Seconds Before Disaster: How Emergency Rescue Systems of Spacecraft are Designed

On October 11, 2018, the Soyuz-FG rocket was launched from the Baikonur Cosmodrome. Its mission was to put into orbit the Soyuz MS-10 spacecraft with two crew members of the ISS — Roscosmos cosmonaut Alexey Ovchinin and NASA astronaut Tyler Hague. However, a routine rotational flight turned dangerous after an abnormal separation of the side booster, which struck the rocket. This led to a loss of stabilization and depressurization of the second stage.
Emergency separation of one of the side boosters of the Soyuz-FG carrier during launch.

Despite the fact that the Soyuz MS-10 did not reach orbit, the space explorers got home safe. They only experienced increased G-forces and a spoiled mood. Their lives were saved by the timely operation of the launch escape system (LES). In this article, we will explore this device, its types, and its history.

Early Emergency Rescue Systems

The first astronauts were fighter pilots who routinely flew on aircraft equipped with ejection seats. Therefore, it was only natural that the first emergency rescue system in history, installed on the Vostok spacecraft, was also a catapult.
The water landing of the Mercury capsule on April 25, 1961, following the failure of the Atlas 3 carrier.

The creation of this system was largely influenced by the explosion of a prototype Vostok rocket in July 1960, which carried the dogs Lisichka and Chayka. The loss of the animals made a deep impression on Sergei Korolev, and he demanded the development of a crew rescue system in case of emergencies. The task did not seem too difficult since the spacecraft already had an ejection seat. The catch was that the spherical landing capsule, although equipped with a parachute, could not provide sufficient speed reduction for a soft landing. To avoid injuring the cosmonaut due to a strong impact, the designers decided to use a catapult during the return to Earth. At an altitude of 7 km, the pilot would activate the ejection seat, after which he would land separately from the capsule using a parachute.

Eventually, this ejection seat became the basis for the LES of the Vostok. In the event of a rocket failure within the first 40 seconds of the flight, the Mission Control Center (MCC) could command the ejection of the cosmonaut’s seat. Between the 40th and 150th seconds, the engines of the carrier rocket were supposed to be turned off, and after it descended to 7 km, the parachute would be used again. In the event of an accident at a later stage, the spacecraft could then use its own engines to get away from the rocket.

Of course, the Vostok LES was not perfect. For example, in a situation where the rocket was still on the launch pad or in the first seconds after launch, the parachute would not have time to open. Soviet engineers even placed metal nets near the launch pad in the most likely landing area for the catapulted cosmonauts.

Of course, this was not a final solution to the problem, but in the context of the space race, Korolev had to take risks and choose the best available option. In December 1960, the system was tested in practice. Another prototype Vostok with the dogs Kometa and Shutka experienced an accident. The LES successfully separated the landing module, saving the animals. Fortunately, during manned flights, there was no need to activate it.

As for the American Mercury spacecraft, it used a fundamentally different scheme due to its small size. The capsule was too small to accommodate a built-in ejection seat. Therefore, the designers decided to install an external towering frame with a solid-fuel rocket. In case of an emergency, it was supposed to “pull” the spacecraft out and detach it from the booster. Then, the frame would be jettisoned, and the capsule with the astronaut would descend using a parachute.

The frame with the solid-fuel engine of the automatic escape system, which was installed on the Mercury spacecraft.

In November 1960, the escape system of the Mercury spacecraft was accidentally activated during the famous “ten-centimeter flight.” The Redstone rocket engines, with the unmanned spacecraft attached to it, shut down immediately after launch. The rocket was able to ascend only 4 inches (10 cm) before descending back to the ground. Unexpectedly, the rescue system was triggered, but in a malfunctioning manner: the capsule remained attached to the rocket, while the frame with the solid-fuel motors “flew away” and reached a height of 1200 meters before landing 370 meters away from the launch site. Three seconds after the LES engine ignition, the Mercury capsule deployed its braking parachute followed by the main parachute. After 30 seconds, without experiencing tension in the straps, the backup parachute was automatically deployed.

In April 1961, the system demonstrated its capabilities once again. During a new test, the rocket carrying the unmanned Mercury spacecraft failed to reach the necessary power and couldn’t follow the planned flight trajectory. The operator commanded the destruction of the carrier rocket, while the escape system separated the capsule, which successfully landed in the Atlantic Ocean. This was the last instance where the escape system was activated during a Mercury launch.

The Risky Voskhod and Gemini

 It may seem paradoxical, but the Voskhod and Gemini spacecraft, which succeeded the Vostok and Mercury respectively, had even less effective escape systems than their predecessors, providing the crew with fewer chances of survival in the event of an accident. But let’s discuss each of them one by one.

 The new Soviet spacecraft, Voskhod, essentially was the same as Vostok, but designed for multiple crew members. This posed a problem: the designers couldn’t fit multiple ejection seats inside the tight capsule. This meant that in the event of an accident during the early stage of the flight, the cosmonauts would be doomed. The Voskhod crew could only be saved after the 44th second of launch when the main shroud was jettisoned, allowing for the separation of the landing module from the rocket.

Of course, launching a spacecraft with such a major flaw in the crew rescue system was highly dangerous, especially considering the overall reliability of the carriers of that era. However, maintaining leadership in space required taking risks. So the Soviet leadership made the decision to take another chance. Fortunately, in the case of Voskhod, everything went well: both launches of the spacecraft proceeded without any complications.
The scheme of crew ejection from the Gemini spacecraft.

As for the American Gemini spacecraft, to save weight, the designers abandoned the towering frame with a rocket engine and instead installed two ejection seats inside the spacecraft. The astronauts could use them during the early stages of the flight. In the event of an accident at a higher altitude, the plan was to separate Gemini from the booster and then descend the crew capsule using parachutes.

The decision to install ejection seats on the spacecraft sparked controversy. Firstly, many experts believed that after ejection, the astronauts could be hit by the rocket’s jet stream, leading to instant death. Secondly, NASA had never tested the ejection seat in conditions similar to actual flight. The thing was, the atmosphere inside Gemini consisted of pure oxygen and during launch the spacecraft maintained an elevated pressure. Some astronauts were concerned that attempting to use the ejection seat under such conditions would end in disaster, with them turning into “human candles.” By the way, something similar happened to the crew of Apollo 1 later on.

Fortunately, once again, the space explorers were lucky. The Gemini crew members never encountered a situation that required them to activate the ejection seat.

Rescue Systems of Soyuz and Apollo

Both Voskhod and Gemini can be considered as “intermediate” spacecraft necessary for accumulating experience in spaceflight before the arrival of the heavyweights, Soyuz and Apollo. These spacecraft were noticeably larger than their predecessors and designed for a crew of three, which necessitated the creation of new LES (launch escape systems).
The photo of the Saturn V launch vehicle with the rescue rocket clearly visible at the top.

The developers of Apollo ruled out the possibility of using ejection seats. This was due to the spacecraft’s design features, the large number of crew members, and the launch with the most powerful rocket in history, which left a huge trail of fire. Therefore, they decided to return to the scheme tested on Mercury. They installed a towering frame with a solid-fuel rocket on top, which, in case of an emergency, would have carried the crew capsule as far away as possible from the Saturn V rocket. Interestingly, its power exceeded that of the Redstone rocket that was once used for Mercury launches. Just like with the previous American spacecraft, the Apollo crews never had to use the SAS.

As for the Soviet systems, their designers also settled on the option of “pulling out” the spacecraft from the booster using a separate solid-fuel rocket. However, the LES of Soyuz cannot be considered an exact copy of the American system, as it has important peculiarities dictated by its own design. Firstly, unlike Apollo, Soyuz is closed by the shroud during launches. Secondly, it has a completely different arrangement: the service module is located at the top, with the crew capsule positioned below it.

Over the years of Soyuz operation, its LES underwent several upgrades, but no fundamental changes were made. The main propulsion unit is installed on a special tower attached above the shroud. If an accident occurs before the 114th second of the flight, the system activates and separates the main section consisting of the shroud, service module, and descent module from the booster. Then, the solid-fuel separation engine is activated, which ensures the separation of the shroud and service module from the capsule with the cosmonauts. The latter descends by parachute.
The later version of the launch escape tower. The large engines (at the bottom) were intended for use in emergency situations, while the smaller ones were used to separate the tower from the spacecraft during a regular launch.

The separation of the frame with the main LES engine occurs at the 114th second of the flight, while the shroud itself is jettisoned at the 161st second. During this interval, the astronauts’ lives depend on small solid-fuel engines installed on the sides of the shroud. They have less power than the main engine but are sufficient to separate the main section from the rocket. These engines saved the crew of Soyuz MS-10, whose accident occurred after the jettisoning of the LES frame. However, if a problem arises after the 161st second, the automatic separation system of the descent module is activated. It separates the module from the rocket and then it descends by parachute.

Alexey Ovchinin and Tyler Hague became the third crew of Soyuz whose lives were saved by the LES. The “pioneers” were Vasily Lazarev and Oleg Makarov. In April 1975, they were supposed to fly to the Salyut-4 orbital station on board Soyuz-18, but they never reached their destination. An accident occurred during the working phase of the upper stage. The LES separated the descent module, but due to a rotation, it lost orientation, subjecting the crew to life-threatening acceleration reaching 26 g. The capsule with the cosmonauts landed on the slope of a mountain southwest of Gorno-Altaysk. It was discovered by geologists and later evacuated by the military.
The LES carries the spacecraft away from a burning rocket.

The LES saved the crew’s lives for the second time in September 1983. At the Baikonur Cosmodrome, 48 seconds before the launch, a fire broke out on the Soyuz T-10 rocket. The fire burned some of the cables that transmitted information about the carrier’s condition, so observers only noticed the fire twenty seconds before the launch. Ten seconds were spent giving the command for operators to activate the LES. Two seconds after separating the main block from the rocket, it disintegrated and fell into the pit of the launch pad. For four seconds, cosmonauts Vladimir Titov and Gennady Strekalov experienced accelerations ranging from 14 to 18 g. Eventually, both escaped with minor fright and later completed several more spaceflights.

Emergency Abort Procedures for the Space Shuttle

Unlike its capsule predecessors, the reusable Space Shuttle did not have a full-fledged crew escape system. During the design phase, engineers considered making the crew cabin detachable, which could have saved the astronauts in the event of a serious accident. However, calculations showed that this would significantly burden the structure and make it impossible to launch any useful payload into orbit. The experience of previous years may have played a role, instilling confidence in the engineers. All in all, the crews of Mercury, Gemini, and Apollo never needed a rescue system.
In May 1977, NASA conducted a test of the Shuttle’s rescue system using jet-assisted sleds (the system included a catapult from a Lockheed SR-71 aircraft). The tests were conducted at Holloman Air Force Base in New Mexico.

However, Shuttle crews still had possibilities for survival in certain types of accidents. During the first four test flights, two ejection seats were installed on board the Columbia spacecraft, capable of providing rescue within the first two minutes of flight, while the vehicle was still below an altitude of 30 km. However, like with Gemini, many NASA experts doubted their effectiveness, believing that the ejected astronauts would simply get into the flames from the solid rocket boosters and be vaporized.
The arrangement of jettisonable panels for the emergency ejection of the commander and pilot of the Columbia spacecraft.

After completing the test flights, the ejection seats were removed from the Columbia and were never installed on any other Shuttle. The crews could only be saved in accidents where the integrity of the spacecraft was not compromised and it could continue controlled flight in the atmosphere. This was possible in case of failure of one or more Shuttle engines.

For such scenarios, NASA developed a series of emergency procedures that determined the crew’s actions based on the achieved speed or altitude. Some procedures involved turning the Shuttle around and landing at the Kennedy Space Center, while others involved flying across the Atlantic Ocean and landing at one of the prepared sites in Western Europe or Africa. Under certain circumstances, an option was available for the Shuttle to perform a single orbital maneuver before returning to Earth.

Throughout the years of operating the reusable spacecraft, there was only one incident of premature engine shutdown. It occurred during the STS-51F mission in 1985. As the incident happened during the final phase of the flight, the Shuttle simply reached a slightly lower orbit than planned, which had no impact on the mission’s results.
Parachutists perform test exiting from the C-141 aircraft through the sliding hatch, which was intended to be used in the shuttle rescue system.

The Challenger disaster in 1986 once again raised the question of a crew escape system. However, subsequent investigations confirmed that the installation of a detachable cabin would make the continued operation of the winged vehicles impractical due to their weight. The peculiarities of their design also ruled out the installation of ejection seats for all crew members.

As a result, NASA made some changes to the emergency procedures and equipped the Shuttles with a jettisonable hatch and a directional thruster that allowed leaving the vehicle with a parachute if it was at an altitude below 10 km and traveling at subsonic speeds. Astronauts could use this option if, for some reason, the Shuttle could not reach the landing strip or perform a safe landing.

Regarding the Soviet Buran aircraft (which is similar to Shuttle) its designers planned to install K-36RB ejection seats on it. This would allow the crew to escape at altitudes up to 25 km during ascent and below 30 km during descent. These seats were tested during several launches of the Progress spacecraft. The tests confirmed the fundamental possibility of using ejection seats for astronaut rescue.
A unique photograph of the test of the escape catapult of the Soviet space shuttle Buran.

The problem was that, similar to the Shuttles, K-36RB seats were planned to be installed only for the two pilots during test flights. The rest of the crew (and Buran was designed for ten people) would have no means of escape. Subsequently, there was a proposal to eject astronauts in pairs: first two from the upper deck, then two from the lower deck, using shared rails. This scheme would allow the rescue of four individuals. The question of what to do if the “Buran” crew consisted of more people remained unanswered.
A mannequin after the test of the escape catapult of the Soviet space shuttle Buran

However, by the time of the first and only unmanned flight of the Soviet Shuttle in 1988, the K-36RB seats were not yet ready, and it was launched into space without them. The subsequent termination of the program spared specialists from the need to solve the problem of rescuing the entire crew.

Capsule spacecraft of the 21st century

In conclusion, let’s say a few words about the rescue systems of capsule spacecraft that have emerged in the present century. Let’s start with the Chinese Shenzhou, often referred to as a replica of the Soyuz. It has the same compartment arrangement and replicates many of its technical solutions. The same applies to the escape system.
The Falcon 9 rocket booster with the registration number B1046 disintegrates due to aerodynamic forces after the launch of the Crew Dragon manned spacecraft.

Next, we have the Orion spacecraft being developed by NASA, which is positioned as the new Apollo that will return American astronauts to the Moon. It is not surprising that it has the same escape system as its famous predecessor: a towering frame with a solid rocket motor that will be installed at the top of the main module. A similar technical solution has been applied to the Indian spacecraft Gaganyaan, which has yet to make its first orbital flight.
Tasting the LES of Crew Dragon spscecraft.

As for the private spacecraft, the Crew Dragon and CST-100 Starliner, their developers have decided to forgo the use of a separate escape rocket. Instead, they rely on the spacecraft’s own engines. In the event of an accident on the launch pad or during ascent, these engines are designed to move the capsule away from the launch vehicle to a safe distance. Boeing and SpaceX have already conducted successful escape system tests. It is hoped that, like with most other spacecraft, they will never have to be activated in a real emergency situation.