Richard Nakka’s Experimental Rocketry Web Site
________________________________________________
Introduction
to Rocket Design
8. Reliability
Introduction
Every rocketeer will undoubtedly
agree that the concept of reliability
is a most important element of rocketry, whether we are engaged in model
rocketry, High Power rocketry, EX rocketry, or professional rocketry. What
exactly do we mean by reliability in terms related to rocketry? Here are some pertinent
definitions of reliability:
- the
ability of equipment to function without failure
-the probability that a product or system will
perform its intended function adequately in a defined environment without
failure
-the extent to which a procedure yields the
same results on repeated trials
- the
quality of being trustworthy or of performing consistently well
The last of these definitions is particularly noteworthy. Reliability
is closely related to trust. Can you trust that something will function as
expected? When we head out to the launch site to fire our rocket, we want to
feel confident that all will go well.
No worse feeling than having doubts. Setting up the launch pad and firing
equipment and expecting that all will activate nominally. Then the rocket
itself. We trust that the motor will ignite and burn as expected. The rocket
will fly in a stable predictable trajectory, the recovery systems will activate
and safely return the rocket to earth. Electronic payloads will perform as
expected. The recovery process will allow us to find the rocket in a timely and
trouble-free manner.
When I began my amateur rocketry journey many years ago, I recall
heading out to the launch site feeling uptight and lacking confidence that
things would go right. I had not yet gained the hard-earned lessons about
building in aspects of reliability. Sure enough, we often had problems with
things that “should” have worked, such as the launch controller or igniters
failing to fire up the motor. Occasionally we forgot to bring needed items and
had to improvise, reducing reliability in the process. Running short of time,
we may have “cut corners” to get the rocket off the pad, with the obvious risk
associated with such actions. “Proven” motors would occasionally CATO and we
suffered many recovery system failures. Part of this was the natural learning
process, a result of limited knowledge and limited experience. However, in
hindsight, a contributing factor was failing to recognize the weighty nature of
quality and reliability.
____________________________
Maintaining Focus
Running into “glitches” while prepping for launch (or static test)
is something we want to avoid, or at least we wish to minimize. Not only do
such glitches waste precious time, such can be an unwelcome distraction. Distraction
can lead to errors, rushing or missed steps. Distraction during launch prep can
come from other sources, such as spectators being on-site with their natural
tendency to engage in conversation. In the airline industry, flight crews
operate under the Sterile
Cockpit Rule during critical phases of flight such as take-off and landing,
whereby idle chatter and other non-essential activities are forbidden. This is
also a good philosophy for rocketeers to adopt when prepping a rocket for
launch, or when setting up for a rocket motor static test.
A prelaunch checklist
formalizes the step-by-step process that ensures that things are done in an orderly
and timely manner and that nothing important is missed. Following a checklist
also serves to sustain focus on
the tasks at hand.
____________________________
Checklist
I learned the hard way the absolute necessity of having a
checklist to ensure a rocket, and anything related to launch preparation, is performed, and performed correctly. The results of not doing
something right can be catastrophic (e.g. forgetting to arm the altimeter) or
can be distracting and time-wasting (e.g. forgetting to arm the Launch
Controller) or can lead to loss of a flight objective (e.g. forgetting to power
an on-board camera). Development of an effective checklist turned out to be an
evolutionary undertaking that eventually included steps that are either
critical to perform, or steps that help the prelaunch process to run smoothly. It
is easy to forget to do something in the heat of the moment.
The checklist that I developed contains three classes of items to
be performed:
1.
Steps to facilitate setup of the rocket and launch support
equipment
2.
Important steps to perform, however, not flight-critical
3.
Flight-critical steps
Here the example checklist is colour coded to illustrate:
Example Prelaunch Checklist (marked
up)
The steps need not be performed in the exact order as laid out in
a checklist. Capable judgement is required in this regard. For effective time
management, two or more persons can be carrying out the steps independently. It
is imperative, however, to physically check
off each step as it is completed, preferably by the person who
performed that particular step.
____________________________
Flight Criticality
What is meant by flight-critical?
Flight-critical refers to any component or system whose failure or malfunction
results of loss of the rocket. Loss of the rocket may refer to its destruction,
or irreparable damage, or may refer to failure to recover the rocket following
an otherwise nominal flight. Example of the former could be structural failure
of the airframe or motor. Example of the latter could be failure of the GPS
tracking system.
Examples of flight critical operational
components:
Rocket motor
Altimeters or other Recovery Control System
Pyro devices
GPS transmitter
AvBay static ports
Examples of flight critical structural components:
Motor mounts
Airframe
Airframe couplers and coupling systems
Nosecone
Fins
Launch clips
Bulkheads
Tethers and attachments
It is obvious as to why most items listed are considered to be
flight critical. A clarification as to why the less obvious items are
considered flight critical:
Launch clips – Also referred to as “buttons”, a minimum of two launch clips
are needed to guide the rocket along the launch rail during liftoff. What if
one clip failed (e.g. broke off)? A single clip cannot safely guide a rocket
skyward. Think of a single clip as a hinge point. Even a tiny lateral component
of thrust from the motor could cause the rocket to rotate, to some extent,
about that hinge point. Instead of rising vertically as expected, the rocket
could unexpectedly veer. If the veer is significant enough, the rocket could
end up veering at a dangerous angle, jeopardizing the safe flight and recovery
of the rocket.
Bulkhead – Specifically, a fixed bulkhead that forms an end
closure of a pressure vessel, as explained in the Recovery System webpage. The pressure
vessel, in this case, is that part of the rocket body that is pressurized upon
firing of an ejection pyro device. Failure of the bulkhead or its attachments
to the rocket body could prevent pressurization and thus failure of rocket body
separation to occur.
GPS Transmitter – This component is considered to be flight critical even though
failure or loss of the transmitter does not necessarily mean a rocket would be
lost. If visual sighting of the rocket is maintained at touchdown, recovery of
the rocket is likely. However, experience has demonstrated that it is certainly
possible to lose visual tracking of a rocket well before the rocket lands.
Without GPS transmission, only shear luck will be on your side trying to find
the downed rocket.
Nosecone – A nosecone may or may not be flight critical, depending on what
is housed within the nosecone. For my rockets, the GPS transmitter is located
within the nosecone. Loss of the nosecone would mean loss of this flight
critical recovery device.
____________________________
Redundancy
In engineering, redundancy
is the intentional duplication of critical components or functions of a system
with the goal of increasing reliability of the system, usually in the form of a
backup or fail-safe feature.
Redundancy allows us to take advantage of something called probability-rule-of-product. This rule states that
the probability of two or more independent events occurring is the product of their individual probabilities.
In simpler terms, assuming one event doesn't affect the outcome of another, you
can multiply their individual probabilities to find the probability of all
happening simultaneously. Consider, for example, having two altimeters in the
rocket that are used to trigger the Recovery Deployment system. Both are fully
independent. If the probability of either altimeter failing to trigger the
Recovery Deployment system is 1 in 10 (i.e. has 90% reliability), then the probability
of both failing is:
P = 1/10 ´ 1/10 = 1/100
In other words, if we choose to use only one such altimeter, one
rocket in ten launches will statistically crash. If we employ an independent
backup altimeter, one rocket in 100 launches will statistically crash, a vast
improvement in reliability for minimal “cost”.
For my later Xi series of rockets, I chose to have three independent Recovery Control systems. Initially I
utilized two (different) altimeters and an electronic timer. Beginning with Xi-7, I’ve employed three altimeters,
dispensing with the timer. For the flight-critical apogee separation event, all
three units activate pyro charges (independently). For chute deployment, which
is not considered to be flight critical (as long as apogee separation event
occurs), two altimeter units fire parachute deployment pyros (independently).
Based on experience over many flights, the probability of an altimeter failing
to fire its pyro, for whatever reason, may conservatively be taken as 1 in 10.
This leads to the probability of failure as shown in Table 1. Note that apogee separation event is synonymous with
drogue chute deployment:
|
Event |
Probability of Failure |
Consequence of Failure |
|
Apogee separation |
1/10 ´
1/10 ´
1/10 = 1/1000 |
Catastrophic
loss |
|
Parachute deployment |
1/10 ´
1/10 = 1/100 |
Light
to moderate repairable damage |
Table 1: Recovery
System failure analysis
Realistically, what is
the likelihood of two of three altimeters failing? It actually happened! For Flight Xi-15, despite following set procedures and quality control practices, both backup altimeter units malfunctioned
and as such, did not fire the critical apogee event pyros. Fortunately, the
primary Raven altimeter operated, and the flight had a nominal recovery. What
went wrong with the backup BREO
altimeter and the backup EggTimer
altimeter and what were the lessons learned?
BREO
failure-- One of the pyro wire
leads was not correctly inserted into the terminal block of the BREO, in fact, it was found
“free-hanging”. The screw on the terminal block that normally secures the lead
wire was found to have been fully tightened, clearly indicating that the wire
was not properly inserted into the hole prior to tightening. This is a known
drawback of certain types of terminal blocks where insertion of the wire lead
can be done incorrectly. Visually it is not obvious whether the lead has been
correctly installed. Lesson learned was to update the set procedure to include
a “tug test” of any wire following
installation into a terminal block.
EggTimer failure-- The reason for the EggTimer failing was an odd one. The EggTimer had proven to be highly reliable,
having worked flawlessly on all 14 previous flights. Examination of the data
file indicated normal operation. Altitude was correctly recorded throughout the
flight. However, the data indicated that the two pyro channels had not been
triggered. Closer examination revealed that the EggTimer configuration had somehow changed and that both pyro channels had been disabled. This
was odd because I had never intentionally
changed any configuration settings since the unit was built. Unfortunately, it is not possible to
ascertain, prior to launch, whether the pyro channels of the EggTimer are enabled or not, so such an
anomaly could theoretically repeat itself (this is referred to as a hidden
flaw). Lesson learned was to update the set procedure to check the pyro
configuration settings when prepping the unit to verify these have been enabled.
A second lesson learned, or rather reinforced, was to expect the unexpected.
Redundancy can be utilized as a means of reliability enhancement for
the following:
1.
Recovery Control system
2.
Recovery Deployment system
3.
Tracking means to ensure rocket is recovered
4.
Launch clips
5.
Rocket motor closure o-rings
Recovery Control system – As discussed earlier, multiple independent altimeter units can
be used for triggering both the apogee separation event and for parachute
deployment event. The units should be as independent as is practical, such as
each having a dedicated power supply and dedicated pyro charges. Ideally, if
COTS altimeters are utilized, the units should not be of the same model.
Recovery Deployment system – Redundancy can be utilized to make a recovery
deployment system more reliable. For example, dual tethers for connecting the
rocket components following apogee separation (or drogue deployment) as well as
for connecting the parachute to the rocket body. My Xi rocket now uses dual tethers for all such connections, a
lesson learned from the first Xi
flight when an unexpected tether failure occurred due to unexpectedly high
loading.
Tracking – Redundancy can be utilized to improve reliability of finding a
rocket after touchdown. Having a redundant GPS transmitter is something that I
have not, to date, implemented. Instead I have relied upon a quasi-redundant tracking
method, which is the Landing Locator. As long as a visual
sighting of the rocket is acquired at touchdown, proper use of a Landing Locator
guarantees that the downed rocket will be found.
Launch clips – The launch clips for my newer rockets are 3D printed, and have
historically been bonded to the rocket body. Experience has demonstrated that
such a bond may fail under certain conditions. To improve reliability, my
rockets now feature a third launch clip. As well, the means of attaching the
launch clips has been improved by the use of redundancy. In addition to
bonding, a tiny
screw retained with a nut serve
as a fail-safe retention feature.
____________________________
Robustness and Quality Control
Reliability cannot always be achieved by redundancy. In fact, most
of the rocket components cannot
be redundant, examples being the rocket motor and airframe. In some cases,
redundancy may be possible but may not be practical (or desirable due to cost,
weight penalty or added complexity), such as with having a backup parachute
deployment system. The alternative strategy to achieve reliability is to design
for robustness and maintain quality control. The objective of robust
design is to prevent failure under severe or unforeseen conditions. Robustness
can refer to physical strength or can refer to the concept of requiring a key
system to remain reliable even when conditions deviate from the normal.
Designing to include a safety margin is one example of robust physical design,
such as a rocket motor casing which may be designed with a safety factor of
two, meaning it can safely withstand an internal pressure of twice the maximum
design pressure. Systems can be made robust by having a backup. A simple
example is to have a spare motor igniter on-hand that allows for
straightforward replacement in case of a igniter misfire.
Quality control is a proactive measure to prevent or detect flaws
through testing, inspecting, and identifying defects. It can be as simple as
checking batteries prior to heading out the launch site or more involved such
as proof-load testing of structural components. Developing (and rigidly adhering
to) standards for flight critical components can have a profoundly positive
effect upon reliability. For example, out of more than 350 recovery pyro units made for my Zeta,
DS and Xi series of
rocket flights, only a single unit failed to fire when nominally triggered.
This represents a reliability of 99.7% for this flight critical item. Strict
quality control makes such reliability possible.
Developing standards for making and inspecting parts is perhaps
one of the more challenging aspects of quality control. You have to ask
yourself: how can this part (or system) fail? What do I have to do to ensure
the part will function as intended? As an example, when making the recovery
system pyro units, the following identifies such:
-
Crimson Powder, or CP (pyrotechnic material). Can fail if it is
damp, or particle size to fine or too coarse. Error can hypothetically occur
when producing a new batch. Too much or too little CP loaded in pyro unit can
affect functionality.
QC measures:
Store CP in sealed container with desiccant. Use sieves to control particle
size. Burn a sample of every new batch to ensure consistent combustion. Weigh
the amount of CP using milligram scale to ensure required amount is loaded.
-
Nichrome bridgewire. Can fail if not soldered to leads correctly.
Can be too long or too short. Can fail if cracked or nicked.
QC measures:
Use a standardized soldering method. Inspect solder joint and bridgewire using
20x magnifier. Measure and record resistance of finished pyro unit and verify
such is within acceptable limits.
-
Pyro casing. Can fail to burst effectively if end plugs, made from
hot glue, fail to seal or adhere to casing.
QC measures:
Check integrity of seal with 20x magnifier.
____________________________
Continuous Improvement
Continuous improvement is the ongoing, systematic and proactive effort
to enhance products or processes (including quality control) through
incremental or innovative changes in order to improve reliability over time.
Continuous improvement has led the way toward making my rockets progressively
better and more reliable.
Two of the fundamental and most challenging aspects of
experimental rocketry are the rocket motor and parachute recovery system. The
design and construction of these has evolved primarily through incremental
improvements. The reliability of both has shown marked improvement over time.
To demonstrate this
assertion, Table 2 presents a comparison between my newest series of rocket
flights (Zeta, DS and Xi) dating from 2014 to present, and all previous flights dating
from when I first launched my parachute-equipped rockets (B, PT
and C series) (1972-1984) to more
recent flights (such as Cirrus, Frostfire, Boreas, etc.) up to the year
2005. The table presents the results in terms of safe recovery, which is the
prime objective of any recoverable rocket flight. The first four rows in the
table represent a safe recovery of the rocket (zero or minor damage). The last
three rows represent loss of the rocket (destruction or serious damage).
Table 2: Comparison of rocket flight results
[1] No rocket
flights occurred between 2006 and 2014.
[2] Definition of Results
The cruelest result of any rocket flight is, of course, a lawndart whereby the recovery system
completely fails and the rocket flies a ballistic trajectory and crashes straight
into the ground. The second worst result undoubtedly is a motor CATO. For the
Previous flights listed, 37% of all flights ended in loss of the rocket. For
the Zeta, DS and Xi
flight, only 2% of the flights ended in loss of the rocket, and notably, zero
dreaded lawndarts.
Of course, this is not a wholly fair comparison, as an ever-increasing
knowledge base and experience played as significant a role in achieving reliable
performance as did the fundamental aspects of reliability such as incorporating
redundancy, robust design and quality control which were implemented as an
evolutionary process over time.
____________________________
Implementing Reliability Measures
Quality Control measures
The following are examples of quality
control measures that I have implemented on my newest rockets:
Recovery System
-
Detailed visual check of Avionics board when prepping for flight
-
Tug test of all electrical leads in terminal blocks
-
Strain-relief of electrical
connectors and cable-tie loose wires
-
Battery voltage/load test. Values recorded in log book
-
Resistance check and recording of pyro bridgewire resistance.
Verify resistance value within allowable limits
-
Crimson Powder stored in sealed jar with calcium chloride
desiccant
-
Crimson Powder accurately weighed and recorded for each pyro
-
Parachute folded and packed per standardized method
-
Close visual inspection of all tethers
-
AvBay static ports clear from blockage
-
Tether eyebolts secured with Locktite
-
Recovery system tethers lightly coated with RTV in areas directly
exposed to pyro combustion heat.
Rocket Motor
-
Propellant prepared per standardized method without deviation
-
Rocket motor requirement of being successfully static test fired
prior to being flown
-
Perform tap test to verify inhibitor bond
-
Grain density check to verify lower limit has been met
-
Motor casing fabricated from material meeting industry standards
(e.g. 6061-T6 alloy)
-
Snap-ring installation check
-
Standardized o-ring installation
-
Optional hydro-static testing of complete motor
Redundancy measures
The following are examples of redundant
features that I have implemented on my newest rockets:
-
Triple redundancy of altimeters for recovery system
-
All tethers are paired for redundancy
-
Three launch clips; failsafe fastener attachment
-
Landing locator as backup to GPS transmitter system
-
Dual o-rings to seal motor nozzle
-
Second igniter brought along in case of primary igniter failure
-
Launch Controller fitted with backup relay
Robustness measures
The following are examples of robustness
features that I have implemented on my newest rockets:
-
All power supply units are Lithium based for reliability over
large ambient temperature range
-
Rocket body structural bulkheads and attachments designed with a
minimum safety factor of two.
-
Rocket body couplers and attachments designed with a minimum
safety factor of two.
-
Fins fabricated of high yield strength 2024 aluminum alloy to
resist bending loads due to handling and landing
-
BRB GPS transmitter housed in protective shock-absorbing shell
within nosecone
-
Motor casing and closures designed with a minimum safety factor of
two
-
Field kit containing various hardware and other items that might
be needed for small repairs in the field. Contains selection of screws,
tie-wraps, spare parts for launcher, adhesive tape, various tools, etc.
___________________________
Complacency
Complacency has been called the silent killer of system
reliability. Defined as overconfidence coupled with an unawareness or neglect of
actual risks, it causes people to mentally check out, skip safety protocols,
and under-monitor systems. Ironically, complacency peaks when equipment, or a process,
is highly reliable, causing blind trust. This gradual behavioral drift
normalizes unsafe practices. Complacency encourages
minimum effort.
I have certainly been
guilty of complacency. It seems to stem from a trait of human nature compelling
us to conserve energy, both mental and physical. As an example, consider snap-ring
installation (snap-rings are used to retain nozzle and bulkhead). Several years
ago, when I static fired a rocket motor, the snap-ring let go and the nozzle popped
off upon motor ignition. As a result, the propellant exited the motor and
caused some damage to the test stand. The snap-ring had not been installed
fully into the snap-ring groove in the casing. This blunder is easy to do.
Consequently, I improved my quality methods for snap-ring installation. This stipulated
a close visual examination of the snap-ring, once installed, using a magnifier.
I also added a dimensional check using a set of calipers. Fast forward several
years, which covered many dozens of snap-ring installations, I became
complacent and tended to skip the dimensional check on occasions when a certain
nozzle shape made the dimensional check a bit of a pain to perform. On a subsequent
static test firing, sure enough, a nozzle popped off due to the snap-ring not
being fully installed in the mating groove. After that botched incident, I
printed out a sign and mounted it prominently in my workshop to serve as a
constant reminder.
AVOID COMPLACENCY
It is also easy to place trust in memory. This is complacency in
disguise. Avoid, as much as possible, relying on memory. Institute a process
referred to as Active Verification.
This entails enforcing the use of structured, regularly reviewed checklists to
ensure every key process is executed correctly every time. An example is the
earlier mentioned pre-launch checklist. Another example is a checklist for
ensuring everything you will need for a launch or a static test firing is
brought along. I have checklists for both which are updated on an as-needed basis.
____________________________
Normalization of Deviance
A cousin of complacency is something called normalization of deviance. This
ominous-sounding phrase refers to the gradual process by which an unacceptable
practice or rule violation becomes accepted as the norm. This entails
development of a thought process that tends to ignore a recurring potential
concern. This occurs when people repeatedly bypass safety protocols without
immediate negative consequences, desensitizing them to the associated risks
until a major failure or accident occurs. Two classic examples of normalization
of deviance are the Challenger and Columbia Space Shuttle accidents, whereby
concerns about recurring o-ring anomalies and the consequences of detaching foam
insulation causing critical damage were tragically dismissed because such irregularities
occurred on previous flights without harm.
Awareness of the concept of normalization of deviance, and its
possible dire consequences, is perhaps the most realistic way to avoid such
behaviour. After all, such behaviour is easy to fall victim to. I have been
guilty, on occasion, of such practice. For example, igniter failures had been
fairly common before I implemented quality control practices when designing and
building my launch controllers, as well as developing enhanced quality of the
igniters. I had set a rule, early on, to wait two minutes before approaching a
rocket (or motor, if static testing) in case of an igniter misfire. Due to lack
of patience and other pressing matters, combined with complacency, I would tend
to wait less and less time before approaching the rocket and switching to a new
igniter. Fortunately, igniter misfires became far less common an occurrence,
and the two minute rule was more strictly followed, for the sake of
prioritizing safety.
____________________________
Hidden Damage
Hidden damage refers to structural, mechanical, electrical or
other internal damage or flaw that isn't visible at first glance. In worst
cases, it is not visible at all and is truly hidden. Such damage typically
hides beneath the surface and requires a close inspection, teardown, or
diagnostic testing to discover. Hidden damage is truly the bane, or nemesis, of
reliability. For the amateur rocket engineer, who has limited resources at his
disposal, there is scant course of action to deal with discovering all hidden
damage. Hidden damage can, in some cases, be detected through quality
processes, such as conducting a tap test on grain inhibitor to check for
disbonding. As well, propellant density measurement will detect voids that may
be hiding in a propellant grain. In some cases, it is darn near impossible to
detect hidden damage. Here is an example of such. Recently during a standard post-flight
inspection of avionics components, a slight pull on a Li-ion battery wire lead
for the GPS transmitter resulted in the wire detaching from the battery. The
transmitter had functioned nominally for the flight, and by good fortune, the
wire had stayed attached. To investigate, the battery was opened
up by cutting open its
shrink-wrap cover. It was discovered that a significant amount of corrosion was
present. The wire that detached was mostly corroded away at the connection to
the battery. This was all hidden internal damage. The exterior of the battery
had a pristine appearance.
Another example of hidden damage came to light a few years back.
This occurred during a Zeta launch. The Raven
altimeter experienced a brief power loss, which was sufficient to reset the
unit and consequently it stopped recording flight data, and failed to deploy
the parachute. Fortunately this event happened during descent, after the unit
successfully fired the apogee separation pyro charge. A similar event occurred
on a subsequent flight. It was initially speculated that the Raven unit had
developed a fault. However, after much endeavour spent investigating the
anomaly, the actual cause was discovered. The Raven, at that time, was powered
by a standard alkaline 9V battery. I discovered that the female battery socket was not firmly clamping
the mating male stud on the snap-connector. Further investigation
revealed that the stamped-metal battery socket had lost its clamping effectiveness
after being attached and removed a number of times. As such, it became a
slightly loose fit, and vibration could cause a brief but fatal power loss to
the Raven (the same deficiency was true for many snap-connectors that I had in
stock). Why was this so? In “the good old days” 9V battery sockets
were fabricated of nickel-plated spring steel which retains its shape without
permanently deforming (it literally springs back). Cost cutting on behalf of
battery manufacturers clearly took precedent over quality, as it is cheaper to
skip the heat-treatment that gives spring steel its high yield point. Nowadays
it seems that most 9V batteries suffer this sad deficiency. Not much can be
done to address this conundrum other than to be vigilant of any looseness and
to minimize removal and reinstallation of the battery. A leaf-spring type battery
holder is a far better means
of connecting a 9V battery that eliminates the need to rely on the snap
connector.
Care also needs to be taken when choosing a good quality snap
connector. Cheap snap connectors tend to suffer this same deficiency. When I purchase
snap connectors (usually from Digikey),
I check the spec sheet or part drawing to see what material the sockets are
fabricated from. Spring
steel or phosphor-bronze (not brass) are the materials of choice. An
alternative to snap connectors are leaf-spring connectors.
In a practical sense, it is not realistic to expect to discover
hidden damage before it does harm. To mitigate the negative consequence of a
hidden flaw, vigilance and redundancy are the only practical defense. Again, it
goes to show, one must expect the
unexpected.
Last updated July 14,
2026
Originally posted May
29, 2026