Termination shock
By Jonathan O'Callaghan|October 2023
Starship’s slow-motion destruction in April was a rare example of a rocket’s flight termination system failing to do its job adequately. Such a failure could put people on the ground at risk, and so, SpaceX must prove to FAA that it has a fix in hand before the agency permits the company to launch its next Starship. Jonathan O’Callaghan takes us inside the technology.
Rocket Lab CEO Peter Beck was among those in the industry watching nervously in April as a Super Heavy booster and Starship spacecraft roared to life on SpaceX’s Texas launch pad and began to rise, making the stack the most powerful rocket ever to lift off. Just over two minutes later, the SpaceX livestream showed the vehicle flipping around in preparation to release Starship for a planned journey through suborbital space and a splashdown somewhere near Hawaii, while the Super Heavy, for purposes of this test, was to then plunge harmlessly into the Gulf of Mexico.
None of that was to be. The rotation continued, and this lack of control prompted the triggering of the flight termination system, a cord laced with small explosives meant to tear open the rocket and ignite its propellant into a nearly instantaneous fireball. Instead, the rocket tumbled in one piece for an agonizing 40 seconds before the atmosphere ripped it apart and it exploded.
“For us standing back in the industry, it’s like your worst nightmare,” says Beck.
Had the FTS failure occurred much lower, with the rocket on a wayward path immediately after launch and thousands of spectators at risk, disaster could have struck. A calamity like that would have effects beyond the fate of any one launch provider.
“We would all be grounded if an event of that magnitude happened,” says Beck.
This time, chunks of rocket fell harmlessly into the Gulf of Mexico, due to the atmosphere. But ineffective FTS is among a punchlist of 63 “corrective actions” that SpaceX must address before FAA permits it to launch its next Starship. The actions were summarized in a letter sent to SpaceX in early September that did not specify whether any of the actions had been completed. SpaceX must also redesign “the launch pad to increase its robustness,” the letter said, describing the ignition of the Super Heavy engines as “sending debris and sand into the air.” More specifically, pulverized concrete reached as far as 10 kilometers from Boca Chica, according to the U.S. Fish and Wildlife Service.
Separately, FAA also must conduct a written reevaluation of the 2022 environmental assessment of launches from Boca Chica. Meanwhile, days after the letter, SpaceX watchers noticed the company unstacking the Starship-Super Heavy it had put together on the pad on Sept. 5 for the next launch.
NASA is counting on future Starships to carry astronauts from lunar orbit to the surface and back under the Artemis program, for which SpaceX has $4.5 billion in contracts. Elon Musk is counting on Starships to carry out his vision of transporting colonists to Mars, with up to a hundred on each vehicle.
For some observers, the FTS issue looms especially large.
“I can’t think of a bigger issue they would face,” says Wayne Monteith, FAA’s former associate administrator for Commercial Space Transportation, referring to SpaceX. “They will be very thorough, and very methodical.”
SpaceX did not respond to a request for comment.
As of this writing, there is no publicly available official account of precisely how the FTS was supposed to work and what went wrong. Musk’s online comments, statements from SpaceX and expert insights offer some clues.
Musk revealed in a Twitter Spaces virtual meeting nine days after the launch that SpaceX “did initiate the flight termination system.” SpaceX clarified further that the rocket was equipped with the company’s “Autonomous Flight Safety System,” and that this equipment “automatically issued a destruct command.” While the system “fired all detonators as expected,” there was an “unexpected delay” before the vehicle “broke up.”
Neither Musk nor SpaceX have been entirely clear about whether the firing of the detonators had any impact at all, if indeed they know. In the Twitter Spaces meeting, Musk said the rocket falling into the “lower point in the atmosphere” likely “aided in the destruction of the vehicle.” He said the issue was needing a “much longer detonation cord,” typically a tube containing explosive.
Another industry expert who watched the livestream closely in April, and studied it frame by frame afterward, is Charlie Garcia, chief engineer at Colorado-based Agile Space Industries, which develops in-space propulsion. He points out some venting just after three minutes that may have been the FTS trying to activate but ultimately failing to destroy the vehicle. Explosive charges are typically strategically placed to create a hole between the fuel and the oxidizer. Often, flight termination is triggered manually by an operator in a control room, but in recent years — including on Starship — such systems have been made autonomous, relying on telemetry fed from the rocket to an onboard computer.
The goal is a nearly instantaneous explosion, eliminating any chance of a largely intact rocket veering off course and crashing into a populated area. There was no such explosion at this point in Starship’s April flight.
“SpaceX managed to essentially explode a bomb right next to oxygen and methane, and nothing happened,” marvels Garcia. He speculates that the vehicle’s status as the most powerful rocket ever to lift off meant it “needed more oomph to break it.”
Musk described things similarly, saying it “took way too long to rupture the tanks.” In SpaceX’s livestream of the launch, we eventually see a large explosion and hear groans from SpaceX employees watching from SpaceX headquarters in Hawthorne, California, followed by cheers given that the rocket did manage to lift off and climb toward space. “An exciting end to the Starship inaugural integrated test flight,” said Kate Tice, a quality systems engineering manager at SpaceX, in the livestream.
Musk admitted the delay in the FTS activating was not ideal. “This is obviously something that we want to make super sure is solid before proceeding with the next flight,” he said in his Twitter Spaces comments.
In Garcia’s view, the solution could be fairly straightforward: “The answer really does just appear to be, you know, add a little more boom,” he says. “This is about the easiest problem to fix.”
For his part, Musk said the trouble could have been averted with a “longer detonation cord,” perhaps providing the necessary oomph to initiate a big enough explosion to ignite the rocket’s propellant and break it apart.
Even if it is an easy fix, however, the slow-motion destruction “should be a huge cause for concern,” says Donald Edberg, a professor of launch vehicle, aircraft and spacecraft design at Cal Poly Pomona. “If it had headed in a different direction, it could have crashed into the ground and injured or killed people. I’ve never seen a case like that where [there] was such a very long delay. The only thing that saved them was it was out over the ocean.”
In a statement provided to me, FAA said that “Flight Safety Systems are one of the most safety critical systems used on rockets as they are activated to ensure the protection of the public and property.” The agency added that during its licensing process for any rocket, it would “conduct reviews to ensure the applicant is in compliance with the various requirements of the Flight Abort Hazard Control Strategy regulations.”
In other words, FAA must be convinced that SpaceX has solved the FTS issue along with the others before it will modify the company’s license to permit a second fully stacked Starship flight. No target date has been announced, but Musk declared on X in early September that “Starship is ready to launch.” SpaceX in mid-September began installing a new FTS on the second Starship, according to comments from Kathy Lueders, general manager for Starship at SpaceX, uploaded to X (formerly Twitter) by the SpacePadreIsle account that closely follows Starship progress.
Starship was not the first SpaceX rocket to carry an automated termination system. In 2017, a Falcon 9 rocket flew from Cape Canaveral in Florida with an autonomous FTS, the first time a human had not had their finger hovering over a button to destroy the rocket if things started to go wrong.
“Quite frankly, it was very tense,” says Monteith, who as commander of the Air Force’s 45th Space Wing at the time oversaw the launch. “While I was very confident having looked at all of the data that the system would work, there’s still some unknown. If there had been an anomaly, I was the one who approved it.”
In the end, everything went smoothly, and with plenty of positives. Removing a human from the FTS process eliminated the possibility of human error. It also reduced the time to activate a termination system.
Typically a human operator might take “three to five seconds” to decide whether to terminate a flight, says Brian Hall, the deputy director for strategic integration and development at NASA’s Goddard Space Flight Center in Maryland. For an autonomous system, it is “at the millisecond level,” he says — potentially crucial time to prevent a rocket heading off on a wayward path.
An onboard, autonomous FTS can also continue to assess whether to terminate the flight when the rocket is over the horizon and therefore out of view of the range cameras and telemetry antennas that would otherwise receive attitude and other health readings from the rocket. This freedom allows for unusual launch corridors, such as south from the Cape, “because of the layout of where the ground systems are,” says Monteith.
An autonomous FTS also removes the need for ground infrastructure at spaceports such as Cape Canaveral — radio equipment and otherwise — to be repurposed to send a destruction command to different rockets. Such systems “would often take 72 hours” to configure for different launches, says Burton Catledge, a retired U.S. Air Force colonel and now CEO of Launch on Demand, a Florida company that provides technical services to spaceports. Autonomous FTS removes this logjam and allows for a much quicker turnaround between launches.
“It would be very difficult for SpaceX to achieve the launch cadence that it is doing right now, one or two times a week, if they were not on an autonomous flight safety system,” says Catledge. “I think Elon Musk’s biggest contribution to the space industry has been autonomous flight safety systems.”
NASA has since followed suit, testing its own autonomous FTS software called the NASA Autonomous Flight Termination Unit on a Rocket Lab Electron launch in January. “We’ve released it to the industry as a building block,” says Hall, “to take what NASA has developed and make it their own.”
With such systems in place, rocket launches can be more frequent and safer. The only issue then is making sure that if an FTS is instructed to activate either by a human or an automated system, it works as intended. Starship’s mishap shows problems can still arise, and ensuring they are ironed out is of the utmost importance.
“That just can’t happen,” says Beck of Rocket Lab. “You never put a rocket on the pad and wonder if the FTS will work.”
Associate Editor Cat Hofacker contributed to this report.
Some close calls, a foul up and one deadly mishap
Large space launch vehicles are accelerated by the explosive combustion of hundreds of metric tons of liquid oxygen and fuel, sometimes aided by solid rocket boosters burning a rubbery mixture of fuel and oxidizer. Their structures are massive: A European Ariane 5 is 53 meters tall, a United Launch Alliance Atlas V is almost 60 meters tall, NASA’s first Space Launch System rocket was almost 100 meters tall, and April’s fully stacked Starship rocket measured 120 meters tall. Large rockets, and even some ballistic missiles, are therefore equipped with onboard flight termination systems to destroy them should they start to go off course. Here are some noteworthy rocket incidents, starting with history’s worst accident.
Feb. 15, 1996 A Chinese Long March 3B lifts off from the Xichang Satellite Launch Center in Southwest China, drifts off course and crashes close to a nearby village. The Chinese government reports that six are killed, but independent reports suggest hundreds are killed. The rocket was carrying U.S.-based Intelsat’s 708 telecommunications satellite.
“It pitched over immediately to the point it almost hit the [launch] tower,” says Wayne Eleazer, a retired U.S. Air Force lieutenant colonel who once managed the service’s Thor ballistic missile program, among other roles. “The guidance system just lost reference.”
The rocket had an FTS on board, but Eleazer says China decided not to activate it for fear of hitting high-value buildings near the launch site.
Aug. 12, 1998 A Titan IV lifts off from Cape Canaveral, Florida, carrying a classified satellite for the U.S. National Reconnaissance Office. About 40 seconds later, an exposed wire in the rocket’s second stage shorts the missile guidance computer and control of the rocket is lost, an investigation board convened by Air Force Space Command later concludes. The FTS is manually activated at T+45 seconds.
July 27, 2011 An unarmed U.S. Minuteman intercontinental ballistic missile is launched from Vandenberg Air Force Base, on the coast of California, and begins traveling east over land instead of west over the Pacific Ocean. Vandenberg officials activate the FTS. “The guidance said it was going one way, and another piece of guidance said it was going another way,” recalls Burton Catledge, a U.S. Air Force colonel and then-commander of the service’s 45th Operations Group at Vandenberg. “We blew up the rocket based upon the feedback. The debris fell where it did, but we couldn’t confirm whether there was anybody in the area or not.” There are no injuries.
May 25, 2017 Four minutes into the first test flight of a Rocket Lab Electron rocket, contact with the rocket is lost and a safety officer terminates the flight at an altitude of 224 kilometers near the launch site on the Mahia Peninsula in New Zealand. Rocket Lab later determines that a programming error in ground equipment caused the loss of telemetry. “It turned out to be operator error,” says Peter Beck, CEO of Rocket Lab.
Jan. 25, 2018 A European Ariane 5 carrying two communications satellites is launched from French Guiana in South America. It flies in the wrong direction and passes over the nearby town of Kourou, to a wildly incorrect inclination to the equator of 20.6 degrees instead of the intended 3 degrees. Telemetry is lost about nine minutes into the flight, shortly after the Ariane second stage with the satellites separates from the booster. Arianespace later confirms in a press release that the satellites reached orbit, though they are at a lower altitude than planned. — Jonathan O’Callaghan
