And weight? I would guess? And I understand weight is proving to be a major issue with starship?
Yes. Starship's dry mass keeps creeping upward. That happens with nearly every spaceship design. The Apollo lunar module kept acquiring mass until it exceeded the design constraints and had to be put on a diet. The mass-reduction exercise was legendary in the field, but in that case it was mostly reducing the mass of the agreed-upon components without materially changing the design. As noted, Starship's design philosophy seems to be reducing the operational margins as the result of design simplification.
Redundancy in a flight dynamics system means redundant tanks, jets, piping, wiring, and controllers. There is a tremendous urge to think, "We don't need all that; we'll just make the primary system inherently more reliable." That's just not how reliability has been heretofore achieved.
If you have a subsystem with three nines of reliability (probably of success,
p ≥ 0.999), the rule of thumb says that adding another nine to that
(p ≥ 0.9999) costs as much as the previous three nines combined. In contrast, a failover setup with two redundant subsystems, each with two nines (
p ≥ 0.99) gives a reliability probably of 1 - [ (1-
p)2 + Q
c(2) ]. The basic term is just simple probability. If both systems have to fail to result in mission failure, then you get your desired
p ≥ 0.9999, or four nines. The important point is that a two-nines system would be easier and cheaper to develop than a three-nines system. Once you've developed and tested it, the manufacturing cost is not necessarily the driving factor. It costs $10 billion to develop an airliner design, but it takes only a small fraction of that to build each unit.
The Q
c(2) term is a complexity index function that represents the probability of failure in the redundancy itself, independent of the individual reliability of the redundant element. That's estimated from qualitative factors in the design. Perhaps there's some necessarily common part that could fail. Perhaps the interaction between the two systems has an emergent characteristic. Those can arise during nominal operation. Or one may arise at the moment of failover. Whatever, you have to include it in the estimate because making something more complex has a reliability cost, and you will eventually arrive at irreducible risk where adding more redundancy creates more problems than it solves.
And obviously you have a cost in mass. You can have another nine at the cost of more than twice the mass of a single system. Understanding what flavor of cost you can best sustain is the art of engineering.
Human-rated spaceships have typically taken a hybrid approach. The Apollo lunar module had a primary guidance system that was very capable and built according to robust principles. It also had a secondary guidance system that was smaller, stupider, simpler, and built entirely differently. Failover was simply a matter of flipping a switch. The space shuttle orbiter famously had five redundant AP-101 (later SP-101) computers. Four of them were programmed in one way, but the fifth ran a completely different software load that solved the same problems using different algorithms. These didn't operate in a failover configuration; they used voting logic. The math is different than for failover. But the point is that unless something has radically changed, you will typically get more bang for your buck with redundancy.
