Case Study: Falcon 9's Engine-Out — Is More Engines More Reliable?

"Falcon 9 is designed to complete its mission even if it loses an engine on ascent." — a design claim SpaceX has made since the vehicle's introduction (widely reported)

Executive Summary

The Falcon 9's first stage is powered by nine Merlin engines — an unusual choice. Most first stages of its era used one or two large engines; nine small ones means nine times as many turbopumps, nine times as many igniters, nine times as many things that can break. Intuition says that is less reliable, not more. And intuition is exactly right — unless the vehicle can lose an engine and keep flying. This case study uses the reliability math of §32.2 to settle the question quantitatively: we compute the first-stage propulsion reliability three ways — needing all nine engines, tolerating one engine out, and tolerating two — and compare each to a hypothetical single-engine stage. We will find that many small engines is a reliability disaster when all must work and a reliability triumph when the stage is designed for engine-out — provided one crucial condition holds. That condition, and the Soviet N-1's failure to meet it, is the real lesson.

Skills applied

  • Computing series and $k$-of-$n$ reliability for a real propulsion system (§32.2).
  • Recognizing redundancy, single points of failure, and the independence assumption (§32.2).
  • Distinguishing benign from catastrophic (cascading) failure modes — FMEA thinking (§32.3).
  • Connecting the audit to "test like you fly" and the N-1 counter-example (§32.4, §32.5).

Background

The vehicle

The Falcon 9 first stage clusters nine Merlin 1D engines in an octagonal "octaweb" — eight in a ring around one center engine. This layout is deliberate: it lets the stage shut down a failed engine and rebalance thrust across the survivors, and it lets the same engine design serve everything from a small booster to (in the Falcon Heavy) a 27-engine cluster. SpaceX has stated from the start that the vehicle is built to tolerate the loss of one engine during much of ascent and still deliver its primary payload — and in October 2012, on the CRS-1 mission, it did exactly that: a first-stage engine shut down about 79 seconds into flight, the flight computer recomputed the trajectory, the remaining eight burned longer, and the Dragon capsule reached its target orbit. (A secondary payload was not deployed, for range-safety reasons unrelated to the engine-out itself.) That flight is the real-world validation of the math below. (Vehicle details and the CRS-1 account are widely reported; treat specific figures as Tier 2.)

The reliability question

We want the probability that the first-stage propulsion completes its burn. Model each engine as an independent unit with an ascent reliability $r$ — the probability it runs cleanly for the whole first-stage burn without a mission-affecting failure. We will use $r = 0.99$ as a plausible, illustrative per-engine figure (Tier 3; the real number is not public), and test the sensitivity to it at the end. The whole audit turns on one modeling choice: how many of the nine engines must work?

Phase 1: The naive case — all nine required

Suppose the stage has no engine-out capability: if any one of the nine quits, the mission is lost. Then the nine engines are in series (all required), and their reliabilities multiply:

$$ R_9 = r^9 = 0.99^9 = 0.9135. $$

Compare that to a stage with a single engine of the same per-engine reliability, whose propulsion reliability is simply $r = 0.99$. The nine-engine stage, needing all nine, is only 91.4% reliable against the single engine's 99%. This is the series trap of §32.2 in the flesh: more engines is more ways to fail. Every engine you add is another factor of $r < 1$ in the product, and nine of them drag the stage down almost nine percentage points. If this were the whole story, clustering nine engines would be indefensible.

Sanity check. With nine engines at $r = 0.99$, the expected number of engine failures per flight is $9 \times 0.01 = 0.09$ — about one flight in eleven suffers some engine failure. If every such failure lost the mission, you would lose roughly 1 flight in 11 to engines alone. No launch provider could survive that. So the many-engine design only makes sense if a single engine failure is survivable.

Phase 2: Engine-out — tolerate one failure (at least 8 of 9)

Now give the stage engine-out capability (a Chapter 22 term 🔗): it can lose one engine and still complete the burn by firing the survivors longer. The mission succeeds if at least 8 of 9 engines work. This is a $k$-of-$n$ reliability problem, and we sum the binomial probabilities of 9 working and exactly 8 working:

$$ R_{\ge 8} = \underbrace{r^9}_{\text{all 9}} + \underbrace{\binom{9}{8} r^8 (1-r)}_{\text{exactly 8}} = 0.9135 + 9 (0.9227)(0.01) = 0.9135 + 0.0830 = 0.9966. $$

The number jumps from $0.9135$ to $0.9966$ — and now it beats the single engine's $0.99$. One allowance for engine-out has converted the nine-engine cluster from the least reliable option into the most reliable one. The redundancy did its job: the stage now fails only if two or more engines fail, a far rarer event ($1 - 0.9966 = 0.0034$, about 1 in 290).

Phase 3: Two-engine-out — tolerate two failures (at least 7 of 9)

Early in flight, when the vehicle is heavy and slow, Falcon 9 can in principle tolerate more than one engine out; later, near staging, it may tolerate more because less thrust is needed. Model the best case as at least 7 of 9:

$$ R_{\ge 7} = R_{\ge 8} + \binom{9}{7} r^7 (1-r)^2 = 0.9966 + 36(0.9321)(0.0001) = 0.9966 + 0.0034 = 0.9999. $$

Now the propulsion reliability reaches 99.99% — the stage fails only if three or more engines fail at once. Each additional tolerated failure adds another "nine" to the reliability, because it pushes the loss condition further out onto the improbable tail of the binomial distribution. Let us put all three in code:

from math import comb

def k_of_n(r, n, k):
    """Probability at least k of n identical independent units survive."""
    return sum(comb(n, i) * r**i * (1 - r)**(n - i) for i in range(k, n + 1))

r = 0.99
print("all 9 required:", round(r**9, 4))
print(">= 8 of 9:     ", round(k_of_n(r, 9, 8), 4))
print(">= 7 of 9:     ", round(k_of_n(r, 9, 7), 4))
# Expected output:
# all 9 required: 0.9135
# >= 8 of 9:      0.9966
# >= 7 of 9:      0.9999

Phase 4: The catch — independence and the N-1

Every number above assumed the engines fail independently and that a failed engine fails benignly — it simply stops, and the survivors carry on. That assumption is doing enormous work, and it is exactly where clustered engines can go catastrophically wrong. If an engine does not merely quit but explodes, it can shower its neighbors with debris, sever a propellant line feeding several engines, or start a fire in the base of the stage — a common-cause failure (§32.2) that takes out multiple engines at once and voids the tidy binomial math. When failures are correlated like that, the "redundant" cluster behaves like a series system after all: one bad engine kills the rest.

This is precisely the trap that destroyed the Soviet N-1 (§32.5), whose first stage carried thirty engines. Thirty engines needing most-of-thirty is a brutal reliability problem to begin with ($0.99^{30} = 0.74$ if all were required), but the fatal flaw was that its engine failures were not benign: a failing engine damaged its neighbors and the plumbing, and the shutdown-control system's responses sometimes made things worse. The engine-out logic that should have provided redundancy instead propagated the failure. The difference between Falcon 9 and the N-1 is not the idea of engine-out — both had it — but whether the design contains a single engine's failure so the others survive. Falcon 9's octaweb includes structural barriers meant to isolate an engine bay for this reason; the redundancy math is only valid because engineering makes the independence assumption approximately true.

This is where "test like you fly" returns. You cannot claim engine-out reliability from a binomial formula alone; you must demonstrate that a real engine failure stays contained — by test, and ideally by surviving a real one in flight (as CRS-1 did). The N-1's designers could not test their integrated 30-engine stage on the ground at all, so the containment assumption was never validated until flight, four times, to four failures. The formula is necessary; it is never sufficient.

Phase 5: Sensitivity — how good must each engine be?

Redundancy's payoff depends on each unit already being reliable. Redo the $\ge 8$-of-9 case with a worse per-engine reliability, $r = 0.97$:

$$ R_{\ge 8} = 0.97^9 + 9(0.97^8)(0.03) = 0.760 + 0.212 = 0.972. $$

At $r = 0.97$, tolerating one engine out gives $0.972$ — barely better than a single $0.97$ engine, because now two engines failing (which engine-out does not survive) is no longer rare: $\binom{9}{2}(0.03)^2 \approx 0.032$, a 3% chance. The lesson: redundancy multiplies the reliability you already have; it does not manufacture it from nothing. Nine mediocre engines with single-engine-out are not much better than one mediocre engine. The strategy works for Falcon 9 because each Merlin is itself a highly refined, heavily tested, flight-proven engine — the redundancy is the icing, and per-engine reliability is the cake.

Discussion Questions

  1. Explain, in mass-and-cost terms, why "just add more engines" is not a free way to buy reliability, even with engine-out. (Hint: what does each engine cost you in dry mass, and how does the rocket equation punish that?)
  2. Falcon 9 can tolerate more engine-outs early in flight than late. Why does the number it can tolerate change over the burn? (Think about thrust-to-weight and remaining delta-v.)
  3. The binomial model treats all nine engines as identical and independent. Name two real effects that violate each assumption, and say whether each makes the true reliability higher or lower than the model.
  4. A reviewer says "engine-out capability means an engine failure is a non-event." Push back using the idea of a performance reserve: what must the stage carry to make an engine-out survivable, and what does that cost?

Your Turn: Extensions

  • Option A (analysis). Recompute all three cases ($\ge 9$, $\ge 8$, $\ge 7$ of 9) for $r = 0.995$ and for $r = 0.98$. Tabulate the nine results and describe how the value of engine-out changes with per-engine reliability.
  • Option B (computation). Extend the k_of_n code to a Falcon Heavy-style 27-engine cluster. Compute the reliability for "all 27," "at least 26," and "at least 25," at $r = 0.99$. Does engine-out matter more or less as the cluster grows? Explain the trend. (Hand-trace; add # Expected output:.)
  • Option C (design). Suppose an engine failure has a 10% chance of being non-benign (damaging a neighbor). Modify the model: with probability 0.10 a single failure becomes a double failure. Estimate the corrected $R_{\ge 8}$ and discuss how much the containment design is worth.

Key Takeaways

  1. More engines is less reliable when all must work ($0.99^9 = 0.91$) and more reliable with engine-out ($\ge 8$ of 9 $= 0.9966$). The design choice, not the engine count, sets the reliability.
  2. Each tolerated failure adds roughly a "nine" by pushing the loss condition onto the improbable tail of the binomial distribution.
  3. The math assumes independence and benign failure. A non-benign (cascading) failure is a common-cause event that collapses the cluster back into a series system — the N-1's fatal flaw.
  4. Redundancy multiplies existing reliability; it cannot create it. The payoff of engine-out depends on each engine already being excellent, which is bought by design, margin, and relentless testing.