Launch Aborts Challenge Rocket Engineers
While companies design and perfect spacecraft and rockets to take people into space safely, teams of NASA engineers are deciphering what needs to happen if a launch goes wrong.
In other words, what kind of ejection system will astronauts need to survive?
"We're trying to give the crew that last option for when things go bad," said Brent Jett, deputy director of NASA's Commercial Crew Program, or CCP, and four-time space shuttle astronaut.
Keep in mind that the system needs to work at all points during ascent, from the launch pad where the air is thick and the spacecraft is not moving at all, to more than 100 miles above Earth, where there is no discernable air and the spacecraft and crew are speeding along at 17,500 mph, or about 5 miles a second.
Also, consider that because rockets can malfunction and even explode within a second of the first problem, the ejection system needs to be able to spot a problem and get the spacecraft out of danger before it's too late.
"Basically, you're separating from the rocket with a smaller rocket and it's a pretty extreme environment to put the crew into," said Chris Gerace, deputy chief of CCP's Systems Engineering and Requirements Office.
Setting up requirements for an abort system and designing a reliable one are no afterthought for engineers.
"This is one of the biggest emergency systems in the overall architecture of the commercial transportation system," said Don Totton, a CCP systems engineer.
"It was definitely in my top five on my list in terms of making sure we got it right," Jett said.
NASA's work in the next generation of spacecraft abort systems is significantly different from past programs. Instead of designing a specific system for a given craft, the engineers are drawing objective requirements that private companies must meet to be considered for NASA missions.
"We ask ourselves, is it necessary and is it achievable," Gerace said. "It's always important to look at what you want with those two questions in mind."
The agency also is funding some of the design work for the companies while offering its own extensive expertise under other partnerships, known as Space Act Agreements.
"To me, these guys are being very innovative," Totton said. "They've all taken such different approaches and our requirements allow that. We've given them a lot of flexibility."
The criteria range from showing that the escaping spacecraft will not run into a tumbling or exploding rocket to proving that the escape will not put the astronauts through more than 15 g of force or pressure, or 15 times the force of gravity.
The crew also has to have a chance to override an abort command, or begin one even if the flight computer doesn't sense a problem. The astronauts also will be able to take control of the spacecraft's flight after computers handle the initial separation from the rocket. That will give the flight crew the ability to navigate through the complex realm of entry. Whoever is at the controls, whether it is a person or a computer, has to position the heat shield properly in an abort and slow the craft down safely so its parachutes can be deployed or land on a runway.
"Probably the only things we get in today that does not have a human being ready to step in and take control of that system is a monorail system at the airport or an elevator," Jett said. "Everything else we get into for transportation – airplanes, trains – the human always has the ability to insert themselves into the system."
Finding the right requirements was a new challenge for NASA, engineers said.
"We're not designing a launch abort system, what we're doing is, we're saying, given the requirements and the goals that we're trying to achieve, what are the objectives that an abort system needs to achieve," Gerace said. "What we struggled with was, OK, how do we describe in objective terms what it is we're trying to do?"
Totton said the team focused on aborting safely from two failures: if the rocket's thrust is suddenly lost or the attitude vector veers off course.
"If it's sized properly for those failure modes at all points in ascent, we're going to get a very robust system," Totton said.
To meet those requirements, designers at individual companies are developing powerful rockets and computer networks that can sense trouble and then carry the whole spacecraft and crew away from the failing rocket to a safe landing. It will be up to NASA to judge whether they will work.
"The type of abort system individual companies choose will depend on a variety of engineering design factors. Ultimately, it's about what approach is most efficient to meet requirements for a safe abort for their integrated spacecraft and rocket configuration," said Wayne Ordway, CCP's associate director and manager of the Spacecraft Office at Johnson Space Center in Houston.
There have been at least three occasions when a launch abort system was or would have been triggered. The Russian Soyuz spacecraft and rocket fired their escape rocket on two occasions and successfully rescued the crew, one of which from an explosion on the launch pad. In 1986, the space shuttle Challenger broke up during ascent when a joint on one of its solid rocket boosters failed to seal and exhaust leaked out and ruptured the external fuel tank.
The space shuttle did not use a dedicated launch abort system, but was programmed with abort modes that would allow it to return and land safely in certain scenarios.
Each of those cases offer little to today's designers. Very few specifics are known about the Soyuz aborts, so it's hard to use them to confirm computer models, Totton said. In the case of Challenger, the space shuttle is such a different design from the designs under consideration that it is wouldn't be useful to compare them.
In the past, NASA incorporated rockets on a tower above the capsule for Mercury and Apollo. The launch escape system for Apollo used a solid-fueled rocket that, at 200,000 pounds thrust, was more powerful than the Redstone that launched Alan Shepard into space. Those designs are generally known as "tractor rockets" because they pull the spacecraft away from the rocket. The rocket is jettisoned before the spacecraft reaches orbit.
Designs with the rockets below the spacecraft are known as "pushers."
Each system has advantages and disadvantages compared to the other. For example, an Apollo-style tractor rocket mounted atop the capsule can allow more mass to be taken into orbit, Totton said. A tower also ignites quickly and builds up its thrust very fast to escape danger. On the other hand, if there is not an abort, the tower is thrown away.
A pusher system, with all the weight of the spacecraft above it instead of below, can put more pressure on the computers controlling the abort during the critical first second or so when the spacecraft is getting away from the rocket.
Think of balancing a baseball bat on the palm and how many adjustments it takes to keep it balanced.
On the plus side, the engines and propellant not used in an abort can still be used by the spacecraft once it reaches orbit. SpaceX, for example, has expressed interest in using the engines at landing to make pinpoint returns to a pad on Earth after a mission.
"A pusher becomes very synergetic to the overall mission," Gerace said.
Previously, liquid-fueled pusher engines were not practical for an abort system because they didn't build up thrust quickly enough. Jett said engine technology advances have closed that gap, though.
Boeing and engine maker Pratt & Whitney Rocketdyne successfully tested the Bantam abort engine that is the basis of a pusher escape system. NASA's Orion spacecraft performed well in a test of its escape system, a traditional tractor rocket tower.
Sierra Nevada and Blue Origin also anticipate using pusher systems. NASA is working under unfunded Space Act Agreements with three companies, including United Launch Alliance, which is determining what will be necessary to make its Atlas V rocket acceptable to launch people. ATK and Excalibur Almaz also are working with NASA through unfunded agreements.
While deciding whether and how an abort would work during launch, designers also will examine the warning system in the rocket itself.
"That design process is every bit as important as the launch abort system design," Gerace said.
They want to make sure the flight computers have the right information to find out if something major is wrong, but not so much information that a perfect flight is accidentally abandoned.
The Apollo flight computers looked at between nine and 13 things during a launch to determine if the flight should be aborted. Space shuttle main engine computers looked at dozens of things several times a second and modern rocket computers can add more to that.
"In selecting abort triggers, we have to balance the risk between performing the abort and not aborting when we don't need to," Totton said.
The next generation of U.S. spacecraft is not expected to venture into space with people on board until 2015 or so, but there is plenty of work for designers as they refine their launch abort strategies.
NASA will evaluate the systems as they progress, including using state-of-the-art blast modeling that can tell engineers how a rocket malfunction will progress and whether a spacecraft's abort system will withstand the effects.
Since engineers are putting in hundreds of hours developing and testing these escape systems, could that time be better used improving the design of the rockets and spacecraft themselves so an escape system isn't needed?
"No," Gerace said. The reason is that rocket designers can achieve a 95 percent success rate to start with, but each percentage point above that is extremely expensive and still leaves a chance for failure at some point, even if it's one failure in 35 or 40 launches.
So, building something into the rocket that allows the crew to survive that one failure is cheaper than designing a foolproof rocket, even if it comes dozens of launches into the program.
"By having an abort system that's highly effective, we're able to increase the safety of the system, the overall system, by an order of magnitude," Gerace said.
Steven Siceloff, KSC