Getting out on a bad day

A look at new egress options for NASA astronauts on launch pad

Some days, you want to stop the rocket and get off. I know the feeling. My crew’s STS-68 countdown in 1994 ended in lots of smoke but only five seconds of fire. A last-second engine shutdown left us still on Earth, swaying atop a fully fueled space shuttle — a volatile bomb, really — unsure of whether flames were climbing our orbiter or our fuel tank was coming apart. I unstrapped to help crewmate Jeff Wisoff prepare Endeavour’s hatch for opening, the first step in a possible emergency egress by our six-man crew.

We knew the risks of space travel wouldn’t begin with the moment of liftoff. Astronauts on the launch pad sit, sometimes for hours, atop hundreds of tons of stored chemical energy. A pad emergency can threaten a crew’s safety as surely as a micrometeoroid strike or a damaged heat shield.

Ground emergencies like the 1967 Apollo 1 cabin fire, a 1983 booster fire that nearly engulfed the Soyuz T-10a crew, and the explosion of an unmanned Falcon 9 rocket during fueling in September 2016 remind us all that the design and function of ground safety and egress systems are critical. A delay of seconds can mean the difference between survival and immolation.

As the industry gets ready to field two new, commercially owned spaceships, the contractors are working hard with NASA and former astronauts to give crews something we never had during the shuttle program: multiple options to escape from a looming catastrophe on the launch pad — in short, a sure way out on a bad day.

Safe transports

The SpaceX Crew Dragon and Boeing CST-100 Starliner will ferry NASA astronauts to the International Space Station and will later be adapted to carry private passengers and workers to open low Earth orbit to tourism and industry. To perform the ISS missions, these spaceships must meet NASA’s exacting human spaceflight safety standards.

Under NASA’s Commercial Crew Program, which is helping to fund the new spacecraft, agency engineers were not involved in establishing the detailed designs, but instead left it up to the contractors to choose how to meet the agency’s requirements. NASA’s ISS crew transportation requirements document, CCT-REQ-1130, says among many safety specifications that crews must be able to exit their spacecraft in less than 90 seconds. How contractors meet these requirements is up to them. “They can come up with their own, innovative design solutions to meet our requirements,” says Kathy Lueders, NASA’s commercial crew program manager.

Getting out fast

In SpaceX’s Crew Dragon, astronauts would lie on their backs, four abreast for launch from Kennedy Space Center in Florida. If the crew’s safety were threatened by a spacecraft or Falcon 9 malfunction, they’ll have three options for escape. They could exit via the outward-opening side hatch, cross the crew access arm to the gantry, descend the elevator to the pad surface, and drive away in an MRAP, a mine-resistant, ambush-protected personnel carrier. NASA obtained two, surplus from the Army. Second, the four could walk across an access arm 80 meters above Pad 39A and to the opposite side of the gantry. They would jump into escape baskets (the same ones provided for space shuttle egress), and zip down the slidewires to ground level and drive away. SpaceX’s choice of Pad 39A gave it the option of employing this shuttle-heritage hardware. Finally, for a fast getaway, the crew could activate Crew Dragon’s rocket-powered launch abort system, riding the capsule to a splashdown offshore.

Veteran space shuttle and space station astronaut Garrett Reisman, now SpaceX’s director of crew operations, says the company examined past pad failures, including Russian experience on Soyuz, in designing its ground safety and egress systems. On STS-68 and other missions, crews had only the basket-and-slidewire option on Pad 39A or B to escape a shuttle ground emergency. “The way we’re safer than shuttle is that we have a launch abort system that is enabled before we ever flow propellants to the vehicle. You and I sat on a fully fueled shuttle where the fastest way of getting out to safety was a slidewire basket. A Dragon crew will have the option to punch off the rocket in under a second and get out of there. That’s a huge advantage that we didn’t have, but that crews did enjoy in Mercury, Gemini and Apollo.”

After last September’s spectacular Falcon 9 explosion during propellant loading, SpaceX CEO Elon Musk tweeted about the fireball: “Dragon would have been fine,” he typed, referring to Crew Dragon. SpaceX maintains that a May 2015 test of the Crew Dragon launch abort system showed it’s ready to save a future astronaut crew.

Escape from Starliner

The blast danger area, called BDA, for an Atlas 5 booster for Boeing’s CST-100 Starliner has a radius of about 400 meters (1,340 feet) centered on Space Launch Complex 41, the pad at Cape Canaveral Air Force Station near Kennedy.

Chris Ferguson, a former shuttle commander and now director of Crew and Mission Operations for Boeing’s commercial crew effort, says that the United Launch Alliance and Starliner teams were highly motivated by past pad emergencies, like the Apollo 1 fire, in designing its egress systems. “When you bear the scar tissue of an accident, it stays with you,” he says.

Ferguson explained that the Starliner crew will strap in at L-2.5 hours in the countdown, after Atlas 5 fueling is complete. Ground crews will close the hatch at L-1 hour and leave the pad. At L-9 minutes, the crew access arm will swing away from the spacecraft, nestling against the gantry.

Inside L-4 minutes, the Starliner’s pusher-rocket launch abort system will become active, enabling a near-instantaneous escape from the blast zone.

Should a ground egress be necessary, the access arm would swing back to the spacecraft in just 15 seconds. “It’s really moving out there,” says Ferguson. The crew, seated three across with a fourth just beneath in the CST-100, would swing the hatch outward. In 1967, a clumsy, three-piece, inward-opening hatch trapped the Apollo 1 crew; since then, all American spacecraft egress hatches have opened outward.

Once through the hatch and across the access arm, the crew would clear the danger area riding a simpler version of the shuttle’s slidewire system. To minimize the modifications necessary to the Atlas 5 pad, the ULA/Boeing team chose an off-the-shelf slidewire harness, the ZipRider, from Terra-Nova, a recreational equipment vendor. Ground crews and astronauts would strap on individual seats and start down from 52 meters (172 feet) above the pad deck, reaching speeds of 65 kph (40 mph) during descent. Riders slow to a safe stop with a manual brake or by hitting a 10 m series of spring dampers at the end of the cable. At the end of the line, the crew would pile into an MRAP and drive to a collection point.

Boeing’s Starliner, like the Crew Dragon and NASA’s new Orion deep-space module, has a launch abort system to call on if an emergency develops too quickly to allow ground egress. But the abort option should be a last resort: Rocketing off the pad to safety would likely destroy the structural integrity of the booster below and possibly ignite its propellant load.

“I’d prefer to walk out if I can,” says NASA’s Eric Boe, one of the astronauts training to fly 2018 test flights on the new ships. “But if it looks like the situation’s going to become catastrophic, I’d much rather get away in a capsule than be trying to get down a slidewire.” The industry teams “are definitely taking space shuttle standards to the next level, adding additional capability if something goes wrong. The shuttle was ahead of its time, but one of the challenges of its design was that it rode right alongside its stack of boosters and fuel tank — there was no good way to get off the vehicle if something happened during launch.” By contrast, the new launch abort system designs offer crews an out from the launch pad all the way to orbit. “Think of it as a collective ejection seat,” says Boe.

Test … and test again

For a minute or so after Endeavour’s STS-68 engines shut down, my crew was physically ready to exit the orbiter and hustle across the swing arm that had just arrived outside our hatch. It was our only escape route; the shuttle had no rocket-driven pad abort option. But launch controllers were able to verify a safe shutdown — no fire, no imminent explosion. We stayed put inside Endeavour.

STS-68 was the last shuttle pad abort, and thankfully, we did not have to ride the slidewire. But a future commercial transport crew will likely face a critical pad emergency. Their lives will depend on NASA’s exacting review of egress and safety system designs, and rigorous tests proving they’ll function on the day when they must work.

NASA expects that the commercial transports will be ready for their first piloted tests in early 2018. But no one is going anywhere on a Crew Dragon or Starliner until their ground egress and safety systems are proven. Says Lueders, “We want them to fly only when they — and we — are ready.”