SpaceX's Latest Advantage? Blowing Up Its Own Rocket, Automatically (qz.com)

SpaceX has reportedly worked with the Air Force to develop a GPS-equipped on-board computer, called the "Automatic Flight Safety System," that will safely and automatically detonate a Falcon 9 rocket in the sky if the launch threatens to go awry. Previously, an Air Force range-safety officer was required to be in place, ready to transmit a signal to detonate the rocket. Quartz reports: No other U.S. rocket has this capability yet, and it could open up new advantages for SpaceX: The U.S. Air Force is considering launches to polar orbits from Cape Canaveral, but the flight path is only viable if the rockets don't need to be tracked for range-safety reasons. That means SpaceX is the only company that could take advantage of the new corridor to space. Rockets at the Cape normally launch satellites eastward over the Atlantic into orbits roughly parallel to the equator. Launches from Florida into orbits traveling from pole to pole generally sent rockets too close to populated areas for the Air Force's liking. The new rules allow them to thread a safe path southward, past Miami and over Cuba.

SpaceX pushed for the new automated system for several reasons. One was efficacy: The on-board computer can react more quickly than human beings relying on radar data and radio transmissions to signal across miles of airspace, which gives the rocket more time to correct its course before blowing up in the event of an error. As important, the automated system means the company doesn't need to pay for the full use of the Air Force radar installations on launch day, which means SpaceX doesn't need to pay for some 160 U.S. Air Force staff to be on duty for their launches, saving the company and its customers money. Most impressively, the automated system will make it possible for SpaceX to fly multiple boosters at once in a single launch.

Comments

There's another name for this

[ScentCone]

Don't we also call this a missile? I think I actually like the idea of the Air Force guy with the destruct button better.

Re:There's another name for this

[msmash (Top Editor)]

Not a missle, no nukes. If it had nukes, it would be a nuclear missle. There is your thought for the day.

Re:There's another name for this

[ScentCone]

Just a little reminder that there are plenty of missiles out there that are NOT nukes. And a lot of them aren't nearly as destructive as a Falcon Heavy going boom right over your house. Here's hoping they have a good flight.

Re:There's another name for this

[thegarbz]

You only like it because you don't work in the reliability field. Having a human operator in charge is one of the least reliable ways of doing things.

Re:There's another name for this

[Anonymous Coward]

Don't we also call this a missile? I think I actually like the idea of the Air Force guy with the destruct button better.

Obviously you failed to see the rather glaring point made in TFS:

"the automated system means the company doesn't need to pay for the full use of the Air Force radar installations on launch day, which means SpaceX doesn't need to pay for some 160 U.S. Air Force staff to be on duty for their launches, saving the company and its customers money."

Re:There's another name for this

[Anonymous Coward]

I don't know. GPS was never supposed to be used for anything like this.

Seems like a really bad idea to me.

Re: There's another name for this

[Anonymous Coward]

Better than this claim:

"radar data and radio transmissions to signal across miles of airspace"

So... round-trip, that's what, 1/500th of a second? Seems to me it doesn't matter where the automated system is, just that there is one instead of a human.

Re:There's another name for this

[Anonymous Coward]

"supposed" by _you_ to have never been envisaged for uses like this.

Fortunately the rest of us are not limited by your shortsightedness.

Re: There's another name for this

[Type44Q]

Having a human operator in charge is one of the least reliable ways of doing things.

Speak for yourself. Oh, sorry; you are.

Re:There's another name for this

[Anonymous Coward]

Hillary lost the election. Get over it.

Re:There's another name for this

[MightyYar]

More evidence of AI stealing jobs.

Re:There's another name for this

[umghhh]

Am I the only one that read it "AI Force" instead of "Air Force"?

Re:There's another name for this

[Ol Olsoc]

You only like it because you don't work in the reliability field. Having a human operator in charge is one of the least reliable ways of doing things.

Then again, there are the famous Airbus incidents where software caused the plane to safely mow through a forest and crash because it knew that the pilot desperately trying to fly it was obviously wrong.

Or the computer glitch that told another Airbus that it was somehow flying nose-up at 30 degrees at cruising speed, and immediately pitched it down at 30 because it then thought it was in level flight. Miraculously they eventually wrested control and managed to land - though safely is a bit strong of a word for that mess.

There was another case where software was added to keep pilots from throttling back right after takeoff. Some did this to lower noise. There was an airstrike on the flight as the plane took off. The engines were running rough, the pilot called for reduced power, but the software insisted on full power for takeoff. Killed the engines and the plane had to land in a local field.

The point is, I don't know that I'd take the position that the human is the least reliable ways of doing things, when the humans tried to do the correct thing, but the computers insisted on their way or the highway.

I'd like to know how they determined that this is failsafe. The presumably unsafe range officers - do you have the numbers of flights that should have been destroyed that were not? The only one I know of was a Chinese launch that took out a nearby town, and I don't even know if that had a human in the loop or was a more reliable computer

TL;DR - Don't be in too big a hurry to declare superior safety. Hubris always attracts Karma

Re: There's another name for this

[thegarbz]

Nope, I'm speaking as a reliability engineer backed up by 50years worth of data and statistics.

But hey I'm sure *you* are different. Reminds me of the 92% of males and 85% of females who believe they are better than average drivers and thus immune to the various researched effects on their driving efficacy.

Re:There's another name for this

[thegarbz]

Then again, there are the famous Airbus incidents where software caused the plane to safely mow through a forest and crash because it knew that the pilot desperately trying to fly it was obviously wrong.

On indeed. No computer is perfect, and no system created by people is perfect. In industry we look at the differences between random failure and systematic failures. Some >80% of failures of systems are systematic and the result of human error in design, operation or maintenance. The remainder can be easily quantified and is widely considered several orders of magnitude better in performance than humans.

The point is, I don't know that I'd take the position that the human is the least reliable ways of doing things, when the humans tried to do the correct thing, but the computers insisted on their way or the highway.

I'm reminded of the usual safety pep talks: No one goes to work with the intent to injure themselves (obviously not true, but true enough). If you consider humans doing the correct thing then they are actually quite reliable. However the key reliability problem is that humans startlingly often don't do the correct thing, often due to no fault of their own. The human brain is incredibly fallible.

TL;DR - Don't be in too big a hurry to declare superior safety. Hubris always attracts Karma

Safety systems were invented for a reason and humans are only ever considered the first line of defence before automatic systems take over. I often like getting asked why I don't perform reliability calculations on emergency stop pushbuttons on critical equipment. The answer typically stops the person asking the question dead in their tracks: "Without doing a calculation I can say the reliability of the pushbutton is approximately 3 orders of magnitude higher than the brain that is tasked with making the decision to push it."

Re:There's another name for this

[Ol Olsoc]

Safety systems were invented for a reason and humans are only ever considered the first line of defence before automatic systems take over. I often like getting asked why I don't perform reliability calculations on emergency stop pushbuttons on critical equipment. The answer typically stops the person asking the question dead in their tracks: "Without doing a calculation I can say the reliability of the pushbutton is approximately 3 orders of magnitude higher than the brain that is tasked with making the decision to push it."

I think the takeaway here - or at least the one that to me would work best, is to have both. An override of the computer in the event it refuses to destroy an obviously errant rocket. Which should actually increase safety, not just eliminate payroll.

Re:There's another name for this

[DontBeAMoran]

I'm Canadian. I keep reading it as "Air Farce".

Re:There's another name for this

[janoc]

That's not a quite good analogy.

Here we are talking about replacing a proven (albeit expensive) method with a cheap computer on board of the rocket.

Those computers have always been there in the past, the range safety explosives (and any eventual rescue systems in the case of manned flights - e.g. the Apollo/Soyuz escape towers) could have been either triggered automatically when the electronics detected an anomalous deviation from the pre-programmed path OR remotely by a human from the ground should something have gone so wrong that the computer didn't (or couldn't - e.g. the Challenger explosion where the errant boosters were destroyed from the ground after the fuel tank explosion destroyed the orbiter) handle it.

The system was designed with redundancy in mind. Now we are cutting one side of that redundancy to save costs. If you work in safety systems, you certainly know that there are plenty of examples from the past where such simplification and cost savings have costed lives - e.g. the infamous Therac 25 (hw interlocks replaced with software - several people dead from radiation overdoses and many more injured), original DC 10 cargo door design where the elements indicating whether the door was safe or not were changed to show only whether it was "supposed" to be safe and not an actual position of the interlocking (door blew out at altitude, causing an airplane crash that killed 300+ people), plenty of railway accidents have been caused by a loss of redundancy in the signalling systems over the years, etc.

It doesn't take that much imagination to envision a situation where e.g. an unfortunate lightning strike knocks the computers irrecoverably offline (freak accidents that shouldn't happen but they do - e.g Apollo 12 where they got uber lucky). And now you can only watch as those 500 tons of steel and explosive fuel are going to uncontrollably land somewhere, with no way to do anything about it.

Could the current method be made less expensive? Most likely, the airforce (or military in general) are rarely concerned with doing things in a cost effective way. But taking the human out of the loop completely? That doesn't sound like such a smart idea. His role is not to be reliable (that's the computer's job) but to guard against the unexpected.

Re:There's another name for this

[nitehawk214]

Uhh, no, GPS was designed specifically to guide missiles and military aircraft.

Re:There's another name for this

[ColaMan]

Challenger's boosters are an excellent case for automated range safety.

How long did they spin out of control for? Video suggests 15 to 20 seconds. Or about a hundred times longer than an automated range safety device would have let them, greatly increasing the debris field.

Re:There's another name for this

[JD-1027]

These are great examples of times when the computer messed up the day.

You can't make an informed decision based on that alone (well, you can, but science can't).

For balance, we now need to list every time the computer saved the day and see which method really wins.

Re:There's another name for this

[Anonymous Coward]

Military R&D has produced most of the game changing technologies we take for granted today. Throughout human history War has been the driving force behind advancements in science and technology. Satellites, communication security technologies, advancements in material science, medicine, nuclear power, aviation technologies, computers, encryption methodologies, radar and lidar advances, advances in quantum based computers and secure communication, and rocket science. If you want the government to fund your research all you need to do is mention your research may have military applications. The military spends more money on technology research than all the other government technology and science agencies combined.

The world we live in now has been defined by war and mayhem not peace, love, and understanding. The really big problems throughout history have been settled by war and not diplomacy. Diplomacy just gives all sides in a conflict time to re-arm.

Re:There's another name for this

[thegarbz]

Yes and no. Ideal redundancy is through independent systems and by independent I am also talking technologically independent. For basic and defined outcomes a human is not needed. A human is critical in decision making where the decision point isn't well defined (i.e. does that car look like it's about to run a red light).

The payroll in this case is a bunch of humans looking at a computer to make a decision based on an event. If the decision point is defined then the computer can just cut out the middle man (no pun intended).

Re:There's another name for this

[thegarbz]

Here we are talking about replacing a proven (albeit expensive) method with a cheap computer on board of the rocket.

The cost or proven in use case have no bearing on the overall reliability of a system. Computer based safety systems have by their nature replaced proven and expensive methods of safety that came before them, yet with each iteration of technology the reliability continues to improve.

What it sounds like you're making a case for is the lack of field experience for this particular computer, but that's exactly where reliability engineering comes in, something that we have also gotten far better at over the years.

Re: There's another name for this

[Anonymous Coward]

If a lightning strike disables the computers, how are they supposed to remotely donate the rocket?

It's not like the air force are sitting there waiting to physically shoot it down. Chances are it's traveling to fast to intercept to even try.
They're sitting there looking at they're radars making a decision about pushing a remote donate button. That button still requires Adobe functionality still working on the rocket, including communications.

Re:There's another name for this

[Guspaz]

Any event that happened to the vehicle that knocked the computers offline would have caused the same impact to the flight termination system regardless of if it was manual or automated. The ability to manually terminate the flight still exists, they have just now added the ability for the vehicle to decide to trigger the FTS itself. If there is any reduction in potential safety, it would come from switching from radar tracking to GPS tracking, not the vehicle having the ability to push the button itself.

Re:There's another name for this

[Ol Olsoc]

These are great examples of times when the computer messed up the day. You can't make an informed decision based on that alone (well, you can, but science can't). For balance, we now need to list every time the computer saved the day and see which method really wins.

Well, I suppose if you are trying to say that I'm wanting to go back to woodburning rockets.

My point is that people have a tendency to believe that a human in the loop equals bad, and that computers will always be accurate.

I'm dealing with that very thiing right now as we write. There is a process that currently involves hand checking a number of databases.

This is being replaced with an automated checking process that is demonstrably less accurate than the hand checked version.

I can demonstrate this easily, but there is a powerful meme at work that says even if hand checking is more accurate, it is less accurate.

But that's how people are - the biggest advantage is that the hand checks are challenged all the time, around 20 percent. but the acceptance rate on the automated version is 100 percent. So whatever, do it and move on to the next project. Fortunately, this is not the sort of thing that causes People to die, but if they are going to launch these things fairly close to populated areas when doing polar orbit launches, they better hope that the always more accurate computer controlled goboom works every time.

Then again, a Rocket that lands in say Jacksonville because the computer won't kill it - I'm certain that everyone will be completely understanding, yes? It was just an outlier. https://www.youtube.com/watch?...

Re:There's another name for this

[Anonymous Coward]

Trump is a moron. He deserved to be mocked. The post you are replying to is mocking Trump's claim to have a bigger nuclear button on his desk that Kim Jong Un. The reality is that there isn't a button at all, how the President would initiate a launch of nukes is public knowledge, look it up if you don't know. It was just Trump making shit up to boost his fragile ego.

Hey

[backslashdot]

âoeItâ(TM)s not a bug itâ(TM)s a feature. âoe

Well played SpaceX. Well played.

Re:Hey

[Anonymous Coward]

Just so you know, when I see your posts and I have them, I mod your shit down. Learn to fucking character set.

Re: Hey

[Anonymous Coward]

To be fair, theres no way Im aware of to get ascii quotes from an iOS device. The only solution is to skip them entirely. Too bad slashdot cant be bothered to filter the form submissions.

Re:Hey

[Sarten-X]

I am disappointed that this new feature is not being called an Overpressure Event Generator.

Re: Hey

[Anonymous Coward]

To be fair, Apple is the devil and this is just one more reason to hate them.

Vandenberg AFB.

[Templer421]

So they are going to try and close Vandenberg AFB and take a chunk out of California's economy?

Re:Vandenberg AFB.

[geekmux]

So they are going to try and close Vandenberg AFB and take a chunk out of California's economy?

I kind of doubt SpaceX is the keeping Vandenberg AFB off the chopping block, particularly given the fact that Vandenberg serves as a key coastal missile defense position. Hell, Trumps Twitter account is keeping Vandenberg alive more than SpaceX at this point.

And a handful of SpaceX launches per year affects the California economy about as much as taking a piss in the Pacific ocean.

Re:Vandenberg AFB.

[hackertourist]

Vandenberg, unlike Cape Canaveral, can be used for launches to polar orbits. Polar orbits are popular for Earth observation satellites. That is what keeps Vandenberg open.

Re:Vandenberg AFB.

[Waffle Iron]

I understand that nobody here reads the linked articles before they pontificate on topics, but it would really help if you could at least read the short summary at the top of the page.

Re:Vandenberg AFB.

[apoc.famine]

Missed the summary, eh?

Re:Vandenberg AFB.

[hackertourist]

I got as far as the first paragraph of the summary, then thought, "hang on, that's not right" and went to look for better sources (1). I missed the section on polar orbits entirely.

1: which led to my post about AFSS not being a SpaceX development.

Re:Vandenberg AFB.

[Bruce Perens]

Californians in general and the nearby community of Lompoc aren't great fans of the base. It very likely is a candidate for base closure. Development of the base real-estate would likely lead to greater economic benefit to California and communities close to the base.

Populated areas vs other populated areas

[Anonymous Coward]

Launches from Florida into orbits traveling from pole to pole generally sent rockets too close to populated areas for the Air Force's liking. The new rules allow them to thread a safe path southward, past Miami and over Cuba.

In other words, the new rules only count populated areas north of the wall. Latino Lives Matter.

Re:Populated areas vs other populated areas

[Anonymous Coward]

Yeah. Kim Jong-un should just have said that he is only firing rockets over Japan "to save some money", then everything would have been A-OK.

Re:Populated areas vs other populated areas

[GameboyRMH]

It's OK, those Latinos are communists, and anyone who would say communist lives matter must be a dirty commie!

Re: Populated areas vs other populated areas

[Anonymous Coward]

U r dense. They can fly over populations because of the safety blowup thing. Us or Cuban, same difference in this case.

Please no spoofing of GPS...

[ClarkMills]

I'm sure it's been sorted but this comes to mind:

Reports Say U.S. Drone was Hijacked by Iran Through GPS Spoofing.

(The nabbing of a drone by spoofed GPS signals)

The US govt is privatizing safety?

[Anonymous Coward]

This is less of a technical breakthrough, and more the US govt being willing to let a computer take the decisions, and/or SpaceX willing to foot the insurance bill in case of a crash.

Re: The US govt is privatizing safety?

[Anonymous Coward]

The US government are designing a system and SpaceX is the first to use it.

You'll have to read more than just the summary to figure that out though.

How would that work

[SuperKendall]

In order to spoof GPS for a rocket you'd have to have a system that had multiple nodes at various altitudes along the exact flight path in order to have a strong enough signal to overpower the real satellites... it seems extremely unlikely that something going as fast as a rocket could be spoofed, unlike a drone which is usually sent to basically hover over an area.

Re:How would that work

[Richard_at_work]

You only really need to spoof it long enough for the rocket to make a correction which endangers the mission, or long enough for the rocket to think its seriously off course and triggers the destruct. You don't need to spoof the entire path.

Re: How would that work

[Anonymous Coward]

In order to spoof GPS for a rocket you'd have to have a system that had multiple nodes at various altitudes along the exact flight path in order to have a strong enough signal to overpower the real satellites...

It would take any normal person about 5 seconds of critical thinking to realize how much closer ground (or air) based overriders are than the orbiting SATs.

But not you apparently...

Re:How would that work

[K. S. Kyosuke]

The rocket wouldn't make any correction (of its flight path, I presume?) since it most likely integrates GPS and INS data. (No launch vehicle I'm aware of flies purely on GPS data, and I picture that the flight path integrator only integrates GPS data into INS data until GPS goes wildly astray with no confirmation from accelerometers that the rocket is actually going wildly astray, too, so spoofing the GNC system could be rather difficult.)

Re: How would that work

[Anonymous Coward]

A gps antenna doesnt care which direction the signal comes from. I would think a precisely aimed directional antenna would have no trouble overpowering the signal from a solar-powered satellite.

Re: How would that work

[Anonymous Coward]

Raim would also kick in anyway. It wouldn't be easy to spoof

Re: How would that work

[Anonymous Coward]

It doesn't work that way.. Even basic aviation receivers these days will auto detect dodgy satellites and ignore them using raim. If raim was failing, I'm guessing the default would be for the rocket to detonate.

Thing is though, they'd probably use military gps anyway

Re:How would that work

[FuzzyDaddy2]

No, you can broadcast all the signals from a single source on the ground. GPS antennas aren't very directional; GPS measures range from signal timing only. The only requirements are that you are strong enough to override the real signal. You adjust the timing of the fake signals to spoof out the location you want the target to believe it's at.
The GPS antenna is probably on the top side, with low gain towards the earth (if they are smart). A cubesat might be able to generate the spoofing signal, although you'd need to launch enough to make sure you've got one overhead.

Re:How would that work

[torkus]

But then all you've done is destroyed the rocket on it's normal path which is still planned for relative safety.

Yes, it would potentially allow someone to blow up these particular rockets. Once.

Avoiding innovation because someone, somewhere, somehow could maaaaaybe use it to break something is ridiculous.

Re: How would that work

[Anonymous Coward]

Ask the ships in Norway who keep getting their GPS guidance fucked with by the Ruskies how awesome GPS is. They'll give you an earful. Mind you it is in Nowegian so you likely wont understand any of it...

Re:How would that work

[Anonymous Coward]

The rocket wouldn't make any correction (of its flight path, I presume?) since it most likely integrates GPS and INS data. (No launch vehicle I'm aware of flies purely on GPS data, and I picture that the flight path integrator only integrates GPS data into INS data until GPS goes wildly astray with no confirmation from accelerometers that the rocket is actually going wildly astray, too, so spoofing the GNC system could be rather difficult.)

INS data doesn't invalidate GPS data when spoofing or repeater attack is present. INS data works in conjunction with GPS data to provide better accuracy. GPS data is considered reliable but less accurate, while INS data is accurate over short period of time but is not usable over a long period of time. If spoofer gradually and consistently pushes GPS data to another location, no INS data will be able to correct that.

Also the second paragraph of the article says that the SpaceX rocket will correct its path relying on its GPS data.

Re:How would that work

[Immerman]

> If spoofer gradually and consistently pushes GPS data to another location, no INS data will be able to correct that.

That's just it though - a rocket is simply moving too fast to "gradually adjust" the spoofed GPS data without a substantial investment in spoofing transmitters. High-speed drones are standing still by comparison - a Falcon 9's groundspeed is mach 1 within ~90s of launch, and it's barely getting started.

Re:How would that work

[ClarkMills]

You really only need to spoof GPS for a brief moment in time; long enough for the guidance to come to the conclusion that it's out of the scheduled flight-path. Then... Goodbye cruel world. I'm not suggesting that the rocket would be hijacked in this case; rather sabotaged.

Again, I'm sure there are work-arounds for this sort of "prank" by now.

Re:How would that work

[Richard_at_work]

Destroying one rocket one time can still cripple a competitor business (many satellites aren't insured), or can set back a military project (spy satellites etc).

Re:How would that work

[K. S. Kyosuke]

GPS data is considered reliable but less accurate

Not in orbit. In passive orbit, GPS is extremely accurate and can be very well used by the second stage for accurate burns from parking orbits with great effect. And you have no meaningful way of spoofing that.

Also the second paragraph of the article says that the SpaceX rocket will correct its path relying on its GPS data.

The second paragraph of the article says no such thing. The flight safety system is NOT guiding the rocket.

Replacing a person pressing a button with AI

[Anonymous Coward]

So instead of a person bring responsible for pressing a button there is now AI making that decision.

I feel so much safer. Thank God (Elon).

Re:Replacing a person pressing a button with AI

[geekmux]

So instead of a person bring responsible for pressing a button there is now AI making that decision.

Better get used to that. It's our future whether we like it or not.

Re:Replacing a person pressing a button with AI

[JaredOfEuropa]

It's not an AI, it's an algorithm. And likely not even one using machine learning.

Re:Replacing a person pressing a button with AI

[GameboyRMH]

No it's more than that. With the old system, someone on the ground had to monitor the flight path of the rocket and press the self-destruct if it went far enough off course. This meant you needed to be able to track the entire flight of the rocket with radar ground stations (which they can't for this kind of launch), and you had to hope the self-destruct signal from the ground got through to the rocket.

This new system eliminates both problems, because the rocket tracks itself (using onboard GPS sensors and a predefined safe flight path) and autonomously triggers its own self-destruct if it exits the safe flight path.

If SpaceX can get permission to use encrypted military GPS signals (an off-the-shelf civilian GPS is programmed not to output data beyond 1200mph or 60,000ft anyway) they can also be safe from any GPS spoofing attempts. Otherwise a terrorist group could launch some high-altitude balloons above the flight path carrying GPS spoofing devices to cause a false positive leading to detonation, possibly raining debris on inhabited areas. Or it could be a way for one of the few eco-terrorist groups out there to make a statement.

Re: Replacing a person pressing a button with AI

[Anonymous Coward]

It's not an AI, it's an algorithm.

Shush, don't give up the AI bubble's secrets. A lot of VCs read Slashdot.

~Re:Hey

[Anonymous Coward]

ANSI, DO YOU SPEAK IT??!?!

Put all your enemies on a rocket

[oldgraybeard]

BOOM ;)

"Reliability of Shuttle Destruct System"

[supernova87a]

I quote for Slashdot posterity a long and informative piece of relevant information from many years ago, because I fear it's disappearing from the web:


Reliability of Shuttle Destruct System [LONG]
"MARTIN J. MOORE" [mooremj@eglin-vax]
28 Jan 86 14:06:00 CDT
Copyright © 1986 Martin J. Moore
[COMMENT: READERS -- PLEASE OBSERVE THE RESTRICTIONS ON THIS MESSAGE AT THE END OF THE MESSAGE. PGN]

> From: Peter G. Neumann [Neumann@SRI-CSL.ARPA]
> For those of you who haven't heard, the Challenger blew up this morning...
> One unvoiced concern from the RISKS point of view is the presence on each
> shuttle of a semi-automatic self-destruct mechanism. Hopefully that
> mechanism cannot be accidentally triggered.
[COMMENT: I did not intend to imply that as the cause -- only to raise concern about the safety of such mechanisms. PGN]

Peter, I assume that you are talking about the Range Safety Command Destruct System, which is used to destroy errant missiles launched from Cape Canaveral. From 1980 to 1983 I was the lead programmer/analyst on the ground portions of that system, and I am the primary author of the software which translates the closing of destruct switches into the RF destruct signals sent to the vehicle. I think I can address the question of whether the system can be accidentally triggered; worrying about that gave me nightmares off and on for months while I was on the project. I'd like to tell you a little about the system and why I think the answer is No. Note that my information is now three years old, and some details may have changed; there may also be minor errors in detail due to lapses in my memory, which isn't as good as my computer's!

On board the vehicle, there are five destruct receivers: one on the external tank (ET) and two on each of the solid rocket boosters (SRBs). There is no receiver or destruct ordnance on the Orbiter; it is effectively just an airplane. The casing of each SRB is mined with HMX, a high explosive; the ET contains a small pyrotechnic device which causes its load of liquid hydrogen and liquid oxygen to combine and combust. The receivers and explosives are connected such that the receipt of four proper ARM sequences followed by a proper FIRE sequence by any of the receivers will explode the ordnance.

The ARM sequence and FIRE sequence must come from the ground; they cannot be generated aboard the vehicle. These sequences are transmitted on a frequency which is reserved, at all times, for this purpose and this purpose alone. There are several transmitters around the Eastern Test Range which can be used to transmit the codes. These transmitters have a power of 10 kw (continuous wave). The ARM and FIRE sequences consist of thirteen tone pairs (different for each command and changed for each launch). There are eight possible tones, resulting in 28 possible tone pairs; thus, there are (28^13) or slightly over 6.5E18 correct sequences.

The Range Safety Officer has two switches labeled "ARM" and "DESTRUCT". When he throws a switch, it generates an interrupt in the central processor (there are actually two central processors running and receiving all inputs, but only one is on-line at any time; in case of software or hardware error the backup is switched in. And yes, they have different power sources.) The central program checks for the correct code on each of two different hardware lines (the correct code is different for each line); if correct, and all criteria are met to allow the sequence to be sent, the central program requests the tone pairs for that sequence from another processor. That processor (like everything else in the system, actually redundant processors) has only one function: to store and deliver those tone pairs. The processor resides in a special vault and can only be accessed in order to program the tone pairs (which are highly classified) before each launch. The data line between the central processor and the storage processor is

Re:"Reliability of Shuttle Destruct System"

[Anonymous Coward]

What part of "not for reproduction or retransmittal without the express permission of the author" did you not understand?

Re:"Reliability of Shuttle Destruct System"

[Anonymous Coward]

You fear that a post from RISKS list (which has its own archive site) will "disappear from the web"? How exactly? Do you think Trump will somehow tweet a button at it from the fifteenth green, and simultaneously blow up every copy in existence? I guess PGN is going to die eventually, but it's a well-known e-mail list digest, and it also gets posted to usenet, which has archives all its own.

Re:"Reliability of Shuttle Destruct System"

[Anonymous Coward]

Also, I noticed the date, this was just a week or two after the boom, before the investigation could barely even start? Yeah, so they had a bunch of fail-safes on the destruct system, are you trying to imply it was caused by anything but O-rings failing in cold weather and a culture of ignoring risk?

And in case you don't understand my previous message: RISKS 1-43. Of course the true root cause was the design of the vehicle mounted on the side of the rocket, with no proper crew abort. The O-ring fault in the SRB was merely the mechanical root cause.

Re:"Reliability of Shuttle Destruct System"

[wbr1]

Disappearing can just mean reduced in reach or scope. Perhaps it is not as widely known or shared - even if it is 'archived' somewhere.

Re: "Reliability of Shuttle Destruct System"

[Anonymous Coward]

What part of your brain still believes in copyright faeries and magical permission slips? Grow up.

Re:"Reliability of Shuttle Destruct System"

[SirGarlon]

Sometimes doing what you think is right requires knowingly doing what someone else thinks is wrong.

Re:"Reliability of Shuttle Destruct System"

[Anonymous Coward]

How do you know supernova87a does not have permission to reproduce the message? Or that he is not Martin J. Moore himself?

First Rocket?

[mentil]

I swear I heard ~15 years ago that (at least some) NASA rockets utilized a gyroscope to automatically detonate during launch if they started pointing below the horizon.

Re:First Rocket?

[torkus]

Even so, that's an extremely simplistic backup for a single failure mode which may not occur until well after a rocket has deviated from it's flightpath.

Not exclusive to SpaceX

[hackertourist]

NASA and the Air Force (which provides the range safety systems) have been working on the autonomous flight safety system for at least a decade. SpaceX is just the first customer to use it.

Re:Not exclusive to SpaceX

[Anonymous Coward]

Which, you know... is the news.

So Air Force can reduce its staff!

[Anonymous Coward]

Reduce staff by 160, see Air Force's shares soar! Champagne! Hookers! Cocaine!

Re: So Air Force can reduce its staff!

[Anonymous Coward]

Reaganism is back and better than ever baby!

I'm pretty sure...

[Smidge204]

...that all rocket explosions are automatic. They're rarely intended or desired but they still qualify as "automatic."

=Smidge=

Re:I'm pretty sure...

[torkus]

Depends which rockets you mean. The ones with explosive ordinance in them usually go kaboom. Otherwise someone might be sad to not have their earth shattering kaboom!

Re:I'm pretty sure...

[Doctor Memory]

Uh, no. "Automatic" implies a pre-planned action. Unintended and undesirable rocket explosions are "accidents".

Re:I'm pretty sure...

[Smidge204]

Two ways to argue this;

1) Nothing about automatic implies preplanning; "Done or occurring spontaneously, without conscious thought or attention"

2) Explosions are absolutely pre-planned in rocket design, though the intent is to keep the explosions contained within the engine. :-)

=Smidge=

Ariane 5

[drolli]

I was under the impression that Ariane 5 did automatically self-destruct in 1996.

Re:Ariane 5

[keneng]

Yes, the Ariane 5 did self-destruct as instructed in the software which was running on redundant hardware. Because ultimately, it was the software that made the decision to self-destruct. No human in the loop and BANG. It leaves no room for corrective course of action from any human experts.
http://www.nytimes.com/1996/12...
"When the guidance system shut down, it passed control to an identical, redundant unit, which was there to provide backup in case of just such a failure. But the second unit had failed in the identical manner a few milliseconds before. It was running the same software."

Back to SpaceX and their auto-self-destruct without any humans in the loop to save cash by giving the illusion that they don't have to employ military personnel to babysit spacex launches.
The topic up for debate here is "human reaction time envelope" as the rationale for delegating all responsibility to correct/self-destruct to the hardware/software system.
The other topic for debate is should any country trust a corporation to launch stuff into without any monitoring/intervention capability allocated into the budget? SpaceX is giving the sales pitch that they will be saving the company money and saving government tax dollars by asking the U.S. and other countries to trust them. Should we? Should we trust SpaceX software/hardware engineers will have done a correct impact analysis on everything? Not to be bleak here, but engineers were also responsible for impact analysis of nuclear power plants/offshore-drilling stations for which the world is still paying for to clean up.

Bottom Line: we need humans in the loop and government intervention in order to force the greatest of deliberation on matters that do not distinguish borders.

Re:Ariane 5

[torkus]

Paranoid much? How about a rogue range officer. How about rogue software reporting incorrect flight data? How about someone having a Bad Day? How about someone being negligent in their job and not paying enough attention? What if someone blocks/jams the signal?

Bottom line: any practice has potential avenues of failure. Computers can react faster and with more precision than a human plus this puts the decision look within the spacecraft eliminating the need for a groundside communications loop.

Oh, and you didn't RTFS. This is *also* to allow a polar launch which cannot be tracked and monitored by a RSO as there is no radar coverage for that flight path. So besides just saving some cash, it opens up an entirely new launch slot.

Re:Ariane 5

[Doctor Memory]

Well, yeah, after it started to come apart in mid-air. See this analysis for details.

Re:Ariane 5

[Anonymous Coward]

"No such thing as a free launch."

Lovely. (RTFA).

uhm....???

[pezpunk]

"Launches from Florida into orbits traveling from pole to pole generally sent rockets too close to populated areas for the Air Force's liking. The new rules allow them to thread a safe path southward, past Miami and over Cuba."

Actually, according to my research, Miami and Cuba are in fact populated areas.

Re:uhm....???

[Anonymous Coward]

Agreed!
Although, I'm no fan of Cuba's political leadership

Re:uhm....???

[Zocalo]

Given the geography, "past Miami" probably means over the Glades, which is almost certainly below the maximum population density requirement, but Cuba did raise my eyebrows too. I think the clue is actually in the bit that says "thread a safe path southward", which implies a rather narrow launch corridor. Keep in mind that by the time the rocket even gets from the Cape to Miami it's travelling pretty quickly, so if there is a problem with the trajectory it could easily be outside the permitted corridor before a human has a chance to react. An on-board system could fire the detonators, igniting any high explosives and propellant within milliseconds of the rocket crossing a GPS "fence", and probably wouldn't preclude someone in Mission Control doing a manual destruct were one to be required either. You're still going to have the risk of falling debris hitting something on the ground, but that's prettty slim given the available mass, how much of it will be vaporized in the blast, and the size of the debris field increasing exponentially with altitude.

Re:uhm....???

[pezpunk]

fine, but gotta admit the odds of SpaceX crashing some debris directly onto Raúl Castro's head as opposed to some random sugar cane farmer is pretty remote.

Re: uhm....???

[Anonymous Coward]

thats ok. the world is no fan of your's.

But the Cubans have universal healthcare with lower mortality than the US so they must be politically evil right? Go fuck your cousin USAmerican!

Re:uhm....???

[nitehawk214]

I suppose you can fly over Cuba without being too close. If you were 100km away straight up?

Re:uhm....???

[Dragonslicer]

"Launches from Florida into orbits traveling from pole to pole generally sent rockets too close to populated areas for the Air Force's liking. The new rules allow them to thread a safe path southward, past Miami and over Cuba."

Actually, according to my research, Miami and Cuba are in fact populated areas.

Yes, I think that's the point. The previous system (a person tracking the rocket and pressing the destruct button if necessary) was not fast enough to let them launch rockets over heavily-populated areas. The new system can react more quickly, so it can fly over heavily-populated areas with considerably less danger to the people on the ground.

*Civilian* GPS

[DrYak]

I don't know. GPS was never supposed to be used for anything like this.

*Civilian* GPS was not supposed to be used like this and got limitations (speed, altitude *) to avoid being usable like this.

The military had guiding missile in this way in their mind from day one.

---

*: normal GPS chips will refuse to give a precise answer above a certain speed (~500 m/s) and altitude (18km).

Re:*Civilian* GPS

[Agripa]

I don't know. GPS was never supposed to be used for anything like this.

*Civilian* GPS was not supposed to be used like this and got limitations (speed, altitude *) to avoid being usable like this.

It has been a while since I studied them but I think the ITAR regulations only apply if the GPS receiver is exported as with cryptography. An export regulation makes a nice unambiguous jurisdictional hook. Of course as a practical matter, this applies to any mass produced implementation. If this is an issue for SpaceX, then they should have no trouble getting a licensed exception and I assume some of the ASIC manufacturers produce a custom firmware without the civilian ITAR restrictions or that SpaceX can procure a military receiver from one of the companies which make them.

Re:*Civilian* GPS

[dyslexicbunny]

Actually civilian receivers lose lock completely. It's to prevent their use on missiles.

Hold down the button or Settings General Keybo

[raymorris]

Prior to iOS 11, you had to hold down the quote button to get the option to use "smart quotes". Now that those are the default, holding the button down may give the option to use standard quotes. If not, one can turn them off entirely in Settings > General > Keyboards.

The rocket goes to the satellites 12,000 miles up

[raymorris]

Which one is closer depends very much on how long after launch we're talking about. It's a space rocket - toward the end of the flight is very much nearer space than it is to the ground. In fact the Falcon may go twice as high as GPS satellites.

populated, yes, but not by Americans

[Anonymous Coward]

Browns don't count.

Will they use it on a manned launch?

[Anonymous Coward]

So the big question is will they use the automated device on a manned rocket launch?

Re:Will they use it on a manned launch?

[tomhath]

The only manned flight these days is to the Space Station which is inclined about 51 degrees; that's apparently "roughly parallel to the equator" according to the BS summary. Polar orbits are used for weather and spy satellites.

Re:Will they use it on a manned launch?

[DontBeAMoran]

Polar orbits are used for weather and spy satellites.

Polar orbits are used for weather and "weather" satellites.

FTFY.

Signed,
CIA/FBI/NSA/X-Files/whatever.

IF!?!??

[Anonymous Coward]

I think you mean WHEN this massive ponzi scheme of a rocket fails it can be blown up destroying evidence. Big difference.

Safety of what's below?

[Anonymous Coward]

I suppose the flight paths are all calculated such that whatever is underneath is a minimal loss from falling debris.... But I remember reading about RSO's also being necessary to evaluate what's under the rocket before the destruct is pressed. Then again, I'm pretty sure that was fiction (probably Heinlein or Niven/Pournelle...)

But I wonder if my misgivings about it - that a human should most definitely be in the direct path of approval - are somehow justified or just a vestige of thinking people are better than machines at making choices of what to destroy, when.

I think there's probably a parallel to be drawn about self-driving cars.

Oh, and by the way..... that this will save SpaceX money is an absolutely shitty reason and EXACTLY the reason private enterprise should not be running space programs. Safety should be the first and ONLY goal of such efforts. So if the automation actaully is more safe, great! If it isn't, SpaceX can suck it and pay the Air Force the money, or get out.

Least impressively.....

[Ancient_Hacker]

Least impressively, it will take a cheap human out of the decision loop, making it more likely that the wrong decision will be made by some possibly buggy software, like, say the $400 million Ariane blowup of yore.

Re:Least impressively.....

[Anonymous Coward]

Did you miss the part about also taking the radar stations with their 160 staff to operate them out of the loop as well? Surely the cost of that isn't negligible.

emergency self-destruct

[Immerman]

No, we call it an emergency self-destruct system. A rocket is already a missile by nature, with its fuel being the warhead. If it were to malfunction and hit the ground with most of its fuel still on board it would make for a *really* bad day for anyone in the area. A high altitude airburst as soon as the situation becomes unrecoverable is by far the preferable alternative.

Local insurance claims

[Anonymous Coward]

DESCRIBE THE ACCIDENT: I was driving and saw a bright flash in the sky. Next minute, this Tesla appeared from outta nowhere and landed on top of my car.

DID THE OTHER PARTY STOP?: There was no other party. Sky. Tesla. My car.

WAS THIS A HIT-AND-RUN?: No. :(

Re:The rocket goes to the satellites 12,000 miles

[Immerman]

Space is only 60 miles away. GPS satellites are ~12,000 miles away. You'll be in stable orbit long before you get closer to the satellites. At which point automated self destruct systems will almost certainly be disengaged because there's no longer an imminent threat to anyone, have essentially limitless time to try to regain control, and any explosion is going to create some nasty orbital debris that nobody wants around.

Two

[SuperKendall]

It takes about two seconds to realize that any ground based system will be passed WAY out of range in about a second at the speed a rocket is going.

Not to mention the signal from a ground based station would be whack because of how fast the rocket is moving relative to the station, a GPS satellite being pretty far away means a rocket can lock on and track it very quickly even going fairly fast; no way the GPS circuits would be able to lock onto the rapidity receding ground station that is my comparison super close, it simply would never factor in.

But apparently you are too ignorant as to how GPS systems these days work... don't feel too bad, many of the people on the Earth are probably almost as stupid as you. Maybe.

You're confusing orbit with "space"

[raymorris]

At 60 miles, the air pressure is very low. That doesn't mean you have "limitless time" or any of that. In order to orbit at that altitude, you'd need to be traveling at 20KM/ s or so. The Falcon is only going 500 m/s at that altitude. It would need to be going about 40 times as fast for what you said to make sense.

Re:You're confusing orbit with "space"

[Immerman]

Sure, at 60 miles you won't stay up indefinitely - still plenty of time to futz around and destruct manually though. And even the ISS is only at 254 miles altitude - still not completely free of atmospheric drag, but near enough for most purposes.

Actually low-Earth orbital speed is only ~8km/s, and falls off with altitude. Really though, the Falcon booster, which is the real threat, is strictly suborbital, it's only the second stage that even has the option of reaching orbital speeds, though that may change with the Heavy.

My point though is simply that regardless of what you're flying, you're going to reach orbit long before you get closer to the GPS satellites than to Earth. Thanks to the properties of orbital mechanics, it's more fuel efficient to add momentum at lower altitude - so pretty much all flight plans are going to enter low orbit before climbing much higher.

How did the H2 and O2 become an explosive mixture?

[GPS Pilot]

the External Tank contains a small pyrotechnic device which causes its load of liquid hydrogen and liquid oxygen to combine and combust.

I have often wondered -- and this makes me wonder once again -- how did the Challenger's H2 and O2 become an explosive mixture? Inside the External Tank were actually a LOX tank (above) and a separate LH2 tank (below).

The cause of the disaster was explained as a faulty O-ring that allowed a jet of hot gas to escape out the side of one of the solid rocket boosters, impinging on the External Tank. Fine, but that could cause a breach of the O2 tank or the H2 tank -- not both.

And even if both were breached, wouldn't the breaches have to happen in a very unlikely configuration, to allow the escaping O2 and H2 to travel toward each other and become an explosive mixture?

Maybe the Destruct System played some part in this after all.

Re:How did the H2 and O2 become an explosive mixtu

[im_thatoneguy]

[quote] how did the Challenger's H2 and O2 become an explosive mixture? [A jet of hot gas] could cause a breach of the O2 tank or the H2 tank -- not both.[/quote]

The mixture was caused by kinectic force. When the H2 tank breached the rupture rocketed it into the O2 tank.

Re:How did the H2 and O2 become an explosive mixtu

[Anonymous Coward]

The cause of the disaster was explained as a faulty O-ring that allowed a jet of hot gas to escape out the side of one of the solid rocket boosters, impinging on the External Tank. Fine, but that could cause a breach of the O2 tank or the H2 tank -- not both.

 
They lost a strut. The escaping jet of hot exhaust gasses impinged upon it and it failed. The SRB then became free at its lower attach point (the failed strut), and began to rotate around its upper attach point until it hit the ET and ruptured it, resulting in structural failure of the tank (which the Orbiter is supported solely by, taking the acceleration loads from the SRB's through its main structural components, and into the Orbiter) that initiated the structural breakup (via direct impressment of out-of-boundary structural loads as well as impressment of off-axis aerodynamic loads) of the entire stack at the same time the castrophically failing tank was releasing its contents of LOX and LH2, which reacted together and burst into flame. All of this happened very rapidly.

All of this information is freely-available in the Rogers Commission Report, which you may wish to read if you're interested in the details of the accident.

The Range Safey System played no part in any of these events.

msg sent day of accident

[Anonymous Coward]

Shuttle blew up mid morning on 28 Jan, msg date is early afternoon same date

Musk is great at BLOWING UP rockets

[Anonymous Coward]

It is more the getting a rocket to space part that he has not quite figured out.

Civilian GPS

[DrYak]

It has been a while since I studied them but I think the ITAR regulations only apply if the GPS receiver is exported as with cryptography.

According to the Wikipedia segment I've linked, it's indeed an import/export rule.
So in theory an pure 100% all-USAmerican chip manufacturer (do such thing still exist ?) can legally flash a non limited firmware as long as the device never cross US' border during production, is only sold in-land, and is clearly market "not for export".
Also means that the usual asian chip manufacturer only need to flash such firmware on thing clearly sold elsewhere but not in the US (nor the few other countries which follow these rules). They could still flash non-limited firmware for other market as long as they mark them "not for export to US and XyZ countries" (i.e.: only sell them on the less obvious corners of Ali Baba)

If this is an issue for SpaceX, then they should have no trouble getting a licensed exception and I assume some of the ASIC manufacturers produce a custom firmware without the civilian ITAR restrictions

Yup, very likely that SpaceX will easily get the proper licensing, given their field of work. (It's a completely legit use, and the AirForce is on this with them anyway).

Still, they're probably the first US civlian company to be able to basically get a GPS on a giant Missile-like device.
(Until then, US civilian use has been restricted by the export regulation).