Commercial Crew Abort System Design Evolution and Validation

New commercial crew vehicles require an emergency detection system for crew abort capability. This system is implemented to provide protection for the crew in the event that a catastrophic hazard occurs. The emergency detection system developed for the Atlas V is not unprecedented. The Space Shuttle program had several abort capabilities, as did the Apollo/Saturn vehicle. The underlying principles in designing an abort system remain very similar across programs and across time. The technology available to implement these systems has evolved and improved. The understanding of past failures to abort when needed also play into modern day abort system design. Launch vehicles include many complex integrated systems and subsystem components. Understanding the failure space of all these systems and their combination is a daunting and seemingly endless task. When in abort system design, there are two contrasting design perspectives that must be considered: “Failure Space” and “Success Space”. The Failure Space case design is used where there are unknown outcomes, nonlinear time variant complex analyses that cannot be done in the time allotted, and unknown fault system interactions. The concern with designing in Failure Space is the inability to abort when necessary. Because this type of abort analysis is not well understood, it moves validation of these abort cases into effect-based validation. On the other hand, the Success Space case design is more straightforward. In this space the causes are understood, testing to determine abort success exists, execution of redundancy is clear, and the statistical analysis associated with assessed failure modes is clear. The concern on this design side is overachieving or inadvertent abort. The validation of Success Space abort design is cause-based where the cause of the failure can be detected and the abort sequence initiated properly. Abort system validation techniques can be polarized between the complex effect-based validation and the less complex cause-based validation. The first puts the designer in a qualitative risk based assessment world and the later places the designer in a logical limit based analysis world. It is imperative that the designers of an abort system can be successful in both of these types of failure spaces. The design of the Atlas V emergency detection system has required this and although the hope is that it will never be used, should it be called upon, it stands to be the most comprehensive emergency detection system in launch vehicle history.