >And you haven't saved anything. The cost of 0.001 components isn't fundamentally different than the 0.0001 components were. There is no reason to believe that at all. Invert the question: if a system is 99.999% reliable, does that mean it should be free to make it more reliable? And why? >It is either go or no go. Take CPU production. Intel spends billions at each of hundreds of fabrication step to push down miniscule error rates because any of a million errors can destroy a chip. There is no money to be saved by allowing any one process to become less than as perfect as it can possibly be. This is completely wrong. Chip factories do produce chips with defects; those chips are sold for cheaper, since they still work, but not as fast. IIRC most of TSMC's modern processes are designed to sell the good chips at a high price and the bad ones cheaper.

nostrademons 4y ago

Only if the failure points are arranged in series - A AND B AND C must happen to have a successful outcome. If the failure points are arranged in parallel - X OR Y OR Z must happen to have a successful outcome, with multiple redundant paths to success, your total failure rate is the chance that ALL of X, Y, and Z fail. This is a much lower number than when they are in series. To use concrete math - say that Starship has 33 raptor engines with a failure rate of 0.01%, 3 grid fins with a failure rate of 0.05%, and a fuel tank with a failure rate of 0.001%. If it's engineered so that all 33 raptor engines, all 3 grid fins, and the fuel tank all need to work for a successful launch, the success rate of the whole system = 0.9999^33 * 0.9995^3 * 0.99999 = 0.9952 = ~0.5% chance of failure. If it's engineered so that it can get to orbit on 28 out of the 33 raptor engines, 2 out of the 3 grid fins, and there is a double-hull to the fuel tank with a failure rate of 0.005%, then the chance of failure for each subsystem is 0.0001^5 = 10^-20, 0.0005^2 = 2.5 * 10^-7, and 0.00001 * 0.00005 = 5 * 10^-10, and when you multiply out those subsystem failure rates you get 1 - (1 - 10^-20) * (1 - 2.510^-7) * (1 - 510^-10) = 0.9999997495 = ~0.000025% chance of failure. Moreover, lets look what happens if you take the multiply-redundant design above and then increase the chance of failure of each component 100x. Raptor engines are now 99% reliable, grid fins are now 95% reliable, and fuel tanks are now 99.9% reliable. The overall failure rate for each subsystem becomes 0.01^5 = 10^-10, 0.05^2 = 2.5 * 10^-3 and 0.001 * 0.005 = 0.000005. When you multiply out those subsystem failure rates you get 1 - (1 - 10^-10) * (1 - 2.510^-3) * (1 - 510^-6) = 0.00250498759 = ~0.2% chance of failure. The multiply-redundant system, even with component failure rates 100x higher, still has better reliability than the perfectly-engineered system where every component must perform exactly to spec. This principle is used all the time in practical engineering. It's why Google builds server farms out of thousands of commodity PCs, hooked up in primary/replica clusters with replication and transparent failover. It's why ships have watertight compartments and double-hulls. It's why passenger jets have multiple engines, multiple hydraulic control systems, and multiple flight computers. Any engineer worth their salt is going to avoid SPOFs and assume that components will fail, then build redundancies into the design so that a partial failure does not endanger overall mission success.

hackernewds 4y ago

> risk is now 10-fold higher at each failure point, but with thousands of failure points adding up you are now essentially doomed. And you haven't saved anything. The cost of 0.001 components isn't fundamentally different than the 0.0001 components were. exactly. optimizing for an acceptable risk for space launches, esp space travel, seems still to be leading to $2B launches. at which point, what's the difference?

JumpCrisscross 4y ago

> you switch from 0.0001 to 0.001 failure rates. You risk is now 10-fold higher at each failure point, but with thousands of failure points adding up you are now essentially doomed Our ex ante ability to estimate these probabilities is lacking. Especially when they’re coupled. And redundancy, instead of tighter tolerances, is often cheaper than the classic approach. These are proven lessons from SpaceX.

DuckFeathers 4y ago

Before the anti-Musk cats get too wet, Elon Musk has said, and I quote, "If we get far enough away from launch pad before something goes wrong, then I think I would consider that to be a success. Just don't blow up the pad.": https://edition.cnn.com/2023/04/16/world/starship-spacex-launch-test-orbit-scn https://edition.cnn.com/2023/04/16/world/starship-spacex-lau...

kortex 4y ago
Right. The criteria for this test was "Failure = CATO (catastrophic at takeoff)". It took off, it didn't CATO, it even hit max Q, therefore success. That's not "partial success". That's 100% success, you won the game show, but you didn't get all the points in the sudden death bonus round.

sterlind 4y ago

but like, SpaceX's whole thing has been blowing up test rockets over and over as they experiment, iterating quickly. once they've nailed the design down, the result is pretty reliable, but look at how many booster recovery fails they had before they got successful. your logic works more for defect rates on parts than on the design itself.

gridspy 4y ago

What you've missed here is that failure points can only be guessed or simulated prior to testing. That analysis is often more expensive than the cost of a test and test article. So SLS does a LOT of analysis and manages to find and rectify failure points prior to flight. They pay a lot in analysis and inflexible design to do this. SpaceX does some analysis, but then flies to confirm the analysis early. That way they identify actual failure points and can use sensors to see how close they got to failure. For instance today I'm sure they learnt a lot from each failed engine, parts on the booster that stopped working, detailed telemetry on ship behavior on flight and sensors for the non-separation of booster from ship. SpaceX builds to the same high tolerances as other rocket manufacturers, but they don't try to avoid testing through overly rigorous analysis. They also don't gold-plate their manufacturing, instead making tradeoffs to allow cheaper volume production with recovery instead.