How safe must a potential crewed launcher be demonstrated to be before it is crewed?

The US is entering into a new era in space. The Vision for Space Exploration (VSE) (Bush, 2004) announced by the US President has been fleshed out during the Exploration Systems Architecture Study (ESAS) (ESAS Team Final Report, 2005) and work has been underway since then to develop a generation of launch vehicles to implement the preferred 1.5 launch architecture identified in the study. The 0.5 part of the launch set indicates the smaller Crew Launch Vehicle in the new set designated Ares I by NASA. The Ares I was selected by the team because analysis had shown that its complement of a solid first stage, with a liquid H₂/O₂ cryogenic second stage offered the best potential balance among cost, risk and performance. In particular the risk that this conceptual design would impose on the crew once matured was forecasted to be an order of magnitude better than the current matured crewed launcher set, the Soyuz and the Space Shuttle (Isakowitz, 2004). This forecast relied heavily on the experience of the heritage systems upon which the concept was based, specifically the heritage of the Shuttle solid rocket boosters and the experience with cryogenic upper stage engines from the Apollo and Shuttle era. Even with this strong heritage in play, it was recognized by the ESAS Risk Analysts that it would be necessary to mature the design with a set of test flights prior to placing the crew at risk. However the question was and is: “How many test flights are necessary before a crewed flight should be attempted?”This is the question that this paper addresses. That is, it is clear that the number of test flights is related to the desired safety level and that this, in turn, is related to what safety goal should be assigned to enable the crewed flight. Further, demonstration of goal achievement is again in turn related to how much of the heritage base can be captured in the new design. In the extreme, for a completely “new” design, the demonstration would be bounded by the requirements of the identical, repeatable experiments of classical probability theory (Mises, 1957). Even if the tens, or even hundreds of launches that this would require would be financially possible, tests of developmental systems are seldom, if ever, identical and repeatable because the design is modified to address the failure events observed. On the other hand, if the design was completely identical to the heritage then the heritage demonstrated reliability could be subsumed compared to the goal without further testing. This paper addresses the role of heritage in a developmental environment in the establishment of a minimum goal for the initiation of crewed missions and the testing required for its demonstration.