Controlled Pod Six Feet Under Terrain epitaph 4: Launchpad of Horror

re-uploaded to fix technical issues. this was the halloween episode!

wow, UPS 006 was heavy. We wanted to do something that wouldn't make us cry, so here's some rockets exploding.

as always, Controlled Pod Into Terrain comprises Kyra, the aviation writer who investigates plane crashes, Ariadne, the aviation business expert, and J, who is some kind of engineer.

Episode Transcript

(00:00):
Hello, and welcome to a very special episode of Controlled Pod Into Terrain.

(00:04):
We are a spooky multimedia podcast about air and space mishaps, aiming to put them in the
broader context of how and why things went wrong.
Now to introduce myself and my co-hosts, my name is Ariadne.
I'm the business and aviation industry-knowing one, and my pronouns are they and them.
My name is J.
I'm the systems and engineering expert, and my pronouns are also they and them.

(00:28):
And I'm Kyra Dempsey, better known as the aviation writer Admiral Cloudbert, and my
pronouns are she and her.
Okay, let's take us to the next slide.
It's some kind of news thing.
Next slide.
All right, Kyra, you want to go ahead and take this?
Yes.
So, I forget when this happened, but it was a few days ago.

(00:53):
There was a collision between two business jets at Houston Hobby Airport in Houston,
Texas.
My understanding was that the Cessna Citation Mustang, the Cessna 510, was on approach,
and then the Hawker blew through without clearance and decided to take off.
Yes, yes.
A Cessna 510 was landing on an intersecting runway where a Hawker was taking off without

(01:20):
permission according to air traffic control.
That is their official position.
The pilot of the Hawker, based on their transmissions to air traffic control after this happened,
apparently believed they were cleared for takeoff.
That was evidently not the case.
The left wing tip of the Hawker clipped the tail cone of the Cessna, and the Hawker lost

(01:43):
a winglet and then came back around and landed and apparently slightly lost directional control,
went onto the grass during the emergency landing.
I don't entirely know why that happened.
This certainly, it's sort of a concerning escalation of the general pattern of near
misses on American runways.
And if this had happened, if these two planes had come together a quarter of a second earlier

(02:09):
than they did, it would have been catastrophic.
Yeah, we've heard the ATC radio after the incident, but as far as I know, they have
not released audio that happened during, which would sort of clear who is, I don't want to
say at fault, but it would give us a lot more clarity as to who made what decision and why.

(02:31):
Yeah, officially the story is the Hawker didn't have takeoff clearance, but clearly thought
they did for whatever reason.
One theory that I heard was that there had been another transmission to another totally
different airplane.
It was not takeoff clearance, but had certain key words in it that could have led the pilot

(02:56):
of the Hawker to believe they were being cleared for takeoff.
And I don't have the actual quote of this transmission in front of me, so I can't read
that for you.
But that's one possibility that's going to be explored.
But isn't one of the major things we got from Tenerife, the whole standard phraseology thing,

(03:16):
wasn't that supposed to prevent that from happening?
Yeah, part of the standard phraseology that is in place is the word takeoff should only
be used when issuing a takeoff clearance, and otherwise you use departure.
And yeah, again, I don't have the transcript of what happened in front of me, but it's

(03:40):
entirely possible somebody did not use standard phraseology or any other similar types of
errors could have led to this.
So how much of this was just not as bad as it would have been because these planes are
small biz jets that are massively overpowered?
I mean, even if they just full on collided, this would be not as bad as it could be because

(04:04):
they're small business jets.
I mean, this airport also serves some, has full-size commercial flights.
But then you also have the added confounding factor that if these planes were three, four
times as big, maybe they would have seen each other coming.
Yeah, they also probably, you would not have been able to do the Yolo takeoff that the
Hawker pilot apparently decided to do.

(04:25):
Yeah, I mean, not to mention that simply the training requirements for pilots on these
business jets, which are almost certainly operated under either part 95, sorry, part
91 or part 135, are not as stringent as they are for the airlines.

(04:45):
I'm pretty sure most of them were part 135 actually, yeah.
Yeah, they're part 135 because it's all charter dispatch.
Yeah, if these were charters, they're part 135.
If these are somebody's private jet, then they're part 91.
And that's a good point.
But I don't know who they belong to.
They're probably charters.
We could look that up, but frankly, we can't be bothered.

(05:06):
So yeah.
All right.
Can we have anything else to say?
Okay.
Yeah.
Okay, so we're going to do an update on what we talked about the previous time, the FedEx
belly landing, because the NTSB preliminary report on the belly landing in Chattanooga
came out and it was sort of likely speculated.

(05:27):
They're looking at multiple unrelated mechanical failures.
So one of these was that the original hydraulic failure affecting the left hydraulic system
was at the landing gear door.
So the stand pipes in the left hydraulic system that pump excess fluid through to open the

(05:51):
doors and deploy the gear during a hydraulic failure didn't work because they just pumped
the standby fluid straight out through the breach at the landing gear doors.
Whereas if the breach was elsewhere in the system, it would not have been affected.
Then the second issue was there was bad wiring coming from connecting between the DC battery

(06:11):
bus and the alternate electrical extension system.
So that didn't work either because there was just a broken wire.
No signal got there.
No, there were two broken wires.
It was both DC battery buses.
That's actually insane.
I only know that there was one.
So yeah, not only that, after the plane came to a stop, there were issues with both of

(06:36):
the emergency exit doors.
A jump seat occupant tried to open one of them and it didn't open and they opened the
other and it was very difficult to open.
The first one, yeah, not only did it not fully open, the slide didn't deploy or anything.
The other one had to be forced open very hard because it got stuck on the slide and they

(07:03):
really had to lean into it.
So they eventually managed to get the slide deployed and get out.
But it's so many systems on this plane not working properly and it clearly raises questions
about the way this airplane is being maintained.
Even though there was only three people in there, couldn't they just have gone out of

(07:23):
the cockpit window?
Yeah, but that's hard.
I mean...
You have to figure with the real nose up attitude.
That's probably 20 feet down.
Every time I've read about accident reports involving an accident or on accidents where
a pilot used the cockpit emergency escape rope, they suffered a number of injuries like

(07:47):
sprained ankles, rope burn on hands, other kinds of things like that you wouldn't get
by jumping down a slide.
So it's kind of a last resort.
Okay.
Okay.
And they also just wanted to go way down the slide.
We'd all want to go.
Yeah.
I mean, I think it's important we note that this was very much a maintenance issue.

(08:10):
This was nothing to do with the design of the CEM57.
There were multiple redundancies and backup systems and all of them failed because of
poor maintenance.
Yeah.
I mean, yeah, absolutely.
There's no two ways about it.
This was clearly something to do with maintenance and the NTSB is going to find out, but you
don't have that many systems failing for totally unrelated reasons, just for no reason.

(08:34):
You have to be actively not maintaining a plane properly for something like that to
be reasonably profitable.
We're very careful not to say anything actionable about FedEx, but we will say that FedEx tends
to not like spending money.
They tend to buy very old airplanes.
They tend to run them all the way ragged.

(08:57):
They tend to have pretty fierce negotiations with labor.
So listeners, you are welcome to draw your own conclusions on perhaps what led to the
string of cascading failures in this case.
I feel very sure that Boeing is going to have some difficult aging fleet program conversations
in the coming months, particularly with the NTSB report on this aircraft because even

(09:22):
if the operator was doing just the minimum that they were allowed to do, this shouldn't
have happened.
Yes.
I think that the NTSB is probably going to have some fairly stern words for the depot

(09:45):
that was maintaining this plane.
Agreed.
Agreed.
All right, anything else?
No, next slide please.
And of course, the big news story of the intervening time since the previous episode was the in-flight
incident on an Alaska Horizon Embraer flying between Seattle, not Seattle, Everett outside

(10:10):
Seattle and San Francisco.
So on the jump seat at this flight, there was an Alaska Airlines pilot, full Alaska,
Alaska Horizon, who was riding apparently home to Northern California.

(10:31):
And all of a sudden he said, I'm not okay.
And then he jumped off and he pulled the fire cutoff handles for both engines.
So these are two big red handles.
You pull them out to shut off the fuel, hydraulics, electrics, a whole bunch of things.

(10:51):
And then you twist them to activate the Halon fire extinguishers.
And he pulled them out.
We don't know exactly how far, but he didn't twist them.
The engines didn't shut down.
We don't even know if he wanted to twist them.
But in any case, he was stopped by the other pilots before he could get that far.
And so the pilots declared a level four security breach, which is the highest level, and diverted

(11:19):
to Portland.
And this pilot was arrested and charged 83 counts of attempted murder, 83 counts of reckless
endangerment and one count of endangering an aircraft.
So extremely serious charges.
And at first, this was speculated to have been a suicide attempt, but that was actually

(11:40):
not what it was, according to the latest information.
And this is something that's really being talked about by everyone in the industry.
I imagine most pilots are probably already familiar with this.
But the pilot who did this claimed to have one, been not slept in 40 hours, which is

(12:00):
insane.
I have personally never slept for never gone more than 26 hours without sleeping.
And I can't imagine 40.
Your brain starts to do really weird things at that point.
Second, he claimed to have taken psychedelic mushrooms.
And originally there was a lot of speculation that he was on psychedelic, the influence

(12:22):
of psychedelic mushrooms when he did this, but that does not appear to have been the
case.
He said he had taken the mushrooms about a day and a half to two days before the flight.
And their effects last about six hours.
So he was not under the influence.
However, he apparently hadn't slept since he took them.

(12:43):
So I don't know what to make of that.
Yeah, I have actually been awake for 48 straight hours.
Startup life sucks.
You start to see some weird shit.
You very much lose connection with reality.
You can't really tell whether you're awake or not at that point.

(13:06):
If you were in control of any kind of vehicle, it would be a profoundly dangerous thing to
do.
Yeah, and actually we know that he was having many of those symptoms because he said in
his interview with the police that he thought he was dreaming and he pulled the fire handles
in an attempt to wake up from the dream.
So after, and obviously that didn't work.

(13:26):
So he was kicked out of the cockpit and walked peacefully to the back and told flight attendants,
please cuff me because I'm afraid I'm going to do something dangerous.
So they did.
They cuffed him to a flight attendant jump seat at the back of the plane.
And as he was sitting there, he actually tried repeatedly to reach out and grab the emergency
exit handles, but was stopped by the flight attendants.

(13:47):
So he was clearly just not all there.
He doesn't seem to have actually been a dangerous guy.
I mean, this guy was in a really bad situation and he really needed help and the FAA made
it as difficult as possible for him to get that help.
Yeah.

(14:08):
I mean, according to recent reports, he, I mean, it's not, it's not an exaggeration at
all.
He said that he did, was afraid to get help for his ongoing depression and other issues
because he feared that the FAA would take away his license.
And obviously some, sometime we're going to have to do a really deep dive into everything

(14:31):
that's wrong with the aeromedical system when it comes to mental health.
But this is, this is clearly a symptom of that.
This, this incident would never have happened if this pilot thought, you know, Hey, I could
go, I could go see a therapist.
I could go get medication.
I could just be, you know, and then when I'm, when I'm feeling better, I could go back

(14:51):
to the cockpit because it doesn't work that way.
And the results is that people hide their issues and this, this man was hiding his issues
and he, you know, he was, he, there was a lot being piled on him.
He had, he'd been hit, apparently been hit really hard by the death of a friend a few
years ago.
The anniversary had just passed.

(15:12):
He was not in a good mental state and he had no way of getting help.
Yeah.
We, we, we really feel for this guy.
We know initially when this happened, the reaction is, is sometimes he's tended to be
is really cheap jokes and memes.
And we were not going to be doing that.
We will not be making any jokes about this guy.
We don't think any of them are funny.
This was, this was a man who was very, very much in a lot of pain and the system actively

(15:36):
prevented him from doing so.
I mean, right now, like, like Kyra said, we're, we're going to do a deep dive into the way
the FAA handles mental health.
And we're going to demonstrate that if you, if you designed a system to be as hostile
and dangerous as possible, I don't think you could come up with something as evil as what
they have built.
What is funny though, which we will be making jokes about is the air traffic control recording

(15:58):
of the pilots left in the cockpit after they'd gotten this guy out.
Oh my God.
They're, they're so annoyed.
They are.
It's, it's just, it's yeah.
Done.
They are done with this.
They, they, this, this is the voice of two, of two individuals knowing that they have
to do infinity paperwork.
It's just, it's, it's real listeners.

(16:19):
You've ever seen clerks.
The way I describe the audio is it's, I'm not even supposed to be here today.
Energy.
It really is.
It's great.
I think every, every pilot should sound that way.
Ready to move on?
Yeah.
Next slide please.
Okay.
So let's do some, some notice to podcasters.
We have a Patreon now, patreon.com slash CPIT.
Give us two bucks a month.

(16:41):
You get access to our members only Patreon where you can hang out with us and participate
while myself and J argue about which NASA project is the worst.
It's SLS.
No, it's not.
It's Aries one and you know it.
That, that's true.
So we're, we're, we're looking at other benefits and tiers.
We'll probably be doing a monthly bonus episode soon.
Maybe we've discussed commentary tracks for movies.

(17:05):
So you know, join right now, hang out with us in the discord and figure out what we'll,
we'll do next.
Patreon.com slash CPIT.
Yes.
Thank you.
Okay.
Every episode we've gotten suggestions and hints for editing and we appreciate the spirit.
We know it's put the best intention.
We really appreciate you guys and you've, you've really just said nothing but wonderful

(17:27):
things about the show.
What you guys should know, however, is that the person who does our video editing has
visual agnosia.
They also have helitonitis and they edit the audio too.
They're doing pretty well and don't complain unless you would or we'd like to volunteer
to edit it for free.
And if you would like to volunteer to edit it for free, please message me on discord.

(17:49):
Yeah.
Let us know.
Yeah.
And the last thing we want to do is we, we want to do a follow up from a last episode
and this is about UPS.
UPS announced that they are going to be doing a round of layoffs for pilots.
If you, if you follow the aviation industry listeners, you will know that there's, there's
sort of a cycle of fuckery about these layoffs and it's, it's a bit insidious beyond the,

(18:11):
the obvious, it's an easy way to cut costs and boost the stock price, which is that these
are very frequently not just a way of, of freeing up operating expense and capital,
but a way of, of culling the most expensive and senior people at every sort of tier.
And you saw a lot of this during early COVID where the airlines were offering buyout packages

(18:33):
and they, in early retirement.
So these naturally went to the pilots that had in, in, in almost every case, the most
seniority and a lot of these happen to be people with, with choice schedules and a lot
of them were wide body over water pilots.
So now you had a sort of critical shortage, which is why now you have situations where
people are coming in straight from working at a regional airline and maybe flying some

(18:55):
of the Q 400 and going straight to an A 350 or if you're with somebody like UPS, a 747.
So there's, we just like to remind you everybody, there is no such thing as a pilot shortage.
There is only a shortage of companies willing to pay what pilots deserve to be paid.
Exactly.
And that's more or less what I said in my latest article if you read it.

(19:16):
So it was a long one.
It was next slide, please.
Next slide.
What is this?
I don't even.
What even is today's episode about?
Before we tell you that we will say this.
The last episode was, was rough.
It was upsetting.
It was emotional, both to put together and to record.
So for this episode, we wanted to do two things.

(19:37):
Have fun and do an episode where no one gets hurt.
Just like you guys know, this isn't going to be our usual format where we sort of lay
the background and we describe an accident sequence.
So this time J and I are going to tell about a half dozen stories about a subject we know
a lot about, Tequila, who knows nothing about it.
With that in mind, let's talk about rockets.

(19:58):
Next slide.
Oh boy, rockets.
Yeah, I'm pretty sure that's the wrong kind of rocket.
That's rocket raccoon, right?
That's rocket raccoon.
Next slide.
Yeah, that's a chain eatery, I believe.
That's Johnny Rockets.
Okay.
Yep.
Next slide.
Let's try this again.
That's a rugela, also known as rocket.
Okay.
Okay.

(20:19):
Last try.
Last try.
That looks like a rocket.
Even I know that.
All right.
There we go.
That is an Ariane 5.
Specifically, this is Ariane 5 flight V88, also known as Ariane 501, on the 4th of June
1996.
Ariane 5, as you may know, was the workhorse of European Space Agency flight for about

(20:45):
30 years, right?
Almost 30 years.
Yeah, the most recent one.
The last one in the series just flew.
Yep.
The final Ariane 5 flew in 2023.
And this was the first one.
This was the very first one.
It didn't go well.
It did not go well.

(21:06):
The whole European Union was watching this flight because ESA talked a lot of, well,
it turned out to be old-tude about potentially human-rating this vehicle and putting a little
space plane on top called Hermes, which was super cool.

(21:27):
We all wish they'd done that.
It would have been Hermes.
No, it would have been Hermes because it was mostly being designed in the UK, actually.
Yeah.
You didn't know that, did you?
I did not.
Now, J, I will tell you, I know as a sort of software and computer engineer, is it true
that this particular flight is taught in sort of every sort of 201-level class?

(21:53):
This is one of the two software disasters that is taught to every software engineer
who's going to go into an embedded software career in the don't fuck up module.
The other incident is a thing called Therac 25, which was a Canadian radiotherapy machine

(22:15):
which killed a whole bunch of people because of bad software.
Ariane 5-501 didn't kill a whole bunch of people.
It just cost an ungodly amount of money.
The conventional story is that an integer overflow occurred in the software in this
vehicle causing it to be destroyed 36 seconds into flight.

(22:39):
But it's actually a little bit more complicated.
Error trapping features in the ADA runtime that caused the number bad to turn into flight
computer has crashed and then immediately into thrust vector control has stopped working
and then followed shortly by cluster is now in the mangrove swamp.

(23:00):
Okay, so back up a second.
What do you mean by the ADA runtime and what is TBC, the thrust vectoring?
Okay, so we're going to get into this in a minute, but in short, ADA is the language
the flight software was written in.
It's a language that's very popular in sort of less US military.
They have their own kinds of languages for that, things like Jovial, but other militaries

(23:25):
in other places in the world use ADA for a lot of their software because it has very
good testability characteristics so that you can actually prove that a piece of ADA software
does what you think it's going to do.
Of course, in this situation, they actually didn't do that and that was like half the

(23:45):
problem.
So runtime is the environment that that software runs in.
Thrust vector control or TBC is where you swivel the engine nozzles to control where
the rocket is going to go.
Mostly up, but sometimes other directions.
Well, you want it to go up and then over.
Yes.
So, okay, so anyway, this somehow caused a rocket to get very explodey somewhere in France

(24:09):
in 1996.
So I guess let's hear why.
Well kind of not really in France.
The ESA spaceport is in Kourou, which is in French Guiana because they're colonizers.
Hey, I'm still right because French Guiana is a full department with no more autonomy
than any other French department.
So it's still in France and in fact, it's literally part of the European Union despite
being in South America.

(24:29):
So I'm in this one.
Yeah, you can actually take the world's second longest domestic flight.
So flight which does not require a passport goes from Paris to Cayenne in French Guiana.
The only flight that's longer is France to Réunion, which is another French colony.
I would rather not say that this is actually part of France because there were people there

(24:51):
before the French showed up.
That's all I'm saying.
I think that's more of a judgment whether it should be part of France.
That's outside the scope for a podcast about plane crashes.
Okay, so I assume the European Space Agency launches its rockets there because it's close
to the equator and that makes it easier to get into orbit.
Yeah, it's actually a really great place to launch rockets from because it's only three

(25:13):
and a bit degrees from the equator.
So they get this nice little boost in terms of energy when they're heading for orbits
that are on the ecliptic like geostationary transfer orbit, which is mostly what Ariane
5 was designed for putting big communication satellites to a time onto a geostationary

(25:34):
transfer orbit.
And these ecliptic orbits are on the same plane as the rotation of the Earth.
So the closer you can launch from, the less energy you need to do that plane change to
get onto that same orbital plane.
Which is why Russia has to do a bunch of funky stuff because the Baikonur Cosmodrome is literally

(25:57):
45 degrees north.
Anyway.
Yeah, that's why the ISS is on this annoying compromise orbit that's way too inclined for
either ESA or NASA to access conveniently and not really inclined enough for Roscosmos
to access easily.
But that's a rant for a completely different episode.

(26:18):
And as I say, they teach you this incident and THERAC-25 in the Don't Fuck Up module
in software engineering school.
So to go into a little bit more detail, this happened because people were kind of not really
paying attention when they built Ariane 5's software and the hardware that it would run

(26:43):
on.
So Ariane 5 has two inertial reference system modules.
One active and one hot standby, which are called SRIs because French.
It's always appropriate to make fun of the French.
You can make fun of any colonizer country.
That's always acceptable.
I mean, we'd make fun of the French even if they weren't a colonizer country.

(27:03):
I'm sorry.
That's absolutely true.
Okay.
And so I take it the inertial reference system is basically the same idea here as on an airplane.
The basic means of navigation in three dimensional space.
It's how the missile knows where it is, so to speak.
Yeah, it was invented for rockets.

(27:23):
Absolutely, the first inertial reference system was actually the gyroscope that was on the
V2 weapon.
ICBMs, of course, had more sophisticated systems and of course all rockets ultimately come
from ICBMs.
Yeah, the ring laser gyro inside the Titan 2 was apparently one of the most closely guarded

(27:49):
secrets of the Cold War because it gave the Titan missiles orders of magnitude more accuracy
than the equivalent Russian SS.
I think it was the SS-12 or the SS-15.
Yeah.
So the missile has to know where it is in relation to the target city.
And of course, your rocket that's trying to lift your satellite into orbit needs to know

(28:14):
where it is with reference to the ground because otherwise it's not going to fly in the right
direction and you will not go to space today.
So normally SRI-2 was active.
It was the sort of the one that was active by default.

(28:36):
And suddenly the onboard computer started eating this diagnostic bit pattern when it
thought it was eating inertial reference platform data.
So if I understand correctly, there are two redundant inertial reference systems and one
of them has a problem.
And I guess we get to learn what a diagnostic bit pattern is or?
Well kind of.

(28:57):
It doesn't really matter.
All that matters is that it isn't inertial reference data and the flight computer does
not know that it isn't inertial reference data.
That sounds pretty bad.
Yeah it's pretty terrible.
Yeah comment theme in this podcast is going to be computer fucks up because it has bad
information.
SRI number two has crashed because Ariane 5 is faster than Ariane 4.

(29:20):
But surely there must be a backup.
Well yes there is.
There's SRI-1.
But the flight computer couldn't switch to that because it had already crashed.
It was running the exact same software as SRI-2.
And of course when SRI-2 crashed, SRI-1 was seeing the exact same situation so it crashed
too.

(29:42):
And so what had happened was that the SRI software had to take a value from its inertial
measurement unit and convert it from a 64 bit IEEE 754 floating point number, which
programmers will call a double because it's a double precision number, and it has to convert

(30:08):
it into a 16 bit signed integer.
So the ADA runtime in the SRI was not protected from eating shit and dying if the 64 bit floating
point number, which has a range from minus 1.8 times 10 to the 308 to plus 1.8 times

(30:28):
10 to the 308, was outside the range of 16 bit signed integers, which is minus 32,767
to 32,768.
And when this happened it threw an untrapped operand error exception.
The exception was handled in other spots but not in this one spot.

(30:51):
So if I understand right, in normal people language this means there was a very large
number followed by 308 zeros.
It could be a very very large number.
It actually doesn't matter how big the number was because if it happened to be minus 32,768,

(31:16):
then that would cause the same exception to happen as if it was minus 147 quintillion.
It was outside this very narrow range that it could actually have.
Yeah, so the range could be up to a number with 308 zeros or a decimal of 308 zeros,

(31:36):
and that number could be positive or negative.
So I think in my opinion that's like altogether way too many zeros, and I would also crash
if I had to process that, so I completely understand.
Yeah, I mean it's like they had a variable that can hold the state of your average 1975

(32:01):
calculator and the inertial measurement unit was returning a number that could be as large
as the number of electrons in the universe.
And this is bad.
You need to trap this kind of error and handle it, and they just didn't.

(32:21):
And the reason for that is that the Ariane flight computer, or specifically the Ariane
4 flight computer, had limited performance.
You know, obviously flying a giant freaking rocket requires some fairly quick decisions
to be made, and they had some real-time concerns about the behavior of this computer.

(32:43):
And a bunch of the conversions were protected by error trapping, but this one was not because
error trapping takes cycles in the computer.
Ariane 5's flight computer was much faster than the Ariane 4 flight computer because
it was made in 1996 rather than the space year 1988.

(33:03):
So this wasn't actually a concern, you know, it was eight years newer, and obviously computers
on spaceships get faster just like computers on your desktop do.
So this wouldn't have actually been a concern, they could have trapped this.
But that's all kind of irrelevant anyway because the software wasn't really supposed to be
running anyway.

(33:25):
It was actually in the platform alignment code.
On Ariane 4 it ran for 40 seconds after liftoff, which they thought Ariane 4 needed for some
reason.
Actually it didn't, it was completely unnecessary.
Ariane 5 didn't, but the code was left unmodified because they didn't want to change it without

(33:47):
a good reason.
And the reason for this was that there was actually a period between the main engine
start and liftoff where an abort can be called.
Because when you start the liquid-fuelled engine, the Vulcan engine in the core booster,

(34:08):
you want to make sure that engine is happy before you light those solid rocket boosters
because once those things are lit, you can't turn them off.
So there was a period between starting the main engine and actually lifting off where

(34:28):
you could abort.
And they wanted the ability to be able to recycle after an abort without waiting for
the inertial platform to realign itself, which took about 45 minutes.
This was Bobbin's anyway, the Ariane 5 inertial platform would realign itself much faster.
And also, more in a minute, there was other reasons why this was stupid.

(34:53):
So when you say platform realignment, that's like just hitting reset on the inertial reference
system.
So say you are at the platform.
Yeah, it's actually aligning it to the rotation vector of the Earth and measuring that vector
and measuring the offset on all of these sensors and these ring laser gyros, which are phenomenally

(35:17):
accurate things.
But they do have an offset that has to be calibrated.
And on Ariane 4, this took about 45 minutes.
It didn't take anything like that long on Ariane 5.
I see.
So yeah, so this code was zombie code, basically.
It was zombie code.
It was zombie code.

(35:38):
And actually, it was zombie code in like three different ways.
Ariane 5 had a different launch preparation process and didn't need it.
But they didn't want to change the software without a good reason.
Well, turns out they had a good reason.
And actually, also, even on Ariane 4, leaving it running after liftoff was completely useless

(36:00):
because there is no physical way it's possible to align the inertial reference platform after
the vehicle has left the ground.
So it served no good purpose to leave it running on either vehicle.
Next slide, please.

(36:22):
So here you see three stages in Ariane 5.01's mission, which lasted approximately 36 seconds.
On the left, you have Ariane 5 waiting to launch.
In the middle, you have Ariane 5 launching.
And then on the right, you have Ariane 5 definitely not launching.

(36:46):
So the measurement that caused this operand error was a calculation called horizontal
bias.
Ariane 5's early trajectory has much larger horizontal speed than Ariane 4's did.
So it caused this number to exceed this range of 32,768 to minus 32,767 within the first

(37:15):
40 seconds of flight when this code was still running.
So it triggered this code, which didn't need to be running, to crash when it wouldn't have
done on Ariane 4.
So this code was measuring the horizontal displacement from the launch pad with an extreme

(37:36):
amount of precision to 308 places or whatever.
And so when the measured number became too big, it just crashed everything.
Yep, that's exactly what happened.

(37:56):
And it did this because the Ariane 5 does a gravity turn earlier than the Ariane 4 did.
So that's the only reason that Ariane 4 didn't blow up?
Yeah, actually that is the only reason Ariane 4 didn't blow up.
That's hilarious.
I'm not going to lie.
So this horizontal bias figure was supposed to be the amount of drift in the inertial

(38:22):
measurement unit.
It was supposed to be saying, when this vehicle is standing still, my inertial measurement
unit thinks it's moving sideways at this speed.
And so of course, when the thing actually did start moving sideways, it started measuring
this bias to include the entire horizontal speed of the vehicle, which is why it only

(38:47):
had this limited range in the data format that it was going to put onto the bus for
the flight computer to look at it.
That makes a lot of sense.
I get it.
Okay.
So Ariane 5's first 40 seconds of flight goes more sideways than Ariane 4's did.

(39:09):
The number got bigger than 32,768 or more negative than minus 32,767, and it wouldn't
fit into the variable anymore.
I did actually read the report on this to refresh my memory from when I did this in
2001.

(39:31):
And I couldn't find whether the number underflowed or overflowed.
I did try and look because I thought it would be funny, but there wasn't any code to handle
the situation.
The SRI software crashed, and the SRI software crashing caused the flight computer software

(39:54):
to start doing completely unpredictable and wrong things.
And as a consequence, the telemetry that they were getting from the vehicle became scrambled.
So you can't actually tell quite what was happening because Ariane 5's computer was

(40:15):
relatively modern.
I mean, it was new when they launched it.
It wasn't like when the Space Shuttle Challenger exploded 10 years previously, and they could
look at the core memory in the engine control computers to see what had happened, because
there was no magnetic memory in this thing.

(40:36):
It was all semiconductor memory, and it lost its state when the vehicle came to pieces,
unfortunately.
So the SRI crashed.
It spewed the contents of its memory out into the bus that connected it to the flight computer,
which did not know what the fuck it was looking at.

(40:56):
It tried to fail over to the other SRI, but it had already crashed and was doing the same
thing, because they were both running the exact same code.
So they're not redundant after all.
And I think I covered this exact failure scenario in my article on Smart Links Estonia Flight
9001 for anyone that remembers that.
But two redundant computers receiving information from the same source and running the same

(41:26):
code on that information and then both failing despite being theoretically, despite the fact
that they're supposed to be redundant is not at all unique to Ariane 5.
Was the Smart Links flight an Airbus or an Embraer?
Yes, it was.
It was an Airbus.
Yes, it was probably the same people designed the avionics on it.

(41:48):
Oh no, it 100% was.
It literally is.
Yeah.
Yeah.
Ariane, Spass, Thales, and BAE Systems and the other companies.
I forget their names, who make the avionics for Airbus.
So obviously, they're all part of this sort of European aerospace borg collective of different

(42:17):
companies that all actually do the same thing.
So it then commanded all of its nozzles hard over.
Why did it do that?
Well, it's so far out of normal numbers coming from both SRIs.
It thought they were accelerations and angles, but actually they were just random bites from
the SRIs memory.

(42:39):
It thought it was writing the ship.
It very much was not.
The rocket starts tumbling.
Aerodynamic forces pulled the solid rocket boosters off of the core booster.
And of course, you cannot turn an SRB off.

(42:59):
So if anything goes wrong, the range safety package has to automatically trigger.
You can't turn them off.
Boom, they go.
I love how when all else fails, the last line of safety defense is just make it explode.
I mean, don't have that one on airplanes.
Well, to be fair, airplanes don't have solid rocket motors unless they are fitted with

(43:19):
JATO bottles, as all wide-body jets ought to be.
I can't believe you managed to jam that reference.
Okay.
And so half of the scientific community and all of the aerospace community of Europe was
watching this launch.
And every single one of them thought, well, that was expensive.

(43:43):
And it was really expensive because this was the maiden flight of Ariane 5.
And so therefore, Cluster was not insured.
So what is the Cluster?
So Cluster referred to four satellites.
It was carrying in a constellation.
It originally stood for something, but by the time the satellites actually flew, it

(44:05):
was just a cluster of satellites.
It was four satellites were observing the solar magnetosphere and its interaction with
the Earth's magnetic field.
It was intended to operate in tandem with the solar heliospheric observatory SOHO, which
is still flying.
It's a great satellite.

(44:28):
So they did manage to get money for a do-over.
Cluster 2 cost $300 million, 40% of which was paid by Ariane Spass.
Plus they also gave the mission a free Ariane 5 ride.
I couldn't find the actual cost to Ariane Spass of that anywhere.
I believe that the sort of industry swag for the cost to ESA of construction of an Ariane

(44:55):
5 is 60 million euro.
OK.
But they usually charge about 200 million euro, including all of the launch services
and everything.
We would hope that that doesn't cost Ariane Spass that much money.
But they're usually split across two payloads.
But yeah, let's just say 500 million US dollars is a good swag at a price for this whole escapade,

(45:24):
which is about $960 million adjusted for inflation.
You can see we have a running total in the bottom right hand corner of this slide.
We will be updating that.
And of course, despite all of this, Ariane 5 turned out to be exceptionally reliable,
very kind to its payloads.
It was a huge favorite for launching fragile things like the Jimmy Wibbs base thingy.

(45:50):
117 launches, 96% of which were a complete success.
98% if you count recoverable partial failures, like when it didn't quite reach its desired
orbit but only by a little and they managed to make it up as a success.
It was a very, very successful vehicle.

(46:12):
Yeah, so thank you for that because I'm going to be calling it the Jimmy Wibbs base thingy
from now on.
We do not stan NASA Administrator James Webb in this podcast.
No, no, he's not great.
The telescope's fine.
The telescope's great.
So what did we learn, J?
Yeah, what did we learn?

(46:33):
Test your software in the environment it's going to run in, especially when it's keeping
nearly a billion bucks worth of shit from turning into hot vapor.
Software written nearly a decade ago needs more scrutiny.
Software that was actually written more than a decade ago needs even more scrutiny.
Let's move on to the next slide.

(46:55):
Can we also say don't assume that the software from the previous version will work on the
new version?
Well, I mean, clearly.
Okay, so listeners, we've gone from the gorgeous and sleek Ariane rocket to this ghastly fucking
nightmare.
J, why don't you tell us about this?
It's worse than you could possibly imagine.

(47:15):
It's the Soviet Russian Proton-M.
Hell yeah, I've actually heard of this incident for once.
So the Proton-M is a converted ICBM prototype.
We'll talk more about this, a little bit more about this later.
That was pressed into service, thank God, as a commercial launcher because them using

(47:38):
this thing as an ICBM would have been unholy terrifying.
Yeah, that's just how the USSR did everything though.
Half their early commercial airplanes were converted bombers too because the military
industrial complex had absolute funding priority and basically anything civilian had to pick
up the scraps.
It is a two-stage rocket with liquid boosters, so two and a half stages, and guess what?

(48:03):
It's all hypergolics, baby!
For those of you that don't know, hypergolic fuels are the ones where you just mix the
oxidizer and the fuel together and they ignite on contact with each other.
On paper these are great, although their specific impulse is not super awesome and their energy
content isn't super high, but they're shelf stable for a really long time.

(48:28):
They're liquid at room temperature.
For the most part, they don't break down over time, so you can put them in a missile and
you can put that missile in a silo and you can leave it there for years.
On the other hand, every single one of them is a different kind of fucking nightmare chemical
that can and will kill you in the most agonizing way possible.

(48:53):
People have to wear full pressurized moon man suits to handle these things, but they're
so good at lasting a long time and being reliable that they're still used in satellites and
spacecraft as fuel.
Their danger meant that the West stopped using these things for actual booster rockets decades

(49:14):
ago.
It was just too dangerous to have thousands of tons of this stuff on a launch pad in Florida
or some shit.
If anyone was downwind when this thing blew up, their lungs would be getting dry cleaned.
But fortunately, on the Kazakh steppes, this is not a huge problem.

(49:38):
The Russians just don't really give a shit and they refuse to stop doing something that
works just because it's stupidly lethal and will dissolve your lungs and set fire to your
hair.
They also still have a terrible habit of dropping spent stages full of the remnants of these

(50:00):
toxic chemicals on the Kazakhs, which is in accordance with their proud tradition of being
cruel to Kazakhstan.
I think Kazakhstan should simply seize the Cosmodrome and start its own space program
because that would kick ass.
I mean, steppe lords on the moon, bring it on.
The new Mongol Empire starts here.

(50:21):
The space Mongol Empire.
Anyway.
Can we put horses in space suits?
Never say never.
I'm not asking.
Okay.
So on July 2nd, 2013, a Proton-M, aka a DM-03, was scheduled to take three GLONASS navigation

(50:42):
satellites to orbit.
And GLONASS is the Russian version of GPS, which stands for, well, in Russian, it's Global
Navigation System, basically.
It has some advantages over GPS, usually at higher low latitudes.
Most modern GPS systems are actually designed to take input from GPS and GLONASS at the

(51:06):
same time.
Some of them can even handle the European Galileo system as well.
As the token European on this podcast, I have to say that Galileo is actually pretty sweet.
It has some features that neither GLONASS nor GPS have.
Okay.
Let's move on to the next slide.
This has gone poorly.

(51:27):
It has.
We're looking at a rocket flying the wrong direction and then not being much of a rocket
anymore and then being a fireball.
So you may have heard that the hard part of getting into orbit is not going up, but going
sideways very quickly.
Unfortunately, you do need to go up before you go sideways very quickly, which is where

(51:52):
this vehicle appears to have gone wrong.
You can see that it failed shortly after liftoff.
Within a few seconds of leaving the pad, the booster began to pitch wildly off axis.
The GNC system tried to correct but kept overcorrecting in what may be the first case I've seen of
a fly-by-wire system itself initiating a pilot-induced oscillation.

(52:17):
So when you say GNC system, presumably you mean this has something to do with the fact
that the rocket was gender nonconforming.
Absolutely.
Yes.
It actually stands for guidance, navigation, and control.
But here on CPIT, we are experts in both.
Is this why Russia is so down on trans people?
I mean, I don't know.
There are other reasons.

(52:38):
24 seconds into flight, the rocket is now fully horizontal.
It's the image you can see right at the top there.
Why didn't control fire the FTS to blow up the rocket?
And FTS stands for what?
Flight termination system.
It's a bit of C4 and deck cord that usually just unzips the fuel tanks.

(53:01):
That's simple and brutal.
I like it.
It's because the Russians don't use them.
Yeah, of course, because not turning the Cossack's step into a flaming crater is not worth the
cost.
I mean, this completely checks out.
Very quickly, aerodynamic forces tear the fairing open and pull the payload out.
The engines continue burning because what else are they going to do?

(53:22):
I mean, the engines must burn, comrade.
It's a bad rocket if it doesn't go fast.
Yeah, Pete, I'm sort of picturing Stellan Skarsgard saying, make the rocket go properly
or I'll have you shot.
So it is often said that the pointy end should be up and the flammie end should be down or

(53:43):
you will not go to space today.
And as you can see, the pointy end is no longer attached to the rocket and the flammie end
is very much up.
And so eventually the booster hit the ground and because it's all hypergolics, they mix
together and they explode an absolutely enormous fireball.

(54:05):
Listeners, I encourage you to find the YouTube video of this accident.
It is an enormous explosion.
I have seen it.
It's incredibly spectacular.
I think it's important to point out that even though this was an absolutely enormous
explosion, the enormous brown cloud that followed the explosion was actually dinitrogen tetroxide,

(54:34):
which will kill you if you breathe any of it.
The rocket explodes and then it gets worse.
Yeah, it's great.
But this didn't kill anyone because as you can see, this was fired off in a completely
barren moonscape.
Of course, not even the Russians are sick enough to actually put humans on top of a

(54:55):
proton, although they have suggested it in the past.
Yeah, I mean, as an expert on Russian and Russians, I mean, they're people too at the
end of the day.
You know, we're making fun of them here, but they're not that stupid.
I don't know, I've seen some shit.
Okay, so what went wrong?

(55:19):
They found that the angular momentum sensors had been installed upside down, three of them
at least.
I'm not a rocket scientist, but that sounds bad.
Well, I'm not a rocket scientist either, but I am some kind of engineer and it certainly
isn't ideal.
If you want your spacecraft to know which way is up, you probably don't want the tell

(55:43):
what way is up sensors to be upside down.
And these sensors actually have an arrow on them that is oriented up that you can see
through a window on their cover as part of QA and they are constructed in such a way
as to only fit in the correct direction.
And the pins that they had to fit onto were bent, which indicates that they had been forced

(56:09):
or hammered into place.
And the inspection that was performed, if any, very obviously did not catch this.
And really, I would bet that it wasn't performed because pencil whipping checks and inspections
is absolutely rampant in a lot of Russian industries and it's gotten a bit better over
time, but it's not great.
I mean, I had a whole sub chapter in my master's thesis about this.

(56:32):
And it's basically just caused by the way structural incentives are set up in the Russian
bureaucracy.
And I could go on about that forever, but I won't because this is not about that.
I mean, blindly signing QA reports on an item that is like 97% Bernie Nightmare Juice by

(56:52):
weight seems like a poor idea, but I don't, you know, what do I know?
I'm not a supervisor at the...
Khrunichiv, look, I'm not going to try and pronounce that, Kyra, you can pronounce that
factory.
The Khrunichiv factory?
I wasn't even close.
I don't know if I have the stress right.
I've never encountered the word before, but that's mostly how it's pronounced probably.
Oh, it's not just Bernie Nightmare Juice.

(57:14):
It'll also give you cancer.
And then it'll give you a cancer, cancer.
But that won't matter if you've already been exposed to the Bernie Juice.
You know, it's a little high, a little low.
This cost $155 million, all told, in 2013 bucks.

(57:34):
Let's call it 185 in 2023.
That brings our running total to $1.145 billion, 2023 dollars.
This cock-up was so bad that Putin decided to reorganize the entire Russian space agency
into Roscosmos, and it absolutely worked because the Russian space program hasn't had any catastrophic

(57:59):
failures or QA problems or failures of any kind since.
Go fact check, I saw that.
Yeah, don't.
Of course, Proton is now done.
It's done, baby.
Gone.
Never called me mother.
Because your boy Putin doesn't like the fact that the first stage is made in Ukraine.

(58:25):
So he directed a few years ago, or a decade ago, for Roscosmos to actually build a replacement
for it called Angara.
And it's all Angara, Angara, Angara.
Does Angara work?
Well, that's a question for another episode, but no.

(58:46):
The answer is no.
And they still have a launch roster for this thing, fucking somehow.
And I think they're even still making them.
I don't know.
So what did we learn?
QA your shit.
QA your shit.
Absolutely.
QA your shit.

(59:11):
So do you remember earlier I was saying that Proton is a horrifying thing?
I was looking at it the other day and thinking, you know, Proton is an odd beast.
It uses unsymmetric dimethylhydrazine and dinitrogen tetroxide, which is usually a fuel
and oxidizer combination that's used in ICBMs.

(59:33):
It only has about 270 seconds of specific impulse.
It's not great.
But it's way, way too big to be an ICBM, isn't it?
And then I looked it up and I quote, Proton started its life as a super heavy ICBM.
It was designed to launch a warhead of 100 megatons or larger, a distance of more than

(59:59):
13,000 kilometers.
I wish I hadn't looked it up.
That existing means that there are two fucks in the world as sick as Edward Teller.
Let's move on to the next slide.
This one is less horrifying.

(01:00:21):
This one's less horrifying.
Okay, I'll take this one.
So listeners, our next incident involves the Antares rocket, which we have on the top of
the screen.
The Antares is kind of a Frankenstein rocket and it's a weird byproduct of the Cold War
ending.
So final assembly for this is done in the US on the East Coast.
It has a Ukrainian built first stage and Russian engines.

(01:00:45):
Yes, back when the US and Russia actually tried cooperating with each other, it was
a beautiful moment from my perspective that could have produced all kinds of cool stuff,
but mostly didn't because it ended too quickly.
Just sad about what could have been.
So this rocket, it was sort of built and it was offered for other things, but at the end

(01:01:07):
of its life, all this rocket ever did was launch Cygnus, which is on the bottom of the
screen to the ISS.
It's this ugly trash can.
It's a gonk droid of a space capsule.
All it does is it brings stuff to the station.
It's not even sophisticated enough to be able to dock.
It can just sort of fly next to the station where they have to grab it with the robot

(01:01:29):
arm and attach it.
Once they're done with it, they pack it full of trash, all of their human waste and their
planet, and then they pack it up.
This is then yeeted outside the space station.
It retrofires and burns up in the atmosphere.
I mean, it's an important job.
Someone's got to do it.
You know, there are three other people who could and did and will continue to do it,

(01:01:53):
mostly better than these guys did.
Okay, so this rocket has a liquid first stage, which is normal, but then a solid second stage,
which is fucking bananas, and it's mostly just done to keep orbitals, chemical, solid
chemists employed.
You would normally see this the other way around.

(01:02:14):
A solid rocket, as we've said before, it can't be turned off.
It has no ability to throttle itself, to sort of turn itself up or down.
Steering is a lot more difficult.
Now, this is fine for a first stage where all you care about is getting up and over
as fast as possible.
But a second stage requires extreme precision, especially if you're trying to do something
like dock to the ISS.

(01:02:35):
So they have to come up with all these kind of like weird tricks to make it act like a
liquid engine.
It's able to burn really weird off axis and burn at these weird angles.
And I believe it may even have blowout panels to end the burn early if it has to.
Ari, I'm detecting Morton Thiokol.
Is orbital 80k actually Morton Thiokol?

(01:02:57):
Why yes it is, J.
All became thiokol chemical corporation, then Morton Thiokol incorporated, then cordon
technologies incorporated, then thiokol propulsion, Alcoa industrial components group, part of
Alliant Technosystems, ATK, then ATK thiokol, ATK launch systems group, and finally orbital
80k before becoming part of the Northrop Grumman Innovation Systems, and finally Northrop Grumman.

(01:03:21):
The DC based military industrial complex is an absolute nightmare.
So this rocket uses the AJ-26.
So this engine had the best thrust to weight ratio of any rocket on the planet until the
SpaceX Merlin engine.
It's a direct descendant of the rocket that was used on the N1, which was a Soviet moon

(01:03:41):
rocket.
It's designed and built in Russia as the NK-33.
Then it goes to Aerojet, which is now part of L3Harris.
Again, the mergers and acquisitions culture right now is insane.
So it gets refurbished and then it goes to a warehouse before it's mounted to one of
these.
Aerojet was originally Jack Parsons company and we always stan Jack Parsons.

(01:04:06):
We do always stan Jack Parsons, yes.
He wanted to know could you get to the moon with drugs and occult sex and we deserve, we
owe it to him to find out if that's true.
But you're not going to do that with Antares.
No, no you're not.
So this engine that it was fixed with has an insane ISP and it can put a shitload of

(01:04:26):
energy into an orbital stage.
So think of ISP as being like MPG.
It measures how much energy an engine can get out of a fixed amount of fuel.
So imagine if everyone around the world was making a small SUV that got like 31 miles
per gallon and then the Russians announced that they had made one using just regular
engine components that got 53 miles per gallon.

(01:04:46):
That was what happened.
This engine was so good American scientists did not believe this engine existed in the
way that the intelligence community was describing.
So the Soviets were generations ahead of us in material science during the Cold War.
So when they debuted what's known as an oxygen rich stage combustion engine we had no way
of replicating this for decades.

(01:05:09):
As an aside it's always been really fascinating to me the way the US and USSR prioritized
different areas and arrived at completely different ways of doing things.
Like there were other areas where the USSR was decades behind the US and then there were
areas where they were decades ahead.
It's just really cool.
Yeah the US went straight for high energy propellants like hydrogen and oxygen.

(01:05:30):
The Soviets just made really efficient kerosene engines.
Really impressive.
Yeah so what was special about this engine listeners and we're not going to get super
into it but what you know is this engine runs what's called an oxygen rich engine cycle
and that means it uses a fuel that has too much oxygen to run the turbo pump and the

(01:05:52):
turbo pump is just designed to force in as much liquid oxygen into the engine as fast
as you can.
So you're talking about oxygen at a hundred atmospheres of pressure at a thousand Kelvin
and that is unerase everything laser beam.
But the Soviets had somehow figured it out.
You know in fabrication circles we call that a cutting torch or a gas axe and if you want

(01:06:14):
to actually watch some really fun YouTube videos search for gas axe and just watch people
cutting through inch thick pieces of steel like they're not even there.
That's what this pre-burner exhaust would do to ordinary steel.
Yeah so we never really figured out how to replicate this specific alloy.

(01:06:40):
So when the Russians invaded sovereign Ukraine the rocket died and we never successfully
figured out how to replicate this exact engine.
So they're going to be launching this trash can on the SpaceX Falcon 9 for the immediate
future until the new rocket powered by Firefly engines can make it.

(01:07:04):
That makes me sad.
I mean it sounds like this engine is really cool and of course Putin had to go and mess
it up.
It's not quite true that we never figured out how to reverse engineer one.
Blue Origins BE-4 is also an oxygen rich stage combustion engine or at least it will be when
it flies.
So I guess it's almost not quite true.

(01:07:25):
Almost.
Next slide.
October 28 2014 on the fifth launch it was flying upwards.
It was very normal flight nominal trajectory and six seconds after launch something goes
wrong in the liquid oxygen turbo pump.
And this is the device that we said is powered by a pre-burner.
It hurls as much liquid oxygen as possible in the combustion chamber and this is on the

(01:07:48):
order of hundreds of pounds of cryogenic liquid per second.
Something went wrong inside this impeller.
It started to rub against the walls.
We have no idea what caused it to go off kilter because all of the evidence was atomized and
spread over the Virginia Beach.
These include a bad bearing, an imperceptible disc in the blisk itself because these are

(01:08:09):
obviously forged as one usually grown from a single crystal or a tiny piece of debris
even cavitation bubbles.
So the LOX turbo pump explodes.
This causes the shock waves that burst all the surrounding propellant lines and then
starts a fire with all the fuel that's sort of spewing everywhere.
Now the GNC computer panics and it shuts down the other engine.

(01:08:29):
So very quickly the rocket loses all its upward velocity.
It slows to zero and then it falls backwards.
Now the rocket had already started its pitch over so it spread itself on sort of most of
the beach and it missed launch pad mostly.
As you can see there the launch tower itself had to be basically completely rebuilt but

(01:08:50):
the launch pad infrastructure itself survived pretty much intact.
For this NASA paid $338 million per flight.
They did not get a refund and that is $459 million in 2023 dollars so we have our running
total of $1.604 billion US dollars.

(01:09:11):
It's kind of messing with my brain.
We have to convert to $23 for something that happened in 2014 because that was like two
weeks ago.
Yeah, yeah pretty much.
Yeah.
What did we learn?
As far as I can tell really nothing of value.
Yeah, so don't make rockets with Russian engines I guess.

(01:09:34):
After this they went to a new different engine design that was also built in Russia.
Well I'd say do make rockets with Russian engines.
I mean this all sounds cool to me and I'm like if Russia was playing nice on the international

(01:09:54):
stage I would love for more stuff like this.
I mean just as someone who has lots of connections to the country but it's just no longer possible.
Well they decided to go to the RD-193 didn't they?
Of course they can't get those either now so it's not going well for them really.

(01:10:16):
ULA was also using the RD-180 for the Atlas V which is just an incredible phenomenal engine.
It's basically the four chambered version of this rocket and yeah again that rocket
was also discontinued because those stages can't be built anymore.
And actually a lot of these vehicles are being replaced by ones that use the BE-4.

(01:10:36):
Vulcan is ULA's new workhorse and that uses the Blue Origin BE-4 which again is this oxygen
rich stage combustion architecture or at least it will be when it flies.
So next slide.
Okay so let's talk about Falcon 9 which is the rocket you see on the right.

(01:10:58):
Before we get started we should make something clear.
We are not an anti-SpaceX podcast.
We are an anti-Muskrat podcast.
But they're so cute and fluffy.
Oh not that kind of Muskrat.
Sorry.
Yeah sorry not that one.
The world would be a better place without him in it.
We'd like it if he left it as soon as possible.
We'd like to expand human consciousness to Mars.
I think that's a great idea.
We start with his consciousness in particular.

(01:11:20):
Goes to Mars, sets up his tiny home, RV on Mars.
We'll get supplies to him at some point.
Eventually.
RV in this case stands for re-entry vehicle I guess.
We send him to Mars and then we start charging him for oxygen.
We charge what the market will bear.
That's capitalism baby.

(01:11:43):
In this house we stand the true leaders and creators of SpaceX.
Tom Mueller the greatest engine designer in half a century and Gwen Chutwell the rocket
company prodigy.
We also recognize that Falcon 9 and its descendants of various are the greatest rocket ever made.
So hopefully that will keep the Blue Check Brigade happy.
Did you know that Tom Mueller has left SpaceX though?
Yeah it is weird that they're having engine problems.

(01:12:05):
Engine development problems.
It really is.
So let's talk about some dumb shit they did.
So both of these stories are going to be about what's called a COPV.
Which we have on the left of the screen.
There are three of them suspended inside a liquid oxygen tank that we're looking at.
It stands for composite overwrapped pressure vessel.
So imagine you take like a scuba tank and you wrap it very very tightly in an epoxy

(01:12:31):
soaked blanket.
And then you cure that blanket into a solid cylinder around the tank.
So remember that a composite matrices as OceanGate founder Dr. Rush found out they're great in
tension they're terrible in compression.
So a composite overwrap is ideal because you can make the inside wall a lot thinner and
then you lean on the composite to hold it in place and the composite also acts as a

(01:12:53):
great insulator if there's a temperature differential.
So the pressure in the tank pushes out and it puts the composite into tension where it's
happiest.
So these COPV tanks that you see on the left are filled with liquid helium and they're
used as what's called a header tank to repress.
So to basically backfill the liquid oxygen tank with inner gas.

(01:13:16):
Right, because you need to keep the tank pressurized or we will be making a different Stockton
Rush analogy.
Exactly.
And if the pressure in your tank gets too low, so if you're not able to successfully
repress the tank, you can pull air or vacuum into the fuel lines and when this hits the
turbo pump it will cavitate and then all the inside bits of your engine will become outside

(01:13:39):
bits rapidly.
Please see previous boom.
A turbo pump turns at about eight times the speed of the high speed spool of a jet engine
or a turbo fan engine.
So its bits are seriously on the move.
Yeah, they spin at 90,000 rpm.
So like it's the speed of a denture drill, but like it's about the size of a dinner

(01:14:00):
platter.
So these are 200 plus bar aluminum tanks.
They're over wrapped with carbon fiber and you can see they put them inside the lock
tank.
It helps keep them cold.
Now, normally this is fine.
But SpaceX was trying to pioneer reuse and that demands every single percentage of performance.
And it necessitated the use of what they've called super chilled propellants.

(01:14:25):
So you basically, you chill these liquids as cold as you can go before they effectively
solidify and then you shove as much as you can into the tanks.
Because they're denser and colder, you can put more in.
The RP-1, the kerosene fuel is turned into kind of a sludge and again the locks turns
into sort of almost like a slurpee style.

(01:14:47):
Mm, tasty.
Yeah.
RP-1, obviously the rocket propellant, it's extremely, extremely pure jet fuel.
Yeah, it's a narrow cut distillate, which is designed not to turn into tar quite so easily
when it's used as regenerative coolant for the rocket engine and nozzle.
Because there are passageways in the rocket engine's combustion chamber and nozzle and

(01:15:08):
throat that the fuel gets pumped through before it gets pushed into the injectors and burned,
which stops the engine melting usually.
But obviously it's bad if your fuel has a tendency to turn into tar and coke up and
polymerize, especially if you want to use the engine more than once.
And especially since the fuel is going to sit in those passageways and cook off after

(01:15:34):
the engine is turned off.
Because after the engine is turned off, obviously the fuel isn't passing through those passageways
anymore.
So all of the heat that's in that engine is going to cook the fuel that's in those passageways
into goo if it's chemically able to do so.
So they have this special fuel that doesn't do this or hopefully doesn't do this.

(01:15:57):
The U-2 spy plane uses a very similar special fuel for very similar reasons because it's
so efficient in flight that the fuel doesn't pass through the engine quickly enough to
avoid regular fuel turning into tarry goo and killing the engine.
Yeah.
So we're loading these propellants.

(01:16:19):
And to prevent boil off, you have to pump these in both very, very quickly under pressure
right before the launch.
Right.
Because the liquid oxygen will boil off if you just leave it there, right?
Yeah.
Any warming at all will cause both the propellants to start to boil and then raise the pressure
and then you have to vent.
So what this means is that SpaceX has launch windows that are usually measured in minutes.

(01:16:42):
The smallest hold is what's called a recycle, which means the entire rocket has to be drained
and purged with gaseous nitrogen and then they usually try again either later that day
or the next day.
So this takes, like I said, this takes hours.
So if you do this correctly, this can net you something like five to 7% of extra chemical

(01:17:02):
energy you can put into a payload, which is a really, really huge deal.
And I know it doesn't sound like much, but most rocket engineers would be willing to
sell you their own parents for a single percentage point performance gain.
Next slide.
I mean, Elon Musk is prepared to sell you his parents anyway.
I mean, that's just how they roll in the Musk family.
Yeah.

(01:17:22):
So the date is September 1st, 2016.
SpaceX is doing a wet dress rehearsal.
They are practicing loading the rocket for launch.
It was carrying Amos 6, which was being released to Facebook to broadcast conspiracy theories
and minion memes to Eastern Europe and Southern Africa.
Yeah.
All in the service of the American culture victory.
You've just been made possible by minions, obviously.

(01:17:44):
Yeah, this is why we won the Cold War.
So they're loading this with super chilled oxygen and kerosene.
In the upper stage, some of this liquid oxygen under pressure managed to worm its way between
layers of the composite.
And once it touched the metal helium tank, it instantly froze solid.
So this buckled the carbon fiber, which allowed an even more oxygen, which also froze, and

(01:18:07):
it caused a runaway until the friction between the layers was enough to ignite it.
Most things burn really well when they're literally immersed in liquid oxygen, it turns
out.
So I may have missed something.
Liquid oxygen is very cold already.
So why does it freeze when it touches something?
It has to be something even colder than it, right?
Yeah.

(01:18:28):
So what it was touching was the exterior of the tank for the liquid helium.
Oh, fuck.
So liquid helium is the coldest stuff in the universe.
It's colder than interstellar space.
The boiling point of liquid helium is 4 Kelvin.
Carbon boils at 80 Kelvin.
Okay.
And so as more of this oxygen was freezing in between the carbon fiber layers of the

(01:18:50):
helium tank, so this was causing friction between layers somehow, and that set the carbon
fiber on fire.
Yes.
So if you remember our fire tetrahedron, you have the oxidizer in the form of liquid oxygen,
you have the fuel in the form of the actual carbon fiber overwrap and the epoxy resin,
and then you're now creating the energy with the friction between the layers.

(01:19:11):
And the carbon fiber is carbon, right?
It's basically it's coal, right?
So it burns really well when it's immersed in liquid oxygen.
You just kind of have to get it going.
The epoxy resin also likes to burn once it gets ignited.
And the alloy pressure, the alloy tank is not strong enough to hold this helium pressure
in.
So when the composite loses strength, it gets ripped apart, and that's heat in motion.

(01:19:33):
And then boom, boom goes the Facebook.
So believe it or not, you can see on the screen left to right are sort of the events as they
happened.
On the left, you see that this is the upper stage detonating.
And it doesn't, it's not an explosion.
Technically what it is is the tanks just burst and then all of that fuel ignited.

(01:19:58):
So eventually the rocket loses enough structural rigidity, the lower tanks are ruptured, you
have an even bigger explosion.
Everything burns.
The payload slides off the top.
And you can see this on the right, flying down in a very comical and amusing fashion.
It goes pointy and down upon hitting the earth, it detonates the hyper-agolic fuel inside

(01:20:21):
the satellite best propellant.
Because urgolls can be hyper, can't they?
Exactly.
Now, because the rocket was in trep, not in flights, you guessed it, insurance did not
apply.
Well, that was expensive.
So it was $260 million for the payload, plus another $30 million for the rocket.

(01:20:45):
What did we learn?
Load your fuel in a different way.
Seriously, that's it.
I know it doesn't sound like it would matter much, but what valves you open and how fast
you open them is the difference between you delivering your customer's satellite to an
orbit or your customer's satellite being small pieces of tinsel floating in the Atlantic
Ocean.
And Falcon has had a flawless record ever since this incident.

(01:21:08):
Next slide.
Okay, so on the topic of the Falcon 9, what we have on the screen now is the defunct Cargo
Dragon Mark 1.
This is more or less the reason that they were able to build the Falcon 9 in the first
place.
It was the impetus and the backbone of the Falcon 9 program.
Much like Cygnus, this is designed to bring cargo and consumables to the station, but

(01:21:29):
unlike Cygnus, this has parachutes and a heat shield.
So the Cargo Dragon capsule can actually bring samples and test subjects back to Earth in
a comfortable pressurized cabin.
I still don't like it as much as ESA's ATV.
That thing is badass.
It's so huge.
Yeah, I believe it was like four times the internal volume.

(01:21:50):
All right, next slide.
June 28th, 2015.
Commercial Resupply Service Mission 7, aka CRS-7.
So on screen, you can see a rocket currently in the process of bursting.
About 135 seconds in the flight, a strut that was holding one of these COPDs failed catastrophically

(01:22:11):
and it dropped the now runaway bottle into the LOX tank.
It basically ripped the regulator off of it.
And imagine if you will, those GIFs or videos we've seen where the neck of a scuba tank
breaks and it starts to fly across the room everywhere.
That's basically what was happening with this helium tank inside the liquid oxygen.
So I had to go remind myself that stands for Composite Overwrapped Pressure Bessel and

(01:22:35):
it was the helium tank, Composite Overwrapped Pressure Bessel that failed?
Yes, yeah.
The helium tank fell into the liquid oxygen tank.
Because it broke off its mountings?
Yes.
And do we know why that happened?
Oh yes we do.
That's really stupid.

(01:22:56):
So eventually the helium tank dropped into the oxygen tank.
It emptied enough of its contents into the liquid oxygen tank that the LOX tank burst.
The Dragon capsule was ejected from the exploding launch vehicle.
It continued transmitting data all the way up until the point which impacted the ocean.
The best part is that it was disclosed later that the capsule survived the explosion perfectly

(01:23:21):
intact.
It could have survived this accident even without an abort motor.
It just didn't deploy the parachutes.
This was not a failure mode ever intended.
There was no mechanism in the software to deploy a chute.
I guess a barometric failsafe was just considered unnecessary.

(01:23:41):
Now there isn't as much to say on this one as Amos because while it's a spectacular,
it was somehow dumber and less sort of metal album.
So let's talk about why you should not make your rocket out of parts you can order online
with a credit card.
Next slide.
So what happened?
So the single point of failure was found to be a stainless steel eye bolt.

(01:24:03):
That's what I have up here in sort of the top of the screen.
You see sort of your standard 701 stainless steel eye bolt, maybe sort of 8 or 10 centimeters
long.
This is just a notional and indicative it's not the specific one that failed.
It was rated to 10,000 pounds, but it was determined that it failed at 2000 pounds.

(01:24:23):
Now why did it fail?
Because instead of using an aerospace grade material, they bought it from the McMaster
Bucking Car catalog.
Now for those of you that have a job that requires making anything out of anything else,
you are very familiar with the yellow catalog on the left.
Well, maybe you only get the phone book if you are special and hand selected by McMaster

(01:24:44):
Car.
Otherwise you are a filthy peasant to them and you can use the website like the rest
of the trash.
So McMaster Car is a huge industrial supplier.
They sell everything you would need to like build a factory.
You know, I know McMaster Car.
I work in a business where we have factories, we make things and of course we know McMaster

(01:25:08):
Car.
And McMaster Car, it's sometimes called McFaster Car because they will deliver things to you
very quickly.
We're also well known for being very expensive for what you get, but this particular eyeball
was really expensive.
How expensive?
We will get to that.

(01:25:30):
So stuff that lives in a cryogenic environment, it needs to be designed to live in a cryogenic
environment.
And this eyeball was way, way, way below what's called its nil ductility transition temperature.
Now we obviously know this.
For a chair warmer at SpaceX got designing that restraint, apparently did not.
All metal has what's called ductility, which is what it takes to bend it plastically in

(01:25:54):
a way that takes stress.
And this is very known, it's accounted for.
There is a temperature at which it stops being ductile and starts being brittle.
So it will shatter.
If you've ever seen those images where like a basketball is dipped in liquid nitrogen
and it turns into like a solid rock and then you could just hit it with a hammer and it
shatters into a million pieces.
So that's 77 Kelvin.
And liquid oxygen is 90 Kelvin.

(01:26:15):
So it's for all intents and purposes, when you're talking about temperature differentials
for something that's designed to be used at like room temperature, it's effectively the
same.
Now the chart.
This was densified propellants, so it would have been colder than that.
Yeah, that's right.
So we have down here in the corner of the screen, what's called a, it's a chart in the

(01:26:37):
lower right that shows what this kind of looks like when you have a crossover point where
the temperature becomes so cold that the metal is now brittle and will shatter.
Now what did we learn?
Stuff that lives in cryogenic fluids needs to be designed to live in cryogenic fluids.
Now this eyeball was way below this nil ductility transition temperature.
Like we said, this is sort of crossover point and arguably we already knew this.

(01:27:00):
It was just that whatever cheer warmer at SpaceX got stuck with designing that restraint,
apparently did not think of this.
So Ariane 501 and Sarek 25 are taught basically day one in software engineering school to
teach you that shit you fuck up may very well kill people or bankrupt your company.

(01:27:22):
Like civil engineers and the Hyatt Regency or Aero engineers and the de Havilland Comet.
I imagine that they tell this story day one in mechanical engineering classes.
Okay.
So having said all that, you are right, this is really stupid.
I mean like you don't have to be a genius.
The load specifications on a hardware store bold probably don't apply when the temperature

(01:27:45):
outside is 90 Kelvin.
Oh, the weather outside is frozen.
I mean, I don't know, something, something frozen cloud planet with Matt Damon on it
is interstellar.
Matthew McConaughey saying this little maneuver is going to cost us $186 million.
Total cost of McMaster car, stainless 300 series eyeball $15.91.

(01:28:10):
You're right.
That was really expensive.
You could buy like, I don't know, 0.5 of an Xbox for that.
SpaceX not not apparently using else's powers for testing, which is a real lost opportunity.
It's raining air.
Hallelujah.
So the contract price was $152 million in 2019 sets 186 million per mission in 2023.

(01:28:37):
Our running total is $2,080,000,000.
This blurb from the mission reports, mission duration planned one month, actual two minutes,
19 seconds.
That's within five orders of magnitude.
And really, I call that good enough.
As an American taxpayer that paid for this mission, I disagree since I am not allowed

(01:28:58):
to good enough my tax bill to within five orders of magnitude.
All right, the way jokes work is you say something obviously ridiculous.
There is a high bar for ridiculous on a slide where we are discussing dropping the production
budget for an Avengers movie into the Atlantic because of the same bolt I use in my herb
garden to drop the vine chamber climber strings from.

(01:29:20):
Nothing could be more ridiculous than that.
I mean, honestly, this is more about Avengers movies than anything else.
You know, actually, I think maybe our next thing is more ridiculous.
Yeah, next slide.
All right, J, what are we looking at?
Okay, our last story is about Explorer S1 on a Juno 2 rocket.

(01:29:40):
Like Ariane 5-501, it's a story about why testing your avionics before flying a rocket
is important.
Also, I would just like to point out that Juno 2 was the most cursed piece of rocket
engineering in at least 50 years.
Until Delta 3.
Until Delta 3, yes.

(01:30:01):
It was adapted from a Jupiter ICBM.
It had one RP-1 and liquid oxygen stage and three solid stages, one of which had 11 solid
rocket motors in it, all of which were garbage.
Given how unreliable Juno was, it's deeply concerning how reliable that the ICBMs that

(01:30:22):
they were based on would have been, although arguably failing to launch an ICBM is a good
thing because, you know, an ICBM that fails to fly is less likely to kill people than
one that goes on without a hitch, you know?
So in the photo that you can see on this slide, it is July 16th, 1959.

(01:30:45):
That's why it's in black and white.
I hadn't invented color yet.
In short, the inverter that ran the inertial reference platform had two shorted diodes
and therefore literally all of the avionics died as soon as the plug came out, which happened
at an altitude of four feet when the cable went tight.
No, really, this is how it worked back then.
Okay, so can you explain this to normal people?

(01:31:06):
How is any of this connected?
What's a shorted diode?
Why does it kill the avionics and what does a cable have to do with this?
Okay, so back in those days, rockets were kind of crap.
I mean, I just spent five minutes saying that, but they were really kind of jank.
There was a cable that was plugged into the side of the rocket that was giving power to

(01:31:30):
it while it was on the pad.
This is because batteries sucked back then.
They hadn't yet invented lithium batteries, and while lithium batteries, as we've seen,
can have their ups and downs, they do mean that you can do things like run a whole ass

(01:31:50):
rocket on the pad for an hour or two without having to worry about it.
But back then, you really couldn't.
They had a cable that plugged into the side of the rocket that gave it power while it
was sitting on the pad.
When the rocket lifted off by about four feet, the cable went tight and was pulled out of

(01:32:12):
the side of the rocket.
This was supposed to happen.
This was how it was designed.
Yes, that is complete jank.
The rocket did have batteries on board, but the avionics, including the inertial reference
system, needed 115 volts AC at 400 hertz like all aircraft stuff does.

(01:32:36):
There was an inverter that was supposed to take the battery power and run the avionics
off of it.
Except the inverter didn't work.
Two diodes were shorted together, so as soon as the plug came out, as soon as the rocket
was disconnected from ground power, its guidance system just completely stopped working.

(01:33:00):
It had no onboard source of power to run any of its guidance electronics, the gyro or anything.
The nozzle gimbled hard over.
For some reason, thrust vector control systems always seem to do this.
I don't know why.
I believe it's because they revert to sort of a maximum value when the system fails.

(01:33:21):
Yeah, well, it didn't do this rocket any good, and it started going sideways rather than
up, which is kind of bad when you're only 20 feet above the ground.
All of the propellant valves slammed closed a few seconds later, and then the range safety
officer presses the big red button five and a half seconds after liftoff.

(01:33:43):
The Russians are calling us fucking cowards.
They say, lick a stamp and send that shit.
Your rocket doesn't work.
You have to own it all the way to the ground.
Well, they did indeed own it all the way to the ground.
The rocket goes very boom, impacts actually 249 feet from the pad.
I wrote 250 here, but apparently NASA wanted to be accurate.

(01:34:06):
The payload, which was all of 40 kilograms, pops off the top and lands not far away.
So, I did some math listeners, and this rocket, inflation adjusted, costs about the same as
a modern day rocket lab electron.
This has less than a tenth of the payload, and there's four times the sort of wet weight

(01:34:27):
launch mass, which is sort of a neat comparison for progress, and also the fact that this
thing sucked so hard.
That's incredible.
They built a whole rocket with only four times the mass of an electron.
I'm talking about mass budgeting on an atomic level.
I mean, that's just how Peter Bick rolls.
I'm telling you.

(01:34:47):
It's the hair.
Anyway, the best part is that after the explosion, the Explorer satellite was sitting on the
concrete next to the launch pad, fully intact and still transmitting its radio signal, because
as far as it knew, it had just come off the top of the rocket and was in space and ready
to do its thing.

(01:35:08):
They don't make them like they used to.
I'm in space.
Okay.
Okay.
So, the space probe, this thing was supposed to deliver to orbit, in which it instead delivered
to the concrete 249 feet from the pad, transmitted a very clear signal.
Okay.
So, I'm writing, making progress towards project goal on the status report then.

(01:35:28):
Yeah.
Although, it was a bit dinged up, so they couldn't just reuse it on the next attempt
a few months later, because they are cowards.
So, instead, it got retired in the National Aerospace Museum.
I've actually seen this in DC.
Yeah.
It's in the main annex of the National Aerospace Museum on the Mall.
And its antennas are bent.
So, Juno 2 had a less than 50% success rate, and we should all be glad they gave up on

(01:35:53):
the stupid thing.
This whole escapade probably cost about $115,723,000, which gives us a running total of $2,195,715,000.
That's a lot of dollars.

(01:36:15):
It really is.
Let's go on to the next slide.
Now, what did we learn from this?
We have gotten better at space or nautistry.
That is the correct term.
Simultaneously, we've also gotten more ambitious.
Sometimes one factor wins, sometimes the other does.
Yeah.

(01:36:35):
Now, rockets are an extremely difficult thing to do.
It's maybe the most difficult thing we do, and it's doubtlessly the most unforgiving
thing we do.
Margins are infinitesimally small.
The penalties for mistakes are instant and catastrophic.
That said, we have gotten better.
For instance, since the two incidents with Falcon 9, it's since become the most dependable
and reliable launcher ever made.

(01:36:56):
Right now it has a string of more consecutive landings than other rockets have of successful
launches.
Antares went on to have a spotless record, so did Ariane.
The other rockets have been abandoned, because rightly so, they are shit.
Fundamentally, the reason space is hard is that the amount of energy required to put

(01:37:16):
a kilogram of mass into orbit is similar to the amount of energy stored in that kilogram
of mass's chemical bonds, the bonds which hold that material together.
Getting that much energy into something without accidentally taking it apart is difficult
as a consequence.
These are just six of the spooky, ooo-key accidents that have happened over the last

(01:37:40):
70 years.
There are many, many more.
These ones alone ended up consuming just shy of $2.2 billion, and every single one of them
could have been avoided.
Yeah, so the reason this episode is our spooky Halloween episode is because we're adults,
and there's nothing spookier than incinerating $2.2 billion out of taxpayers' pockets.

(01:38:02):
So I say try dressing up as that, I dare you.
I also thought it was entertaining that we did a sort of reversal of the Halloween horror
tradition.
And actually, nobody dies in any of these incidents.
Actually, no one is even hurt in any of them, as far as I'm aware.
Although I suspect that in some cases, some people needed a change of underwear.

(01:38:25):
Quite possibly.
All right, next slide.
Thank you, everybody, for joining us.
Our next episode will be on Malaysia Air 370.
As it always, always will be.