It all began with a single line in a space roundup for September 29. Starship Flight 14 reached orbit for the first time, the Super Heavy booster made a soft landing in the Gulf of Mexico—and was blown up. The wording said it was a regulator’s requirement, adding that unlike last time, when the pyrotechnics “pretended not to work,” the detonation went normally.
The rocket made it. Landed cleanly. Nothing broke. And they blew it up.
The question that immediately begged to be asked: who even has the right to destroy a rocket, and why does that right exist? It turns out that behind this button lies a separate engineering discipline with a seventy-year history, a reliability standard of nine hundred and ninety-nine thousandths, and a rule that sounds like an oxymoron: a flight termination system is not allowed to detonate the propellant.
Range safety—that is, keeping the range safe—has been practiced since 1950, from the very first launches at Cape Canaveral. The logic is simple: a rocket that has lost control must be destroyed before it falls on people. Everything else is implementation detail, and a great many details have accumulated.
On the range safety officer’s console were two switches. The first—arm—shut down a liquid rocket’s engines and put the destruct system on standby. The second, destruct, ignited detonating cord wrapped around the tanks, after which the propellant was scattered and burned in the air. There was a delay between them: rupturing the tanks instantly while the engines were running would have sent fragments roughly where the rocket itself had been going.
In front of the officer was a display with two coordinates: where the rocket was now, and where its debris would fall if thrust were shut off. “Destruct lines” were drawn over the calculated trajectory. As long as the marker stayed within the boundaries, no one touched anything; once it crossed outside, the procedure began. The boundaries were calculated to preserve 99.73% confidence that a vehicle on a normal flight would remain within the corridor.
The range’s authority was legally established. The Webb–McNamara Agreement of January 17, 1963, confirmed that the Air Force could require a flight termination system on NASA vehicles just as it could on military ones, and that right applied from liftoff to orbital insertion.
NASA did not like it. For a year and a half, Houston sought the right to send Apollo to the Moon without a destruct system on the spacecraft: engineers cited the risk of a false activation and the possibility of an explosion during docking. The Air Force responded with wording from its manual—“both engine cutoff and destruct capability are required for each stage.” The argument that ultimately worked was weighty in the literal sense: a 120-pound system required either 7500 newtons of additional thrust or a lighter first stage. In September 1964, the waiver was signed.
The case in which all of this became visible at once happened on January 28, 1986. The range safety officer at the Challenger launch was Air Force Major Gerald Beringer. In his report, written two hours after the accident, he described how, at the 76th second, the readings from the primary and backup sources diverged sharply, and how he heard about the explosion over the internal comms almost simultaneously. He was already inclined to do nothing—by all appearances, the entire stack had come apart on its own.
He changed his mind when he saw a side booster on the screen, stabilizing and moving toward the display’s upper-left corner. Beringer sent arm, waited about ten seconds, then sent fire—at roughly the 110th second.
That report contains a detail that seems more important to me than the decision itself. All calculations had assumed that an early-separating solid rocket booster would tumble, making its impact point predictable. Challenger’s boosters did not tumble: they kept firing and flying stably. Without the live camera feed, the officer would have known absolutely nothing about the boosters’ actual behavior—the model and reality had diverged, silently.
The American standard for this system is set out in 14 CFR, Appendix D to Part 417, and it reads like a paranoid design specification. Predicted reliability: 0.999 at a 95% confidence level. No single failure may either prevent activation or trigger it unintentionally. Redundant components must be separated structurally, electrically, and mechanically, so damage to one cannot affect the other. The flight termination system must operate independently of every other rocket system, including its own power supply—the batteries last for weeks. Every stage and every side booster capable of reaching populated territory gets its own set.
The control command stands apart. The officer on the ground must be able to shut down a running liquid engine nondestructively—before destruction begins. A destruct command may be received only after a valid arm command. The radio link must maintain a 12-decibel field-strength margin over 95% of the sphere around the rocket. That budget includes signal attenuation in the plume of its own engines.
Now, the reason for this entire chapter. Section D417.3(b) puts it this way: a flight termination system must not result in detonation of solid or liquid propellant. In other words, the system whose sole job is to destroy a rocket is explicitly forbidden from doing what the public understands by the words “blow up the rocket.” Its job is different: breach the structure, vent its contents, and strip the vehicle of aerodynamic stability, so that detonation and combustion remain controlled and occur as high above the ground as possible.
Technically, this is done with linear shaped charges—cords that cut through the skin at specified points. On cryogenic tanks, they are placed to breach the tank from the side: mixing oxygen and methane inside an enclosed volume would produce precisely the uncontrolled explosion the standard does not permit. On solid-fuel stages, it is physically impossible to shut down the engine, so the casing is breached—the grain can no longer hold pressure, thrust vanishes, though the mass keeps burning.
Until 2017, a person sat in the room at every Falcon 9 launch, ready to destroy the rocket. On August 22, 2014, at the test range in McGregor, Texas, an autonomous system activated on the F9R Dev1 test vehicle: a jammed sensor sent the vehicle off trajectory, and the onboard logic terminated the flight without ground involvement. The industry marks this as the first activation of an autonomous flight termination system on an American rocket.
What did the move to automation bring, apart from speed? A human takes three to five seconds to decide; an autonomous system takes milliseconds. Onboard logic also works beyond the horizon, where there are neither cameras nor range telemetry antennas.
And the most unexpected consequence: the need to reconfigure the range’s ground radio equipment for every rocket type disappeared. Retired Air Force Colonel Burton Catledge cited a figure of 72 hours for such a reconfiguration. After the transition, the Eastern Range could support 48 launches a year, while the cost of launch services for a single mission was cut in half.
One of the industry’s biggest economic changes grew directly out of that. Catledge put it plainly: it would be very difficult to reach a cadence of one or two launches a week without an autonomous safety system aboard. Another effect is less obvious—autonomy opened polar corridors from Cape Canaveral. A ground-command scheme had ruled them out because of ordinary radio interference: a rocket plume turned toward the ground station jammed the command signal.
Now, failures. April 2023, Starship’s first integrated flight. The rocket lost control in its second minute, and the autonomous system issued a destruct command. What happened next was described in an Aerospace America industry report without comforting language: the vehicle kept tumbling intact for about forty seconds before the atmosphere tore it apart. There was no instant explosion.
The sequence of explanations is telling. SpaceX said the system “fired all detonators as expected,” but there had been an “unexpected delay” before destruction. Nine days later, in an audio chat, Elon Musk said a detonating cord had been too short and that “it took too long to rupture the tanks.” Separately, he noted that falling into the lower, denser layers of the atmosphere had probably helped destroy the vehicle. And Charlie Garcia, chief engineer at Agile Space Industries, who broke down the broadcast frame by frame, captured the essence in one sentence: SpaceX managed to detonate a bomb right next to oxygen and methane, and nothing happened.
What saved the situation then were the ocean and the altitude. California Polytechnic professor Donald Edberg said he had never seen such a long delay, and that the only saving grace was that it all happened over water. Rocket Lab’s Peter Beck put it more briefly: “For those of us standing on the sidelines, it’s like your worst nightmare.” And he added another line, the one that best explains why no one in the industry is indifferent to this subject: “We’d all be grounded if an event of that scale happened.”
They were grounded even without that scale, though. The failed flight termination system made the list of 63 corrective actions SpaceX committed to complete before the FAA would authorize another launch. That same list required a redesign of the launch mount: pulverized concrete had been flung up to ten kilometers from the spaceport.
The opposite failure happens too—when the system simply does not activate. November 19, 2024, Starship’s sixth flight. A booster landing on the tower was canceled because of automated checks of the launch mount, and Super Heavy made a soft landing in the Gulf in 32 kilometers downrange.
After landing, it did not break apart: the liquid-oxygen tank section remained afloat, and it was sunk the next day. The word “failure” immediately surfaced in the discussions, and one commenter drew a distinction worth keeping in mind. A flight termination system is designed to terminate flight, not to sink a booster after a soft touchdown on water. If it could not terminate the flight quickly enough, that is a failure, and the FAA will demand an investigation. If it could not sink an already-landed tank, it was not designed for that.
For this case, incidentally, SpaceX had a decision ladder written down: first, remotely open the vent valves and let water into the tanks; if that failed, open the tank valves; and if that too did not work, bring in a ship and roll the hull around its longitudinal axis with a tow cable to cause flooding. The second option worked. The third remained on paper, unfortunately.
A separate category: cases in which the decision to destroy is not made. On January 25, 2018, Ariane 5 began its flight on an azimuth of 90 degrees instead of the planned 70: the payload was headed for an unusual supersynchronous orbit, while the inertial units had been loaded with the standard number. The trajectory shifted by nearly 20 degrees in inclination, and ground stations lost telemetry at nine minutes and twenty-six seconds.
A standard Ariane 5 would be destroyed immediately in that situation. Here, the safety officer wanted to do it—and could not: the rocket was already passing too close to the town of Kourou, and destruction would have brought a rain of debris over the town. According to industry sources, the danger to the local population from destroying the vehicle outweighed the danger of continuing the flight. Both satellites re-established contact, turned out to be healthy, and reached their target orbit under their own power—one of them four weeks late.
The most expensive case of the same logic was February 15, 1996, China, Xichang Satellite Launch Center, the first launch of Long March 3B. The rocket went off course two seconds after liftoff and struck a hill near the spaceport’s main gate, 23 seconds after launch. There was a flight termination system aboard. According to retired U.S. Air Force Lieutenant Colonel Wayne Eleazer, it was not activated to avoid hitting expensive structures near the launch pad.
The explosion wiped out the village of Mayelin, standing directly beside the center’s gate. The official Xinhua agency reported six dead and 57 injured; Western estimates went as high as 500, while a 2003 CCTV documentary named seven people. The sources diverge so sharply here that reducing them to a single number would be dishonest: American eyewitnesses maintained that the official list counted only military personnel and excluded civilians, while the author of an analysis in The Space Review countered that the village’s population did not exceed a thousand and had been evacuated before launch. After 1997, the village was demolished and its residents resettled.
Up to this point, everything has looked like a set of engineering compromises. Crewed launches break the system’s very logic, and break it in the direction of failure.
Pyrotechnics cannot fail safely. They have no neutral state: a charge either fires or it does not. For a cargo launch, this means autonomous systems are designed around the rule that “failure to activate is unacceptable”—the price of a false decision is lower than the price of delay. NASA’s engineering safety-management documents state this directly: for cargo launches, a flight termination system is built fail-destruct, not fail-safe, and has no safeguards against inadvertent activation, because range requirements protect the public and ground personnel.
Then a crew gets aboard, and the premise flips to its opposite. An inadvertent destruct bypasses the launch escape system, and therefore requires two-failure tolerance. It cannot be achieved through redundancy at the system level—the protection must exist inside every unit. The asymmetry is visible in the requirements’ details. The range permits the arm switch to reside in ground equipment and be removed once personnel have left the pad. The range requires monitoring only those inhibits that activate on the ground. Onboard inhibits on the destruct command do not have to be monitored, because for the range, an inadvertent destruct in flight threatens neither the public nor the ground team. The logic is flawless, and has absolutely nothing to do with the people sitting on top at that moment.
The complexity, meanwhile, is not hidden in the hardware but lives in the data. An autonomous system consists of three parts: the CASS core with its computational logic, a “wrapper” for the specific launch vehicle, and an MDL—a rules file written in XML against the range’s schema. This file contains the entire flight-termination decision logic; it is written jointly by the provider and the range, and in size and complexity it is comparable to the rocket’s own typical flight software. NASA separately warns that the MDL contains elements that cannot tolerate even a single failure.
So back to the line where this began. Flight 14, September 28, 2026: the booster completed its burn, landed, and a moment after engine shutdown its flight termination system was activated. SpaceX describes this as a demonstration of the safety hardware—that is, they fired up a system which had spent seven minutes flying ready not to be needed, as a reward for not being needed. Formally, this is the safest part of the flight and the most pointless at the same time, and there is not a drop of irony in that: the ability to fail cannot be tested on the ground; it can only be spent.
And the second half of that same flight ended differently. The ship splashed down in the Pacific north of Hawaii a little over three hours later, rolled onto its side, and the remaining propellant in its tanks ignited on its own—no one had planned that. One launch, two rockets, two different deaths: one by order, the other by inertia.