What should the commercial rocket sector scrutinize in the aftermath of the automotive pedal bracket fracture?

What warnings does the car pedal fracture incident bring to commercial rocket companies?

Recently, a certain automotive brand encountered pedal bracket fracture in a public braking test, which has drawn widespread public attention.

The enterprise subsequently stated that the braking system has completed relevant development and verification, no such fault has occurred in actual user use, and announced that it will optimize the design to provide free upgrade options for delivered users.

At present, publicly available information is not sufficient to determine the specific cause of the fracture.

How force is applied during the test, what material the bracket is made of, and how it is manufactured all require support from raw data.

What is certain is that the bracket undertakes the responsibilities of supporting and force transmission. Once it breaks, even if other components of the braking system are intact, the driver may not be able to brake normally through the pedal.

On rockets, similar components are also easily overlooked.

Apart from engines and tanks, the entire rocket also relies on connecting parts, supporting parts, pipelines and thermal protection structures to maintain operation. As commercial rockets continue to reduce weight and cut costs, these components are also included in the adjustment list, and every modification will bring new verification work.

The Hidden Cost of Material Changes

The automotive industry has had similar lessons before.

In 2020, Ford recalled 38005 automatic-transmission Mustangs in the United States.

The recall document points out that after the brake pedal bracket was changed from nylon to polypropylene, the specific design's tolerance to sudden braking loads decreased, which may lead to fracture and loss of main braking capacity. The engineering specifications and verification procedures did not leave sufficient margin for fluctuation factors.

Changing a material usually affects the entire set of design. Thickness, reinforcement methods, molding processes and force-bearing positions will all affect the load-bearing performance.

On rockets, components also have to face conditions that only appear after installation. Pipelines that work normally on the test bench may bear extra vibration after being installed on the rocket; after the connecting parts pass the normal temperature test, their performance still needs to be confirmed when entering a low-temperature environment. Even if the new process shortens the production cycle, it is necessary to check whether the consistency of the product is affected.

This is also the reason why qualification tests and acceptance tests have their respective divisions of labor.

The former verifies whether the design can meet the specified environmental and load requirements, while the latter checks the quality and function of actual products.

Even with a qualified design, manufacturing defects may still occur; passing the acceptance of a single part is not enough to prove that the design boundary has been fully assessed. After changes in materials, processes or suppliers, it is necessary to evaluate item by item whether the original test conclusions can still be applied.

Automakers can obtain feedback from a large number of in-use vehicles and deal with existing problems through recalls. However, rockets have few flight samples, and it is difficult to maintain key structures after launch, so ground verification assumes greater responsibilities.

Redundancy and Weight

In 2015, the Falcon 9 performing the CRS-7 cargo mission suffered a launch failure. NASA's independent review concluded that the end of the secondary helium tank support rod fractured, the tank broke away from its fixation, which then led to the rupture of the liquid oxygen tank.

As for why the support rod fractured, material defects, manufacturing damage and installation problems were all listed as possible causes.

The review also found that the industrial-grade casting bearing this critical load was used in the harsh low-temperature flight environment without sufficient screening and testing, and the design did not fully follow the safety factor recommended by the manufacturer.

A low-cost support part may cause equipment displacement and pipeline damage after failure, and eventually endanger the entire rocket. How much the part itself is worth is completely different from how much loss it can cause.

Adopting mature industrial products can reduce procurement costs and shorten the delivery cycle. However, the performance parameters given by suppliers have applicable conditions, and the developer needs to confirm whether these conditions are valid on the rocket. After saving procurement costs, it may still be necessary to cover the expenses for screening, testing and integration.

Whether a device can be used on a rocket cannot be judged solely by the labels of "industrial grade, automotive grade, aerospace grade".

The quality and environmental assessments that automotive-grade products pass may not cover space radiation. Product selection still depends on what environment it works in, what functions it undertakes, and how much impact the failure will cause.

Whether the backup can work also depends on the specific component. Computers can be equipped with standby units, but after the main load-bearing structure fractures, it is difficult for another set of structures to take over. Reinforcing the bracket reduces the possibility of failure of the original structure; adding backups retains the ability to continue working after a fault occurs.

However, two sets of equipment may not provide double protection. If they share the same power supply, circuit, or their installation positions are too concentrated, a single leak, high temperature or structural damage may cause them to fail at the same time.

Rockets also have to bear the weight brought by redundancy. In addition to the equipment itself, fixing structures, cables, power supply and thermal control may also increase accordingly, taking up payload capacity. The added weight in different stages has different impacts on payload capacity. Whether to adopt redundancy requires weighing the risks it can reduce against the increased weight and cost.

This calculation cannot only count the cost of a single rocket. A launch failure may also bring payload loss, technical rectification, launch delay and order loss. The procurement price of the faulty part is often only a very small part of all losses.

The Overall Situation Behind a Single Fault

When a bracket breaks, is the problem solved after replacement or reinforcement? In engineering practice, we also need to look at the surrounding areas. If the stiffness of the bracket is improved, the load may be transferred to the adjacent connection points; if the pipeline is moved to a new position, the vibration and thermal environment may also change. The verification scope of rectification needs to be extended along with these changes.

The review after the Falcon 9 CRS-7 accident did not stop at the damaged end of the support rod. NASA also found problems in the selection of the support cable for the liquid oxygen delivery pipe, purge flow rate and telemetry architecture. Some of these problems, although not the direct cause of the accident, were still included in the rectification list.

The case of Tianlong-3 reflects the mutual influence of multiple systems during flight.

According to the disclosure from Tianbing Technology, the discharged liquid oxygen was sucked to the bottom of the rocket, causing secondary combustion. The local high temperature damaged the thermal protection connection structure, and then high-temperature gas entered the aft compartment, resulting in flight anomaly. Therefore, the investigation needs to be carried out along the connection between liquid oxygen discharge, tail flow field and thermal protection structure.

Tianbing Technology subsequently adjusted the liquid oxygen discharge direction, thermal protection scheme and part of the pipeline layout, and disclosed the results of a thermal test run of about 200 seconds under fault recurrence and improved conditions. Zhang Jianhong, Deputy General Manager of the Rocket R&D Department and Assistant Chief Designer, stated that the second flight of Tianlong-3 will not reduce the overall performance of the entire rocket just to ensure mission success.

This choice retains the original performance targets, and also sets higher requirements for rectification verification.

The approximately 200-second thermal test run provides verification data, but beyond the test duration, it is also necessary to check whether the flow field, pressure, temperature and operating status of all systems cover the flight conditions that need to be assessed.

Only by reproducing the original fault and then confirming that the improvement scheme can block this process can we prove whether the adjustment is effective.

The work to be completed for reflight is more than just checking this single rectification. The data obtained from the previous round of flight can support the judgment of the corresponding stage; after the mission is terminated early, subsequent engine operation, payload separation and final orbit insertion may still lack full assessment.

All these contents need to be continuously verified in subsequent flights.

After successful orbit insertion, flight data can still help the team verify the design. The actual performance such as temperature, valve response and vibration can be compared with the predictions one by one, providing a basis for subsequent missions. Especially when the payload, trajectory or environment changes, these data help to judge the applicable range of the original design, making the preparation for the next flight more sufficient.

From the pedal bracket to the rocket support parts, the reliability of a single part is linked to the entire process of design, testing, production and use. The improvement after a fault must not only stand verification, but also be implemented in subsequent products; after the rocket is recovered, it is also necessary to confirm whether it can perform the mission again through inspection and life assessment.

Commercial rockets continue to reduce weight and cut costs, ultimately aiming to make customers pay less, and bear less cost of delays and re-launches. The cost advantage of launch services needs to be proven in every mission completed on schedule.

This article is from the WeChat official account "Xingdong Wuji", written by Julian, and published with authorization by 36Kr.