Safety

Ron Ayers

A friend recently expressed surprise that I should be involved in projects such as Thrust SSC and BLOODHOUND SSC. He knows me to be a very risk-averse individual and he cannot understand my association with projects that are potentially dangerous. I told him that it was because of my very cautious nature that I am entrusted with work on such projects. Gung-ho people need not apply. My early training as an aircraft designer reinforced my systematic approach to identifying, analysing and minimising dangers. This safety culture must be shared by every team member.

When commencing an engineering project the design team must spend time identifying all of the risk factors, and consider what strategy will result in the safest possible engineering solution. As an example, the suggestion was made for Thrust SSC that it would be prudent to provide an ejector seat to enable the driver to escape from an impending crash. However, a detailed analysis (with the help of Martin-Baker Ltd, world leaders in this technology) showed that ejecting at ground level and at sonic speeds was itself fraught with insuperable difficulties and dangers for the driver, so ejection did not offer a ‘fail-safe’ option. We concluded that the safest approach was to ensure that the best way to protect the driver in an emergency was that the vehicle must be kept firmly on the ground under all circumstances, regardless of what technical problem was occurring. Thus, the vehicle suspension, controls and systems needed to have multi-layer fail-safe logic circuitry to ensure that, in an emergency, the car would revert to a ‘safe-at-all-speeds’ condition until it had stopped. This approach had to work for every conceivable type of emergency.

The wisdom of the decision not to use an ejector seat became apparent during runs with Thrust SSC. Several times the vehicle control system aborted runs for technical reasons that were not themselves dangerous. If we had fitted an ejector seat there is the strong possibility that the abort signal would have triggered an unnecessary ejection, possibly resulting in the loss of the driver and the vehicle.

But primary safety was just the start. We also incorporated ‘secondary safety’ features. That is, features that would protect the driver if the ‘primary safety’ had failed. For instance, the driver was firmly strapped into a fitted seat in a very strong safety cell, he had fireproof clothing, a halon fire extinguisher, a water-spray fire extinguisher and an independent oxygen supply.

Also to be considered was the ‘tertiary safety’. That is, assuming that the driver had survived an emergency, how could we get him out of the vehicle and away from the scene as quickly as possible. This was made possible due to our ‘Firechase’ vehicle. This was a supercharged Jaguar saloon, equipped with fire fighting equipment and manned by two team members who had been trained by the Gatwick Airport fire crew. Our unique fire engine was timed travelling at over 140 mph through the measured mile, so it could certainly reach an accident scene quickly.

The best way of preventing an accident, clearly, is to know what is happening to the vehicle and look for incipient problems. Thus, ThrustSSC had over one hundred instruments being monitored, and the ‘safety critical’ ones could trigger the abort system. For instance, the temperature of each wheel bearing was measured throughout each run. In practice, the bearing temperature never rose by more than 20 deg.C, even at the vehicle maximum speed. Other safety critical things monitored were wheel loads and structure loads.

All of the above precautions were taken for Thrust SSC, and much was learned from that project which will be of great value on BLOODHOUND SSC. However, there are some differences. The new vehicle has a hybrid rocket motor as well as a jet engine. Although the rocket’s solid propellent is incredibly stable, so should not contribute significantly as a safety issue, the hydrogen peroxide must be handled very carefully.

One of the shortcomings of the ThrustSSC concept was that we could only control the download on the front wheels. We achieved this by using an active suspension to control the pitch attitude. When we ran the car it became apparent that this was barely sufficient.  It would have been much safer (and easier to drive) if download had been controlled on the rear wheels as well. On BLOODHOUND SSC, controllable winglets at front and rear will enable precise and instantaneous control of download on front wheels and rear wheels independently. We are currently refining the vehicle shape (using CFD, see the section on aerodynamics) to ensure that the car will not leave the ground – even if the control systems fail. That ‘fail-safe’ option was not available on Thrust SSC. Thus, the controls can now be used purely to optimise the handling characteristics throughout the Mach number range. In particular, they can be used to counter the dramatic trim change that occurs when the rocket (with its high thrust line) is firing.
One of the design decisions that has yet to be made is the method of controlling these winglets. Should they be ‘open loop’ whereby the loads on the wheels are computed and the winglets follow a preset programme to ensure the best download distribution? Or should they be ‘closed loop’, whereby the wheel loads are fed ‘live’ into the control system which reacts and computes the required winglet angles? This is very much a safety issue.

Most important of all is to have carefully designed procedures for preparing, testing and operating the vehicle. All team members must know precisely what is expected of them. If any team member has any doubts about a run, he/she must ensure that the run does not take place until every team member is satisfied.

Just a final thought. Stopping a car from over 1000 mph in, perhaps, four or five miles is not a trivial problem. It must be achieved with total reliability –or we need some overrun track.