Department of the Air Force Report, 1996

== -== -=--=-=------===--====-==-=--=-=-==-__;;;;._ ____________ _ RESEARCH TRIANGLE INSTITUTE /RTI Contract No■-FO4703-91-C-0112 RTI Report No. RTl/5180/77-43F September 10, 1996 Modeling Unlikely Space-Booster Failures in Risk Calculations 19961025 122 Final Report Prepared for Department of the Air Force 45th Space Wing (AFSPC) Safety Office - 45 SW/SE Patrick AFB, FL 32925 and Department of the Air Force 30th Space Wing (AFSPC) Safety Office- 30 SW/SE Vandenberg AFB, CA 93437 Distribution authorized to US Government agencies and their contractors to protect administrative/ operational use data, 10 September 96. Other requests for this document shall be referred to the 30th Space Wing (AFSPC) Safety Office (30 SW/SE), Vandenberg AFB, CA 93437, or 45th Space Wing (AFSPC) Safety Office (45 SW/SE), Patrick AFB, FL 32925. 'mJC QUALITY INSPECTED ff 3000 N. Al1antic Avenue • Cocoa Beach, Flo0ida 329315029 US/1 - --- ---------------------~-=,-- Contract No. FO4703-91-C-0112 RTI Report No. RTI/5180/77-43F Task No. 10/95-77, Subtask 2.0 September 10, 1996 Modeling Unlikely Space-Booster Failures in Risk Calculations Final Report Prepared by James A. Ward, Jr. Robert M. Montgomery of Research Triangle Institute Center for Aerospace Technology Launch Systems Safety Department Prepared for Department of the Air Force 45th Space Wing (AFSPC) Safety Office - 45 SW/SE Patrick AFB, FL 32925 and Department of the Air Force 30th Space Wing (AFSPC) Safety Office - 30 SW /SE Vandenberg AFB, CA 93437 Distribution authorized to US Government agencies and their contractors to protect administrative/ operational use data, 10 September 96. Other requests for this document shall be referred to the 30th Space Wing (AFSPC) Safety Office (30 SW/SE), Vandenberg AFB, CA 93437, or 45th Space Wing (AFSPC) Safety Office (45 SW/SE), Patrick AFB, FL 32925. Form Approved REPORT DOCUMENTATION PAGE 0MB No. 0704-0188 Public tel)Ort1ng burden for this collection of information is estimated to average 1 hour per response. induding the time for reviewing instructions, searching exi5ting data sources. gathering and maintain in!,! the data needed, and completing and rev,ew,ng the collection of Information. Send comments r~ardlng tlils burden estimate or any other aspect of this collection of Information, including suggestions tor reducing this burden. tO Washington Headquarters Services, Directorate or Information Operations and Reports, 1215 Jefferwn Davis Highway, Suite 1204, Arlington, VA 12202-4302, and to the Office of Management and Budget. Paperwork Reduction Project(0704-0188), Washington. DC 20503. 1. AGENCY USE ONLY (Leave blank) ~.• REPORT DATE 1 3. REPORT TYPE AND DATES COVERED . eptember 10, 1996 Final 4. TITLE AND SUBTITLE 5. FUNDING NUMBERS f.1odeling Unlikely Space-Booster Failures in Risk Galculations C: F04703-91-C-o112 TA:10/95-TT 6. AUTHORW • James A. ard, Jr. Robert M. Montgomery 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8. PERFORMING ORGANIZATION REPORT NUMBER Research Triangle Institute * ACTA, Inc. ** RTl/5180m-43F 3000 N. Atlantic Avenue · Skypark3 11 Cocoa Beach, FL 32931 23430 Hawthorne Blvd., Suite 300 Torrance, CA 90505 9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10. SPONSORING/ MONITORING AGENCY REPORT NUMBER Department of the Air Force (AFSPC) Department of the Air Force (AFSPC) 30th Space Wing 45th Space Wing r\~'1~.1 - -m.-t1<a-a - Vandenberg AFB, CA 93437 Patrick AFB, FL 32925 -Mr. Martin Kinna (30 SW/SEY) Louis J. Ullian, Jr. (45 SW/SED) 11. SUPPLEMENTARY NOTES *Subcontractor " Prime Contractor 12a. DISTRIBUTION/AVAILABILITY STATEMENT 12b. DISTRIBUTION CODE Distribution authorized to US Government agencies and their contractors to protect administrative/operational use data; 10 September 96. Other requests for this document shall be referred to the 30th Space Wing (AFSPC) Safety Office (30 SW/SE),Vandenberg AFB, CA 93437, or 45th Space Wing (AFSPC) Safety Office (45 SW/SE), Patrick AFB, FL 32925. (!__, 13. ABSTRACT (Maximum 200 words) Missile and space-vehicle performance histories contain many examples of failures that cause, or have the potential to cause, significant vehicle deviations from the intended flight line. In RTl's risk-analysis program, DAMP, such failures are referred to as Mode-5 failure responses. Although Mode--5 failure responses are much less likely to occur than those that result in impacts near the flight line, risk-analysis studies are incomplete without them. This report shows how Impacts from Mode-6 failures are modeled in program DAMP. The impact density function used for this purpose contains two shaping constants that control the rate at which the density function drops In value as the angular deviation from the flight line and the impact range increase. Certain Mode--5 •malfunctions are simulated, and the two shaping constants then chosen by trial and error so that impacts from the simulated malfunctions and the theoretical density function are in close agreement. An appendix to the report contains alisting and brief narrative failure history of the A~as, Delta, and Titan missile and space-vehicle launches from the Eastern and Western Ranges from the beginning of each program through August 1996. Each entry gives the vehicle configuration, whether the flight was asuccess, the flight phase in which any anomalous behavior occurred, and aclassification of vehicl~ behavior in accordance with defined failure-response modes. 14. SUBJECT TERMS 15. NUMBER OF PAGES· launch risk, unlikely failure modeling, booster failure probabilities 180 16. PRICE CODE 17. SECURITY CLASSIFICATION 18. SECURITY CLASSIFICATION 19. SECURITY CLASSIFICATION 20. LIMITATION OF ABSTRACT OF REPORT OF THIS PAGE OF ABSTRACT Unclassified lJnclassified lnclasslfled SAR NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) Prescribed by AIIISI Std. Z39-18 298·102 Abstract Missile and space-vehicle performance histories contain many examples of failures that cause, or have the potential to cause, significant vehicle deviations from the intended flight line. In RTI's risk-analysis program, DAMP, such failures are referred to as Mode-5 failure responses. Although Mode-5 failure responses are much less likely to occur than those that result in impacts near the flight line, risk-analysis studies are • incomplete without them. This report shows how impacts from Mode-5 failures are modeled in program DAMP. The impact density function used for this purpose contains two shaping constants that control the rate at which the density function drops in value as the angular deviation from the flight line and the impact range increase. Certain Mode-5 malfunctions are simulated, and the two shaping constants then chosen by trial and error so that impacts from the simulated malfunctions and the theoretical density function are in close agreement. An appendix to the report contains a listing and brief narrative failure history of the Atlas, Delta, and Titan missile and space-vehicle launches from the Eastern and Western Ranges from the beginning of each program through August 1996. Each entry gives the vehicle configuration, whether the flight was a success, the flight phase in which any anomalous behavior occurred, and a classification of vehicle behavior in accordance with defined failure-response modes. Various filtering or data weighting techniques are described. The empirical data are then filtered to estimate (1) failure probabilities for Atlas, Delta, and Titan, and (2) percentages of future failures that will result in Mode-5 (and other Mode) responses. 9/10/96 RTI Table of Contents · 1. Introduction............................................................................................................................... 1 2. Examples Showing Need for Mode 5 ................................................................................ 3 3. Understanding the Mode-5 Failure Response ................................................................... 7 3.1 Effects of Mode-5 Shaping Consta.nts ................................. " ..................................... -...... 9 3.2 Effects of Shaping Constant on DAMP Results ........................................................ 9 4. Methodology for Assessing Failure Probabilities ........................................................... 13 4.1 The Parts-Analysis Approach .................................................................................. 13'­ 4.2 The Empirical Approach .......................................................................................... 15 5. Computation of Failure Probabilities ............................................................................... 16 5.1 Overall Failure Probability ....................................................................................... 16 5.2 Relative and Absolute Probabilities for Response Modes ..................................... 24 5.3 Relative Probability of Tumble for Response-Modes 3 and 4 ............................... 30 6. Shaping Constants Through Simulation .......................................................................... 31 6.1 Malfunction Tum. Simulations........... • ...................................................................... 31 6.1.1 Random-Attitu.de Failures ...............-............................................................... 31 6.1.2 Slow-Tum Failures ........................................................................................... 32 6.1.3 Factors Affecting Malfunction-Tum Results ................................................ 33 6.1.4 Malfunction-Tum Results for Atlas IIAS ...................................................... 35 6.2 Shaping Constants for Atlas IIAS ............................................................................ 37 6.2.1 Optimum Mode-5 Shaping Constants ........................................................... 37 6.2.2 Launch-Area Mode-5 Risks ............................................................................ 49 6.2.3 Effects of Mode-5 Constants on Ship-Hit Contours ..................................... 51 6.2.4 Range Distributions of Theoretical and Simulated Impacts ........................ 58 6.3 Shaping Constants for Delta-GEM .......................................................................... 60 6.3.1 Optimum Mode-5 Shaping Constants ........................................................... 61 6.3.2 Launch-Area Mode-5 Risks ............................................................................ 64 6.4 Shaping Constants for Titan IV................................................................................ 65 6.5 Shaping Constants for LLVl .................................................................................... 69 6.6 Shaping Constants for Other Launch Vehicles ....................................................... 72 7. Potential Future Investigations ......................................................................................... 73 8. Summarv: ., ............................................................................................................................ 74 9/10/96 ii RTI I Appendix A. Failure Response Modes in Program DAMP ............................................... 79 Appendix B. Shaping-Constant Effects on Mode-5 Impact Distributions ........................ 81 Appendix C. Filter Characteristics ....................................................................................... 90 Appendix D. Launch and Performance Histories .............................................................. 96 D.1 Basic Data ................................................................................................................. 96 D.1.1 Data Sources ................................................................................................................................................................... 96 D.1.2 Assignment of Failure-Response Modes ...................................................... 98 D.1.3 Assignment of Flight Phase .......................................... ~ ....................................................................... 98 D.1.4 Representative Configurations ................................................................... 100 D.2 Atlas Launch and Performance History .............................................................. 101 D.2.1 A'tlas Launch History ..................................................................................................... 103 D.2.2 Atlas Failure Narratives ........... ~ .................................................................... 115 D.3 Delta Launch and Performance History .............................................................. 133 D.3.1 Delta Launch History ................................................................................... 136 D.3.2 Delta Failure Narratives .............................................................................. 142 D.4 Titan Launch and Performance History .............................................................. 146 D.4.1 Titan Launch History ................................................................................... 149 D.4.2 Titan Failure Narratives .............................................................................. 157 D.5 Thor Launch and Performance History (Not Including Delta) ......................... 164 D.5.1 Thor and Thor-Boosted Launch History .................................................... 164 D.5.2 Thor and Thor-Boosted Failure Narratives ............................................... 167 References............................................................................................................................. 171 9/10/96 iii RTI Table of Figures Figure 1. Joust Impact Trace Showing a Mode-5 Failure Response ....................................6 Figure 2. Atlas IIAS Risk Contours for Inner-Ear Injury with A = 3.0.............................. 11 Figure 3. Atlas IIAS Risk Contours for Inner-Ear Injury with A = 3.5.............................. 12 Figure 4. Filter Factor Results for Representative Configurations of Atlas ...................... 23 Figure 5. Combined Random-Attitude and Slow-Tum Results ........................................ 36 Figure 6. Atlas IIAS Breakup Percentages for Random-Attitude Tums ........................... 37 Figure 7. Atlas HAS Impacts with No Breakup ........................................................ ~ ........ 39 Figure 8. Atlas IIAS Impacts with Breakup ......................................................................... 40 Figure 9. Atlas IIAS Simulation Results with B = 1,000 ..................................................... 42 Figure 10. Atlas IIAS Simulation Results with B = 50,000.................................................. 44 Figure 11. Atlas HAS Simulation Results with B = 100,000................................................ 45 Figure 12. Atlas HAS Simulation Results with B = 500,000................................................ 46 Figure 13. Atlas HAS Simulation·Results with B = 5,000,000.............................................47 Figure 14. Effects of Breakup q-alpha on A for Atlas IIAS ................................................ 49 Figure 15. Mode-5 Density-Function Values at Three Miles ............................................. 51 Figure 16. Atlas IIAS Mode-5 Ship-Hit Contours with A= 3.00 ....................................... 53 Figure 17. Atlas IIAS All-Mode Ship-Hit Contours with A = 3.00.................................... 54 Figure 18. Atlas IIAS Mode-5 Ship-Hit Contours with A= 3.45 .......................................55 Figure 19. Atlas IIAS All-Mode Ship-Hit Contours with A= 3.45.................................... 56 Figure 20. Atlas IIAS Mode-5 Ship-Hit Contours with A = 6.30 ....................................... 57 Figure 21. Atlas IIAS All-Mode Ship-Hit Contours with A = 6.30.................................... 58 Figure 22. Impact-Range Distributions .................................................................................. 59 Figure 23. Delta-GEM Breakup· Percentages ....................................................................... 61 Figure 24. Delta-GEM Simulation Results with B ==-1,000.................................................. 62 Figure 25. Delta-GEM Simulation Results with Best-Fit Shaping Constants ................... 63 Figure 26. Titctn·IV Breakup Percentages ................................................................................ 65 Figure 27. Titan·Simulation Results with B = 1,000 ............................................................ 66 Figure 28. Titan Simulation Results with Best-Fit Shaping Constants .............................. 67 Figure 29. LLVl Breakup Percentages ..................................................................................................................... 69 Figure 30. LLVl Simulation Results with B = l,000............................................................ 70 iv RTI 9/10/96 Figure 31. LLVl Simulation Results with Best-Fit Shaping Constants ............................. 71 Figure 32. £-Ratios for Ranges from 1 to 25 Miles .............................................................. 86 Figure 33. Percentage of Impacts Between Flight Line and Any Radial .......................... 87 Figure 34. Percentage of Impacts in 5-Degree Sectors ........................................................ 88 Figure 35. Exponential Weights for Fading-Memory Filters ............................................. 93 Figure 36. Recursive Filter Factor for Last Data Point ........................................................ 94 Figure 37, Atlas Launch Summary..................................................................................... 102 Figure 38. Delta Launch Summary." ................................................................................... 135 Figure 39. Titan Launch Summary..................................................................................... 148 Figure 40. Thor Launch Summary ..................................................................................... 164 Table of Tables Table 1. Effects of Mode-5 Shaping Constant A on Atlas IIA Risks .................................. 10 Table 2. Predicted Failure Probabilities for Representative Configurations .................... 17 Table 3. Predicted Failure Probabilities for All Configurations ........................................ 18 Table 4. Comparison of Weighting Percentages ................................................................. 19 Table 5. Filter Factor Influence on Weighting Percentages ................................................ 21 Table 6. Failure Probabilities for Atlas, Delta, and Titan ................................................... 24 Table 7. Number of Atlas Failures - All Configurations (532 Flights) .............................. 25 Table 8. Number of Delta Failures-All Configurations (232 Flights).............................. 25 Table 9. Number of Titan Failures - All Configurations (337 Flights) .............................. 25 Table 10. Number of Eastern-Range Thor Failures (85 Flights) ........................................ 25 Table 11. Number of Failures for All Vehicles (1186 Flights)............................................ 26 Table 12. Date of Most Recent Failure ................................................................................. 26 Table 13. Percentage Weighting for Sample of 1186 Launches ......................................... 27 Table 14. Response-Mode Occurrence Percentages ............................................................ 27 Table 15. Recommended Response-Mode Percentages for Flight Phases O - 2................ 28 Table 16. Recommended Response-Mode Percentages for Flight Phases O - 1................ 29 Table 17. Absolute Failure Probabilities for Response Modes 1 - 5 .................................. 29 Table 18. Percent of Response Modes 3 and 4 That Tumble .............................................. 30 9/10/96 V Table 19. Sample Impact Distribution for Atlas IIAS-with No Breakup .......................... 41 Table 20. Shaping Constants for Atlas IIAS......................................................................... 48 Table 21. Shaping Constants and Related Risks for Atlas HAS­......................................... 50 Table 22. Best-Fit Conditions for Atlas IIAS............................................. : .......................... 52 Table 23. Shaping Constants and Related Risks for Delta-GEM ....................................... 64 Table 24. Shaping Consta.nts for Titan IV ............................................................................ 68 Table 25. Shaping Constants for LLVl ................................................................................. 72 Table 26. Summary of A Values for B = 1,000................. ; ................................................... 72­ Table 27. Failure Probabilities for Atlas, Delta, and Titan ................................................. 75 Table 28. Recommended Response-Mode Percentages for Flight Phases O-2 ................. 75~ Table 29. Recommended Response-Mode Percentages for Flight Phases O - 1................ 75 Table 30. Absolute Failure Probabilities for Response Modes 1 - 5 .................................. 76 Table 31. Summary of A Values for B = 1,000.................................................................. • ... 77 Table 32. Summary of Optimum·Mode-5 Shaping Constants ........................................... 77 Table 33. Effect on £-Ratio-of Varying Mode-5 Constant A {B = 1000) - Part 1 ................ 82 Table 34. Effect on £-Ratio-of Varying Mode-5 Constant A {B = 1000) - Part 2 ................ 83 Table 35. Effect on £-Ratio-of Varying Mode-5 Constant B {A = 3) - Part 1 ...................... 84 Table 36. Effect on £-Ratio-of Varying Mode-5 Constant B {A= 3) - Part 2 ...................... 85 Table 37. Filter Application for Failure Probability ............................................................ 95 Table 38. Flight-Phase Defi°:,itions........................................................................................ 99 Table 39. Flight Phases by Launch Vehicle ......................................................................... 99 Table 40. Summary of Atlas Vehicle Configurations ....................................................... 101 Table 41. Atlas Launch History ........................................................... • ............................... 103 •Table 42. Summary of Delta Vehicle Configurations ....................................................... 133 Table 43. Delta Launch History .......................................................................................... 136 Table 44. Summary of Titan Vehicle Configurations ....................................................... 147 . Table 45. Titan Launch History .......................................................................................... 149 Table 46. Thor Launch History ........................................................................................... 165 Vl RTI 9/10/96 1. Introduction The debris from most launch vehicles that fail catastrophically tend to impact close to the intended flight line. Typical failures that produce such results are premature thrust termination, stage ignition failure, tank rupture or explosion, or rapid out-of-control tumble. Less likely malfunctions may cause a vehicle to execute a sustained turn away from the flight line. Examples are control failures that cause the rocket engine to lock in a fixed position near null, or failures leading to erroneous orientation of the guidance platform. Such failures should not be ignored, since they may produce nearly all or a significant part of the risks to population centers that are more than a mile or so uprange or many miles away from the flight line. Consequently, RTI has been tasked to estimate the probabilities of occurrence of these less-likely failures, and to determine optimum values for the shaping constants of the associated impact-density function RTI has developed a prototype risk-analysis program (1) to analyze the level of risk in the launch area when ballistic missiles and space vehicles are launched, and (2) to provide guidelines for launch operations and launch-area risk management. This program, "facility DAMage and Personnel injury" (DAMP), uses information about the launch vehicle, its trajectory and failure responses, and facilities and populations in the launch area to estimate hit probabilities and casualty expectations. When a missile or space vehicle malfunctions, people and facilities may be subjected to significant risks from falling inert debris, or from overpressures and secondary debris produced by a stage, component, or large propellant chunk that explodes on impact. Although fire, toxic materials, and radiation may also subject personnel to significant danger, these hazards are not addressed in program DAMP. Hazards are greatest in the launch area and along the intended flight line, but lesser hazards exist throughout the area inside the impact limit lines. Small hazards exist even outside these lines if the flight termination system fails or other unlikely events occur. In computing launch-area risks, DAMP makes no attempt to model vehicle failures per se. A list of possible failures for any vehicle would be extensive, and variations in failures from vehicle to vehicle would complicate the modeling process. Instead, DAMP models failure responses. Regardless of the exact nature of the failures that can occur, there are only six possible response modes that affect risks on the ground, five for failure responses, and one to model the behavior of a normal vehicle. The six modes are described in Appendix A. It can be seen from the descriptions that impacts resulting from failure-response Modes 1, 2, and 3 occur at most a mile or two from the launch point, while those from Mode 4 can only occur near the flight line, even though the vehicle may tumble before breakup or destruct. Although the hazards outside the launch area and away from the flight line may be small, vehicle flight tests through the years have demonstrated that finite hazards do exist in these areas. Such hazards are due almost entirely to Mode-5 failure responses, even through the probability of a Mode-5 failure may be only a small part of the total failure probability. The Mode-5 failure-response, theoretical though it is, was developed to reflect the facts that: (1) unlikely vehicle failures 9/10/96 1 RTI can cause impacts uprange or well away from the intended flight line, and (2) some vehicle failures cannot logically be classified as Response Modes 1, 2, 3, or 4. In- keeping with the above, the Mode-5 impact-density function was developed with the characteristics listed below. The function, which fills the void left by Modes 1 through 4, is sufficiently robust to include all possible impacts, yet seemingly comports with observed test results. (1) Impacts can occur in any direction from the launch point and at any range within the vehicle's energy capabilities. (2) At any given impact range from the launch point, the likelihood of impact decreases as the angular deviation from the flight line increases, becoming least. likely in the uprange direction. For any fixed angular deviation from the flight line, the likelihood of impact decreases as the impact range increases. (3) At fixed impact ranges near the launch point, the impact density function changes gradually as the impact direction swings 180° from downrange to uprange. As the impact range increases, the decrease in the density function becomes progressively more and more rapid with change in impact direction. In other words, the greater the impact range, the more rapidly the density function changes with angular deviation from the flight line. • As modeled in DAMP, the effects of destruct action on the Mode-5 density function are accounted for in the launch area by supplementing impacts inside the impact limit lines with those that would occur outside the impact limit lines if no destruct action were taken. The Mode-5 failure-response methodology was fully developed in an earlier RTI report111• As pointed ·out there, the shape of the impact density function can be controlled somewhat through the selection of shaping constants that appear in the defining equation Intuition suggests that the constants should be vehicle dependent, since (1) ruggedly built missiles would, after a malfunction, be more likely to impact well away from the flight line than would a fragile space vehicle that tends to break up before deviating significantly; and .(2) certain vehicles, after a malfunction, tend to stabilize and • continue thrusting at large angles of attack, while other vehicles that experience similar malfunctions tend to tumble. Hit probabilities computed by-program DAMP for targets located more than two miles or so uprange from the pad or more than a few miles from the flight line, are due almost entirely to the Mode-5 impact-density function Thus, the assumed probability of occurrence of a Mode-5 response as well as the selected Mode-5 constants are of considerable importance. The tasking for this. study is set _forth as Task No. 10/95-77, Paragraph 2.0, of Contract FO4703-91-C-0112. The primary purpose of the tasking is: "Perform a study to determine the best values for Mode-5 failure probability and the Mode-5 density- function shaping constant A." Although not explicitly included in the statement of work, the study also develops absolute failure probabilities for Atlas, Delta, and Titan, and 9/10/% 2 RTI relative probabilities of occurrence for all failure-response modes for these vehicles, LLVl, and other new launch systems. Although it may be reasonable to establish the relative probability of occurrence of a Mode-5 failure response by empirical means, the number of Mode-5 failures is too small to have any hope of establishing accurate values for the shaping constants from this sample alone. Inadequate descriptions of vehicle behavior in the available historical records and uncertainty in impact location following a malfunction add to the difficulty of classifying failure responses. In view of the limited data available for vehicles that have experienced Mode-5 failures, the values chosen for the Mode-5 constants must depend on simulations of vehicle behavior following failure. 2. Examples Showing Need for Mode 5 The need for a Mode-5 response or some similar response mode (or a multiplicity of other response modes) can be seen from the following vehicle performance descriptions extracted from Appendix D: (1) Atlas BE, 24 Jan 61. Missile stability was lost at about 161 seconds, some 30 seconds after BECO, probably due to failure of the servo-amplifier power supply. The sustainer engine shut down at 248 seconds, and the vernier engines about 10 seconds later. Impact occurred 1316 miles downrange and 215 miles crossrange. • (2) Titan M-4, 6 Oct 61. A one-bit error in the W velocity accumulation caused impact 86 miles short and 14 miles right of target. (3) Atlas 145D (Mariner R-1), 22 July 62. Booster stage and flight appeared normal until after booster staging at guidance enable at about 157 seconds. Operation of guidance rate beacon was intermittent. Due to this and faulty guidance equations, erroneous guidance commands were given based on invalid rate data. Vehicle deviations became evident at 172 seconds and continued throughout flight with a maximum yaw deviation of 60° and pitch deviation of 28° occurring at 270 seconds. The vehicle deviated grossly from the planned trajectory in azimuth and velocity, and executed abnormal maneuvers in pitch and yaw. The missile was destroyed by the RSO at 293.5 seconds, some 12 seconds after SECO. (4) Atlas SLV-3 (GTA-9), 17 May 66. Vehicle became unstable when B2 pitch control was lost at 121 seconds. Loss of pitch control resulted in a pitch-down maneuver much greater than 90°. Guidance control was lost at 132 seconds. After BECO, the vehicle stabilized in an abnormal attitude. Although the vehicle did not follow the planned trajectory, SECO (at 280 seconds), VECO (at 298 seconds), and Agena separation occurred normally from programmer commands. (5) Atlas 95F (ABRES/AFSC), 3 May 68. Immediately after liftoff the telemetered roll and yaw rates indicated that the missile was erratic. During the first 10 seconds of flight the missile yawed hard to the left. It then began a hard yaw to the right, 9/10/96 3 RTI crossed over the flight line and continued toward the right destruct line. Shortly thereafter the missile apparently pitched up violently and the HP began moving back toward the beach. The missile was destructed at about 45 seconds when the altitude was about 14,000 feet and the downrange distance about 9 miles. Major pieces impacted less than a mile offshore, indicating uprange movement of the impact point during the last part of thrusting flight. (6) Delta Intelsat III, 18 Sep·68. Due to loss of rate gyro, undamped pitch oscillations began at 20 seconds. A series of violent maneuvers followed at 59 seconds. During the 13-second period while these maneuvers continued, the vehicle pitched down some 270°, then up 210°, and then made a large yaw to the left. At 72 seconds the vehicle regained control and flew stably in a down and leftward direction until 100 seconds. At this time, with the main engine against the pitch and yaw stops, the destabilizing aerodynamic forces became so· large that quasi- control could no longer be maintained. The first stage broke up at 103 seconds. The second stage was destroyed by the RSO at 110.6 seconds. Major pieces impacted about 12 miles downrange and 2 miles left of the flight line. (7) Delta Pioneer E, 27 Aug 69. First-stage hydraulics system failed a few seconds before first-~tage burnout (MECO). The vehicle pitched down, yawed left, rolled counterclockwise driving all gyros off limits, and then tumbled. Second-stage separation and ignition occurred while the vehicle was out of control. After about 20 seconds, the second stage regained control in a yaw-right, pitch-up attitude. It flew stably in this attitude for about 240 seconds until destroyed by the safety officer at T +484 seconds. (8) Atlas 68E, 8 Dec 80. Flight appeared normal until 102.7 seconds when the lube oil pressure on the B2 booster engine suddenly dropped. At 120.1 seconds, the engine shut down, followed 385 msec later by guidance shutdown of the Bl engine. The asymmetric thrust during shutdown caused yaw and roll rates that the flight-control system could not correct. As a result, attitude control was lost and the thrusting sustainer pivoted the missile to a retrofire attitude before the vehicle could be stabilized: After the booster package was jettisoned, the missile was stabilized and decelerating in the retrofire mode by 148 seconds. The sustainer continued thrusting in this attitude until 282.9 seconds when reentry heating apparently caused sustainer shutdown and vehicle.breakup. 9/10/96 4 RTI It is obvious from the response-mode definitions in Appendix A that none of the described vehicle failures can be considered as a Mode 1, 2, or 3 response, or a Mode-4 on-trajectory failure.• Except possibly for (2), it also seems apparent that none can be modeled as either a rapid tumble or a slow tum. • Although prompt destruct action during any of the described flights might have resulted in a Mode-4 classification, the safety officer typically needs several seconds to evaluate data after a malfunction. Quick action is contrary to safety philosophy if impact limit lines are not threatened and the destruct • system is not at risk, since additional flight time enhances the user's opportunity to pinpoint the nature of the problem. 9/10/96 5 RTI A good illustration of a Mode-5 failure response occurred during launch of Prospector (Joust) on the Eastern Range in-June 1991. The Joust consists of a single-stage Castor IV-A solid-propellant rocket motor and a payload module. The "vehicle made a radical pitch-up maneuver due to· aft-skirt structural failure at approximately T+14 Seconds." 121 The vacuum instantaneous impact trace from the RSO console is shown in Figure 1. If the safety officer had taken destruct action during the time interval from 18 to 25 seconds, impact would have been well away from the flight line. CYIER A UNCLRSSIFIED IP "AP 1 JOUST1761-R r20SEC. + 3 □.□ + 3 □ .a . . PP.rttE I. 17B RLTEP. CNH!AVE53 SKIN ON TRRCK ... .. . . .. . . .... ON TRACK 1. D DELAY ~• _._:,.--25SEC. 1 .II DELAY ',• r1BSEC. .::---,--­ \"·./ ~-••••30SEC. +· 12 CHEV . . . 15 CHEV t • • \ • ■ ...... ~-. '\ .... 16.3 !iLO 19.7 5LO !II .1 5HT a. 1 RGT 32.2 SltT 15SEC. Q.7 LFT ~ 1 LOU ~-2 LOIi \ \ 78 HDG 625 VEL 2 ALT l ! .......--.. D. I 1l / --•-=--.-,,,•' CNTRAVE'i! --.. --, . ·­ SKIN . i ·; ON TRRU ON TRACK I I 0 0 5 DELAY I ' . 0.5 DELAY f i I i + 4 GREEN Figure 1. Joust Impact Trace Showing a Mode-5 Failure Response As still another example of a Mode-5 failure response, a guided Red Tigress sounding rocket was launched from Pad 20 at Cape Canaveral on 20 Aug 91. Within a second or two after clearing the launcher, the rocket made a near 90° right tum, and flew stably in this direction until destroyed by the safety officer at 23.3 seconds. Pieces impacted some two or three miles from the launch pad. This failure might have been classified as a Mode-2 response if destruct action had been taken·shortly after launch. 9/10/96 6 RTI 3. Understanding the Mode-5 Failure Response Unlike failure response Modes 3 and 4, response Mode 5 (and also Mode 2) is not a direct function of time from launch. For Modes 3 and 4, the mean point of impact (MPI) for each debris class is fixed, once the failure time is established. At each instant there is only one possible location for the :MPI for each debris class. On the other hand, the Mod~S impact- density function for each debris class consists of a primary part and a secondary superimposed part. The primary impact-density function accounts for impact variability due to the erratic flight of the vehicle. It is used to determine the probability that the mean piece in a debris class resulting from vehicle breakup falls in a given area (say on a building or open field). The secondary density function accounts for debris dispersion due to vehicle breakup and to aerodynamic effects during free fall. It is used to determine the probability that fragments from the class actually hit a building or field. In other words, the primary impact-density function is used to compute the probability that the secondary function is centered in some specified area; the secondary function, which describes the distribution of class pieces about the mean point, is then used to compute the probability that one or more class pieces impacts on the specified population center or area. The primary part of the Mod~S impact density function, which was presented as Eq. (9.5) in Ref. [1], is reproduced here as Eq. (1): (1) where R is the range from the launch point in miles, ~ is the angle in radians between the uprange direction and a line fro:r,n the pad through the impact point, Ris the impact-range rate in miles per second. A and C are dimensionless shaping constants, and shaping- constant D is in miles. For a Mod~S response, there is by definition an earliest time of occurrence TP (pitch-over time) and a latest time of occurrence T5 (burnout, orbital injection, or some other specified termination time). The specific time in this span at which a Mode-5 response manifests itself is of no consequence, although the duration of the span must be considered in assigning a probability of occurrence for a Mod~S response. Given that a Mod~S response has occurred, the probability that the center of the secondary function lies in some region or on some building (population center) is determined by integrating the primary impact-density function for the class over the region or building. The primary function depends on range (R) and direction (q>) from the launch point to the population center, but not directly on time from launch. The primary function does, "' As an aid to understanding, the supplement of (j), designated as 0, is used in plots and tables in this report. 9/10/96 RTI however, involve the quantity R which is expressed explicitly as a function of R and only implicitly as a function·of time. Values of R from the nominal trajectory are differenced to computeR. The secondary Mode-5 impact-density function is circular normal in form and expressed by the equation (2) where d is the distance from the impact point of the mean piece to the center of the target, and oc is the standard deviation (dispersion) for the debris class. The fact that the center of the secondary impact-density function (or secondary MPI for a debris class) lies Off some population center does not necessarily mean that pieces in the class hit the center. The probability that one or more pieces actually hits the pop center is determined by integrating the secondaryimpact-density function over the center and combining results for all pieces in the class. The dispersions for the secondary function are computed by root-sum- squaring individual dispersions• arising from the effects of winds, vehicle-breakup velocities, and drag uncertainties for the class. They are computed from the nominal trajectory, and cari be explicitly expressed as a function· of impact range. Since the pop center can also be hit if the MPI of the secondary density function lies outside the pop center, all possible mutually-exclusive locations of the secondary function that can result in impact on the pop center must be considered. For each mutually-exclusive location, the probability that one or more class pieces impacts on the pop center is calculated, and the results combined to obtain the total hit probability for the class. The Mode-5 primary impact-density function is modeled so· it is independent of how the impact point arrives at a particular location For example, there are myriad paths that a vehicle can travel to impact at a location two miles crossrange left from the launch pad. Figure 1 shows one such way for a Joust vehicle that failed at 15 seconds, but four seconds later had moved the impact point uprange and CTO$!ange to a position two miles crossrange left from the launch point. Another way to place the impact point two- miles •crossrange left is for the vehicle to fly in the wrong direction (north instead of east) from liftoff. Although numerous failure mechanisms and vehicle behaviors can lead to a Mode-5 response and impact in a particular area, the exact mechanism and behavior are irrelevant All such possibilities are assumed to be accounted for by Eq. (1). Four specific failures that produce Mode-5 responses are easily- described: (1) a re-orientation of the guidance platform, (2) insertion of an erroneous spatial target into the guidance system, (3) locking of the engine nozzle in a fixed position near null thus producing a near-constant angular * These dispersions are a subset of the Mode-4 impact dispersions. 9/10/96 8 RTI acceleration of the vehicle body and a slow turn of the velocity vector, (4) erroneous accumulation of velocity bits by the guidance system. Many other Mode-5 responses are so convoluted that they defy description or categorization 3.1 Effects of Mode-5 Shaping Constants The primary part of the Mode-5 impact-density function was presented previously as Eq. (1). As originally formulated, the function contained three shaping constants. If both numerator and denominator of the equation are divided by the constant C, and B is substituted for D/C, one unnecessary constant disappears so that the function may be expressed as follows: (3) The values chosen for the shaping constants A and B that appear in Eq. (3) influence, but do not change, the basic nature of the Mode-5 impact-density function For many years values of A = 2.5 and B = 1000 were used in the Eastern Range ship-hit computations, although in more recent risk studies the value of A has been increased to 3.0. This increase resulted . from the observation that, in recent years, vehicles that experience Mode-5 failure responses seem less likely than earlier developmental vehicles to deviate significantly from the intended flight line. To see how A and B affect the distribution of Mode-5 impacts, and to further understanding of the function, the results of choosing various values of A and B are provided in Appendix B. 3.2 Effects of Shaping Constant on DAMP Results As pointed out in the Introduction, two important types of constant parameters required by DAMP for risk estimations must be determined. They are: (1) probability of a Mode-5 failure response, and (2) valqes of the Mode-5 shaping constants A and B, currently set at 3.0 and 1000, respectively. As will be demonstrated later, DAMP results are far more sensitive to changes in A than in B. The following cases illustrate the effects that constant A has on calculated risks. Case 1: Baseline Risks for Atlas IIA In the baseline risk analysis for Atlas IIAm, the probability of a Modew5 failure response was estimated at 12.5% of the total failure probability during the first 120 seconds of flight. Even so, risks resulting from Mode-5 responses accounted for about 90% of the total risks for people inside the impact limit lines (ILL). Table 1 indicates the range of risks inside the ILLs for day launches from Pad A using various estimates of the shaping constant A and a value of B = 1000. 9/10/96 9 RTI Table 1. Effects of Mode-5 Shaping Constant A on Atlas IIA Risks B= 1,000 Percent of Mode-5 IPs Uprange 28.6 Casualty Expectancv (x 10°') inside ILLs Modes Total for all Modes 246 259.9 Constant A 2.5 3.0 3.5 4.0 20.7 14.6 10.0 136 149.4 58.9 72.7 30.5 44.3 The results in·the third column are directly proportional to the probability that a Mode­ 5 failure occurs. For the Atlas IIA analysis, a value of 1/200 = 0.005 was assumed. Case 2: Risk Contours for Atlas IIAS Definitions of Flight Hazard Area and Flight Caution Area may be based on the risk contours for inner-ear injury. Constant A can have a significant effect on the location of the 10-6 contour, as illustrated in Figure 2 and Figure 3 for the Atlas IIAS. For these figures, the Mode-5 absolute probability of occurrence was 0.005, constant A was 3.0 and 3.5, and constant B was 1000. 9/10/96 10 RTI lf) Lo >i '°I "q"" ~ - I -~ 0 I 0 ...---f C ...---f 0 1--1 II ..--t (/.I <[ L<[ 1--1 d 1--1wLn l/l L I d a., a., _, C "ZS .p C Q <I:1--1L Figure 2. Atlas HAS Risk Contours for Inner-Ear Injury with A= 3.0 9/10/96 11 RTI - 0 -4 Figure 3. Atlas IIAS Risk Contours for Inner-Ear Injury with A = 3.5 9/10/96 12 RTI 4. Methodology for Assessing Failure Probabilities A primary purpose of this study is to develop estimates of the relative probabilities of occurrence of a Mode-5 failure response for Atlas, Delta, Ti~ and as a by-product, for other launch vehicles as well. Natural fallouts of this effort are the relative probabilities of occurrence of other failure-response modes used in program PAMP as well as overall vehicle failure probabilities. There are at least two approaches commonly used in estimating launch-vehicle failure probabilities: (1) a so-called parts-analysis or engineering approach, involving an engineering assessment of the reliability of various parts and components comprising each missile subsystem, and the effects of a part, component or subsystem failure; and (2) an empirical statistical approach based on actual launch results. There are serious problems with both approaches. 4.1 The Parts-Analysis Approach A description of this approach, its difficulties and shortcomings, are discussed in some detail in a draft report by Booz• Allen & Hamilton, Inc.141 prepared in 1992 for the Air Force Space Command. Since we cannot improve on the ideas and words expressed by Booz• Allen, we quote the following from that report: "The engineering approach for calculation of launch vehicle success rates is based on measurement/estimation of piece-part reliabilities and their combination into reliability block models of the launch system. These block models . . . include consideration of the criticality of individual components, the presence (or absence) of redundant capabilities, the likelihood that one component failure might cause a failure in another component, as well as other needed data. By combining the individual piece-part reliabilities in this model, the engineering approach produces an overall reliability estimate for the launch system. "The engin~ng approach has several significant limitations that tend to reduce confidence in its results. First, the approach assumes that the interrelationships among and between sub-systems are understood sufficiently to enable development of a reliability block diagram. This assumption is highly questionable in complex systems, such as space launch vehicles, whose operational histories include many anecdotes regarding unexpected relationships between 'independenf sub-systems. "The second drawback of the engineering approach is that it assesses the reliability of the system in a perfectly assembled condition. As a result, it assesses reliability without regard to manufacturing, processing, or operations variations and errors." Effects typically overlooked or ignored include: a. Improper installation of components b. Erroneous computer programs 9/10/96 13 RTI c. Insertion of improper computer programs d. Support-personnel fatigue A third limitation of the parts-analysis approach discussed in Ref. [4] deals with the subjectivity and invalid assumptions often used to· estimate piece/ component reliabilities. Here Booz•Allen quotes from a reporf1 by the Office of Technology Assessment, and we do likewise: "The design reliability of proposed vehicles is generally estimated using: Data from laboratory tests of vehicle systems (e.g., engines and avionics) and components that have already been built; Engineer's judgments about the reliability- achievable in systems and components that have not been built; Analyses of whether a failure in one system or component would cause other systems and components, or the vehicle to fail; and Assumptions (often tacit) that: the laboratory conditions under which systems were tested precisely duplicate the conditions under which the systems will operate, the conditions under which the system will operate are those under which theywere designed to operate, the engineer's judgments about reliability are correct, and the failure analyses considered all circumstances and details that influence reliability: Such engineering estimates of design·reliability are incomplete and subjective ...". Effects influencing reliability that the analyst may fail to consider include: a. Lightning strikes b. Aging effects, particularly for solid propellants c. Corrosion d. Insufficient heat or cold insulation for critical components e.Idng f. Erroneous antennae patterns or instrumentation Booz• Allen concludes as follows:· ''Finally, due to its nature, the engineering approach can not account for undetected design flaws. (If these flaws were detected, and could be modeled, 9/10/96 14 RTI they would be corrected.) However, experience has shown that design flaws do cause failures in operational launch systems, and will likely do so in the future." The major objection to the parts-analysis approach, hinted at above but not actually expressed, is that all such approaches involve either explicitly or implicitly a so-called K- factor. The K-factor is included in the reliability calculations in an attempt to compensate for the fact that the environment in which a part or system is tested is not the same as the flight environment. Since the K-factor is surely not the same for all components and systems, multiple values must be assumed and the entire process becomes highly subjective. In view of the objections and limitations just presented, in this report the parts-analysis approach is not considered in assessing vehicle reliability or in estimating the relative probabilities of occurrence of the various failure-response modes. 4.2 The Empirical Approach A seemingly more objective way to evaluate vehicle reliability (or conversely, vehicle failure probabilities) is by examining the actual performance of flight-tested vehicles. In support of this approach, the following is quoted from the Office of Technology Assessment1report previously referenced: "The only completely objective method of estimating a vehicle's probability of failure is by statistical analysis of number of failures observed in identical vehicles under conditions representative of those under which future launches will be attempted." Although we agree with the Office of Technology Assessment statement, the obvious difficulty with this approach is that no such sample of identical vehicles exists or is ever likely to exist. In their report'41 previously referenced, Booz• Allen makes the same point in different words by stating that "the empirical approach has one significant drawback in that it can not project the effects of changes in the launch systems". The effects of such changes can only be assessed objectively by further flight testing. The difficulty in projecting success rates (or failure rates) from past tests to future tests is clearly recognized. Nevertheless, RTI has relied exclusively on this method to estimate the relative probabilities of occurrence for the various failure-response modes. Even so, total objectivity cannot be claimed since, as will be seen later, the answers depend to a large extent on how the performance data are filtered, and how big a risk one wants to take that the true failure probability is underestimated. 9/10/96 15 RTI 5. Computation of Failure Probabilities The test results for Atlas, Delta, and Titan in the tables of Appendix D have been used for three primary purposes: (1) To predict or estimate the overall probability that each vehicle will fail during the various phases of flight (see Table 39, Appendix D, for flight-phase definitions). (2) To establish the relative and overall probabilities for Response Modes 1 through 5 .. (3) To establish the relative frequency of tumble for Response Modes 3 and 4. 5.1 Overall Failure Probat>ility To- predict failure probabilities for Atlas, Delta, and Titan, the test results in Appendix D for representative configurations (i.e., "l" in last column) have been filtered using three different weighting techniques described in Appendix C: (1) Equal weighting (2) Index-count .weighting (3) Exponential weighting In computing filtered or weighted failure probabilities, a test is assigned a score of one to indicate the occurrence of a failure or some anomalous behavior, and a score of zero if no failure occurred. Admittedly, there may be disagreements about the classification of a few flights, since the launch agency may consider as successful or partially successful some flights that are shown as failures in· Appendix D. To avoid such disagreements, it is better to- think of some non-normal events, particularly those occurring late in flight, as anomalies rather than failures. The flight phases, as shown in column 2 of Table 2 and defined in Appendix D.1.3, are inclusive; e.g., flight phase "0 - 3" includes phases 0, 1, 1.5, 2, 2.5, and 3. An 'NA' in the response-mode column in the tables of Appendix D indicates that some failure or anomalous behavior has had an . effect on the final orbit or impact point without producing additional risks to people on the ground or necessarily failing the mission. In the failure-probability calculations of Table 2 and Table 3, an 'NA' has been- considered as a success for all flight phases except "0 - 5", irrespective of the phase in which the failure or anomalous behavior took place. Only in flight phase "0- 5" is an 'NA' response considered a failure. The filtered results for representative configurations (defined in Appendix D.1.4) are given in Table 2 for six flight phases. For flights with multiple entries in the Response-Mode and Flight-Phase columns (e.g., see Appendix D.2.1, No. 257), the first listed value was used in the filtering process. 9/10/96 16 RTI Table 2. Predicted Failure Probabilities for Representative Configurations Vehicle Flight Phase Filter Technic ue Sample Failures /Total Equal Weight Index Count Expon. F =0.99 Expon. F = 0.98 Expon F = 0.97 Atlas 0 0 0 0 0 0 0/7 0-1 0.0256 0.0253 0.0245 0.0219 0.0186 4/156 0-2 0.0449 0.0385 0.0387 0.0313 0.0243 7/156 0-3 0.0769 0.0715 0.0714 0.0643 0.0568 12/156 0-4 0.0833 0.0811 0.0801 0.0740 0.0663 13/156 0-5* 0.1090 0.1100 0.1078 0~1019 0.0929 17/156 Delta 0 0 0 0 0 0 0/125 0-1 0.0160 . 0.0126 0.0134 0.0104 0.0075 2/125 0-2 0.0160 0.0126 0.0134 0.0104 0.0075 2/125 0-3 0.0160 0.0126 ·o.0134 0.0104 0.0075 2/125 0-4 0.0160 0.0126 0.0134 0.0104 0.0075 2/125 0-5* 0.0640 0.0447 0.0535 0.0469 0.0442 8/125 Titan 0 0.0306 0.0210 0.0225 0.0292 0.0352 3/98 0-1 0.0234 0.0305 0.0314 0.0403 0.0470 4/171 0-2 0.0409 0.0496 0.0514 0.0642 0.0750 7/171 0-3 0.0526 0.0581 0.0597 0.0689 0.0773 9/171 0-4 0.0526 0.0581 0.0597 0.0689 0.0773 9/171 0-5* 0.1111 0.1167 0.1188 0.1284 0.1358 19/171 * Includes response mode 'NA' It is apparent from the data in Table 2 that estimates of future vehicle reliability depend on the filtering (i.e., weighting) technique applied. Since there are many ways to perform the filtering, all generally producing slightly different results, the choice of method to use in deriving empirical failure probabilities cannot be totally objective. Subjective decisions must also be made about which past configurations to consider as representative of future vehicles, which flight tests to include_ in the sample, how to weight the individual flights, and, in unusual cases, whether to consider a flight a success or a failure, and to which flight phase to attribute a failure. Except for data weighting (i.e., choice of filter), these decisions were made for Atlas, Delta, and Titan before computing the failure probabilities shown in Table 2. • For Atlas and Delta, it can be seen from Table 2 that the predicted failure probabilities computed. with the exponential filter decrease as the value of F decreases. Since a decreasing F means more emphasis on recent data and less emphasis on the old, the launch reliability for these vehicles is apparently improving. The reverse seems to be true for Titan, suggesting either that Titan reliability is not improving or, possibly, that improvements that have been or are being made to the vehicle are not yet fully reflected in the test· results. For Atlas and Delta, the computed failure probabilities based on equal weighting are higher than for all other filters, and the predicted failure 9/10/96 17 RTI probabilities using index-count filtering are larger than those for exponential filtering. For Titan, the results are mixed, further suggesting that Titan reliability has not improved in recent years. For comparison purposes, the same filtering techniques have been applied to all flight tests shown in the tables of Appendix D, regardless of configuration. The results are presented in Table 3. Table 3. Predicted Failure Probabilities for All Configurations Vehicle Atlas Delta Flight Phase 0 0-1 0-2 0-3 0-4 0-5 • 0 0-1. 0-2 0-3 Filter Technic ue Sample Failures /Total 0/7 56/532 91/532 111/532 114/532 137/532 0/196 4/232 6/232 10/232 Equal Weight 0 0.1053 0.1711 0.2086 0.2143 0.2575 0 0.0172 0.0259 0.0431 Index Expon. Expon Count F =0.99 F=0.98 0 0 0 0.0641 0.0422 0.0273 0.0990 0.0555 0