Range safety

The Delta 3914 rocket carrying the GOES-G satellite was destroyed by range safety 71 seconds after launch due to an electrical failure.

In the field of rocketry, range safety may be assured by a system which is intended to protect people and assets on both the rocket range and downrange in cases when a launch vehicle might endanger them. For a rocket deemed to be off course, range safety may be implemented by something as simple as commanding the rocket to shut down the propulsion system or by something as sophisticated as an independent Flight Termination System (FTS), which has redundant transceivers in the launch vehicle that can receive a command to self-destruct then set off charges in the launch vehicle to combust the rocket propellants at altitude. Not all national space programs use flight termination systems on launch vehicles.

In the US space program, range safety is usually the responsibility of a Range Safety Officer (RSO), affiliated with either the civilian space program led by NASA or the military space program led by the Department of Defense, through its subordinate unit the Air Force Space Command. At NASA, the range safety goal is for the general public to be as safe during range operations as they are in their normal day-to-day activities.

RSOs are also present in the hobby of model rocketry and then are usually responsible for ensuring a rocket is built correctly, using a safe engine/recovery device, and launched correctly.

Flight termination

Some launch systems use flight termination for range safety. In these systems the RSO can remotely command the vehicle to self-destruct to prevent the vehicle from traveling outside prescribed safety zone. This allows as-yet-unconsumed propellants to combust at altitude, rather than upon the vehicle reaching the ground.

Space vehicles for sub-orbital and orbital flights from the Eastern and Western Test Ranges were destroyed if they endangered populated areas by crossing pre-determined destruct lines encompassing the safe flight launch corridor. To assist the RSO in making a flight termination decision, there are many indicators showing the condition of the space vehicle in flight. These included booster chamber pressures, vertical plane charts (later supplanted by computer-generated destruct lines), and height and speed indicators. Supporting the RSO for this information were a supporting team of RSOs reporting from profile and horizontal parallel wires used at lift-off (before radar could capture the vehicle) and telemetry indicators. After initial lift-off, flight information is captured with X and C-band radars, and S-Band telemetry receivers from vehicle-borne transmitters. At the Eastern Test Range, S and C-Band antennas were located in the Bahamas and as far as the island of Antigua, after which the space vehicle finished its propulsion stages or is in orbit. Two switches were used, ARM and DESTRUCT. The ARM switch shut down propulsion for liquid propelled vehicles, and the DESTRUCT ignited the primacord surrounding the fuel tanks. In the case of manned flight, the vehicle would be allowed to fly to apogee before the DESTRUCT was transmitted. This would allow the astronauts the maximum amount of time for their self-ejection.

The primary action performed by RSO charges is rupturing the propellant tanks down the middle to spill out their contents. In the case of boosters with cryogenic propellants, the RSO system is designed to rupture the tanks in such a way as to minimize propellant mixing, which would result in an extremely violent explosion, specifically by having the charges split the sides of the tanks open like a zipper, which spills out the propellants and minimizes mixing. On boosters with hypergolic propellants, the opposite happens—mixing is encouraged as these propellants burn on contact rather than mix and then explode. In addition, the toxicity of hypergolic propellant means that it is desirable to have them burn up as fast as possible. The RSO system used on these boosters works by rupturing the common tank bulkhead so the oxidizer and fuel immediately contact and burn.

Just prior to activation of the destruct charges, the engine(s) on the booster stage are also shut down. For example, on the 1960s Mercury/Gemini/Apollo launches, the RSO system was designed to not activate until three seconds after engine cutoff to give the Launch Escape System time to pull the capsule away.

American rockets have often a Range Safety destruct system since the early launch attempts conducted from Cape Canaveral in 1950. As of 2016, a total of 32 US orbital launch attempts have ended in an RSO destruct, the first being Vanguard TV-3BU in 1958 and the most recent being Cygnus CRS Orb-3 in 2014.

Some launch vehicles (for example, the Titan family) have included an automatic destruct system to activate in the event that the solid rocket motors or upper stages separate prematurely; this is separate from the standard RSO system which is activated by manual command.

Thrust termination

A less destructive type of range safety system allows the RSO to remotely command the vehicle to shut down its propulsive rocket engines. The thrust termination concept was proposed for the Titan III-M launch vehicle which would have been used in the Manned Orbiting Laboratory program.

Soviet/Russian space program

Unlike the US program, Russian rockets do not employ a true RSO destruct system. If a launch vehicle loses control, either ground controllers may issue a manual shutdown command or the onboard computer can perform it automatically. In this case, the rocket is simply allowed to impact the ground intact. Since Russia's launch sites are in remote areas far from significant populations, it has never been seen as necessary to include an RSO destruct system. During the Soviet era, expended rocket stages or debris from failed launches were thoroughly cleaned up, but since the collapse of the USSR, this practice has lapsed.

ESA

The ESA's primary launch site is in Kourou, French Guyana. ESA rockets employ a proper RSO system similar to the American one despite the relative remoteness of the launch center. Failures of ESA rockets have been uncommon, the most notable one being the failed maiden flight of the Ariane 5 in 1997 which was automatically destroyed after erroneous guidance commands caused it to disintegrate.

Launch corridor

Rockets are usually launched into a space above the launch range called the launch corridor. If rocket engines fail while the rocket flies inside the corridor, the rocket falls in an uninhabited area. Engine failure outside the launch corridor may cause the rocket to fall on people or property. Therefore, if the rocket is about to exit the launch corridor, the RSO will terminate powered flight to ensure that no debris falls outside the launch corridor. This involves sending coded messages (typically sequences of audio tones, kept secret before launch) to special redundant UHF receivers in the various stages or components of the launch vehicle. On receipt of an 'arm' command, liquid-fueled rocket engines are shut down. A separate 'fire' command detonates explosives, typically linear shaped charges, to cut the propellant tanks open and disperse their contents.

Solid-fuel rockets cannot be shut down, but cutting them open terminates thrust even though the propellant will continue to burn.

Reliability is a high priority in range safety systems, with extensive emphasis on redundancy and pre-launch testing. Range safety transmitters operate continuously at very high power levels to ensure a substantial link margin. The signal levels seen by the range safety receivers are checked before launch and monitored throughout flight to ensure adequate margins. When the launch vehicle is no longer a threat, the range safety system is typically safed (shut down) to prevent inadvertent activation. The S-IVB stage of the Saturn 1B and Saturn V rockets did this with a command to the range safety system to remove its own power.

Applications

Range safety concerns are addressed in a variety of ways by the various countries involved with launch vehicle and guided missile technology.

United States

Eastern and Western Ranges

For launches from the Eastern Range, which includes Kennedy Space Center and Cape Canaveral Air Force Station, the Mission Flight Control Officer (MFCO) is responsible for ensuring public safety from the vehicle during its flight up to orbital insertion, or, in the event that the launch is of a ballistic type, until all pieces have fallen safely to Earth. Despite a common misconception, the MFCO is not part of the Safety Office, but is instead part of the Operations group of the Range Squadron of the 45th Space Wing of the Air Force, and is considered a direct representative of the Wing Commander. The MFCO is guided in making destruct decisions by as many as three different types of computer display graphics, generated by the Flight Analysis section of Range Safety. One of the primary displays for most vehicles is a vacuum impact point display in which drag, vehicle turns, wind, and explosion parameters are built into the corresponding graphics. Another includes a vertical plane display with the vehicle's trajectory projected onto two planes. For the Space Shuttle, the primary display a MFCO used is a continuous real time footprint, a moving closed simple curve indicating where most of the debris would fall if the MFCO were to destroy the Shuttle at that moment. This real time footprint was developed in response to the Space Shuttle Challenger disaster in 1986 when stray solid rocket boosters unexpectedly broke off from the destroyed core vehicle and began traveling uprange, toward land.

Range safety at the Western Range (Vandenberg Air Force Base in California) is controlled using a somewhat similar set of graphics and display system. However, the Western Range MFCOs fall under the Safety Team during launches, and they are the focal point for all safety related activities during a launch.

Range safety in US manned spaceflight

Even for U.S. manned space missions, the RSO has authority to order the remote destruction of the launch vehicle if it shows signs of being out of control during launch, and if it crosses pre-set abort limits designed to protect populated areas from harm. The U.S. space shuttle orbiter did not have destruct devices, but the solid rocket boosters (SRBs) and external tank both did.

After the Space Shuttle Challenger broke up in flight, the RSO ordered the uncontrolled, free-flying SRBs destroyed before they could pose a threat.

Despite the fact that the RSO continues work after Kennedy Space Center hands over control to Mission Control at Johnson Space Center, he or she is not considered to be a flight controller. The RSO works at the Range Operations Control Center at Cape Canaveral Air Force Station, and the job of the RSO ends when the missile or vehicle moves out of range and is no longer a threat to any sea or land area (after completing First Stage Ascent).

Autonomous flight termination

Both ATK and SpaceX have been developing autonomous flight termination systems. Both systems use a GPS-aided, computer controlled system to terminate an off-nominal flight - supplementing or replacing the more traditional human-in-the-loop monitoring system.

ATK's Autonomous Flight Safety System made its debut on November 19, 2013 at NASA's Wallops Flight Facility. The system was jointly developed by ATK facilities in Ronkonkoma, New York, Plymouth, Minnesota, and Promontory Point, Utah.

The system developed by SpaceX was included in the prototype development vehicle SpaceX used in 2013/14 to test its reusable rocket technology development program.

In the event, the autonomous system was first tested in August 2014 on the F9R Dev1 prototype booster when the test vehicle had a flight anomaly in a test flight and the vehicle control system issued a command to terminate, and the vehicle self-destructed in the air over the designated test area near McGregor, Texas.

The autonomous flight safety systems had been used on many SpaceX launches and were well tested by 2017. Both the Eastern Range and Western Range facilities of the United States are now using the system, which has replaced the older "ground-based mission flight control personnel and equipment with on-board positioning, navigation and timing sources and decision logic." Moreover, the systems have allowed the US Air Force to drastically reduce their staffing and increase the number of launches that they can support in a year. 48 launches annually can now be supported, and the cost of range services for a single launch has been reduced by 50 percent.

The addition of AFT systems on some launch vehicles has loosened up the inclination limits on launches from the US Eastern Range. By early 2018, the US Air Force had approved a trajectory that could allow polar launches to take place from Cape Canaveral. The 'polar corridor' would involve turning south shortly after liftoff, passing just east of Miami, with a first stage splashdown north of Cuba. Such a trajectory would require the use of autonomous flight termination systems, since the plume of the rocket would interfere with signals sent by ground-based antennas. As of April 2018, the only AFT system on US rockets is the SpaceX Falcon 9. Future launch vehicles such as the Blue Origin New Glenn and United Launch Alliance Vulcan are expected to have them as well.

See also

• Ballistic Missile Range Safety Technology
• Range Safety and Telemetry System

External links

• "45th Space Wing/Patrick Air Force Base Launch Site Safety Assessment" (PDF). June 8, 2002.
• This article includes an explanation of the Space Shuttle's Range Safety System
• presentation on flight safety system on display at the Air Force Space and Missile Museum
• US Range Safety Standards for US government launches (NASA and DoD), pdf, September 2014. FAA uses different standards for private spaceflight.