The Flight of Tube Rocket "Stig"

On May 14 the Armadillo team was at Spaceport America for a second attempt at launching the Tube Rocket Stig.

The first attempt had failed, after an electrical fault developed on the ride out. A floating ground had developed that resulted in the thrust termination system being triggered every time the spark was fired. Spark units are perhaps the biggest challenge of spark torch igniters, they tend to introduce noise everywhere in the system which can cause undesired operation.

The rocket was loaded and ready to fire, would fire the igniter and start opening the throttle valves, only to find that the thrust termination valves immediately upstream of the throttles were closed. We didn't immediately find the fault, and didn't have another chance to try on that trip.

Our impression before we arrived at the spaceport was that if we didn't succeed on Saturday, we'd be able to push the launch into Sunday or later in the week. We scrubbed somewhat prematurely on Saturday, then found out as days went by that we wouldn't be allowed to fly again. White Sands Missile Range, which has sway over the airspace, decided that because it was theoretically possible for the rocket to fly over the mountains and land in their area, they needed to close down the area, and be paid to do it. A conservative but understandable decision on their part, but exacerbated by the fact that the coordination between the three parties has a lot of latency.

On Sunday we went to visit White Sands Missile Range, and spent a good amount of time exploring their rocket garden. Having just spent a bit of time designing and building a launch stand for a large rocket, I took a lot of photos of how they did it. For the most part, people stuck with rails.

After WSMR we went on to the white sands themselves, in the middle of a dust storm. Not the best time for the camera, or the sinuses, but it certainly gave the area a distinctive look.

We finally gave up on getting another window on Tuesday. We packed up the site, sealed Stig in its shipping crate/recovery trailer and left it and the crane truck on site near the runway complex. We came back to home base to start work on the mod and engine tests on the sled.

On the return pad ops went nearly flawlessly, other than a small LOX leak through the TTS valve that caused a short delay. The rocket launched flawlessly, coming off the stand perfectly straight and accelerating away from the launch pad. The thrust of the engine destroyed the graphite blast deflector, whose support had been damaged during one of the mis-fires during the first attempt.

Accelerating upward, the rocket began to fight roll issues. Stig's roll was controlled by an aerodynamic vane near the top of the rocket, in the pressurization system. Being close to the top meant it had a negative influence on aerodynamic stability, offsetting a similar area of fin at the bottom. Offset from the CG and without a symmetric one on the other side, corrections in roll also created a force in yaw. We'd slowed down the response rate of the vane, with the idea that it would be less twitchy, but this resulted in it responding to roll events with significant delay.

In addition, the high length to diameter aspect of the rocket meant it was particularly prone to inertial coupling, meaning that a rapid roll rate can cause a rapid yaw. Since the rocket was not meant to spin, not much attention was paid to keeping the CG on the body axis, which also makes rolls more than just a rotation around the tube axis. The roll vane drive was also inactive when the vane wasn't being driven somewhere, making it possible for aerodynamic forces to drive it over. As the computer was working to null roll rates, it was possible for the vane to go full over with the computer only responding proportionally when that position started to create a significant roll, which was too late.

All of that combined, the rocket did a fast roll, which created a fast yaw, which put the rocket on a course that exceeded the ground speed hard abort limit coded into the flight computer.

The maximum altitude packet received by the base station was 4202m above ground level, 13790ft, capturing a few nice images of the surrounding area and the spaceport's runway. Maximum velocity was 210.5m/s, or 471mph.

The computer then went into the normal recovery sequence. The nose cone was blown off with ullage gas from the fuel tank, which in freefall with significant propellant remaining really meant a mix of fuel and helium. The drogue ballute deployed normally, flipping the rocket into a tail-down position, with the nose cone rebounding harmlessly off the ballute.

During nose cone closeout, the nut meant to hold one of the eight bolts holding the honeycomb bulkhead fell out of its position. The seven bolts were sufficient, but it left a hole into the empty volume of the nose cone, which was designed to be sealed from the parachute bay it capped. The hole was not plugged.

The pressurization of the bay to blow off the cone also pressurized the nose cone, and when the nose left the rocket its internal pressure blew off the bulkhead. The shock of nose deploy was also sufficient to dislodge the nose tracking transmitter, which rattled out of the nose shortly thereafter and fell from approximately 10kft.

The parachute system was designed such that the drogue attachment also held closed the main parachute bag, with a solenoid triggered, spring powered pin puller releasing the drogue and retainer system. As the drogue ballute was buffeted around, it wiggled the pin sufficiently to release itself and the main before the computer triggered main deploy. The nose and drogue floated down independently, as designed.

With the rocket descending at 69m/s (155mph) the parachute was drawn out of the rocket by a small pilot chute, exactly as designed. As it began to inflate, the sudden increasing deceleration it provided vs. the far overweight rocket (due to significant remaining propellant) resulted in a failure of the parachute retainment system.

The parachute system had been designed with a single 5000 lb "three ring" release, such that the computer could theoretically trigger main release after the rocket was on the ground, to prevent Stig from getting dragged across the desert by surface winds in the inflated chute.

However it was decided well before the launch to not use this system, in fear that it would be triggered unintentionally, or worse be triggered on the ground without noticing. It should have then been removed from the system, but the parachute system had generally been one of the more challenging systems to design and test, and one of the last to be complete, as complex parachute system design and rigging was a relatively new skillset for the Armadillo team.

Instead it was secured, such that the release could not be actuated. The rocket was approximately 1000lb at MECO, compared to an intended parachute deployment at the dry weight of under 500lb, reducing all margins by half. The third and smallest ring was ripped off the three ring assembly, which released the parachute from the rocket. The parachute fell collapsed to the desert below.

The welded bulkhead that formed the parachute bay floor, and retained the parachute system, was also beginning to be ripped out of the parachute bay tube. Had the three ring not failed, it is possible that the bulkead would have instead. The nose/drogue retainer system had been designed with a shock reduction portion to reduce the instantaneous force of the cannon-fired nose reaching the end of its leash, but nothing had been designed into the main parachute system itself to reduce the shock on the rocket of opening the main.

The rocket fell mostly flat, with asymmetry creating a roll of increasing rate as it fell. It impacted the desert floor, tearing the propellant tanks at the bulkhead welds and dispersing the remaining propellant. The fuel was ignited, possibly from a spark of the electrical system or just from kinetic energy of tearing metal, and a small area of shrubbery was torched.

Models the FAA uses during waiver applications currently assume debris will be generated in a crash from mixing of fuel and oxidizer followed by a high explosive detonation, models provided by a couple of DoD reports. However, rockets like ours don't do that, there's just the energy of a pressurized tank and a localized fire. Hopefully one upside of this crash will be continued improvement of everyone's mishap modeling.

Though it was not burned, the computer box was sufficiently crushed to prevent recovery of onboard high speed data. All of the expensive tank bulkheads were so deformed as to not be useful again. Few components will be reusable.

The nose and drogue were recovered shortly after, as was the nose transmitter. The parachute was not recovered because we didn't search far enough out, another search on the next trip out found it on the bearing given from tracking video. It was in the sun for almost a month, but may still be reusable.

General lessons:

• Parachute hardware is frighteningly rated at a ~1x FOS, compared to 3-10x FOS for the industrial hardware Armadillo typically uses. Another 5000lb three ring broke at a static weight of 4800lb.
• The parachute load path needs to be more carefully analyzed.
• The parachute opening shock needs to be reduced, either with a slower opening parachute or shock absorption in the rigging.
• More time needs to be put into the GNC system for flights that engage in entirely new flight environments, including:
• Things that can't be tested before freeflight, like roll response, need to be more carefully analyzed and simulated.
• Aerodynamic stability analysis needs to be more thorough or more conservative. The influence of hardware sticking into the airstream, like propellant lines and mounts, camera mounts, &c, could not be analyzed well in off the shelf software.
• Preflight, post-transport shakedown tests need to be more thorough and more closely analyzed, ideally simulating a full flight with hardware in the loop. Had we found the TTS issue before the first flight attempt day we would have been able to launch, saving the time and expense of a second trip to New Mexico.
• Creating a system to ensure access to high rate data even in worse case crashes is import. This could be transmitting high rate data to the ground in real time, hardening the data recorder into a "black box", or something else.
• Having an agreement in place beforehand for how delayed flight ops will occur will also remove the need for later trips and long delays.

The Flight of the SuperMod "Dalek"

Armadillo returned to Spaceport America with the SuperMod rocket Dalek to attempt a set of flights for the Nasa Commercial Reusable Suborbital Research program, with the first on Saturday, June 11.

The recovery system on this rocket was a novel one for Armadillo, a guided parafoil system. On landing the rocket was meant to behave similarly to a modern skydiver, steering itself to a landing zone and flaring the parachute at the last moment to reduce landing loads. The steering system, with integrated actuators, GPS, radio receiver, &c, was provided by Wamore Inc, with experience in military self-guided airdrops.

During post-transport inspection we found that one of the support tubes holding the pressurant tank above the LOX tank had broken. A field repair was undertaken, involving a purchased welder and some rewiring of a generator. A full day was also spent doing the final rigging of the return-to-site guided parafoil system.

The setup and launch went generally nominally. After fuel fill a leak of fuel out the pressurization vent was found, suggesting a crack in the pressurization standpipe. The decision was made to proceed anyway, as the crack did not significantly impair fuel load and would not impact normal operation. The standpipe is unsupported in the tank, forming a cantilever during transport that would be prone to resonance and thus fatigue failure.

The rocket launched off the pad with an acceleration no Mod has ever seen before, due to the largest engine ever put on a mod. Unfortunately, the standpipe issue escalated. It appears that the standpipe crack led to the pipe breaking off completely inside the fuel tank. The geometry of the manifold that feeds pressurant gas into the tank and withdraws fuel then meant that the engine was being fed a mix of fuel and helium gas, which led to engine instability 11 seconds into the flight. The T feeding the supplementary film cooling manifold became loose, and shortly after the film cooling pipe attachment and the gimbal attachments sheared off the engine. The engine went full over, as far as the gimbal attachment would allow, while still producing full thrust.

This extreme gimbal angle created a strong torque on the rocket, which led to it turning sideways into the air at a maximum velocity of 162.5m/s, 363.5mph. Three of five fins and their interfin panels were ripped off the fuel tank by the aeroloading. Apogee was 1461.8 meters above ground level, 4796ft.

The fins and panels fluttered to the ground within the safety exclusion area, as did other debris from the engine compartment that was ripped off during the hard turn. The TTS box, a thick fiber reinforced plastic enclosure, was shredded into small pieces and found over a large area, as was the plastic TTS valve actuator.

The drogue was released, and followed shortly thereafter by the main. Though the main deployed with the rocket quite heavy, it stayed attached to the rocket. However, some parachute shroud lines were broken in the process, making it impossible for the Wamore Automated Guidance Unit to control the main canopy. Dalek spiraled in under canopy and crunched into the desert with most of the propellant load still onboard. Fuel leaking out of a broken line started a small fire in the bushes and burned the wiring in the engine bay, most of which was burning out as the Armadillo team arrived moments later. The local fire crew arrived shortly after that and put out the remaining shrubs. The propellant tanks remained intact.

The Wamore guidance unit did not appear to have taken any damage in the landing, according to Mark Kusbel, the Wamore representative who came out to help rig and configure the recovery system. We'll be trying the return to launch site system again in the future and look forward to working with them again.

The debris was recovered and mapped. Four cameras were onboard. The GoPro HeroHD broke off during the event and fell by itself, continuing to record after it bounced. The Flip MinoHD stayed with a fin that remained attached to the rocket, and was burned in the engine bay fire. Two cameras mounted on the ends of the legs were insufficiently retained and were likely lost during the event. They remain in the desert and will likely be found in the future.

The engine had exhibited some tendency for instability when on the test stand. When the chamber and secondary film cooling portion had been attached to a LOX/methane injector, it rattled the secondary film cooling lines off during one test. In static testing on the vehicle, it managed to loosen the secondary film cooling AN fittings, which were subsequently loctited on. The connections at the T were not locktited.

The gimbal attachment mechanism had not been beefed up for the change from a ~2500lb engine to a 4000lb engine. The engine was not tested on the stand with the gimbal mechanism, so its ability to retain an unstable engine had not been verified. Because it wasn't running with the accidental helium mix in the fuel, it didn't run the same way in hold down testing as it did in flight.

General lessons:

• Retaining cameras on large pieces of debris makes finding them easier.
• Because they use internal memory, the Flip cameras are significantly more difficult to recover data from if they are damaged. While their video is very good, they're only suitable for documenting successful flights.
• Engine gimbal mounts need to be much stronger than their expected loading. Moving away from a screw in a cantilevered beam may be prudent.
• Having a hard stop in the engine gimbal mechanism other than the hard stops inside the linear actuators would limit how quickly the rocket can go out of control, reducing aero loading. The engine went to something like 45 degrees, where 3 degrees would be a sufficient maximum for a vertical takeoff with no translation.
• Most of the cameras on this vehicle were installed with the intention of documenting the hardware, rather than the view. In a nominal flight this is less useful, but for initial test flights this should be standard.
• The day before the launch is not the ideal day to complete engineering of any system on the rocket, unless absolutely necessary.
• There should be at least informal crew rest requirements.
• Part of cat herding duties should include logging who is shooting video or photos, and making sure the videos and photos become accessible to Armadillo for post-mortem analysis.
• The pressure drop of the secondary film cooling system should be tested. Just as it would in the main injector, if the pressure drop is too low it can cause or reinforce feed system and/or engine resonance.
• Tubing should be supported when possible, and not used to support fittings.
• Any vehicle should be analyzed overall for behavior of parts and subsystems during transportation. Driving the rocket to New Mexico on a trailer is a significantly different fatigue environment than dragging it out to the test pad and back.
• The operations manual should include plans for off-nominal propellant detanking situations, such as after portions of the propellant system have been broken off.

2011-June-15 notes by Ben Brockert. Photos and videos by Ben Brockert, with the exceptions of the flying Stig photos by Lee Hardesty, and the Dalek flight video, by Jared Ortega, intern of the New Mexico Spaceport Authority.