Wayne Hale's NASA Blog: Black Zones


Black Zones - part 1

In the 1950's it seemed like almost all of our rockets exploded during the launch. There were a lot of spectacular failures in those days and successes seemed rare. As we considered putting a man in a capsule on top of one of those rockets it was obvious that something was needed to get the pilot out of a bad situation in a hurry.

During the Gemini program, that method of "crew escape" consisted of ejection seats which were only slightly modified from those found in that era's military jet fighter aircraft. This left a lot to be desired as we shall see.

But Max Faget, the innovative genius behind much of the engineering progress in NASA's early days, had a brilliant idea. He invented something called the launch escape rocket system. A cluster of solid rockets attached to the top of the crew capsule could be activated in an emergency to pull the capsule and crew away from a disaster and let them use their normal recovery parachutes to land safely.

This was such a good idea that even other countries adopted this plan. On September 26, 1983, with their rocket exploding below them on the launch pad, the crew of Soyuz T-10-1 was whisked away from almost certain death to fly again another day. Gennady Strekalov and Vladimir Titov owe their lives to Max Faget . . .and a whole bunch of Russian rocket designers who built that launch escape system for the Soyuz spacecraft.

So Mercury and Apollo and the in-design Orion spacecraft use Launch Escape towers. In fact there is a test of the new launch escape rocket system for the Orion scheduled for next week out in Utah.

The shuttle, of course, adopted a different philosophy; a philosophy that, like a commercial airliner, "passenger" safety was provided by bringing the entire ship home safely. More about that in a later post.

Today I want to talk about ejection seats. Gemini had ejection seats and so did the shuttle for the initial flights. I don't know much about the Gemini seats but the shuttle ejection system used on the first four flights was the best there was at the time. And it wouldn't have done much good.

The shuttle ejection seats were taken from those used on supersonic military aircraft. Ejection at supersonic speeds has always been dangerous, probably life threatening. It is best if the ship holds together to get to subsonic speeds where survival is much more likely. At supersonic speeds, hitting the airstream is like hitting a brick wall. Not good. It may be the best option if you are facing certain death by riding a disintegrating ship, but even then it is not a great choice. The shuttle ejection seats were really there for the late stages of landing. If that big glider of an orbiter couldn't make it to the runway, better to eject and bail out than try to crash land on rough territory. In that scenario having ejection seats actually made sense. In a later post I'll talk about the entire entry regime, but just note that from the altitude of about 100,000 ft or lower and speeds from Mach 3 on down, the seats would probably have worked as advertised. An ejection at, say, 10,000 feet and subsonic speed would have been a very good bet in a that situation.

How about using the shuttle ejection seats on ascent?

Not good.

For example; an ejection on the launch pad would not get high enough for the parachute to open in time. Yep, you'd hit the ground from a few hundred feet altitude with the chute still unfurling. Not recommended. If your rocket was in the process of blowing up (remember Titov and Strekalov?) the blast overpressure would still be fatal at the distance the ejection seat would push you. As a final insult, the "landing" would be in the flame trench. So, an ejection off the launch pad was not a good idea for a shuttle crew.

During ascent, the capcom made the call "negative seats". This occurred as the shuttle climbed above 80,000 feet. At that altitude the ejection seats would still work, and the pressure suit had sufficient oxygen get back down so you may ask, why was that a limit? Because an analysis of the speed and trajectory above that point resulted in enough air friction heating to melt the plastic faceplate of the helmet. And probably other things we didn't analyse. But the basis for the call was the melting of the faceplate. So about 90 seconds into flight the ejection seats were useless and until at least 10 seconds into the flight there was not enough altitudefor the chutes to open. So if you ejected in those "safe" 80 seconds? Toasted by the solid rocket booster plumes going past you. If the stack held together and didn't have "an overpressure event" or send shrapnel headed your way.

Nope, ejection seats during shuttle launch was not a good way to get out of a tight spot.

The Gemini situation was probably better in some ways, but still not great. Some retired Gemini engineer will probably post a comment with that information.

So all you future rocket designers please note: launch escape rockets are the way to get out of a bad launch situation.

Of course, the best thing is that your rocket should never to explode. But what are the odds of that?

Stay tuned for more discussion of this fascinating subject.

Black Zones - Part 2

The speeds and energy required to achieve earth orbit is almost beyond conventional understanding. To maintain a low earth orbit, a satellite must travel at over 5 miles each second. At even a fraction of those speeds in the "lower" atmosphere (below say, 80 miles high), air friction converts that vast kinetic energy into tremendous heat. Thus meteors or re-entering space junk are vaporized in a flash.

It is not enough to get to orbital altitudes where there is negligible air friction, getting to speed is critical to establish an orbit. To compare with commercial air travel may be helpful. Typical airline travel is around 6 miles high (30,000 feet or higher). Typical airline speed at cruise is around 500 miles per hour. To be in a safe orbit, a satellite needs to be 20 times higher (120 miles is safe for a few weeks) and going about 40 times faster (18,000 mph). But energy, the real measure of the difference, is directly related to height (altitude) but is the square of the speed. So to achieve earth orbit requires 1,000 times the energy that an airliner has at cruise. Do the math.

This partly explains why war-surplus V-2/WAC Corporal rockets could reach orbital altitude in the late 1940's but it took another decade to develop rockets that could not only get that high but propel a payload to the extreme velocity required for earth orbit.

Satellite launchers seek the most efficient way to get to orbit -- they want to use the least "energy" to get the most payload to orbit. Simplistically, one would want to get to altitude first, then accelerate, accelerate, accelerate. So most expendible satellite launch vehicles go high early and then pitch over toward the horizontal for the largest part of the rocket burn.

Unfortunately, this does not work well if you want to protect a crew from a failure of the rocket. Because a steep, suborbital ballistic reentry leads to extreme heating and extreme g-loads. This is not obvious, so lets examine this closely.

In a typical planned re-entry, the capsule or shuttle enters at a fairly shallow angle so that it encounters thicker atmosphere gradually. As the re-entry proceeds, the speed (kinetic energy) is bled off gradually limiting the maximum heating temperature and holding structural loads relatively low. For a suborbital ballistic type re-entry, the trajectory is quite steep, encountering the denser parts of the atmosphere while the speed and energy is quite high leading to a high heat impulse and very high structural loads.

The trajectories for manned spacecraft try to avoid these steep re-entries even on an emergency case. For complete loss of thrust this is not always possible. The one real life case turned out moderately well. On April 5, 1975 the crew of what would be known later as Soyuz 18A, Vasili Lazarev and Oleg Makarov, were more than half way to orbit - at altitude and about 10,000 mph - when their second stage refused to be jettisoned. During a normal Soyuz entry, decelerations of 5 g are normal. Due to the steep angle of the Soyuz 18A abort trajectory, the crew endured up to 21g. Fortunately they survived, the capsule did not break up and they landed safely. But the two crew members never flew in space again.

An expendible rocket sending a satellite on a one way trip to orbit optimizes its trajectory by lofting high early on. If an engine fails, the mission would be lost no matter what the trajectory; abort modes and crew rescue are not a consideration. There has been some speculation that if an EELV were to be used to power the Orion capsule into orbit, there would be large parts of the trajectory where early aborts would cause loss of the capsule and crew during re-entry: the dreaded black zone. By adjusting the launch trajectory lower, these black zones can probably be eliminated -- but at a cost. The cost is performance: mass to orbit is decreased by flying a safer, more depressed trajectory.

The shuttle flies a trajectory that is more depressed than expendible launch vehicles> This allows for potentially graceful abort trajectories following a premature engine shutdown. After the Challenger, the first shuttle flight followed an even safer "abort shaped" trajectory -- but the performance price was too high to pay for long and all subsequent flights have gone back to the standard shuttle launch trajectory. Which itself is not nearly as steep as the expendible rockets fly.

Recent computer analysis from the Apollo missions had lead many analysts to conclude that the moon launch trajectories did not avoid all black zones. More on this tomorrow.

Black Zones - Part 3

The basic assumption for the shuttle design is that the shuttle would be like an airliner: no ejection seats, no parachutes (except for the first test flights) -- crew safety consisted in total vehicle safety and the crew riding the vehicle down to a runway.

In retrospect that was a very poor assumption.

Adding crew escape to the space shuttle has received tremendous attention over the years and there are actually some methods that might work. Not to put too short a discussion on it, the problem with all of the best methods is the additional weight. After adding the crew escape system (capsules, rockets, whatever) and ballast to get the center of gravity right, there is no payload capacity left. The shuttle would become a huge crew transportation device with no capability to carry much of anything else up or down. Not to mention the pricetag to develop some of these devices! Wow. So, in the final analysis, the best way to make the shuttle safer is to retire her as soon as possible and go to a different type of vehicle. Sorry but there it is.

Actually, the shuttle does have a minimal crew escape capability. If the shuttle gets to a straight and level glide (actually not very level since the shuttle glides mostly like a rock), then down at 30,000 feet or less the the crew can jettison the side hatch and bail out with parachutes like some WWII bomber crew. This is better than ditching in the ocean or rough terrain. All studies show touchdown "off-runway" would not be survivable. So the subsonic, aircraft-in-control, bailout is all there is. And in most cases the crew probably winds up sitting in a tiny inflatable rubber raft in the middle of the North Atlantic waiting for somebody to pick them up. Not a lot of fun.

But the shuttle does have a remarkable capability that most other rockets do not. In virtually all expendable rockets, if any one of the booster engines shut down prematurely -- even if that shutdown is benign -- the mission is over, the payload is going into the ocean somewhere, and the Flight Control Officer is going to "send functions". On the other hand, the shuttle is designed -- required -- to be able to safely return the orbiter, crew, and payload to a runway landing following the benign shutdown of any one of the three SSMEs.

A word about "benign". High performance liquid rocket engines have a tendency to come apart in a hurry if something goes wrong. The SSMEs have been extensively instrumented and tested. Their computer control brain has a number of ways to detect an impending failure and turn the engine off before it comes apart. The system is not completely foolproof, but should prevent an explosive catastrophe in most cases. The only SSME premature shutdown in flight history occurred in 1985 on STS-51F when faulty temperature sensors erroneously indicated a problem with the engine and the computer shut that engine down. This occurred late enough during the boost phase that the mission continued to a completely successful conclusion. After that flight we spent a lot of time building more reliable temperature sensors.

So if any single SSME shuts down prematurely at any point in the launch phase, a safe return of the shuttle and crew will result. All the various options have been examined, simulated, and verified by computer analysis, wind tunnel testing, etc., etc., etc.

From launch to about 4 minutes into flight the shuttle can perform the scariest type of abort - a Return to Launch Site abort (RTLS). Prior to the first shuttle flight, somebody proposed that we do an RTLS on purpose as a test -- they called it the "Sub-Orbital Flight Test (SOFT). Capt. John Young, the chief of the astronaut office and the commander of STS-1 was noted for his colorful memos that he would regularly send on topics of the day. The SOFT proposal drew a classic response: "RTLS requires continuous miracles interspersed by Acts of God to be successful" John wrote in 1980. And in fact, on STS-1, a trajectory bug lofted the shuttle trajectory higher than expected and an RTLS probably would not have been successful.

Since those days, RTLS has been significantly improved and would most likely work -- but I'd just as soon not find out. In particular the separation from the External Tank is very tricky. 'Nuff said on that subject.

From about 2 1/2 minutes into flight until almost orbital insertion loss of an SSME could result in a Trans-Atlantic Landing abort (TAL). The shuttle keeps going forward but aims for Europe rather than orbit. The entry is very similar to a normal end-of-mission entry and the landing would occur at a prepared runway in Spain or France (in the early days we also had landing sites in west Africa).

Later in flight, from about 4 1/2 minutes on, loss of an SSME would result in an Abort To Orbit (ATO) where the shuttle presses forward and we try to scavenge out all the propellant in the External Tank to go on to orbit. Sometimes a dump of propellant from the Orbital Maneuvering System is required, sometimes other adjustments to the trajectory are required, but ATOs can range from landing after a few orbits on launch day to having a fully successful mission depending on many variables. The longer the main engines run, the closer to normal the shuttle can get.

The Abort Once Around (AOA) mission - which is exactly what it sounds like - is basically not used these days except for problems like a big air leak from the crew cabin.

Now all of that is fine as long as two of the three SSMEs continue to operate and the shuttle remains under control. If control is lost, then all is lost since the shuttle does not fly sideways very well. A capsule might right itself, but the shuttle will break up.

If two of the SSMEs quit but one remains running, there are some options to steer toward the east coast of the United States and land at an emergency airfield somewhere on the Atlantic Coast of North America. However, many of these trajectories result in entry conditions that exceed the capability of the shuttle orbiter either thermally or structurally: black zones. The possibility of executing a successful East Coast Abort Landing (ECAL) is far from guaranteed, but in that situation it is worth a try. What is the other choice? If the shuttle doesn't break up or burn up on the steep ballistic trajectory for an ECAL there is every reason to believe that a safe landing will occur. That is sort of a big "if", however.

If three SSMEs quit all at once, there is real trouble. There is little to no way to control trajectory and the black zones get immense. In some lucky cases a successful ECAL might result but then you are not really having a lucky day if all three engines quit, are you?

My least favorite abort is a low alpha (low angle of attack) stretch to try to cross the Atlantic and make it to Ireland or someplace. These multiple-engine-out aborts result in extreme heating on the wing leading edge and the RCC panels are likely to fail. Another thing to try if there are no other options.

And of course, if the whole stack comes apart, its game over. Don't even talk about a failure of a Solid Rocket Booster, either.

So the shuttle has a lot of capability compared with other rockets -- and a lot less capability than any capsules.

More black zone discussions tomorrow.

Black Zones - time out for Q&A

I have really appreciated all the questions and comments to my mini-series of blogs on Black Zones. I am not done with the series yet, but I thought it was time to address some of the questions and comments.

First of all, not to be too grumpy, but I have to set a couple of new blog comment rules. I have received a number of comments that are frankly undecipherable. They are either written by non-English speakers or some type of computer program that strings together English words at random. So my rule is if the comment is unintelligible and/or the grammar and spelling are so bad that most readers could not understand them -- I won't post them. Clear enough? My grammar and spelling aren't perfect and I won't hold you to perfection either, but it has got to make sense or it doesn't get posted. If your comment didn't get posted, that is most likely why.

Second grumpy new rule: I don't do UFO comments. I have no patience for these things, don't even try to start here. Go someplace else with your UFO comments. I will not post them here. This is my personal preference and should not reflect on the agency or anybody else.

Thanks, I'm glad to get those off my chest. On to serious comments.

No, there was no serious entry guidance anomaly on STS-1. There was a significant lofting during ascent, but nothing to speak of during entry. STS-2, 3, and 4 entries were flown automatically not manually with the exception of some short duration pilot test inputs to stimulate the entry flight control system to verify its robustness. Some of these type of manual test inputs continued for a number of flights. But there have been no manually flown entries of the space shuttle -- its all been automatic until subsonic speeds.

At this date in the shuttle program, it is my belief that the bugs have been worked out of all the intact abort modes. That is, for any single SSME premature shutdown, there is a very high confidence level that the vehicle and crew can successfully execute an RTLS, TAL, ATO. The big assumption, though, is that nothing else goes wrong. The shuttle requirement -- which I believe it meets -- is that any single premature SSME shutdown at any point in the trajectory will lead to an intact abort -- safe landing by the orbiter on a runway and safety for the crew.

I was pleased to see a post with the details of the Gemini ejection seats, but I would think that landing a mere 700 feet from an exploding Titan II rocket would not be a good thing. Survivable if the wind was blowing the right way probably. And I do agree that Schirra showed that he had the right stuff when he did not pull the ejection handle on Gemini 6A pad abort.

I probably should have started the series of posts with a definition of 'black zone' so here it is: a portion of a manned rocket launch trajectory where the premature shutdown of any or all running booster engines will lead to loss of the re-entry vehicle and crew subsequently due to the over temperature or structural loads incurred from the resulting trajectory. Is that too muddy? Black zone does not mean what is going to happen in a normal case, only if an engine (or two or three) quits. Black zone does not take into account the weather at the proposed abort landing site which is another way to kill a crew.

As to why EELVs were not chosen by the Exploration team early on -- I don't think black zones had a lot to do with it, but I really don't know. I should ask and I will ask and I will report to you at a later day. However, the standard trajectory design for EELV launches would result in extensive black zones -- which can be either greatly reduced or eliminated by adjusting the trajectory -- which in turn leads to significant reductions in the mass which the EELV could place in orbit.

The two early American suborbital flights -- Shepard and Grissom -- had carefully designed trajectories to keep the entry G level and heating relatively low. If they had flown the type trajectory that the redstone rocket used as a weapon, that would not have been the case. Similarly, the Soyuz T-10-1 high altitude abort had an extreme entry G level because the rocket staging went so poorly that the entry was steeper than it would have been for a clean abort -- as if the 3rd stage engines had merely failed to light off.

Well, that's all for today folks. The series resumes tomorrow.

Part 4

I keep meandering around on this topic and if you get confused, I'm sorry about the writing style.

Just to review the story: Mercury, Apollo, Soyuz, Shien-Zou, and the Orion all use launch escape towers for crew safety. Gemini used ejection seats. The shuttle famously does not have a crew launch safety system although it had ejection seats for early flights for problems during entry and now has a bail-out pole and parachutes for problems resulting in not being able to reach a runway.

I will discuss re-entry safety in a later post; I know a lot of folks are interested in that, too.

Of course a launch escape tower does not provide complete safety. For example, off the pad or very early in the launch of a Saturn rocket, the launch escape system would get the astronauts away from the rocket, but the Apollo capsule would land on the beach. Those capsules were not rated for anything other than a water landing so crew injury potential was high. Similarly, there was a tremendous concern about running into the launch umbilical tower shortly after liftoff. In some of those scenarios, the launch tower might not be effective in getting the capsule away.

At a certain point in the launch sequence the escape tower is jettisoned. Survival here depends on several factors. First of all, that the launch vehicle failure still results in the spacecraft being pointed in the direction of travel. As we saw in the Soyuz 18A story, the third stage firing with the second stage attached resulted in large attitude excursions and a subsequent flight direction that resulted in far higher loads than a controlled abort at that point should have. A real spin up of a launch vehicle would probably overwhelm any of the launch escape systems ever designed.

Second, after launch escape tower jettison, for multi-engine rockets, the capability must exist for all the running engines to be shut down. So if you have an engine out case and everything is still holding together but you cannot shut the remaining engines down perhaps due to an electrical fault, generally the capsule cannot get away. There must be a rocket engine to separate the capsule from the failed launch vehicle, but many times these are relatively small. For example, the Gemini Orbit Adjust Maneuvering System (OAMS) provided such slow acceleration that even with one engine out on the Titan II second stage, the capsule could not get away. Mercury used very small separation rockets with the option to fire the solid retro rocket package, but these could not overcome the acceleration of even the Atlas sustainer engine burning alone. So attitude control upsets which in themselves can be caused by electrical faults, coupled with the inability to shut down the upper stage engine(s) - again could be the same electrical fault - could lead to very bad outcomes. On the other hand, Apollo with its huge Service Propulsion System (SPS) engine -- designed to launch the CSM off the moon when direct flights were envisioned -- had enough oomph to get the Apollo capsule out of almost any circumstance.

All that being said, a capsule with moderate rocket engines and a launch escape tower on top of a long slender rocket is much safer than any tandem design like the space shuttle.

The space shuttle is safe if any single SSME prematurely shuts down and both of the other engines keep running AND the attitude control system is functional AND there was no debris generated in the engine shutdown that affects the orbiter's heat shield. That is quite a bit of difference. One of the reasons for the difference is that the cargo - up to 30 tons - goes everywhere the crew goes.

In the current design for Ares/Orion, the cargo goes up on a separate rocket. This allows for improved crew safety, but at some operational cost -- the crew capsule must rendezvous with the cargo on orbit before any work can commence.

Two other quick points. One person wrote a comment that the SSMEs are so reliable that we could quit worrying about one shutting down in flight. While the engine designers and builders are justifiably proud of the extraordinary reliability of the SSMEs, nobody that has studied them in detail rests easily. Too many parts are rotating at too high speeds, combustion is taking place at too high temperature and pressure for anybody to not keep their fingers crossed for the entire duration of engine firing.

Second, a number of folks have wondered why we did not put a crew escape system on the shuttle. Various systems have been proposed, a number have been studied to a high level, and a couple of designs have been looked at in detail. Ejection seats have been rejected for reasons I mentioned earlier. Putting the crew in a capsule in the payload bay that could be separated has received a detailed examination. Some of the limitations associated with this proposal can be easily imagined. Another idea was to separate the crew module with large solid rockets away from the rest of the shuttle in a launch emergency. And there have been others. The problem with designing in these solutions to an already flying vehicle is that none of them are as reliable as we would like; all of them are very heavy and drive the center of gravity out of an acceptable region, and they all cost an incredible amount of money to retrofit in. So, none of them have been implemented.

Any winged orbital vehicle under consideration needs to have a serious capability for crew escape designed in from the beginning. As to vehicles which are carried aloft by other aircraft for their launch; crew (and passenger) safety in that environment has its own challenges and is going to be neither a simple nor cheap capability to design into that type of vehicle.

I think this rounds out my discussion on Black Zones for launch and how they affect spacecraft design. All you guys out there working to design a spacecraft, keep these points in mind.

Please follow SpaceRef on Twitter and Like us on Facebook.