Range Safety
The question of safety was always paramount at KSC and usually involved much intercenter negotiation, as well as long study sessions with the Air Force. The possibility of the space vehicle colliding with the umbilical tower during launch touched off a study in mid-1962. The LOC group concluded that the Saturn I's proposed emergency detection system would not catch all possible failures in time to signal an abort. If engine number 1 of the first stage failed, attitude and rate mechanisms in the detection system would not sense a rocket drift that could result in a collision with the tower. An initial experiment with backup television coverage (the SA-3 flight of 16 November 1962) was disappointing; flame and dust kept astronaut D. K. Slayton and Marshall's John Williams from seeing the rocket as it climbed by the face of the tower. Petrone concluded from film of the liftoff that ground level visibility would always be sharply limited by blast and flame. He recommended placing a television camera at the top of the umbilical tower to look down between the tower and the vehicle.31
The Crew Safety Panel (one of the intercenter panels) took charge of this study in early 1963. LOC's chief representative on the panel, Emil Bertram, examined several proposals for ground support instrumentation including color television, an electronic "beat-beat" system based on the Doppler principle, and the placement of sensing wire on the umbilical tower. The panel finally settled on television and field observers. The launch team had to overcome further problems with the television during the latter Saturn I flights; for example, the intensity of light at liftoff burned holes in the camera's vidicon tube. The panel, satisfied with the coverage by 1965, approved an abort advisory system for LC-34. (With no manned flights scheduled LC-37 did not require a similar system.) Since the light intensity bleached out colors, the system employed four black-and-white cameras. Two cameras, pointing downward from the 72-meter level of the umbilical tower, covered the space between the tower and the rocket. Three hundred meters away on opposite sides of the launch vehicle, zoom-lensed cameras mounted on 5-meter towers provided a profile of early flight. The four cameras formed part of the complex's operational television network. Telescope sites, located around the perimeter of the complex, supplemented the TV. Gordon Cooper, an influential voice on the Crew Safety Panel, and other astronauts helped man the observation posts. LC-34's operational intercom system gave the posts instant communication with the blockhouse. The coverage proved satisfactory, and a similar arrangement was prepared for LC-39.32
While the establishment of the abort advisory system went smoothly, the matter of who held abort authority during the first ten seconds of flight (until tower clearance) proved more troublesome. KSC officials believed the launch operations director was in the best-position to command an abort. The astronauts objected, arguing that the launch director might abort the mission at an undesirable moment for them or the spacecraft. Eventually the astronauts won the argument. As information came to the launch director during the first seconds of flight, he would assess the situation. If an abort appeared necessary, the director could trigger the "Abort Light" on the flight panel in the spacecraft. If the "Thrust O.K." light indicated a malfunction or if the astronauts sensed a problem, the crew could manually activate the launch escape system.33
Range safety matters caused considerable disagreement between NASA and the Air Force before the issues were ultimately resolved. The Air Force had exercised responsibility for range safety at the Cape since launching the first rocket back in 1950. The basic concern was to prevent an errant rocket from landing in a populated area. Accordingly, when NASA scheduled a mission, the Air Force wanted details on the flight plan: launch azimuth, trajectory, and impact point. Range safety policies required that the launch vehicle have at least one tracking aid and two digital range safety command receivers on each active stage. The receivers had to be compatible with range instrumentation. If a destruct signal was received from the ground, the receivers would cut off the flow of fuel to the engines and then detonate small explosive charges to rupture the propellant tanks. The propellants would then mix and their explosive force be consumed before vehicle impact.34
The command receivers were activated prior to liftoff. The range safety officer sat at a group of consoles located in the range control center of the Cape Kennedy Air Force Station. The display had been developed in the 1950s and it remained relatively unchanged during the succeeding 15 years. The consoles received tracking data on the vehicle from the Eastern Test Range tracking system. This information was processed by a digital computer, and the display showed both the present location of the vehicle and its impact point if thrust were terminated.35
The plot included a set of lines that followed the planned path of the vehicle. These so-called "destruct" lines indicated the maximum deviation of the impact point from the trajectory that could be allowed without endangering life or property. As long as the impact point remained within the destruct lines, no action was required. Should a failure occur or the destruct lines be crossed, the safety officer first sent an arming signal to the receivers aboard the vehicle. This performed the dual function of initiating thrust termination and preparing the destruct system for activation. After an appropriate built in delay, a second signal was transmitted. It caused the detonation of the explosives in the propellant dispersion system. Within seconds the vehicle would be transformed into tumbling, burning chunks of scrap.36
The Air Force's authority in matters of range safety was reaffirmed in the Webb-McNamara Agreement of 17 January 1963. Essentially, the agreement confirmed the authority of the Air Force to require flight termination and propellant dispersion systems on NASA vehicles as well as those of the military, and this authority extended from liftoff through orbital insertion. The agreement was supplemented by the Air Force Missile Test Center-Launch Operations Center agreement of 5 June 1963, which gave NASA the responsibility for ground safety within the confines of KSC but left flight safety with the Air Force.
LOC acknowledged the Air Force's responsibility for range safety, but in a letter of 10 May 1962, General Davis noted that "there are occasional differences of opinion on what constitutes reasonable safety practices" and asked for Debus's comments on Air Force policy. In his response, Debus hesitated to cite specific disagreements since many rules were undergoing review and change. However, he did list a few areas where NASA and its contractors felt uninformed as to how the Air Force reached its decisions. One area concerned the computation of destruct areas; a second was the amount of trajectory data required on a new program. Debus also questioned the rationale for a dual destruct capability in all powered stages.37
This last matter involved KSC in a lengthy debate which found the Manned Spacecraft Center and the Air Force at odds over the latter's insistence on including a destruct system in the Apollo spacecraft. The dispute began in March 1962, when Houston requested a waiver - spacecraft engineers did not want the astronauts carrying a destruct package with them to the moon. The Range Safety Office proposed to restrict Apollo flights severely if the spacecraft did not carry a destruct system. Neither side altered its position in the next twelve months. When the NASA centers and the Eastern Test Range discussed Apollo-Saturn V safety requirements in May 1963, Houston again asked to fly the Apollo spacecraft (including the S-IVB stage) without a destruct capability. Engineers cited the possibilities of an errant signal triggering the systems or of an explosion during docking.38 The Air Force stood firmly by the requirements of the range safety manual: "Both engine shutdown and destruct capability are required for each stage of the vehicle."39
The sparring over the destruct systems soon took on the trappings of international diplomacy. On 9 May Dr. Adolf Knothe, LOC's range safety chief, warned Debus that a crisis could develop. Although no agreement had been worked out by June, Knothe and his assistant, Arthur Moore, began damage probability studies to justify omission of a destruct system. Their calculations indicated that an explosion of the three launch-vehicle stages, triggered by the range safety officer, would also destroy the lunar and service modules with their propellants. (In the meantime the launch escape system would have pulled the astronauts' command module away from the explosion.) Their plan employed a shaped charge on the front end of the S-II stage to explode the S-IVB stage. The results were inconclusive, however, and the Air Force stressed the possibility of a spacecraft falling back onto the Cape. Range officials contended that a spacecraft destruct system would not endanger the mission; NASA could design the system with a jettison capability.* Knothe recommended a detailed destruction probability study by the Lear-Siegler Corporation but saw "no absolutely objective answer to this dilemma."40
The Air Force countered LOC's calculations with a July presentation on a liquid explosive, Aerex. Impressed with Aerojet-General Corporation's product, NASA engineers gathered in Houston two weeks later for a North American briefing on a destruct system using the liquid explosive. Afterward, Moore sounded out spacecraft officials. There was still misunderstanding between the two centers in August when Christopher C. Kraft, Jr., chief of Houston's Flight Operations Division, moved to break the impasse. His call for an Apollo Range Safety Committee, modeled on a Gemini group, included AFMTC participation. LOC and MSFC vetoed Air Force representation until NASA had achieved a common front.41
At the first meeting of the Range Safety Committee, Knothe reviewed safety problems including the Range requirement for dispersion trajectories on all propelled stages.** The destruct systems on the S-I and S-II stages caused no concern, and Knothe believed that Aerex might prove acceptable for the S-IVB and spacecraft. Houston, however, was sharply divided over the destruct requirements, with the astronauts leading the opposition. The committee put the matter aside until the Manned Spacecraft Center could reach an understanding within its own ranks.42
In October, Kraft managed to add Air Force representatives to the Range Safety Committee. In the minutes of the 22 October meeting, he noted: "It was apparent at the meeting that the Range Safety Office is just as concerned that their regulations do not hamper the program as we are that we are not hampered by range safety."43 Kraft's note foreshadowed the agreement reached with the Eastern Test Range the following month. North American would prepare a destruct system for the service module. The spacecraft could fly early tests without the destruct capability since the service module tanks would contain little fuel. The decision, however, did not bring the matter to a close. Marshall and KSC officials were visibly upset in March 1964 when North American Aviation presented five spacecraft destruct systems, none of which incorporated the designs of the Saturn stage destruct system.# When von Braun and Debus raised the issue at an Apollo Review Board, Mueller, head of Manned Space Flight, asked the KSC chief to seek elimination of the destruct requirements. Over the summer of 1964 KSC officials met with Air Force officers, including Lt. Gen. Leighton I. Davis, who had moved from the Missile Test Center to the command of the National Range Division. KSC stressed among other things the weight penalty. A 120-pound service module destruct system would require nearly 7,500 more newtons (1,700 pounds) of thrust or a reduction in the weight of the S-IC stage. When Mueller submitted a formal request for waiver in September, General Davis directed the Range to go along.44
* An abort during the latter phase of the launch sequence (between approximately T+3 minutes into the flight when the launch escape tower jettisoned and T+10 minutes when the spacecraft entered orbit) would depend upon the service module propulsion system to separate the command and service modules from the Saturn. As B. Porter Brown, Houston's representative at the Cape, indicated, "the Manned Spacecraft Center will be most reluctant to carry a destruct system that can in any way jeopardize the capability of this module to perform its abort function" ("Apollo Program Information Submission," 23 August 1963). Since the space vehicle would have cleared the Cape before the launch escape tower jettisoned, the Air Force was willing to discard the service module's destruct system at that time.
** The dispersion trajectories marked the right of way for space vehicle flight. The boundaries on the flight corridor were formed by permissible lateral and vertical deviations. The deviations were necessary because of inevitable variations from standard - two rockets of the same model would have different thrust because of slight differences in alignment of the engines and in propellant weight. The wind effect was another factor that could never be fully accounted for. By taking into consideration the normal deviations from standard in relation to probability curves, LOD gave the Range Safety Office 99.73% assurance that the launch vehicle, in normal flight, would stay within the corridor. Any deviation outside the boundaries indicated a malfunction and the safety officer destroyed the vehicle.
# MSFC and KSC personnel thought the destruct systems should be standard throughout the space vehicle. They viewed MSC's research for a different destruct arrangement as lack of confidence in the Saturn system.
| Next |