• 

During the Apollo lunar missions and landings 50 years ago, there was a real risk of losing a crew during each mission. For the launch phase, the risk was relatively small due to an effective launch abort system with an escape tower. During the passage to the Moon, the crew would have had the option of using the Lunar Module’s engine to return to Earth, as was done so successfully during Apollo 13. However, once a crew was in orbit around the Moon, or had landed on the Moon, the risk level was multiplied: a loss of vehicle control or failure of the propulsion system for Earth return or, worse, a failure during descent to or ascent from the lunar surface.

In one respect, the Apollo lunar module design gave crews the ability to abort a lunar landing by separating the ascent stage from the descent stage and returning to the Command and Service Module, even after committing to land. As long as the lander could reach orbit or was still in orbit, the service module could have probably rescued astronauts stranded in a non-operative ascent stage. However, if the crew had already landed and the ascent stage would not lift off, the crew could only survive a few days. They could not survive a lunar night unless the lander was designed for it. Worse, if the ascent stage had failed in any major way during an ascent, there was no backup system to reach a minimal lunar orbit and to save them from impacting the lunar surface within an hour or less.

On March 26, 2019, Vice President Mike Pence announced a revised lunar initiative, to attempt to return humans to the lunar surface by the end of 2024, instead of by 2028. In April, the picture gradually clarified, as there are now two program phases: to have a new human lunar landing (the exploration phase) by 2024 followed by a more permanent presence (the operational and sustainable phase), probably at the lunar south pole, by 2028. The plans and designs continue to evolve rapidly, as five years is a very short time span and the decision makers can feel the pressure. In early May, this accelerated lunar landing program was named Artemis. The ongoing development program for the lunar vehicles and hardware is called Next Space Technologies for Exploration Partnerships, or NextSTEP. NASA had also planned a Moon to Mars Mission Directorate to coordinate that overall effort, which included Artemis, but Congress refused to allow the organizational change. As a result, Mark Sirangelo, a NewSpace-oriented executive who had been picked to lead it, resigned from NASA on May 23. This means that the existing NASA bureaucracy will be in charge of the program.

There are both good and bad aspects to the new lunar initiative. The significant national prestige or geopolitical aspects of human space operations during a declared “space race” should not be ignored or denigrated, but any acceleration of a lunar effort would also move the day forward to when we can conduct actual water mining operations on the lunar surface. The main drawback (and danger) is that a two-phase plan sets up the possibility that it will include building two sets of lunar vehicles, one set expendable for use by 2024, and another set reusable for later missions. Considering how hard it is to get funding for space programs, it would be very wasteful to build expendable vehicles to use for just a few years. (This assumes that planners still think that expendable vehicles can be built and qualified faster. Hopefully they have paid attention to how fast SpaceX was able to develop its reusable vehicles.)

The danger to the program comes from the strong possibility that whoever is president after 2024 would cancel work on the reusable set of vehicles. The plan also sets up the similar danger that any flow of extra money from Congress in the near term might be cut off after a few lunar landings with the expendable vehicles are accomplished. It also seems unlikely that the House today would even provide such extra funding for the accelerated plan to support a goal backed by Trump. House hearings on the NASA budget earlier this month ignored Artemis and the need for a supplemental budget item to support it.

Assuming that the lunar operational phase, due to be under way by 2028, will include a larger orbiting base or Gateway, from which multiple reusable lunar landers or ferries can operate, the problem of enabling crew survival after 2028 with a subsequent Earth return during an emergency in lunar orbit is probably covered. (Operating a lunar landing program entirely from Low Earth Orbit with no near-lunar base would require a huge vehicle similar to the SpaceX BFS stage).

But what about the period from 2024 to 2028? We have no idea if there are any plans to place an early crew refuge habitat in a low lunar orbit reachable by a lander or ascent vehicle, versus the high lunar orbit where the Gateway will be located. Since each mission launched on Orion will cost billions and is scheduled years in advance, there are no plans for another standby rescue mission in case of a problem. The production capacity for the SLS booster is limited, and funding is always tight, making a set-aside rescue mission via an SLS very unlikely. The overall cumbersomeness of the SLS-based mission concepts also would result in a very long response time, probably too long to effect a rescue.

It behooves everyone in a position of authority over the Artemis program to work to provide reasonable protection for lunar crews during the first phase (2024–2028) so that crews are never again put into the (now) unnecessarily risky position of those that flew on Apollo. To more fully protect the new lunar crews, a couple of additional steps need to be taken besides the lander design. The three main risks to the crew after they have entered lunar orbit are (1) inability to lift off from the lunar surface, (2) failure of the ascent vehicle or its engine during the ascent from the lunar surface or after an aborted landing, and (3) inability to leave lunar orbit and return to the Earth. All of these would require both backup systems and a rescue mission to deal with. Since crews are most likely to be stranded on the lunar surface or in lunar orbit, it makes sense that emergency equipment should be placed in both locations before any human missions. This would consist of either a second return vehicle with storable propellant or a crew refuge habitat with a solar radiation storm cellar and supplies enough to last for several months while a rescue mission is mounted.

The current accelerated lunar plan is one promulgated by the White House. In my opinion, some of the news media unfairly blamed then President Reagan in 1986 for pressuring NASA to launch the shuttle Challenger “on schedule” ahead of a State of the Union speech that night, (a hypothesis which has never been proven), when the provable cause was clearly NASA management’s decision to ignore engineers’ stark warnings, as in “take off your engineer’s hat and put on your manager’s hat.” However, in the case of a future lunar crew lost or stranded with no hope of rescue on a lunar mission before the operational phase, the onus would be at least partly on the White House, since it is a program they have initiated with a clear deadline. Part of the onus would still be on the mission and vehicle designers.

The clear intention for the new plan seemed to be that a lunar landing expedition would first go, in a vehicle like Orion, to a minimal Gateway station with a small habitat module and docking node in a high lunar orbit, where they would board a composite lunar vehicle. A transfer module acting as a space tug would move the lander and ascent sections to low lunar orbit, where the lander would carry the crew in the ascent section to the lunar surface. On ascent, the lander would be left behind and the ascent stage would rendezvous with the transfer tug, which would carry the ascent stage with crew back to the Gateway; alternatively, the ascent stage could go directly to the Gateway. These two modules could possibly have been reusable in the earlier plan.

On May 16, NASA issued NextSTEP contracts to 11 companies to begin studies of lunar vehicles. There are suggestions that the previously planned three-part vehicle system could have reusable ascent and transfer elements. In the contracts, there is not a single mention of the ascent vehicle component, which was previously assumed to be built in-house by NASA but will now be considered by a separate NextSTEP procurement. Thus, in this set of contracts, the integrated lunar vehicle still seems to be in two or three parts, so It is not at all clear if there is now a desire by NASA for it to be designed as a reusable lander or not.

For a vehicle using hydrogen-oxygen propellants and only needs to perform a total of about 4 to 5 kilometers per second of delta-V per round trip, and in an environment with no air drag and low gravity, you simply do not need a three-segment vehicle to perform a lunar landing and return, even from a high lunar orbit. It is not clear why the vehicle would consist of “a complete integrated lander that incorporates multiple elements such as a Descent Element, Ascent Element, and Transfer Vehicle” (NASA wording). Such phraseology seems to be contradictory as it does not describe an “integrated vehicle”, unless the “elements” are fully and physically integrated into a single vehicle. Some companies have since proposed a two-vehicle version of the system which omits the transfer vehicle.

NASA had actually started to change direction in April but seems to be creating some confusion about the program is it moves forward by issuing the design contracts in May for the previous design. On April 26, NASA announced in a procurement filing that it was looking for a NextSTEP proposal, for which it may issue contracts in the summer of 2019, for an integrated lunar lander instead of the weird, three-part vehicle originally proposed. What does this mean for crew safety? It would reduce the number of components and the number of needed rendezvous operations, and provide more flexibility in designing vehicles that can survive in-flight damage and still function, just like the World War II airplanes that often landed safely when shot full of holes.

A truly integrated, reusable lunar vehicle should consist of a single module, with one major exception. Just like the original Apollo lunar lander’s ascent stage, the integrated vehicle should have a self-propelled crew cabin that can separate from the main lander, if (and only if) the main vehicle fails at any point, and perform an abort to orbit or an abort to surface at any time during a lunar mission. (With the expendable Apollo vehicle, the ascent stage was intended to separate on every mission.) The fuel load for the cabin can also be sized to minimize it so that (depending on the current velocity and altitude), either an abort to orbit or surface, but not both, can be performed. Irrespective of whether the vehicle to be used in 2024 is expendable or reusable, such a self-rescue crew cabin should be included in the design. The cabin should be as small and light as possible, but allow for crew survival long enough to provide a practical rescue time window. It should use new storable, non-toxic propellants for its emergency propellant supply if possible. Once the cabin with crew is either back in orbit or on the surface, a rescue by another vehicle is possible. Thus, in terms of configuration, the integrated lander would look much like the original, but with a much larger propulsion section.

One other design for a safer lunar module is potentially possible. If the integrated lunar module can be designed in functional modular sections so that if a portion of its fuel tanks, engines, or controls are damaged, the vehicle would have enough remaining capacity to continue an ascent from the Moon (or abort a descent and return to lunar orbit), the need for a self-powered crew cabin is reduced. However, the design must take into account the damage that occurred during Apollo 13, where an internal explosion destroyed much of the Apollo Service Module, but left the Command and Lunar modules undamaged. In space, the results of an explosion are reduced since there is no air pressure outside (and often inside) the vehicle to conduct the force of an explosion, resulting in less damage. Good design could help isolate the results of such an event to one portion of the integrated lunar vehicle. Structural partitions between functional modules would add some weight, but this would be balanced by removing the need for a separate crew cabin. All engines should be able to be gimbaled and throttled so that any single remaining functional engine can provide the needed thrust aligned through the center of mass of the vehicle.

If a lunar landing takes place as early as 2024, it is still not clear if the lander system would be delivered to the minimal Gateway in lunar orbit fully fueled or if it would be refueled from an orbiting depot before landing. We should be able to develop a usable cryogenic propellant depot in five years as it is not a complex vehicle: just a set of insulated tanks, cryo-coolers, and fuel transfer pumps. Fuel storage and transfer in high or low lunar orbit would increase the total mass a lander could carry to the surface, and also provide an emergency fuel supply. A fuel depot using lower performance non-cryogenic storable propellant would require more propellant and tank mass and would be more expensive than a cryogenic system, even before lunar-sourced-propellant becomes available. Such a crew refuge needs a solar radiation storm cellar. If a depot is used, a crew refuge/habitat module can be attached to the Gateway depot, possibly surrounded by the depot’s tanks for shielding, to take advantage of the required attitude control and station keeping thrusters such a depot would need. This would satisfy the requirement for a lunar orbit crew refuge.

If we have multiple lunar crew landers, one or more of them can be modified to carry down to the surface a nearly identical crew refuge/habitat. If it has a solar storm cellar, the habitat does not even need to be unloaded from the lander after landing, as long as the crew has access to it and can land within a short distance of it. Alternatively, a fresh ascent vehicle could be landed at the intended landing site, well protected against lunar thermal extremes with effective insulation, its own sunshade, and cryo-coolers. The whole intent is to provide coverage of the most likely failure modes without bells and whistles. These can be added as things advance to the operational stage, where mining of lunar water could begin, requiring more frequent and routine lunar flights. Another simple rescue system would be to have a spare lander with ascent vehicle docked at the gateway base, using the base’s power to keep its propellant cold. It would be able to land precisely and rescue a stranded crew very quickly. This is the situation toward which things should evolve to after 2024; the main question is how soon the spares could be built and emplaced.

Of the various companies that are interested in participating in Artemis, SpaceX stands out as the one company that may be able to complete development of two independent kind of lunar access for humans within a short time of each other. A future integrated Artemis lander could fit (probably dry) inside one or more Falcon Heavy launch fairings, and could also be refueled in orbit by tankers launched by Falcon Heavy. At the same time, the company is pushing its Starship/Super Heavy program very hard, and it is quite possible that, due to its huge size, an uncrewed Starship could be refueled in LEO, fly to the Moon, land, take off, and return to Earth before 2024. This timetable is similar to the first scheduled Starship cargo flight to Mars, postulated for 2022 or 2024. If the Starship can land and return safely, it would provide a comprehensive lunar rescue system, even if NASA is unwilling to fund it or participate in its development due to NASA’s continuing political allegiance to the SLS as their primary large booster. By the time the Starship/Super Heavy is flying, it will probably be too late for NASA to switch its support to that system as the primary lunar architecture, but it not only shows great promise as a rescue system, but also as a primary transport system for the period after 2024.

It is possible that, given annual NASA and Congressional budgetary restrictions, the crew safety features, including a depot with a crew refuge in lunar orbit, could slow down a lunar surface program timetable. This is in fact one of the main and legitimate fears of opponents of the Gateway station, which originally was not designed to support lunar landings at all and whose funding, independent of a landing program, would have delayed any lunar landing. To prevent any delays, or even the perception of delays, the safety features should get their own parallel funding so that everyone can see that the landing program is being helped, not harmed. This intent should be clear in any initial proposals for safety-related hardware development.

Having at least two ways of getting crews to the Moon and back is as important as having two ways of getting crews to the International Space Station and back down again. For this reason, it is very desirable to have agreements with commercial companies such as SpaceX, which may be able to conduct their own lunar missions by or before 2024. Thus it is possible that such companies might be able to deliver a crew refuge and depot to lunar orbit and refuges to the lunar surface in advance of human landings, in addition to being able to conduct crew rescues. International partners may also be able to assist.

Taking such a position does not obligate NASA to abandon its own lunar vehicle plans unless Congressional funding fails to materialize, as was the caused during the Space Exploration Initiative almost 30 years ago. There is less than a year to choose between using SLS or private launchers in support of the new lunar program. It is, however, very hard to see how NASA will be able to develop its own lunar hardware without more funding, given the huge financial drain into the SLS program created by Congress. In the event Congress doesn’t provide the additional funding, the Trump Administration always has the option of backing SpaceX or another private company with the capability to develop lunar vehicles by the 2024 deadline, especially if done in cooperation with NASA. The agency is starting to show an inclination to allow vehicle integration by the private companies at their own facilities, which would greatly speed up the process. This private option also offers the huge advantage that the existing NASA plans cannot include for all of its launches: reusable launchers and a much cheaper lunar program.

• 

I've never understood the purpose of life pods. Why abandon a spaceship, however shot up or meteor-damaged it may be, just to hang around in a flimsy balloon or cramped pod? You're still on the same course, since no life pod can carry much delta-v, and the life-support problems are considerable. Why not include some kind of pressure balloon to provide temporary airtight containment in a hulled compartment and use the ship's own life-support? That way you get the ship's radiation shielding, power, etc.

If it's a reactor emergency you're worried about, don't eject the crew in pods, EJECT THE REACTOR!

(Actually, I realize perfectly well the purpose of life pods: it lets sf writers tell lifeboat stories in space.)

• 

      "We are required by law," the Captain went on, "to conduct three survival drills as soon as possible after takeoff, even though nothing has ever gone wrong or, considering the current fail-safe structural philosophies and the multiplicity of back-up systems, is ever likely to. But you know all this. You also know that, to keep the passengers from feeling nervous, the first drill is treated as something of a joke—an amusing film followed by a light-hearted question and, answer session. Don't frighten them. Mercer. But don't be too much of a comedian, either."

     It was a beautifully made film, technically excellent and with a nice balance of animation and actual footage—but it lacked accuracy. Not that it made any deliberate misstatements; it was just that watching the antics of a cartoon character did not give a true picture of a real person's physical and mental capabilities.
     A smiling young pseudo-spaceman who had cut his gleaming teeth on a great many TV commercials began by introducing everyone to their ship, talking brightly over performance and payload charts, design philosophy, and an animated staging sequence. Then he began taking the ship apart, literally, into neat, color-coded sections, magnifying each section and detailing its function—control, officers' quarters, passenger lounge and cabins, weightless lounge, reaction mass tank, and the eye-twisting detail of the reactor itself. Mercer's sickbay/cabin looked ridiculously large for one man and thirteen patients, while the quarters of the passengers were unbelievably spacious. Mercer did not believe, and neither, after a few days, would the passengers.
     "… And now," continued the smiling spaceman, hesitating as if to apologize for wasting their time on non-essentials, "we come to the subject of survival should an emergency arise. No such emergency has arisen in the past, nor, considering the rigorous checks and inspections carried out before every flight, is one ever likely to occur in the future. Nevertheless, we are obliged by the regulations to explain our survival equipment and to give you the chance to practice with it…"
     Mercer had already seen the film many times and had listened to much more detailed lectures on the subject.

     His train of thought branched off onto a different, but nearly parallel, track.
     In his line of work human life had always been considered of paramount importance—in theory, at least, a life was valued beyond price. But the cost of protecting the lives of officers and passengers in a spaceship, where every kilo hauled out of Earth's gravity represented enough coin of the realm—anybody's realm—to make every person on the ship comfortably rich from the cradle to the urn, was astronomical.
     Naturally the price of the passengers' tickets did not defray even a small fraction of the transport bill, much less the extra-weight penalties represented by back-up systems and survival equipment. Those items were conveniently lost in the even more complex systems of government bookkeeping under headings like national prestige, technological spin-off, and assisting the maximum utilization of technically trained manpower. Human life seemed to grow more and more valuable the farther it was removed from Earth. In space its value was incalculable; in the five-hundred-and-one-thousand-seater transports flying between five and ten miles above the surface it was high; but on surface transport systems the powers that were did not seem to worry too much about lives, passing a few laws about car safety belts, speed regulations and ship radar. As a result, no fare-paying passenger had ever been lost in space, a few hundred a year on average were cremated in metal birds which prematurely stopped flying, and on the surface they mowed each other down with cars in thousands every day.
     Mercer had spent two years with an organisation, which processed road accidents. That was how it referred to itself and the cases it admitted, because far too few of them survived for it to call itself a hospital, which cured people. He had grown up in—and was now, he realized, trying to flee—a technologically advanced, ultra-fast and strangely bored society, whose casualties had had the depersonalized, sexless sameness of so many mashed flies. The drunken or drug-ridden or simply bored drivers and the careless or absent-minded or innocent bystanders, when they were separated from the machinery or the machinery was removed from them, could rarely be made presentable by even the most conscientious of morticians. Mercer's thoughts were taking a very morbid turn.

     He had long ago discovered that there were no simple answers to complex problems, and the best thing he could do right now was to give all his attention to the survival film while trying not to look openly scornful of the simple answers it was giving to what would be, if it ever occurred, an extremely complex and lethal problem.
     The spaceman with the teeth, the cap worn on the back of his head and practically all of his uniform zips undone, was saying "… In the unlikely event of such an emergency, the passengers and crew will probably have several hours, or even days, to abandon ship-a process which can, if necessary, be carried out safely and without undue fuss in a few minutes.

(ed note: for more details about the Dark Inferno lifeboats, go here)

• 

The cold emptiness in her stomach congealed into a knot of tension. This whole voyage was turning into a fiasco. With what she'd learned from Martin—including his mission—there was no way the Navy could make a success of it; in fact, they'd probably all be killed. Her own role as a negotiator was pointless. You negotiate with human beings, not with creatures who are to humans as humans are to dogs and cats. (Or machines, soft predictable machines that come apart easily when you try to examine them but won't fit back together again.) Staying on was useless, it wouldn't help her deliver the package for George Cho, and as for Martin—

Rachel realized she had no intention of leaving him behind. With the realization came a sense of relief, because it left her only one course of action. She leaned forward and spoke quietly. “Luggage: open sesame. Plan Titanic. You have three hours and ten minutes. Get started." Now all she had to do was work out how to get him from the kangaroo court in the wardroom to her cabin; a different, but not necessarily harder task than springing him from the brig.

The trunk silently rolled forward, out from under her bunk, and its lid hinged back. She tapped away at the controls for a minute. A panel opened, and she pulled out a reel of flexible hose. That went onto the cold-water tap on her tiny sink. A longer and fatter hose with a spherical blob on the end got fed down the toilet, a colonoscopy probing the bowels of the ship’s waste plumbing circuit. The chest began to hum, expelling pulses of viscous white liquid into the toilet tube. Thin filaments of something like plastic began to creep back up the bowl of the toilet, forming a tight seal around the hose; a smell of burning leaked into the room, gunpowder and molasses and a whiff of sh*t. Rachel checked a status indicator on the trunk; satisfied, she picked up her gloves, cap, anything else she would need—then checked the indicator again, and hastily left the room.

The toilet rumbled faintly, and pinged with the sound of expanding metal pipework. The vent pipe grew hot; steam began to hiss from the effluent tube, and was silenced rapidly by a new growth of spiderweb stuff. An overhead ionization alarm tripped, but Rachel had unplugged it as soon as she arrived in her cabin. The radiation warning on the luggage blinked, unseen, in the increasingly hot room. The diplomatic lifeboat was beginning to inflate.

---

The shipping trunk in Rachel’s cabin had stopped steaming some time ago. It had shrunk, reabsorbing and extruding much of its contents. A viscous white foam had spread across the fittings of the cabin, eagerly digesting all available hydrocarbons and spinning out a diamond-phase substrate suitable for intensive nanomanufacturing activities. Solid slabs of transparent material were precipitating out of solution, forming a hollow sphere that almost filled the room. Below the deck, roots oozed down into the ship's recycling circuits, looting the cesspool that stored biological waste during the inbound leg of a journey. (By long-standing convention, ships that lacked recyclers only discharged waste when heading away from inhabited volumes of space; more than one unfortunate orbital worker had been gunned down by a flash-frozen t*rd carrying more kinetic energy than an armor-piercing artillery shell.)

The self-propelled trunk, which was frozen into the base of the glassy sphere, was now much lighter than it had been when Rachel boarded the ship. Back then, it had weighed the best part of a third of a tonne: Now it massed less than fifty kilos. The surplus mass had mostly been thick-walled capillary tubes of boron carbide, containers for thin crystals of ultrapure uranium-235 tetraiodide, and a large supply of cadmium; stuff that wasn’t easy to come by in a hurry. The trunk was capable of manufacturing anything it needed given the constituent elements. Most of what it wanted was carbon, hydrogen, and oxygen, available in abundance in the ship's sewage-processing plant. But if a diplomat needed to get away in a real hurry and didn’t have a potent energy source to hand … well, fission, an old and unfashionable technology, was eminently storable, very lightweight, and didn’t usually go bang without a good reason. All you needed was the right type of unobtanium to hand in order to make it work. Which was why Rachel had been towing around enough uranium to make two or three good-sized atom bombs, or the core of a nuclear saltwater rocket.

A nuclear saltwater rocket was just about the simplest interplanetary propulsion system that could fit in a steamer trunk. On the other side of the inner pressure hull from Rachel’s cabin, the trunk had constructed a large tank threaded through with neutron-absorbing, boron-lined tubes: this was slowly filling with water containing a solution of near-critical uranium tetraiodide. Only a thin layer of carefully weakened hull plates and bypassed cable ducts held the glassy sphere and its twenty-tonne saltwater fuel tank on the other side of the bulkhead, inside the warship. The hybrid structure nestled under the skin of the ship like a maggot feeding on the flesh of its host, preparing to hatch.

Elsewhere in the ship, toilets were flushing sluggishly, the officer's shower cubicle pressure was scandalously low, and a couple of environment techs were scratching their heads over the unexpectedly low sludge level in the number four silage tank. One bright spark was already muttering about plumbing leaks. But with a full combat engagement only hours away, most attention was focused on the ship's weapons systems. Meanwhile, the luggage's fabricator diligently churned away, extruding polymers and component materials to splice into the lifeboat it was preparing for its mistress. With only a short time until the coming engagement, speed was essential.

---

Subvocalizing again: “Luggage. Query readiness state."

"Lifeboat closed out for launch. Fuel storage subcritical and ready. Spare reaction mass loaded. Oxygen supply nominal. Warning, delta-vee to designated waypoint New Peterstown currently 86 k.p.s., decreasing. Total available maneuvering margin 90 k.p.s." That would do, she decided. The saltwater rocket was nearly as efficient as an old-fashioned fusion rocket; back home, it would do for an Earth-Mars return trip, surface to surface. This was pushing it a bit‐they wouldn't be able to ride it back up into orbit without refueling. But it would do, as long as‐

She swallowed, glanced at Martin and blinked twice, the signal for “hold your breath." “Luggage: prep for launch. Expect crew arrival from one hundred seconds. Launch hold at T minus twenty seconds from that time." Once they burned that particular bridge and jumped overboard, all she could do was pray that the bridge crew wouldn't dare light off their radar—and risk warning the Festival—in order to find her and kill her. The lifeboat was a soap bubble compared to the capital ships of the New Republican naval force.

---

• 

(ed note: After some diversionary explosions and a running gun battle, Rachel and Martin manage to make it back to the secret lifeboat. Rachel is knocked unconsious but wakes up inside the boat.)

     “A minute ago," said Martin. “What's happened in here?” He was in the couch next to her. The capsule was claustrophobically tiny, like something out of the dawn of the space age. The hatch above them was open, though, and she could just see the inner door of her cabin past it. “Hatch, close." I said I had a lifeboat, didn't I?"
     “Yeah, and I thought you were just trying to keep my spirits up." Martin's pupils were huge in the dim light. Above him, the roof of the capsule began to knit itself together. “What's going on?"
     “We're sitting on top of—" She paused to pant for breath. “Ah. Sh*t. On top of—a saltwater rocket. Fission. Luggage full of—of uranium. And boron. Sort of unobtanium you need in 'mergency, stuff you can't find easily. My little insurance policy."
     “You can't just punch your way out of an occupied spaceship! " Martin protested.
     “Watch me." She grimaced, lips pulling back from her teeth. “Sealed—bulkheads. Airtight cocoon 'round us. Only question is—"
     “Autopilot ready," announced the lifeboat. An array of emergency navigation displays lit up on the console in front of them.
     “Whether they shoot at us when we launch."

     “Wait. Let me get this straight. We're less than a day out from Rochard's World, right? This—thing—has enough legs to get us there? So you're going to punch a neat hole in the wall and eject us, and they're just going to let us go?"
     “ ‘S about the size of it," she said. Closing her eyes to watch the pretty blue displays projected on her retinas: “About ten thousand gee-seconds to touchdown. We're about forty thousand seconds from perigee right now. So we're going to drift like a t*rd, right? Pretend to be a flushed silage tank. If they light out their radar, they give themselves away; if they shoot, they're visible. So they'll let us go, figure to pick us up later 's long as we get there after they do. If we try to get there first, they'll shoot…"
     “You're betting the Festival will finish them off." (a Kardashev type 1.5 civilization in the area)
     “Yup," she agreed.

     “Ready to arm initiator pump," said the autopilot. It sounded like a fussy old man.
     “M' first husband," she said. “He always nagged."
     “And here was me thinking it was your favorite pet ferret." Martin busied himself hunting for crash webbing. “No gravity on this crate?"
     “ ‘S not a luxury yacht."
     Something bumped and clanked outside the door. “Oh sh*t."

     “We launch in—forty-two seconds," said Rachel.
     “Hope they give us that long." Martin leaned over and began strapping her into the couch. “How many gees does this thing pull?"
     She laughed: it ended in a cough. “Many as we can take. Fission rocket."
     “Fission?” He looked at her aghast. “But we'll be a sitting duck! If they—"
     “Shut up and let me work." She closed her eyes again, busy with the final preparations.

Sneak was, of course, of the essence. A fission rocket was a sitting duck to a battlecruiser like the Lord Vanek; it had about four hours’ thrust, during which time it might stay ahead—if the uncompensated acceleration didn't kill its passengers, and if the ship didn't simply go to full military power and race past it—but then it was out of fuel, a ballistic casualty. To make matters worse, until she managed to get more than about ten thousand kilometers away from the Lord Vanek, she’d be within tertiary laser defense range—close enough that the warship could simply point its lidar grid at the lifeboat and curdle them like an egg in a microwave oven.

But there was a difference between could and would which, Rachel hoped, was big enough to fly a spaceship through. Activating the big warship’s drive would create a beacon that any defenders within half a light-minute or so might see. And torching off the big laser sensor/killer array would be like lighting up a neon sign saying INVADING WARSHIP—COME AND GET ME. Unless Captain Mirsky was willing to risk his Admiral’s wrath by making a spectacle of himself in front of the Festival, he wouldn't dare try to nail Rachel so blatantly. Only if she lit off her own drive, or a distress beacon, would he feel free to shoot her down—because she would already have given his position away.

However, first she had to get off the ship. Undoubtedly, they’d be outside her cabin door within minutes, guns and cutters in their hands. The weakened bulkheads between the larval lifeboat and the outer pressure hull were all very well, but how to achieve a clean separation without warning them?

     “Mech one. Broadcast primary destruct sequence."
     “Confirm. Primary destruct sequence for mech one."
     “Sword. Confirm?"
     “Confirmed.”
     The transponder in her luggage was broadcasting a siren song of destruction, on wavelengths only her spy mechs— those that were left—would be listening to. Mech one, wedged in a toilet's waste valve in the brig, would hear. Using what was left of its feeble power pack, it would detonate its small destruct charge. Smaller than a hand grenade—but powerful enough to rupture the toilet’s waste pipe.

---

• 

Warships can’t use gravity-fed plumbing; the Lord Vanek’s sewage-handling system was under pressure, an intricate network of pipes connected by valves to prevent backflow. The Lord Vanek didn’t recycle its waste, but stored it, lest discharges freeze to shrapnel, ripping through spacecraft and satellites like a shotgun loaded with ice. But there are exceptions to every rule; holding waste in tanks to reduce the risk of ballistic debris creation was all very well, but not at the risk of shipboard disaster, electrical short circuit, or life-support contamination.

When Rachel's makeshift bomb exploded, it ruptured a down pipe carrying waste from an entire deck to the main storage tanks. Worse, it took out a backflow valve. Waste water backed up from the tank and sprayed everywhere, hundreds of liters per second drenching the surrounding structural spaces and conduits. Damage control alarms warbled in the maintenance stations, and the rating on duty hastily opened the main dump valves, purging the waste circuit into space. The Lord Vanek had a crew of nearly twelve hundred, and had been in flight for weeks; a fire spray of sewage exploded from the scuppers, nearly two hundred tonnes of waste water purging into space just as Rachel's lifeboat counted down to zero.

In the process of assembling her lifeboat, the robot factory in Rachel’s luggage had made extensive—not to say destructive—changes to the spaces around her cabin. Supposedly solid bulkheads fractured like glass; on the outer hull of the ship, a foam of spun diamond half a meter thick disintegrated into a talc-like powder across a circle three meters in diameter. The bottom dropped out of Rachel's stomach as the hammock she lay in lurched sideways, then the improvised cold-gas thrusters above her head kicked in, shoving the damply newborn lifeboat clear of its ruptured womb. Weird, painful tidal stresses ripped at her; Martin grunted as if he’d been punched in the gut. The lifeboat was entering the ship’s curved-space field, a one-gee gradient dropping off across perhaps a hundred meters of space beyond the hull; the boat creaked and sloshed ominously, then began to tumble, falling end over end toward the rear of the warship.

On board the Lord Vanek, free-fall alarms were sounding. Cursing bridge officers yanked at their seat restraints, and throughout the ship, petty officers yelled at their flyers, calling them to crash stations. Down in the drive maintenance room, Commander Krupkin was cursing up a blue streak as he hit the scram switch, then grabbed his desk with one hand and the speaking tube to the bridge with the other to demand an explanation. Without any fuss, the warship's drive singularity entered shutdown. The curved-space field that provided both a semblance of gravity and shielding against acceleration collapsed into a much weaker spherical field centered on the point mass in the engine room—just in time to prevent two hundred tons of bilgewater, and a twenty-tonne improvised lifeboat, from hammering into the rear of the Lord Vanek's hull and ripping the heat exchangers to shreds.

(ed note: Doing some pointless calculations, and linear interpolation of nuclear enrichment of uranium tetraiodine, my slide rule says:)

NSWR Lifeboat

Fuel	20.4% enriched Uranium Tetraiodide
Exhaust Velocity	91,780 m/s
Specific Impulse	9,360 sec
Uranium Tetraiodide Fuel Mass	250 kg
Fuel/Propellant	water solution of 2% 20.4% enriched Uranium Tetraiodide
Fuel/Propellant Mass	12,500 kg
Dry Mass	7,500
Wet Mass	20,000 kg
Mass Ratio	2.66
ΔV	90,000 m/s

• 

ABSTRACT OF THE DISCLOSURE

     An orbital escape vehicle which can be folded and stowed aboard an earth orbiting, manned spacecraft and used to safely return a crewman to the earth's atmosphere in the event of an emergency. The vehicle is comprised of a flexible casing having an ingress-egress opening therein, a heat ablative means covering said casing, and an inflatable bladder system within said casing for supporting the crewman and for maintaining said casing in a stable aerodynamic shape during its reentry into the atmosphere.

---

     The invention described herein was made by an employee of the United States Government and may be manufactured and used or for the Government for governmental purposes without the payment of any royalties thereon or therefor.

     This invention relates to an orbital escape vehicle, and more particularly relates to an inflatable reentry vehicle which can be stowed aboard an orbiting manned spacecraft and used to return a crewman to earth in the event that the manned spacecraft becomes disabled.

     Man's ability to leave the earth's atmosphere, orbit the earth, and return safely is now a reality. However, vehicles required for carrying out such missions are extremely complex, and it is conceivable that failure could occur within a vehicle while it is in orbit which would prevent said vehicle from successfully reentering the earth's atmosphere. In such an event, the vehicle and its crew would be doomed to either orbit the earth forever, or to reenter the atmosphere in an uncontrolled manner which obviously would be disastrous. Therefore, the need for an emergency escape means for crewmen of an orbiting space craft is readily apparent.

     Various means for rescuing stranded astronauts have been proposed, but heretofore none have proven feasible. For example, it has been proposed that a second spacecraft be readied for launch in the event that an orbiting spacecraft becomes disabled in orbit. With technology as it now exists, such a rescue, in addition to the tremendous expense involved, would depend upon the orbital position of the disabled craft, and if said craft were not in proper position for a quick rendezvous, the "catch up" time required for the rescue craft to reach the disabled vehicle could be fatal. Therefore, it is vitally important that the escape means be immediately available to the stranded crewmen whereby they can effect a timely return to earth in the event of an emergency.

     To adequately function as an escape vehicle, said vehicle must meet a strict set of requirements. As mentioned above, the escape vehicle must be capable of being carried on board the orbiting spacecraft so that it will be immediately available to the occupants of the craft. This requires the vehicle to be relatively light in weight and to occupy a relatively small space while stowed on the spacecraft. Also, the vehicle must include means for properly orienting said vehicle for reentry and for braking the speed of the vehicle so that it will drop from its orbital path and reenter the atmosphere in a controlled and pre dictable manner. Further, the vehicle must include protection from the intense heat which is generated during re entry, and must provide a proper environment for the crewman during reentry. Finally, means must be provided for lowering the crewman to a safe landing after he has reentered the atmosphere.

     The present invention fully meets all of the above mentioned requirements. The orbital escape vehicle of the present invention provides the minimum equipment necessary for an individual crewman of an earth-orbiting spacecraft to effect and survive both atmospheric reentry and earth landing in the event that said spacecraft becomes disabled. Structurally, the invention comprises an inflatable casing having a basic spherical configuration when inflated. The casting is comprised of a substrate of heavy nylon cloth which has a zippered opening therein through which a crewman can ingress and egress. The outer surface of said casing is covered with a heat ablative mate rial, while the interior of the casing is adequately lined with insulative material. A small double-panelled window is provided in the casing so the crewman can properly sight the vehicle on a reference point during retrofiring, as will be explained in detail below. A hand grip is provided in the casing through which a solid propellant, internally burning retrorocket assembly is fitted. The retrorocket assembly has air nozzles means as a part thereof which can be connected to a pressure source from within the vehicle to provide means for orienting the vehicle to a proper reentry attitude prior to retrofire.

     An inflatable bladder system is provided in the casing and is comprised of an inner spherical bladder and an outer bladder which conforms to the basic inner configuration of the casing. Also provided in the casing is a gaseous oxygen supply for providing breathing and cooling oxygen for the crewman, a gaseous nitrogen supply for inflation of the bladders, and a parachute having survival equipment on the harness thereof.

     The operation of the reentry vehicle is as follows. The vehicle is folded into a relatively small package and is Stowed in an external compartment of an orbiting spacecraft. In the event that the spacecraft malfunctions and is unable to effect a safe reentry, a crewman dons proper extravehicluler garments which are part of his standard equipment, and connects his suit to either a backpack supply of necessary oxygen, or to the spacecraft's ogygen supply system by use of a long, umbilical line. He then leaves the cabin of the spacecraft, works his way to the storage compartment, and removes the packaged vehicle. The straps holding the vehicle in a folded position are then removed and the vehicle is unfolded. After the crewman has partially entered the vehicle, he switches his oxygen supply from the backpack or spacecraft to the oxygen supply in the vehicle. He then discards the backpack or umbilical line, puts on a parachute and related survival equipment which are stowed in the vehicle, completely enters the vehicle, and zips up the ingress opening in the vehicle.

     The crewman next positions himself with respect to the vehicle so that he can hold the hand grip with one hand and arm the retrorocket assembly with the other. When he is in this position he is also in position to see through the window in the casing. During this time used oxygen and CO₂ from crewman's suit are being exhausted through the air nozzles on the retrorocket assembly, and by manipulating the hand grip and rocket assembly the crewman can maneuver the air nozzles to properly orient the spacecraft to the right attitude for retrofire. The crewman then waits until he sights a predetermined reference point on the earth, at which time he fires the retro-rocket. Upon completion of the retro firing the retro-rocket assembly is jettisoned and the bladders are in flated in said vehicle. These bladders position and sup port the crewman with respect to the casing so that the vehicle and creman form a definite aerodynamic shape which has a high degree of stability during reentry.

     In a short time the vehicle will fall into the earth's atmosphere, and during the early moments of reentry a tremendous amount of heat is generated. This heat will be dissipated by the heat ablative structure on the vehicle, and the insulation in the casing will maintain the interior of the vehicle at an acceptable level for survival of the crewman. After the vehicle has passed through the heating zone it will continue to fall, and the air at the lower regions of the atmosphere will cool same. Since the bladders of the vehicle are at a very small absolute pressure, the pressure of the atmosphere will cause the bladders to automatically deflate as it falls through the atmosphere, thereby notifying the crewman that he is at a safe level to leave the vehicle. The crewman then unzips the opening, disconnects the escape vehicle's oxygen supply and switches to oxygen from a standard "jump” bottle which is attached to the parachute harness, leaves the vehicle, and makes a regular parachute landing back to earth. Survival equipment in the form of a floatation vest, radio beacon, concentrated food, small amount of water, etc. are all attached either to the parachute harness or crewman space suit for use by the crewman once he has landed.

     The actual construction, operation, and the advantages of the invention will be better understood by reference to the drawings in which like numerals identify like parts in the different figures, and in which:

     FIG. 1 is a perspective view of a crewman retrieving the present invention from a disabled spacecraft;

     FIG. 2 is a perspective longitudinal view of the orbital escape vehicle of the present invention when in a folded position;

     FIG. 3 is a perspective view taken along line 3-3 of FIG. 2;

     FIG. 4 is a perspective view of the present invention with a crewman entering same;

---

     FIG. 5 is a side view partially in cross section of a crewman closing the zippered opening of the present invention;

     FIG. 6 is a partial enlarged cross-sectional view of the heat protection structure of the present invention;

     FIG. 7 is a side view partially in cross section of a crewman maneuvering the vehicle into a proper reentry attitude;

---

     FIG. 8 is a partial longitudinal cross sectional view of the retrorocket used with the present invention;

     FIG. 9 is a perspective view of the retrorocket assembly of the vehicle being sighted on a reference point on the earth;

     FIG. 10 is a perspective view looking out the window of the orbital escape vehicle at the time of retrofire;

---

     FIG. 11 is an exploded view partially in cross section of a crewman jettisoning the retrorocket assembly and inflating the vehicle; and

     FIG. 12 is a perspective view partially in cross section of the vehicle in a fully inflated position.

---

     Referring more particularly to the drawings, the orbital escape vehicle 10 (see FIG. 5) comprises a casing 11 which has a spherical configuration when it is fully inflated. A zippered opening 11a (see FIG. 4) having a flap 11b is provided in casing 11 to allow ingress and egress of a crewman. Casing 11 is comprised of a sub strate 12 of fiber glass or heavy nylon cloth which has a heat ablative structure or heat shield 13 secured to its exterior. Any known heat ablative material which allows the desired flexibility can be used for the heat shield. One example of a preferred construction of a heat shield is shown in detail in FIG. 6. Nylon cord 13a, or the like, is woven through substrate 12 much in the same manner as commercial "pile' carpets are woven. This “pile" carpet is then completely impregnated with a layer of an elastomer ablator to form the heat shield. The interwoven cord 13a serves as reinforcement for the ablator 13b and provides a greater surface area to which the ablator material can adhere. The ablator or heat shield 13 at the stagnation point 14 (see FIG. 12), or that point which will receive the greatest load during reentry, is approximately 0.50 inch thick and tapers to approximately 0.010 inch thick 180° from the stagnation point. A layer of insulative material 15, e.g. a 0.5 inch layer of polyurethane foam, is bonded or otherwise secured to the interior of casing 11 to provide the necessary insulation for reentry. This over-all small thickness of the heat shield 13, substrate 12, and insulative layer 15 allows the entire casing 11 and its related equipment (which will be discussed below) to be folded into a compact package having a length of approximately 4 feet and a constructive diameter of 1.5 feet (volume of 7 cubic feet), see FIGS. 2 and 3 for folded configuration.

     A conical projection 16 is formed on flap 11b and is at a point approximately 180° from stagnation point 14. Projection 16 can be formed by embedding a stiff wire 16a, or the like, in the selected portion of substrate 12 (see FIG. 8) to give projection 16 its necessary configuration. This projection 16 has an opening there through to which a hand grip 17 is attached. The grip 17 can be rotated relative to projection 16 and, due to the fiexibility of the casing surrounding projection 16, hand grip 17 can also be “wobbled” with respect to the casing. Grip 17 is a hollow and is adapted to receive the shank 19 of a retrorocket assembly 18 which will be discussed further in detail below. Rocket assembly 18 is press-fitted in grip 17, or is secured thereto by easily releasable shear pins or spring detents (neither shown) whereby the assembly can be easily moved by grip 17, but can also be easily separated therefrom when desired. A double-panelled, heat-resistive window 20 (approximately six inches in diameter) is secured in flap 11b adjacent conical projection 16 for a purpose discussed later.

     A bladder system is provided in casing 11 for shaping and Stabilizing vehicle 10 during reentry. This system consists of an inner inelastic, pressure tight, fabric bladder 21 and an outer semi-elastic bladder 22 (see FIG. 11). The inner bladder 21, which assumes a spherical configuration approximately 36 inches in diameter when in flated, is connected only at one point 21a (approximately 150 from the stagnation point and opposite the win dow) to insulation layer 15 by means of bonding or the like. Outer bladder 22 is connected to insulation layer 15 along the greater portion of its length. Bladder 22 is So constructed that it will essentially conform to the inner configuration of the casing 12 along its outer parameter and to the configuration of the crewman along its inner parameter to essentially form a “cocoon" about the crewman when bladder 22 is in its fully inflated position.

     An oxygen bottle 23 is partially embedded in the inner Sphere and is hermetically sealed thereto. Oxygen bottle 23 has a hose outlet 24 which is controlled by valve 25, and which is adapted to be connected to the suit of the crewman to provide oxygen for both cooling and breathing, and for pressurizing the space suit. Bladders 21 and 22 are connected to each other by a pressure reducing valye 26 for a purpose disclosed later. Also completely embedded and sealed in inner bladder 21 is a nitrogen gas bottle (not shown) which is attached to the inner side of one of two diametrically opposed handles (not shown) provided on the bladder 21. These handles can consist of a molded rubber projection, straps, or any other means whereby the crewman can grasp opposite sides of said inner bladder to open said nitrogen bottle and to maneuver bladder 21 to its proper position while it is being inflated.

     The retrorocket assembly 18 preferably consists of a solid propellant, internally burning rocket engine 30 capable of developing 7500 pound-seconds of impulse at an average thrust of 200 pounds. Rocket engine 30 has dual canted thrust nozzles 31 positioned to brake the orbital speed of vehicle 10 and to direct the blast of said rocket away from the vehicle when the rocket is fired. The rocket normally includes a spring wound timing device 30a (see FIG. 10) that starts upon rocket ignition and "times' the length of retrorocket firing, as will be discussed in greater detail below. Assembly 18 has a shank portion 19 which is adapted to extend through the open ing of grip 17, as briefly explained above, and has canted nozzles 33 as an integral part thereof. A longitudinal passage 34 extends the length of shank 19 and connects opening 35 with air nozzles 33. Opening 35 is adapted to receive a press type fitting 36 which is connected to a hose 37 which in turn is adapted to be connected to the vent of a crewman space suit for a purpose disclosed below. The fitting 36 is easily disengageable from opening 35.

     Shank 19 has a threaded opening 38 at the lower end thereof which normally has a safety cap (not shown) screwed therein to prevent premature firing of the retro-rocket. This safety cap is removed by a crewman after he has entered vehicle 10, and a percussion igniter 40 which is stowed in the vehicle is screwed into opening 38 to arm the rocket 30. A primary igniter material 39 is provided in shank 19 which is ignited by igniter 40 to actuate and fire rocket engine 30. Electric leads (not shown) could also be provided in shank 19 to allow igniter 40 to start timing device 30a, or timer 30a could be actuated by a pressure switch which would be responsive to the pressure within rocket 30 when fired. It is recognized that a parachute including a standard oxygen "jump” bottle for landing the crewman and survival equipment such as a CO₂ inflatable floatation vest, survival kit, emer gency rations, and a radio beacon all can be stowed in vehicle 10).

     The operation of the orbital escape vehicle is as follows. The vehicle 10 is folded and stowed in an external compartment 51 of a manned orbiting spacecraft 50. In the event spacecraft 50 becomes disabled, a crewman 52 immediately updates his knowledge of his ephemeris, desirable retrofire landmarks, firing duration, etc. He does this from both on-board information and/or ground supplied data. During this time it is desirable that crewman 52 will take on as much food and water as possible from the spacecraft systems before leaving spacecraft 50. These operations will take approximately 3 to 5 minutes. Crewman 52, after donning proper extravehicular activity gar ments, will then leaves spacecraft 50 and retrieve vehicle 10 from the service module (see FIG. 1). During this mode of operation, crewman 52 is being supplied with oxygen either from a backpack 53 or through an umbilical cord (not shown) connected to the spacecraft's oxygen supply. Upon retireving the escape vehicle, he releases straps 11c (see FIG. 2), and places his feet through unzipped opening 11a into vehicle 10 (see FIG. 4). At this stage he reaches into casing 11 for hose 24, attaches it to his space suit and opens valve 25. There should be approximately a two hour supply in oxygen bottle 23. Once the hose 24 is attached and valve 25 is open, he discards his backpack 53 or umbilical cord, completely enters the vehicle 10, and zips up the zipper opening 11a (see FIG. 5). This total operation should take approximately 12 minutes. He next "wiggles" himself into the position shown in FIG. 7 so that his body is essentially straight and where he can grip 17 with one hand. He then unscrews the safety device (not shown) from shank 19 of retrorocket assembly 18 and attached precussion igniter 40 to the rocket. Igniter 40 also has a hand grip thereon which the crewman can grasp with his other hand to help hold the rocket in grip 17 while it is being fired and to aid in maneuvering rocket assembly 18 with respect to casing 11.

     Crewman next attaches vent hose 37 on his suit to opening 35 in the shank of the retrorocket so that oxygen and CO₂ venting from his suit will pass through passage 34 in shank 18 to air nozzles 33. By twisting and wiggling grip 17 and the handle on igniter 40, the crewman can utilize the thrust from nozzles 33 to maneuver vehicle 10 into a proper reentry attitude. This attitude is achieved when retrorocket assembly 18 is pointing at or just slightly below the earth's horizon as it appears downrange along the orbital path (see FIG. 10). Crewman 52 during this time is looking through window 20, and when he passes over predetermined reference point X on the earth (e.g. a particular mountain range, body of Water, etc.) he pulls a lanyard (not shown) on igniter 40 to fire retro-rocket 30 and to start timer 30a. Maximum retrofire time for full 500 feet/sec. retrograde velocity increment at 0.5 g is approximately 37.5 seconds. The crewman maintains proper attitude during retrofire by manipulating rocket assembly 18 the same as he did for attitude acquisition. Most of the retrorocket thrust will be reacted through grip 17 to casing 11. Crewman acceleration reaction will be shared between his arms and his legs. He can "stand" against the far end of casing 11 and react a large part of his acceleration force with his legs. The crewman watches timer 30a (see FIG. 10) and when the proper retrotime has elapsed he releases the handle of igniter 40 which allows the still firing rocket assembly 10 to pull itself out of grip 17 and jettison itself from vehicle 10. Fitting 36 on hose 37 will easily disengage as the shank 19 is pulled through grip 17.

     Since there will be at least a minimum of eight minutes between the completion of retrofire and reentry of the earth's atmosphere, crewman has ample time to locate and grasp the two handles (not shown) diametrically opposed on inner bladder 21. Since bladder 21 is highly flexible, the nitrogen bottle embedded therein can easily be opened or broken to allow the inner bladder to inflate. Inner bladder 21 will inflate to 5 p.s.i.a. in about one minute, during which time the crewman maintains a grip on the handles and positions himself on bladder 21 by wrapping his legs around oxygen bottle 23 (see FIG. 11). When inner bladder 21 reaches 1.75 p.s.i.a. pressure, pressure reduction valve 26 (see FIGS. 11 and 12) will begin to meter nitrogen into outer bladder 22 which will fully inflate to 1.75 p.s.i.a. in about 2 minutes. During this time, pressure within bladder 21 will drop to 3.0 p.s.i.a. Crewman 52 will now be semi-enveloped in outer bladder 22 and somewhat pressed into the higher pressurized inner bladder 21. The 1.75 p.s.i.a. bladder pressure is selected as the minimum required to maintain the now spherical contour of casing 11 during reentry and to properly support crewman up to 8.5 g acceleration. The pressures in the bladders are limited to a value that will not collapse crewman's pressure suit and thereby insures that proper oxygen circulation and cooling will be maintained during reentry. The vehicle and crewman are now in the configuration shown in FIG. 12.

     During early moments of reentry vehicle 10 will pass through a Zone in which intense heat is generated, but this heat is adequately dissipated by heat shield 13 with insulation 15 maintaining the interior of casing 11 at an acceptable temperature. Once the vehicle is through this zone, it will fall through the atmosphere which will tend both to slow and cool the vehicle. At approximately 50,000 feet altitude, the pressure differential across the bladders will noticeably decrease. At 30,000 feet, outer bladder 22 will relax to the point where vehicle 10 is no longer spherical. Crewman 52 can now move his arms freely and can begin unzipping flap 11b. At 15,000 feet, outer bladder 22 is almost completely deflated, and inner bladder 21 is but 30% to 40% of its original volume. Vehicle 10, which now has no shape of its own, is descending at approximately 200 feet/sec. Crewman 52 switches from oxygen bottle 23 to the “jump' bottle (not shown) on his parachute harness, pulls himself out of casing 11, and makes a regular parachute landing back to earth. He can then utilize his survival equipment until he is picked up by rescue craft.

     While the invention has been described with reference to a particular detailed embodiment, it should be under stood that modifications, substitutions, and the like may be made without departing from the spirit of the invention and the scope of the appended claims.

---

Satellite Life Jacket (MOOSE)

• 

     It is not inconceivable that an astronaut may eject from a disabled spacecraft in the manner of a man abandoning a "burning ship" by donning a life jacket and jumping into the water. This is, in fact, precisely the scheme proposed by Bloom and Quillinan, (15) and designated by the acronym MOOSE (Man Out Of Space Easiest, later changed to the more professional-sounding Manned Orbital Operations Safety Equipment).

• 

• 

     As shown in the sequence of Fig. 110, when it is necessary to abandon the spacecraft, the man dons a space suit (or he may already have it on) and with it the attendant oxygen supply, recovery aids, and survival gear. As part of this design, the space suit is enclosed in a plastic covering and has attached to it tanks containing a foaming plastic and mixer. The man is also provided with a retrorocket package. To deorbit, the man visually orients himself to the earth and measures the altitude and direction of flight with an optical sight mounted on the retrorocket. Using the altitude information and precalculated range tables mounted in a display on the rocket structure, the man is able to aim and fire the rocket motor at the proper orientation in order to achieve reentry. Since there is little effect due to small retrothrust misalignment, visual aiming with a simple gunsight type of device should provide sufficiently accurate alignment. In many cases, the man will avail himself of the option of delaying the firing of the retrorocket until his position in orbit is advantageous to landing in a particular area. The procedure then calls for the astronaut to orient himself for reentry, using the cold control jets on the retrorocket and inflating the plastic covering to the designed shape for reentry. Straps attached to the man and the plastic covering position him in the proper relationship to the plastic covering. The foaming process then fills the space between the man and the plastic covering with foam plastic. A dense plastic foam of 50 lb/ft³ (800 kg/m³) forms the ablation shield, a less dense foam of 3 lb/ft³ (80 kg/m³) forms the afterbody, and a very low density foam of 1 lb/ft³ (16 kg/m³) "pots" the man and equipment in the vehicle. Prior to reentry, the high-intensity flare is fired and the beacon activated. The design shape is highly stable and orients itself early in the reentry. During reentry, the dense foam plastic ablates, protecting the man from the thermal environment, and the very low density plastic cushions him against the deceleration. After maximum reentry heating, radar chaff is expelled, and another high intensity flare is fired. At an altitude of about 30,000 ft (9,100 m) the parachute is deployed on signal from a baroswitch. Parachute-opening shock and drag pulls cutting cords which remove the lightweight foam plastic from around the man's hands and arms. The parachute is designed to limit the impact velocity to 30 ft/sec (9 m/s) at sea level. This is well below the maximum allowable impact velocity. At impact, Sofar bombs are released to provide location aids if the impact is on water. After impact the man releases himself from the lightweight foam by pulling on cutting cords with his freed hands and arms. He then obtains the survival kit embedded in the plastic foam. MOOSE can be used as a raft if the impact is on water, and the survival kit is equipped to maintain him in almost any earth environment.

• 

• 

     Figs. 111 and 112 show the MOOSE design. The entire unit weighs on the order of 470 lb (213 kg).

• 

• 

• 

• 

     A typical reentry trajectory for the MOOSE system is shown in Fig. 113, and the resultant reentry stagnation heating flux and total heating are shown in Figs. 114 and 115 respectively. Fig. 116 shows the calculated resultant ablation of the MOOSE shield. Urethane foam appears to perform well as the ablation material.

     Improvements beyond the capability of the early MOOSE system may come in the control of the impact area. This can be accomplished by providing the capability of remaining in orbit until a more desirable position has been reached and then firing the retrorocket. The extended time in orbit requires additional oxygen, CO₂ removal, and moisture removal. Altitude-, direction-, and angle-measuring equipment is another area of improvement. The optical sight is replaced by an IR sight of the vaporgraph type, thus enabling the man to view the dark side of the earth more clearly. Photo cells used to scan the IR sight could measure the included angle of the earth, and a simple computer, calculating the altitude and time to go to retrorocket firing, would also control the attitude jets from the photocell information. Air-, water-, and land-snatch capability could also be provided.

15. Bloom, H. L., and Quillinan, J.H., "Manned Satellite Emergency Escape Systems," Adv. in Astro. Sci., Vol. 8, Plenum Press, New York, 1961.

• 

• 

• 

• 

---

Satellite Life Raft

     It is common practice for ships to carry life rafts as part of their emergency equipment. Utilized at sea, a lift raft separates the shipwrecked sailor from the hostile sea environment, and lacking power and controls, drifts toward shore at the mercy of the currents. Its counterpart in space, the satellite life raft, insulates the shipwrecked astronaut from the hostile space environment while it hurtles toward earth (after deorbiting) without propulsive power or course control, under the influence of gravity.

     This concept, as well as that of the satellite lifejacket, is due to Bloom and Qullinan. (15)

• 

     The satellite life raft, shown in Fig. 117, although utilizing the same reentry shape, is a rigid vehicle with a 0.052-in. thick fiberglass liner protected by a nylon-reinforced phenolic plastic ablation shield 3/4 in. thick. With a 1/4 in.-thick aluminum-honeycomb-cored fiberglass afterbody to complete the closure, this rigid device gains in structural integrity and reliability over the life jacket which must be foamed into shape in space.

• 

     Typical operation of the life raft escape is shown in the sequence of Fig. 118. During normal operations, the satellite life raft is mounted in the wall of the satellite, shield protruding, entrance hatch open to living or working quarters, and airtight seal and clamps holding the life raft in its position. On initiation of the "abandon ship" signal, the astronaut climbs into the life raft, secures the hatch, and loosens the clamps (explosive or magnetic). Springs eject the life raft, and after seating himself in the seat composed of aluminum frame with a supporting web of partially drawn nylon, he secures his acceleration-deceleration harness and utilizes the periscope with 180° lens and scribed display face to determine proper orientation for deorbiting. Stored gas (which is air, available for breathing in case malfunction of deorbiting rockets necessitates a wait for rescue) is employed in the attitude jets to orient the life raft for retrorockcting. Attitude is adjusted according to visual observation of the juxtaposition of the earth with scribed circles on the periscope display. The emergency signaling procedure detailed earlier, consisting of flares, radio beacon, and Sofar bombs, is employed in sequence by the life raft.

     Reentry heat protection is furnished by the ablating heat shield, which also furnishes the insulating properties to prevent the reentry heat pulse from penetrating to the interior. Subsequent to traversing the extreme reentry conditions, the parachute is deployed by baroswitch signal at an altitude of 30,000 ft. The heat soaking that would take place during parachute descent and that would raise the inside temperature is avoided by jettisoning the heat shield at parachute opening. Landing impact is maintained at about 30 ft/sec (well below man's tolerance in the orientated seat of partially drawn nylon). After landing, the entrance hatch may be opened for air or egress. Since the device floats, there is no need to leave it if it lands on water. In the event it becomes necessary to leave, the rubber life raft from the survival kit may be launched through the hatch, which provides quick escape capability. As before, the survival kit provides sufficient equipment to maintain the man in almost any earth environment, and the handpowered "Gibson Girl" radio transmitter provides searchers with a homing signal (Nicknamed the Gibson Girl because of its hourglass shape).

• 

• 

• 

     A typical trajectory for the satellite life raft is shown in Fig. 119, and Fig. 120 presents a plot of the stagnation point heat flux resulting from such a trajectory. The total stagnation point heating is given in Fig. 121, and it is this value which fixes the amount of ablating material required.

• 

     By employing phenolic nylon as the ablative heat shield, the life raft design is able to take advantage of that material's higher effective heat of ablation, and thus it requires a heat shield thickness of only 3/4 in. while still maintaining a safety factor of at least 100%. This information is shown graphically in Fig. 122 which, for an extreme reentry condition, indicates the amount of heat shield ablated from the surface of the life raft during reentry. In addition, the char and remaining ablative material form such effective insulation that the inner surface of the fiberglass liner remains below 160° during the heating portion of the trajectory.

---

Satellite Life Boat

     Continuing the analogy with sea rescue equipment, a higher degree of survival capability is afforded by the use of a satellite lifeboat. This idea, also developed by Bloom and Quillinan, (15) is best studied with respect to stipulated crew size and degree of maneuverability desired.

• 

     Arbitrary selection of a three-man team, with associated equipment and a 500- nautical mile cross-range maneuver, combined with a requirement to initiate the maneuver at 0.8 to satellite velocity in order to avoid maneuvers when stagnation heat fluxes are highest, fixes payload weight at about 1,000 lb, and L/D at about 1.5 (Fig. 123). These, together with compact design and simplicity requirements, helped set shape factors in the design selection.

• 

     The resulting device is shown in Fig. 124.

     An interesting feature of this lifeboat is the combination of heat shields used. On the windward surface, where reentryheat fluxes and air temperatures are high, this device employs the ablating phenolic nylon shield. On the lee side, the lower air temperatures allow the use of a reradiation heat control provided by a refractory coating backed by 4 in. of insulation.

• 

     In operation, the sequence of Fig. 125 seems reasonable. At the "abandon ship" signal, the astronauts scramble into the lifeboat which is sealed to the outside of the space station. The access hatch of the lifeboat is open to the interior of the station, and the astronauts occupy the aluminum-nylon web chairs, the hatch is fastened, seal is broken with station, and the lifeboat is sprung away from the station. Using a periscope version of the alignment sight previously discussed, the lifeboat is positioned by cold jets for deorbiting, and the retrorocket fired. With periscope retracted, instrumentation aboard provides information on reentry loads, vehicle orientation at reentry, and time to initiate maneuver. At the "maneuver" signal, the periscope is once again extended and maneuvers begin when the pilot astronaut, using navigation aids aboard, locates a suitable landing area. The previously described location aids are still used in sequence; e.g., flares, beacon, and chaff. On approach to the landing area, the parachute is deployed and the landing is almost vertical. Should the landing take place on water, the lifeboat floats more than half out of the water. When required or desired, the forward half of the device is released and jettisoned. The rear half can continue to float and is provided with a watertight plastic cover for insertion in the space left by the ejected nose section. If the lifeboat is to be abandoned, the rubber raft of the survival kit can be inflated, and, as before, survival kit and "Gibson Girl" provide excellent survival capability.

---

EGRESS

     As noted earlier in this monograph, a complete manned space mission profile is generally divided into prescribed regions, each of which exhibits its own peculiar abort problems. It would seem to imply that several different abort systems would have to be incorporated in the same vehicle.

• 

     EGRESS, which is an acronym for Emergency Global Rescue Escape and Survival System, is an attempt to provide an abort capability over a complete range of flight profiles from on-the-pad, through atmospheric boost, orbit injection, orbit, reentry, and landing. The EGRESS vehicle is illustrated in Fig. 126. Its basic design employs the existing B-58 cockpit ejection capsule. Space rescue additions include an attitude control system, guidance unit, environmental control system, UHF communications link, retrorocket, and a drag stabilization system. The total weight is 716 lb.

     The system operation varies with different phases of the flight profile. For this reason,a manual selector switch is incorporated in the design thereby allowing the astronaut to preprogram the ejection and recovery operation for the particular flight conditionat abort.

     A typical abort sequence begins with encapsulation; that is, the upper, center, and lower doors (which are normally positioned above the hood in Fig. 126) are moved to the down position, thereby completely sealing the astronaut from the environment. The astronaut ejects the capsule by squeezing one or both of th eejection triggers on the ejection handles or firing a canopy or hatch jettison actuator; after a 0.3-sec delay, the ejection catapult is fired, giving the capsule a separation velocity of 50 fps. The rocket provides an impulse of 3,000-lb-sec ,which is enough to ensure tail clearance for a 1,000-lb capsule at a dynamic pressure of 1,600 psf. Since peak dynamic pressure during boost is only 800 psf, this combination of rocket and catapult should be sufficient to provide separation and attenuate decelerations.

     Nominal spinal accelerations imposed on a man by the catapult are approximately 13 g. If the ejection occurs in any suborbital period, the sequence fires the ejection rocket. Since the capsule drag is quite high and is only partially offset by thrust, the vehicle deceleration rate can be as high as 22g. As the capsule clears the vehicle, aerodynamic forces (if they exist) will position the capsule so that the heat shield is forward and positive acceleration (eyeballs in) is imposed on the capsule occupant. Stabilization is provided aerodynamically by the capsule/heat shield combination, and it is augmented by a drag chute stabilization system during sub-orbital periods.

     If ejection occurs during orbit, the ejection rocket is locked out and the ejection sequence fires only the small ejection catapult. The catapult provides minor acceleration; thus the capsule is simply pushed out of the primary vehicle. At this point, the attitude control system is used to orient the vehicle manually and stop tumbling. The astronaut then uses the onboard clock for time information. Knowing the exact time, and using an onboard position location chart (based on time), the occupant decides when to initiate retrofire. The onboard life support system is designed to provide oxygen and environmental control for approximately 1.5 orbits to allow adequate landing site selection. Before retrofire, the capsule is oriented manually so that the telescope reticle is in line with the horizon. Manual retrothrust then is initiated; alignment is maintained by using the large attitude control nozzles. After retrothrust, the capsule is oriented to the reentry position and manually retained by using the attitude control system.

     The 50-ft-diameter ring-sail recovery parachute reduces the capsule' s rate of descent to 25 fps. Ground impact forces are absorbed by four shock attenuators that are part of the heat shield attachments. The closed capsule can float without using auxiliary buoyancy devices. However, to provide stability in rough seas and maintain an upright attitude to open the upper capsule door, four outriggers with inflatable flotation bags are provided. The bags can be inflated quickly from a pressure container on the upper flotation outriggers, A hand-operated pump is provided for inflating the flotation bags on the lower outrigger. The most critically needed items of survival equipment are accessible to the occupant of the closed capsule. After landing, the capsule can serve as a shelter or life raft.

     A typical abort sequence is illustrated in Fig. 126. It is essentially the same with slight, but important, variations over the entire flight profile.

     The boost phase establishes design criteria for the maximum dynamic pressure and maximum airloads; the reentry phase establishes design criteria for the aeroheating condition. The stability problems are somewhat different in these phases because of the differences in the Mach number and dynamic pressure combinations.

     The escape environment has been investigated for several points during ascent, which comprises powered flight to a low perigee, coast, and final injection at the mission altitude. The escape conditions during the period of coast are not significantly different from the normal orbit conditions.

• 

• 

• 

     A typical boost trajectory is presented in Fig. 127. Critical escape points are: (1) at launch, (2) at maximum dynamic pressure, (3) near staging, and (4) before orbit injection.

• 

     Results that affect design criteria are summarized in Table VIII; the first columns show the first critical conditions the capsule would experience when it is separated from the basic launch vehicle during boost; the second critical condition represents the period when the capsule falls back to earth or reenters from the launchabort trajectory.

     The maximum airload and deceleration occur during case A, the low-altitude booster, maximum dynamic pressure condition. However, the heating rates are low in this case. The most critical combination of deceleration and heating occurs in case E, the near-orbit injection case. Although the initial flight path angle at abort is only +3°, the trajectory dynamics and velocity combine to give a return-to-earth, or reentry, angle of about -6° or -7° at a velocity of about 20,000 fps and an altitude of 300,000 ft. This relatively steep reentry angle results in high decelerations and heating rates.

• 

• 

     Table VIII also shows the nominal orbital reentry conditions for comparison. The orbital reentry trajectory shows the most critical heating rates, but the dynamic pressures are about one-half those shown for case E. The critical design limits imposed by the reentry trajectory include maximum allowable decelerations encountered for shallow reentry. The capsule retrorocket will provide a predetermined reentry angle; the trajectory data shown in Figs. 128 and 129 represent the proposed capsule reentry. If the capsule is ejected from a lifting parent vehicle during reentry, the deceleration and aeroheating conditions generally will be no more severe since lift vehicles typically reenter at shallow angles.

     The aeroheating environment is nearly identical to that of the hardwareproved Mercury capsule. The proposed capsule heat shield has a slightly smaller diameter than the Mercury shield (70 in. as compared with 74.5 in.), and the W/CDS is about one-half (25 psf vs 55 psf). No particular problem areas are anticipated for the forward ablative heat shield, since the heating rates of 50 to 60 Btu/ft²-sec and heat loads of 6,000 to 8,000 Btu/ft² are similar to those experienced by the Mercury capsules.

     For escape from the parent vehicle during reentry, the capsule may eject at a maximum heating condition. In this event, the ablative heat shield briefly faces rearward until the capsule can rotate (yaw) 180° . A check of the yaw maneuver showed low total heat loads on the doors.

11. Dunn, J. P., and Carroll, P. C., "Project EGRESS," J. Spacecraft, Vol. 4, No. 1, 1967, p. 9-14.

• 

• 

• 

---

Paracone

• 

     Another system which has an abort capability throughout the flight profile is the paracone. (28) This concept, which is illustrated in Fig. 130, exhibits marked similarities to the satellite life raft (Sec. 3.4.2) and EGRESS (Sec. 3.4.4). Its distinctive feature is the use of an inflatable cone. It is claimed that this affords advantages by providing:

1. Automatic stability and orientation during atmospheric entry and descent to impact due to its peculiar shape.
2. Protection for the crew from temperatures generated by the reentry forces.
3. Absorption of the drag force of reentry due to atmospheric deceleration, For this application this force will be over 2-g for 3 rain with a 10-g peak with the crew in the prone position.
4. Atmospheric deceleration to impact.
5. Impact attenuation to minimize the landing force.
6. Shielding against immersion, forest impact, or landing hazards in other adverse terrain.
7. Flotation in the event of a water landing.
8. A large, three-dimensional target for visual or radar search
9. Shelter for the crew against the elements until recovery.
10. Psychological support to the crew by providing him with a large vehicle during the long minutes of the return.

• 

     Basically, the paracone is a gas-inflatable structure shaped like a cone with a large spherical nose. The astronaut is positioned and supported within the cone approximately one third the length of the cone as measured from the leading edge of the spherical nose. He is suspended over an air mattress flotation plenum chamber which, in turn, is located over the impact attenuator (see Fig. 131).

• 

     The paracone is part of the crew control seat, and includes the ejection device which enables the crew to clear the stricken vehicle, the stabilizing unit for retro postion alignment, the retro unit to allow deorbiting, the Paracone inflation system that inflates the deploys the Paracone, the life support pack, and the survival pack (Fig. 132). When deployment occurs, the astronaut is so positioned within the paraconethathe is protected during the reentry-temperature and aerodynamicdeceleration phase. In addition, as an integral part of its expandable structure, the paracone provides a terminal velocity impact decelerator, impact attenuation system, flotation and anti-immersion devices, and a large, three-dimensional search target for recovery.

     The Paracone is weight-limited rather than size- or shape-limited, and is designed to handle any payload of reasonable size or shape within its weight accommodation design envelope. The astronaut or the crew-containing capsule rests within the Paracone with the crew in the prone position. Deployment of the Paracone may take place either before or after the retrograde force is applied to the payload removing it from orbit.

     In a de-orbit abort sequence, the astronaut actuates the ejection handle which (1) vents the cabin; (2) removes the emergency access door in the vehicle; (3) ejects the astronaut, his seat, and the paracone system at a predetermined rate; and (4) actuates the radio beacon transmitter. At a safe distance from the stricken vehicle, the astronaut stabilizes his seat with his attitude controls. He rotates the retrorocket into firing position, observes his position above the earth, and determines when he will fire his retrorockets. He has one orbit's time in which to do this. As he approaches his selected retrorocket firing point, he stabilizes to the correct firing attitude by using his horizon sighting bar, by orientation through star observation, or by radio instructions from earth. At the selected time, he fires his retrorockets and continues to made his attitude adjustments until the retroroeket impulse is completed (see Fig. 120).

     The velocity increment of 550 fps applied in the retrograde direction will result in an initial entry speed of approximately 26,000 fps and an angle of 2.5°. If a ±10% tolerance in velocity increment and 30° tolerance in application angle in any direction are allowed, the minimum entry angle is 1° and the maximum angle is 2.5°. The paracone has been designed to operate successfully while not exceeding human tolerance limits over this range of entry conditions. These tolerances should provide impact with a range error of less than 500 n. mi.

     After the retrorocket firing, the astronaut jettisons the empty retrorocket and actuates the paracone inflation system which allows the inflation gas to enter the pneumatic shaping structure of the paracone. From this point until after earth impact the astronaut has no other operation requirements. As the Paracone inflates, the internal gas pressure forces the protective housing segments apart until the segments reach a point at which they are automatically jettisoned. The pressurizing gas inflates, the internal gas pressure forces the protective housing segments apart until the segments reach a point at which they are automatically jettisoned. The pressurizing gas inflates the shapes the paracone around the crew. The internal shaping pressure of the paracone is maintained at a pressure differential of 3 psi during the atmospheric reentry and descent to earth. Time of descent from retro to impact will be approximately 1 hour.

     As in the case of EGRESS, the precise details of the abort sequence vary with the particular phase of the flight profile.

• 

     An on-the-pad abort is illustrated in Fig. 133.

     Some basic testing has been performed on the paracone structure including (1) wind-tunnel tests for drag and stability information, (2) free-fall model drop tests for dynamic stability information, (3) full-size impact attenuator tests, and (4) flow tests of various attenuator materials for use in comparative analyses seeking the most efficient material for the attenuator.

     It is reported that these tests have been sufficiently encouraging to demonstrate basic feasibility of the design, Further details may be found in the paper by Kendall. (28)

     28. Kendall, R. T., "Techniques for Space and Hypersonic Flight Escape," Proc. SAE Aerospace Systems Conf., Los Angeles, 1967, p. 394-400.

• 

• 

• 

• 

• 

• 

• 

The escape pods were lenticular ceramic heat shields with thermoplastic covers, hardly bigger than Porta Potties. Stored inside each was a parachute and an inflatable raft in an ejection rig and — the only really specialized gadget — a hand-aimed, gyro-stabilized, solid-fuel retrorocket. An astronaut who had to leave orbit in a hurry was supposed to climb in, lie back, clutch the retrorocket to his or her chest, adjust position and attitude with its gas jets, then take aim at an easily identifiable star specified by mission control and pull the trigger.

The impulse from the solid-fuel rocket would gradually slow the pod until orbital velocity was lost, whereupon the astronaut threw away the rocket, closed the flimsy hatch with its little bubble window, and tried to relax while falling through the atmosphere, on fire, decelerating at five gees plus. Below about 7,000 meters or so the pod's cover would pop off, spilling the astronaut and deploying the chute.

Simple.

In seconds he had the nearer pod free of its straps. Lifting the thermoplastic lid, he found all the neat packages of equipment nestled where they should be. He ripped open Velcro fastening of yellow webbing, yanked at cotter pins festooned with red warning strips. One of them activated a SARSAT radar beacon...

...Flipping over to squat on the pod, he shrugged off his life-support backpack and hooked into the pod's portable emergency oxygen supply. He wrestled himself onto his back and tugged the parachute straps across his chest and shoulders, pulling the life raft package up under his rump. The strap edges scrunched thick layers of suit material into an oppressive lump in his crotch. It was exhausting work, and he heated up fast without the coolant flow from this abandoned backpack, but it had to be done right; parachutists had dismembered themselves with loose harnesses.

• 

(ed note: the planet of New Finland has been conquered by space nazis. No, really. From a hidden rogue planet colonized by the Ku Klux Klan, The New John Birchers, the remnants of Afkrikaaners in Exile, and other assorted fascist groups. Anyway, the Federation cannot rescue New Finland because the nazis have surrounded the entire solar system with homing anti-ship missiles. The New Finland freedom fighters have to capture the control system for the missiles. Which happen to be inside a huge nazi aerospace craft named Leviathan orbiting the planet at low altitude. The controls have to be captured, not destroyed, or there is no way to turn off the missiles. The freedom fighters have to figure out a way to get lots of their soldiers onto the nazi ship. Sadly they do not have spacecraft capable of carrying large amounts of troops.)

      Then Marie-Francoise came up with a wild card: one-man escape shells. Escape shells are one of the simplest and scariest ways to get out of space. About all they amount to is someone in a spacesuit inside an ablating heat shield, plus a moronic guidance system and a retro rocket. If you're stuck in space, you wriggle into the thing and push the button with crossed fingers. The guidance gizmo points the retro in roughly the right direction, and with luck it guns properly, you get kicked in the direction of the atmosphere, and the heat shield melts away, maybe without cooking you. You press another button and explosive bolts blow the reentry shell either away from you or through you and then a chute pops open, which, more than likely, deposits you in the ocean, where you drown.

     They weren't really all that dangerous, I suppose, but there were people who rode them as a sport. In my line of employment I've been close to killed enough times trying to do a job that I don't see the point of risking my neck for fun.

     About 200 escape shells had been stockpiled on Vapaus while it was being built, for the use of construction workers in an emergency. This official stockpile had never been used, and it still gathered dust in a storeroom somewhere.

     Marie-Francoise also found a club full of overconfident idiots who called themselves The Meteors, which I thought was all too well-chosen a name ("meteorites" actually survive long enough to hit the ground. "meteors" usually disintegrate at altitudes of 50 kilometers). They had held regular drops before the war, and had manufactured their own shells. They hadn't been able to make any drops, or any new shells, since the war began, but they had had their eyes on the old official stockpile for a long time.

     The club president insisted that The Meteors could land on the deck of Leviathan if they were dropped from orbit accurately. They planned to use grappling hooks and count on plenty of padding in their suits. I hesitated before agreeing to let them go, but we were going to need every overconfident idiot we could get our hands on.

     From every side it was the same-everyone wanted to fight, everyone wanted to go, everyone wanted to grab that ship. Marie-Francoise told us Vapaus was a beehive stirred up. Every workshop was full, every gun was loaded, every ship was ready to fly.

• 

A SF Staple

For me, the introduction to escape pods came via Episode 1 of Star Wars, and the small capsule that R2-D2 and C3PO used to escape from the Tantive IV. Then there were the triangular Sovereign class pods from Star Trek: First Contact, the spherical escape pod from Starship Troopers 3: Marauder, and the flying coffins from Prometheus (yes, I am going to wash my mouth out with soap after mentioning that abomination). Escape pods are an established feature of SF spacecraft, and unlike many other features shown by Hollywood as vital, they appear to be a logical addition to any ship. In a more realistic SF 'Verse, however, it seems unlikely that a deep-space craft will be so equipped, for reasons that will be explored later. The type of spacecraft, its mission, and the 'flavour' of the 'Verse all affect the utility of a escape pod, and while they may make sense in the context of Star Wars, they may not apply to many situations in a hard SF world.

Escape Pod: Definition

Like many kinds of SF tech the escape pod is often confused with other vehicles, and/or misnamed. Quite often there are small spacecraft that serve the same role, such as the Narcissus shuttle from Alien, or the escape craft in which Ripley, Newt, and Hicks escape from the USCSS Nostromo in Alien3 (more soap). These two craft do not qualify as escape pods because they have an extended flight capability, enabling in them to make planetfall from beyond orbit, or reach a inhabited system from deal space. As in the case of the Narcissus a 'lifeboat' the craft such as these may in fact be the auxiliary vessel carried as part of normal operation; this is seen in Star Trek (2009) when the USS Kelvin was evacuated with the shuttles.

An escape pod can only be used to reach the surface of a planet from orbit, and possesses only enough DeltaV to deorbit, often combined with atmospheric braking. If used in deep space the pod would simply float until help arrived, as it could if the planet was unsuitable for landing. This is the type seen often in Star Wars, especially the animated Clone Wars, although those are far more sophisticated than might be the case. Unlike a 'lifeboat' craft escape pods are often seems as disposable, having only enough power to make a safe landing and call for help.

Arguments For & Against

Escaping from a dying spaceship just in time to see it exploded in a nuclear fireball moments before the escape pod begins to tear into the atmosphere of the inhabitable, uncharted planet... This is kind of fiction that inspires the inclusion of escape pods in spacecraft designs. Desirable as it might be, however, it is only a fiction. Space is a relatively benign environment; a crippled spaceship will not sink, be torn apart, or explode as an aircraft, ship, or submarine might. And don't forget, in space none can hear you scream, so you will be waiting a long time for help.

Deep space is a different case to a planetary system or orbit itself, so I'll discuss it separately. The most effective way of analysing an escape pod in deep space is to compare it to the lifeboats on a cruse ship. I know, space isn't an ocean, but in this case it is a helpful analogy. If a cruise ship sinks the lifeboats have on job — keep people alive until help arrives, which, given the number of ships in major shipping lanes, should not be too long. It seems safe to assume that a space liner could use escape pods in the same way, but this fails under several criteria. One, the spaceship cannot sink, so there is no danger to staying aboard a spaceship that has been disabled by a failure or meteor strike. Note that NSWR spacecraft are an exception to this, as they can explode if the tanks fail; but even then it would be better to jettison the tanks themselves. The ship will be compartmentalised, so even severe damage should leave habitable sections. Two; the pods cannot carry sufficient life support, food, or power. One a lifeboat in the pacific there is air, sun for solar power, edible fish, etc. to help you survive. In space, any escape pod or 'lifeboat' needs to carry oxygen, filters to scrub CO₂, water recycling, etc. This might be doable for the short term, say a few days to a week, but on a Hohmann transfer that is going to do no more than prolong the agony. And if the ships in the 'Verse are fast enough to rescue the survivors, then escape pods are not needed, they could just stay with the ship and its greater supply of food, power, oxygen, etc. So it can be seen that escape pods are infeasible for deep space; dangers like fissioning fuel can be easily dumped, and the pods are going to have fewer resources.

Near space has the same limitations as deep space, but orbit does allow the use of escape pods. Over a habitable planet all the pods have to do is land, something that can be accomplished with far less weight than survival for a few weeks in deeps space. For this task a escape pod might be a one man device scarcely larger than a phone booth; the drop pods used by the ODST in Halo would be quite similar to what would be needed. Or it could be larger, carrying several people and enough supplies to last them for weeks or months, along with communications equipment. If the planet is hostile — incompatible atmosphere — then there is no point landing, and it is better to stay in orbit where the arguments against escape pods in deep space apply.

It seems that pods are of the most use when in the vicinity of a planet, which means that Star Trek and Star Wars got something right at least. It also makes them unlikely to be found on spacecraft that spend a long time in transit between destinations, due to the weight penalty. The place they are most likely to be found is on a space station. Stations likely carry far more people aboard than can be evacuated by shuttle alone, have less of a weight limit, and are normally close to planets. Which brings up another constraint; the planet must be habitable, or at the very least, non-hostile. And these may be few and far between in the real world.

The above points can be extrapolated to indicate the type of 'Verse in which escape pods are going to be a commonplace, and where they will be used. Space stations over habitable planets will be the main use, followed by ships that have large crew/passenger numbers and which regularly pass habitable planets. Note that within a solar system this is unlikely, so you are looking at starships. Given the difficulty of interstellar flight, and the time spent in deep space away from any planet, means that only FTL starship really befit from escape pods. This is the case in Star Wars, where hyperspace is used to jump from one habitable planet to another. Usually the starships are close enough to a habitable planet that escape pods are a perfect safety measure. FTL comms also make them more practical, as it allows for a much higher probability of rescue, especially if the starship went down outside normal travel routes.

So you end up with a moderately hard 'Verse. One in which the technology and setting are generally crammed with realistic science, but in which there is FTL travel and communication, a unlikely number of human habitable planets, and starship design that goes in for catastrophic failure (or space battles in orbit, although it is unlikely anyone would survive from the loosing ship, no matter what escape methods they had planned).

"One thing," Michelle chimed in, "Kelly, take this," , she tossed him a flat metal box, about five centimeters on a side, with a metal chain. "Wear that around your neck at all times from now on. Those are your tracetabs. They contain all the trace elements your body needs. There are about three thousand tabs in that box (8.2 years). If we go on xeno-rations, you'll need them."

Kelly seemed puzzled.

"There are about a thousand planets," Sims explained, "that supply native food edible by humans. On maybe half a dozen of them, all the trace elements necessary for human survival are present in the food."

"If the soil and atmosphere are comparable to Earth's," Michelle continued, "native flora and fauna may give you all the protein, carbohydrates, and vitamins you need, but trace elements can be hard to come by. You'll die just as dead from lack of magnesium, phosphorous, or any number of other elements as from lack of water. If you get stranded on a xenoworld, that box can be your lifeline. Always keep it filled."

• 

A survival kit is a package of basic tools and supplies prepared in advance as an aid to survival in an emergency. Civil and military aircraft, lifeboats, and spacecraft are equipped with survival kits.

Survival kits, in a variety of sizes, contain supplies and tools to provide a survivor with basic shelter against the elements, help him or her to keep warm, meet basic health and first aid needs, provide food and water, signal to rescuers, and assist in finding the way back to help. Supplies in a survival kit normally contain a knife (often a Swiss army knife or a multi-tool), matches, tinder, first aid kit, bandana, fish hooks, sewing kit, and a flashlight.

---

General contents

The general contents of an emergency survival kit depend on the location. Basic components in a survival kit address the needs of first aid, food, water, shelter, navigation, and signalling.

Shelter and warmth

A variety of materials are recommended for emergency shelters, and vary between geographic regions. Options often included in survival kits may consist of:

• Reflective "aluminized" (Mylar coated) space blanket or survival blanket to retain body heat (and signal)
• Lightweight poncho for protection against wind and rain
• "Tube tent" or bivvy bag
• Tarp with grommets or tie-tapes (best if nylon or polyester)
• Large plastic trash bag as poncho or expedient shelter roof
• Ferrocerium rod (AKA "Metal match", "Hot Spark", "Firesteel", "Magnesium fire starter") and fire striker for fire-starting, Fire piston or Solar Spark Lighter
• Waterproof matches or lighter
• Cotton balls or pads smeared with petroleum jelly for fire starting (can be carried in 35 mm film container, zip lock baggie or heat-sealed inside large diameter plastic straw)
• Catalytic heater and bottled gas fuel
• Emergency sleeping bag great for shelter and warmth

Health and first aid

First aid kits will often include a combination of the following:

• Bandages
  • Sterile combine dressing, and gauze pads
• Adhesive tape, and gauze tape
  • Disinfectant pads
  • A 30-day supply of personal prescription medication
• Antibiotic cream
  • Rubbing alcohol
• Burn cream
• Aspirin
• Sunscreen (where appropriate, above 30 SPF)
• 100% UV protective sunglasses ("UV 400") (protects eyes from harmful UV radiation. Polarized glasses are not necessarily UV protective, but aid with glare only)

Food and water

Most survival kits involve sustenance for short periods of time, to be used and replenished before contents spoil.

• Water in sealed containers for dry areas, or water purification tablets or household bleach in areas where water is available but may be contaminated. For emergency water purification see: water purification techniques
• Canteen full of water, and a filter if needed
• Heavy duty aluminum foil to create a distillation tube to remove salt from salt water during boiling/condensation. Must have another receptacle to collect condensate.
• Canned food, Meals Ready-to-Eat (MRE), or high-energy foods such as chocolate or emergency food bars.
• Fishing line and gear (fish hooks, lures, and split shot leads)
• Snare wire
• Gillnetting (for emergency fishing)

Some dry fruits, peanuts or roasted grams.

Signaling, navigation and reference

Since the primary goal of a survival kit for lost or injured persons is rescue, this part of the kit may be considered the most essential. Key elements for rescue include:

• Distress radiobeacon
• Whistle
• Signal mirror
• High power LED light (able to have batteries replaced, and carry an extra battery), white lens, with signaling capabilities. Strobe versions are available for some lights. Use lithium cells only, due to superior shelf life.
• Flare: three fires in a triangle is the international distress signal
• Laser pointer with lithium batteries, for superior signaling range. Laser pointers have resulted in at least one rescue: during the night in August 2010 two men and a boy were rescued from marshland after their red laser pen was spotted by rescue teams.
• Surveyor's tape - orange or chartreuse for marking location for rescuers
• Pen/pencil and paper for leaving notes to rescuers about direction of travel
• Compass. Analog watch can also be used to determine orientation when the sun is visible - See direction finding using a watch
• Trail maps/charts (if location is known in advance)
• Survival manual for technique reference
• Glow stick

Multipurpose tools or materials

Survival kit tools emphasize portability and versatility. Tools recommended for many types of survival kit include:

• Fixed-blade knife, or multitool such as a Swiss Army knife.
• Can opener such as the P-38 or the P-51
• Heavy-duty needle and thread for repairing clothing and equipment
• Red or orange plastic bag(s) or trash bags
• Sturdy cord or "550" parachute cord for setting up a tarpaulin and snaring small animals
• Hatchet with sheath for cold conditions, or machete for tropical conditions (shelter and fire)
• Camp stove or some type of gas burner and fuel such as bottled propane or Liquefied petroleum gas (LPG)
• Candles for light, signaling, fire-starting
• Metal billycan or "water bottle" for water storage, boiling, purification, cooking
• Compact saw such as Japanese style backsaw with coarse teeth (folding models available). Bow saws can quickly cut larger diameter limbs and small to medium thick trees, and Folding saws can be small enough to fit into a kit, but big enough to cut small to medium diameter limbs, and possibly smaller trees.
• Solar charger
• Helmet

---

Lifeboat survival kits

Lifeboat survival kits are stowed in inflatable or rigid lifeboats or life rafts; the contents of these kits are mandated by coast guard or maritime regulations. These kits provide basic survival tools and supplies to enable passengers to survive until they are rescued. In addition to relying on lifeboat survival kits, many mariners will assemble a "ditch bag" or "abandon ship bag" containing additional survival supplies. Lifeboat survival kit items typically include:

Safety equipment

• Life jackets
• First aid kit
• Fire extinguisher
  • Bucket

Communications and navigation

• Compass
• Distress beacons or (EPIRBs) to alert the Cospas-Sarsat rescue consortium, an international satellite-based search and rescue distress alert agency and identify the registered beacon owner's specific information from their registration file
• Red flare, rocket parachute flare, and/or smoke signal flare
• Laser pointer for signaling aircraft (red is color of distress, but green color is higher power and will be seen farther), with lithium cells, in double waterproof plastic pouch (pointers of high power are a theoretical hazard to eyes of low-flying pilots at night)
• Radar reflector (to help rescuers locate the raft)
• Lighter
• Lantern and fuel, the fuel doubles as firestarter
• Radio transceiver, standard VHF marine when operating near inland shore, 121.5MHz AM VHF guard channel capable aircraft band transceiver to contact rescuers and high overflying commercial and military aircraft visible by contrails, an optional amateur radio if a licensed radio amateur, (see Ham Radio) or an AM/FM/Weather/Shortwave radio receiver to receive precise time for celestial navigation as well as weather information
• GPS navigation device

Food and water

• A knife, multi-tool, and/or Swiss army knife
• Fishing kit
• Rainwater collection equipment
• Seawater desalination kit
• Water (typically 3 liters/person/day)
• Emergency high-calorie rations/food (not as important as water). Chocolate has a superior calorie/weight ratio
• Hatchet

Other tools and boating items

• Waterproof flashlight
• Heaving line
• Ladder
• Bailer
• Bilge pump
• Boat hook
• Sea anchor (also called a "sea drogue")

• 

NAZ-3 survival kit. It was designed in 1968 for the Soviet Soyuz spacecraft, the reliable workhorse of space flight which is still in use today. As outlined on this interesting site about the Russian space program, the kit contained the following from top left to bottom right:

• Makarov pistol and ammunition
• wrist compass
• 18 waterproof matches with striker
• machete; fishing kit
• strobe light with spare battery
• 8 fire starters
• folding knife
• antenna
• 3-pair wool gloves
• signal mirror
• NAZ-7M type medical kit
• penlight
• R-855-YM or R-855-A1 radio
• two “Priboy 2S”, ПРИБОЙ-2С radio batteries
• three wool balaclava hoods.

The system is intended to enable two astronauts, exploring with an unpressurized rover, to remove their space suits for an 8-h rest away from the lunar base and then conduct a second day of surface exploration before returning to base. This system is composed of an Environmental Control and Life Support System (ECLSS) on the rover, an inflatable habitat, a solar shield and a solar power array...

...The mass, volume, and power analyses of each subsystem are integrated to generate a total system mass of 124 kg and a volume of 594 L, both of which can be accommodated on the Apollo Lunar Roving Vehicle with minor improvements.

• 

The rover ECLSS connects to the habitat via umbilical cables to maintain the atmosphere in the habitat. A thermal control unit on the rover is connected to the liquid cooling garments worn by the astronauts to provide active thermal control, while a solar shield is used to provide passive thermal control to minimize the load on the thermal control unit. The ECLSS contains a carbon dioxide scrubber, a “slurper” to remove humidity, an oxygen tank for respiration, and a water tank for the sublimator, crew hydration, food preparation, hygiene or medical use. The solar array provides power for the overnight system and recharges the rover batteries for the second day of exploration...

2.1. Inflatable ribbing concept

When the astronauts first enter the inflatable habitat, the airlock volume requires a support structure in order to retain its internal shape while at zero internal pressure. Inflatable ribbing may be chosen for structural support. This ribbing consists of a frame of small-diameter inflatable tubes that, when inflated to high pressure, provide a rigid structure for the habitat. Thus, the astronauts can inflate the ribbing prior to entry without filling the interior of the habitat with O2. Then the astronauts can enter the habitat, close the airlock, and fill the interior of the habitat to the desired pressure. A similar inflatable ribbing concept is used in commercially available inflatable camping tents.

2.2. Flexible membrane airlock design

To reduce the total size of the habitat, a novel flexible membrane was designed such that the same internal volume could function as both an airlock and habitat. As shown in Fig. 3, a thin, flexible, airtight membrane divides the internal habitat volume into an airlock side (left) and a habitat side (right). The membrane material is similar to the habitat outer surface without the micrometeorite protection, resulting in approximately 1/4 the surface density. The membrane is sized such that at any given time the entire volume can be used either as an airlock or as a habitat.

• 

The concept of operations for entering the habitat using the flexible membrane airlock is illustrated in Fig. 3. After the astronauts have entered the habitat and pressurized the airlock, they remove their suits on the airlock side (top row of Fig. 3). Next, the airlock membrane is moved manually by the astronauts to its neutral transition configuration (middle row of Fig. 3). A valve in the membrane is used to regulate air flow from one side of the habitat to the other while the membrane is moved and the flow path is filtered to ensure that lunar dust is not transferred from the airlock side to the habitat side. After moving the membrane to the neutral position (in which it divides the habitat into two equal halves), the astronauts unzip an airtight zipper and proceed to the habitat side through the hole in the airlock membrane. Equipment is passed through in the same way. Next, the airtight zipper is closed and the membrane is manually moved towards the airlock side, maximizing the volume of the habitat side (bottom row in Fig. 3). The astronauts close the valve to the airlock side and then conduct activities within the habitat...

...When considering entry and exit of the habitat, a net could potentially be used to restrain the airlock membrane in its neutral transition position in circumstances where the habitat side is pressurized but the airlock side is not. With a net in place, only partial venting of the volume would be required for entry and exit. The flexible membrane concept makes efficient use of the available space and reduces the total required internal volume of the habitat.

2.3. Inflatable geometry optimization

A preliminary geometric analysis was used to select a cylindrical geometry with hemisphere end caps and a flat floor. The cylinder was designed to accommodate the two astronauts standing vertically to don/doff their suits and the two astronauts sleeping side-by-side. The design was further constrained to a minimum interior volume of 12 m3 as a conservative estimate [9], and was required to have a flat cylinder wall between the end caps that was long enough to accommodate a door 0.75 m wide for entry and egress. The radius of the cylinder, the width of the flat floor, and the length of the cylinder were optimized to ensure that these requirements were met while minimizing the total mass of the inflatable skin and ribbing...

• 

Table 1. Optimal inflatable pill mass and volume

Component	Mass (kg)	Thickness (mm)	Material volume (m3)
Support ribbing	1.10	0.09	0.0007
Adjustable airlock	4.04	1	0.0160
Wall/ceiling	26.27	5	0.1117
Floor	3.60	4	0.0155
Packed volume	–	–	0.2879
Total	35.01	–	0.1440

Table 2. The optimized geometry of the inflatable cylindrical flat-floor habitat

Cylinder radius	1.29 m
Cylinder flat side length	0.75 m
Maximum floor width	1.80 m
Maximum floor length	2.55 m
Maximum height	2.21 m
Interior volume	12.00 m3
Door height	1.84 m

2.5. Inflatable deployment and stowing

...Using the packaged volume of 0.2879 m³ determined in Section 2.3 (packing factor of 2), the folded inflatable can be expected to fit into a rectangular prism of dimensions 1.4 m×0.7 m×0.294 m...

4. Environmental Control and Life Support Systems

To enable an overnight stay on the lunar surface, the system needs to provide a suitable environment and consumables such as water and food. To meet this need, an Environmental Control and Life Support System (ECLSS) was designed to support two astronauts during the overnight stay and to recharge the astronauts׳ Portable Life Support Systems (PLSS) for a second day of exploration. The demands of the first day were not included in the system design because they would be met by the astronauts׳ (PLSS)...

Table 5. Oxygen and water requirements and storage system sizing for the overnight mission

Consumables storage	Oxygen	Water
Quantity required (kg)	8.1	23.9
Tank mass (kg)	6.8	4.0
Tank volume (L)	99.9	23.9

6. Results: system mass and volume estimates

Mass Breakdown

ECLSS	28.5 kg
Emergency Power	2.0 kg
Emergency Inflatable Seat	6.0 kg
Power	13.2 kg
Thermal Shield	4.6 kg
Inflatable	35.0 kg
ECLSS Consumables	34.1 kg
Total	123.4 kg

ECLSS Consumables Mass Breakdown

H2O - Med, Hygeine, Food Prep	7.8 kg
H2O - Crew Hydration	7.1 kg
H2O - Rover Sublimator	5.9 kg
H2O - Refill Suit Sublimator	3.9 kg
Oxygen for Ribs	1.5 kg
Oxygen for Habitat + Respiration	6.6 kg
Food	1.3 kg
Total	34.1 kg

Volume Breakdown

Inflatable Habitat (stowed)	287.9 L
Thermal Shield	4.1 L
Power	62.6 L
ECLSS	186.0 L
Emergency Inflatable Seat (stowed)	51.2 L
Total	34.1 kg

     It was at least two years since Lawrence had been inside an igloo. There was a time, when he had been a junior engineer out on construction projects, when he had lived in one for weeks on end, and had forgotten what it was like to be surrounded by rigid walls. Since those days, of course, there had been many improvements in design; it was now no particular hardship to live in a home that would fold up into a small trunk.
     This was one of the latest models—a Goodyear Mark XX—and it could sustain six men for an indefinite period, as long as they were supplied with power, water, food, and oxygen. The igloo could provide everything else-even entertainment, for it had a built-in microlibrary of books, music, and video. This was no extravagant luxury, though the auditors queried it with great regularity. In space, boredom could be a killer. It might take longer than, say, a leak in an air line, but it could be just as effective, and was sometimes much messier.
     Lawrence stooped slightly to enter the air lock. In some of the old models, he remembered, you practically had to go down on hands and knees. He waited for the “pressure equalized” signal, then stepped into the hemispherical main chamber.
     It was like being inside a balloon; indeed, that was exactly where he was. He could see only part of the interior, for it had been divided into several compartments by movable screens. (Another modern refinement; in his day, the only privacy was that given by the curtain across the toilet.) Overhead, three meters above the floor, were the lights and the air-conditioning grille, suspended from the ceiling by elastic webbing. Against the curved wall stood collapsible metal racks, only partly erected. From the other side of the nearest screen came the sound of a voice reading from an inventory, while every few seconds another interjected, “Check.”
     Lawrence stepped around the screen and found himself in the dormitory section of the igloo. Like the wall racks, the double bunks had not been fully erected; it was merely necessary to see that all the bits and pieces were in their place, for as soon as the inventory was completed everything would be packed and rushed to the site.
     Lawrence did not interrupt the two storemen as they continued their careful stock-taking. This was one of those unexciting but vital jobs—of which there were so many on the Moon—upon which lives could depend. A mistake here could be a sentence of death for someone, sometime in the future.
     When the checkers had come to the end of a sheet, Lawrence said, “Is this the largest model you have in stock?”
     “The largest that’s serviceable” was the answer. “We have a twelve-man Mark Nineteen, but there’s a slow leak in the outer envelope that has to be fixed.”
     “How long will that take?”
     “Only a few minutes. But then there’s a twelve-hour inflation test before we’re allowed to check it out.”
     This was one of those times when the man who made the rules had to break them.
     “We can’t wait to make the full test. Put on a double patch and take a leak reading; if it’s inside the standard tolerance, get the igloo checked out right away. I’ll authorize the clearance.”

• 

The personal rescue enclosure (PRE), or "rescue ball", was a device for transporting astronauts from one Space Shuttle to another in case of an emergency. It was produced as a prototype but never flew on any missions.

The ball was 36 inches (910 mm) in diameter and had a volume of 0.33 cubic meters (12 cubic feet). The structure comprised three fabric layers and incorporated a window and a zipper to allow the astronaut to enter and exit the ball. The ball enabled one crew member to curl up inside and don an oxygen mask and hold a carbon dioxide scrubber/oxygen supply device with one hour's worth of oxygen. The ball would have been connected by an umbilical to the shuttle to supply air until the airlock depressurized. The rescue ball containing the crew member would have been carried to the rescue shuttle by a space-suited astronaut.

The PRE was designed to protect humans in space in the event of an emergency where not enough full space suits were available. It was developed in the 1970s and 1980s to support the Space Shuttle program. The PRE was designed to be used in conjunction with a fully suited astronaut that would provide mobility to the person in the ball. The ball's life-support systems consisting of oxygen and a carbon dioxide scrubber could support a person for about an hour.

The life support system that supplied oxygen was called the Personal Oxygen Supply, or, alternatively, it could be supplied with oxygen from an external source after being sealed. The ball was made of fabric, and was sealed by way of zippers, with a small circular window to allow the occupant to see out.

NASA evaluated three methods of transporting the balls:

• By hand, a suited astronaut would haul the balls
• By robotic arm, a robotic manipulator arm would move the balls through space (see Canadarm)
• The balls would be attached to a line between two spaceships and pulled along like a clothesline.

Dimensions:

• 86-centimeter-diameter (2.82-foot; 34-inch) sphere
• As a flexible not rigid item this figure would be subject to some variation, especially if not pressurized.
• Materials/construction methods
  • Fabric consisting of three layers
    • urethane
    • Kevlar
    • Thermal protective layer (outermost)
• Window constructed of Lexan

     Arvid was out of his seat and trying to reach God knows what, and Wes was checking his seat belt, when the whole station rang and shuddered. Wes yelled and clapped hands over his ears. The others were floating out of their seats — freefall? He swept an arm out to push Giselle back into her seat, and she clutched the arms. He couldn’t reach anyone else.
     Freefall? How could that be? The connecting tunnel must have come apart! Nikolai was screaming into a microphone. He stopped suddenly. He turned and looked around, stunned, ashen.
     Behind Wes the wall smashed inward, then outward. The buckle on Wes’s seat harness popped open. Wes grabbed instinctively, a death grip on the arm of his chair, even before the shock wave reached him. The Nigerian snatched at Wes’s belt and clung tight. He was screaming. Good! So was Wes. Hold your breath and you’d rupture your lungs.
     For the stars were glaring in at them through the ripped metal, and the air was roaring away, carrying anything loose...
     ...Vacuum! Dawson’s eyes and ears felt ready to pop. Giorge’s grip was growing feeble, but so was the wind; the air was almost gone. So. What have I got, a minute before the blood boils out through my lungs? I’ll never reach my million-dollar pressure suit, so where are the beach balls? I located them first thing, every compartment, the emergency pressure balloons, where the hell were they? If Americans had built this place they’d be popping out of the walls...
     ...Nothing was popping out of the walls. Dawson’s intestinal tract was spewing air at both ends. His eyes sought … Rogachev, there, clawing at a wall. Dawson patted the shoulder at his waist and kicked himself toward Rogachev. Giorge hung on, in good sense or simple panic.
     His throat tried to cough but it couldn’t get a grip.
     Wes bounced against a wall, couldn’t find a handhold, bounced away. Losing control. Dying? The black man caught something. but kept one arm around Wes’s waist. Rogachev looked like a puffer-fish. He was fighting to tear open a plastic wall panel. It jerked open and he bounced away.
     Bulky disks, four feet across, turned out to be flattened plastic bags. Wes skimmed one at Rogachev. He pulled another open, crawled inside and pulled the black man in too. Zipper? He zipped them inside. Tight fit. Some kind of lock at the end of the zipper. With his chin on the black man’s shoulder Wes reached around the man’s neck and flipped the lock shut, he hoped.
     Air jetted immediately.
     Reverse pressure in his ears. He pulled in air, in, in, no need to exhale at all. They were going to live. They were floating loose, and nothing to be done about it, because the pressure packages were nothing but balloons with an air supply attached. Rogachev’s too was bouncing about like a toy, but at least he’d gotten inside.
     Wes’s passenger was beginning to struggle. It was uncomfortable. Wes wanted to say something comforting, or just tell him not to rip the g****m beach ball! But now his throat had air to cough with, and he couldn’t stop coughing. He sounded like he was dying. So did Giorge.

     I noted with approval that Carlos' mouth was wide open, like mine, to clear his lungs so that they wouldn't burst when the air was gone.
     Daggers in my ears and sinuses, pressure in my gut...
     ...The air was deadly thin but not gone. My lungs thought they were gasping vacuum. But my blood was not boiling. I'd have known it.
     So I gasped, and kept gasping. It was all I had attention for. Black spots flickered before my eyes, but I was still gasping and alive when Ausfaller reached us carrying a clear plastic package and an enormous handgun.
     He came in fast, on a rocket backpack. Even as he decelerated he was looking around for something to shoot. He returned in a loop of fire. He studied us through his faceplate, possibly wondering if we were dead.
     He flipped the plastic package open. It was a thin sack with a zipper and a small tank attached. He had to dig for a torch to cut our bonds. He freed Carlos first, helped him into the sack. Carlos bled from the nose and ears. He was barely mobile. So was I, but Ausfaller got me into the sack with Carlos and zipped it up. Air hissed in around us.
     I wondered what came next. As an inflated sphere the rescue bag was too big for the tunnels. Ausfaller had thought of that. He fired at the dome, blasted a gaping hole in it, and flew us out on the rocket backpack.
     Hobo Kelly was grounded nearby. I saw that the rescue bag wouldn't fit the airlock either... and Ausfaller confirmed my worst fear. He signaled us by opening his mouth wide. Then he zipped open the rescue bag and half-carried us into the airlock while the air was still roaring out of our lungs.
     When there was air again Carlos whispered, "Please don't do that any more."

• 

Thorpe slowly climbed back into the narrow hospital bed that had been his home for the past month. Despite his argument with the nurse, he was glad for the rest. He had forgotten how heavy Earth gravity was. The fact that he was on Earth at all indicated how close to death he had been after the accident. Normal procedure called for a strict regimen of diet and exercise before returning to standard gravity. To do otherwise risked heart failure. His presence in a hospital bed in the Swiss Alps was evidence that heart failure had been the least concern of his rescuers.

Thorpe remembered very little of the accident, although a month in bed had given him plenty of time to read the report. The lift operation had gone perfectly to the point where the cable operators began slowing the load. One of the cable brakes had seized, causing the Number Two Cable to jerk to a halt. The sudden stop had placed too much strain on the cable, causing it to snap somewhere between tower and load. Relieved of its tension, the broken cable had rebounded like a cracked whip.

In one way, Thorpe had been lucky. If the ten-centimeter-thick cable had landed on him, there would not have been enough left to identify. As it was, the broken end crashed down a hundred meters from where he and Nina had been standing. The impact shattered the strands of the cable and sent a cloud of shrapnel in their direction. One piece hit Thorpe just below his right knee, punched a hole through his vacuum suit, and shattered his leg. His suit had depressurized immediately and unconsciousness had quickly followed.

Stabbing pains in eyes and ears are usually the last things a victim of rapid decompression ever feels. Thorpe remembered thinking that as he blacked out. As soon as Nina saw the cloud of red vapor explode from Thorpe’s leg, she began calling for help. She had then stripped the slip ring harness from her suit and used it to tie a crude tourniquet around Thorpe’s thigh. The tourniquet had sealed well enough that she was able to repressurize Thorpe’s stricken suit. The emergency response team had arrived three minutes later. They had stuffed Thorpe into an emergency bag and inflated it on the spot. After that, it had been a race to see how quickly he could be gotten to an Earthside hospital.

• 

• 

• 

      “All right, dearie. Ready to get on in?” the tech asked, her voice far gentler than Sianna had expected.
     “Ah, um, almost,” Sianna said. “Just—just a second.” Sianna looked down at the personnel module, a box for transporting a person to space at absolutely minimum cost in the smallest space possible. The permod was lightweight, and could be loaded and boosted in any number of launch systems. This one was to be stacked in with a hold full of cargo modules and boosted direct to NaPurHab (space colony).
     The personnel module was completely self-contained, and could keep a human being alive for perhaps weeks at a time in a pinch—if the human didn’t mind losing all semblance of dignity, and, perhaps, any shred of sanity. The permod treated a human being like a slab of meat that had to be kept at a certain temperature, in a certain atmosphere, with nutrient going in one end and waste products coming out the other. It was, in effect, a storage locker designed to hold a person.
     Sianna did not like it, to put it mildly. The fact that the permod was almost precisely the size and shape of a coffin did not do much to make her feel better.

---

     The suit tech stepped down on a treadle switch set into one corner of the module, and the safety catches released with a disconcertingly loud clunk. The tech pulled open a small access panel and yanked on the lever inside it. The top of the module swung open in exactly the manner of a coffin. Whoever had designed this thing had not given much thought to the psychology of the occupant.
     Sianna stepped forward and peered inside. She had gotten a quick training session the day before, but reality was rarely in conformity with training or expectations. The interior was an off-white rubber sort of material, all smooth, rounded contours. The outlines of a human body were molded into the bottom to create a form-fitting shape that was dished-out a bit wider than it ought to be at the base of the torso. Naturally. There was the issue of sanitation, after all.
     “All right, time for the plumbing,” the tech said. “Off with the robe now.”

---

     The robe dropped to the floor, and Sianna stared straight ahead at the tiled wall, determined that the suit tech be utterly invisible. A hand Sianna was determined not to see presented her with the waste control unit, an ungainly white object shaped roughly like an oversized, rigidized diaper that opened up with a hinge between the legs. Tube couplings whose purposes she did not wish to consider came out of it here and there.
     Sianna took the thing in her two hands with as much enthusiasm as she would have felt in accepting a dead rat. She opened the clamshell hinge and looked inside. The interior was coated with a clear lubricant gel intended to keep the parts of it that touched her skin from chafing. The parts of the interior that wouldn’t touch her were all odd-shaped recesses and discreet bits of valving and tubing.

---

     All right, then, she would be a mannequin. It wouldn’t be her she was putting it on, but an inanimate object. Spread the legs. Swing the unit around and hold it between the legs. Use her right hand to push the rear half up against the buttocks—good, clinical, impersonal word, buttocks —stoop down just a bit to open up her—no, the —legs, reach down with the left hand and pull the front half up and closed. Snap the six latches shut, and the mannequin had the unit on.
     It hung loosely on Sianna’s body. She switched on the inflator, and felt the unit snug up to her body in a most disturbing way. It felt cold, and stiff, and sterile. The lubricant was unpleasantly cool and slick again her skin.
     All right, she had it on. The suit tech could now be allowed to exist, at least somewhat. The tech nodded her approval. “Good. Fine. Nice fit. But wait until we get you launched and you’re in zero gee before you try the thing out. The suction system will pull off the waste products while you’re in zero gee, but you’ll get one hell of a mess if you try using it on the ground. Okay?”

---

     “Good. All right.” The tech stepped around in front of her and started to point out the controls. Sianna forced herself to look down. “Suction is that green switch on the left front. Post-use sanitizer is the red switch on the right front. And make sure the suction system is on and running before you try anything unless you want big problems. But once it’s powered up, you can urinate and defecate normally.”
     Normally? How the hell was she supposed to do anything normally when she was wearing a fiberglass diaper and stuffed into a coffin?
     Coffin. Damnation. She had been trying to avoid thinking about that part of it. Coffins. Death. Sealed in. Closed spaces. Tiny space, no space, lost in deep space, out of control sealed in a black death box blasted into the sky—
     No. Stop. Calm. Calm.
     But there was no calm. There was only raging fear and the pounding of her heart, and the thought of the fast-coming moment when the tech would close the lid on her and—

---

     “That’s it,” the suit tech said, completely oblivious to Sianna’s rising sense of panic—or perhaps determinedly ignoring it. “All set.” The tech seemed to have a limitless supply of meaningless little phrases of encouragement. “We need to spray you down next.”
     Sianna nodded, not quite willing to speak. The spray was a combination of a skin moisturizer, to combat chafing, and an antiseptic-antifungal agent, to keep her from molding over in the confines of the module as she became increasingly ripe over the next few days.

---

     “All set now, dearie. Now let’s get the shirt and leggings on and we’ll be all squared away.”
     Sianna did as she was told. She stood on one leg, then the other, as the tech slipped the leggings on and did up the fabric-clasps that held them on. The shirt went on in something more like the normal manner, buttoning up the front. Both leggings and shirt were made of a very warm, soft, absorbent flannel cotton—the one concession to comfort in the whole operation. They felt good next to her skin.

---

     “Two hours until boost, and it’s going to be just about a three-day ride. Long time to be in a box, but you won’t be anywhere near the record. And you should be asleep most of that time, anyway.”
     “Suppose I, ah, can’t sleep?”
     “Then you take a pill, and sleep until it wears off and then take another pill. Keeping you zonked out saves on life support—and boredom. All right then, let’s get you in there.” And, maybe, if we keep you asleep enough of the time, you won’t go insane quite so fast. Even if the tech didn’t say the words, Sianna knew they were there. Thrown off balance by the bulk of the waste control unit, Sianna tottered most unwillingly toward the module.
     After all the briefing and preparation, getting in seemed almost too simple. Sianna simply sat down on the edge of the module, and then put first one leg and then the other over the edge, bracing herself with a hand on either side of the box as she eased herself down into the module, as if she were getting into a bathtub full of slightly over-hot water. Except getting into a tub didn’t put her on the ragged edge of terror. She sat up in the module, and found that her waste control unit wasn’t quite fitting into the recess intended for it. She wiggled herself down a bit, and it dropped into place rather neatly and a bit abruptly, like one of those puzzle games where you roll a ball into a hole.
     “Lie down, dear,” the tech said. Sianna did as she was told. She found herself lying very still, staring at the ceiling. The tech leaned over her for a minute, checking this and that, attaching hoses to the waste control unit and to the interior of the module.
     “All set there. Now, I want you to try the sanitation system. Red switch on the left first, then the green on the right.”
     What point in color-coding the switches if she has to lie on her back and can’t see them? But Sianna reached down and found them after some fumbling. She flipped the left switch. There was a sudden, high whirring noise, and the feel of cold air blowing past her skin. She threw the right switch, and jumped a bit as warm water jetted through the unit. She shut down the water jet and let the suction system run a bit longer to help dry her off. She shut off the left switch and listened as the purifier kicked in, reclaiming the water for its next use in cleaning—or as drinking water. Even the lunatic optimist who had run yesterday’s training session and had told her how great the system was allowed as how the water wasn’t likely to taste real good after the fourth or fifth time.

---

     “Okay, now,” the tech said. “I’m going to close up now, and this hatch isn’t going to open until you’re safe at NaPurHab. You’ll have the use of your arms and hands for an hour or so, but once you get loaded into the launcher, the restraint system is going to come on. The airbags will inflate and hold you in place. You have got to get your arms down into the recesses molded into the padding before that happens.
     “You’re going to be boosted at about ten gees. More if they change the flight plan. If your arm is lying against your stomach or something when the restraints inflate, it will be pinned in place. If that happens, you’ll be lucky to get away with a broken arm and crushed ribs. Internal injuries and bleeding, more likely.” The tech pointed to a small panel light that read “prepare for restraint” set into the inner lid of the module. “When that light goes off, arms and legs in the restraint recesses, and no excuses. You ought to have three minutes warning, but people who count on ‘ought’ get dead. If your nose itches after that light goes on, don’t scratch. Do you understand?”

---

     There was, quite sensibly, no way to open a personnel module from the inside. The danger of a panicky transportee popping the thing open at the wrong time was far greater than the danger of a transportee not being able to get out someplace it was safe.

---

     Wait a second. There was an external view control, right? She could look out. Yes. That would help a lot. She stared intently at the control panel directly over her face. Which one was it? She stabbed a nervous finger at one button, then another. There. That turned the monitor on, anyway. The flat screen came to life, about thirty centimeters in front of her face. Good. Nothing on it but a status display. Air good, temp good, clock showing the time. But what about the external view? External. There! An old-fashioned selector knob. She twisted it hard to the right

---

     The permod was all toughened padding inside, the comm and display and dispenser controls carefully recessed so you couldn’t switch them on by accident. Damn thing was a miniaturized spacegoing padded cell.

---

     She wanted to turn her head away, but the restraint pads had inflated around her head as well, holding it quite gently but quite firmly in place. You could snap your neck by having your head turn when a high-gee boost kicked in, and the permod designers had taken no chances.

(ed note: and of course when the permod reaches its destination, the poor cargo master who has to open it is assaulted with a stench that has to be experienced to be believed. And they are occasionally assaulted by the permod inhabitant, who have gone insane with claustrophobia.)

• 

      Kzanol swung his chair around so he could see the star map on the rear wall. The sapphire pin seemed to twinkle and gleam across the length of the cabin. For a moment he basked in its radiance, the radiance of unlimited wealth. Then he jumped up and began typing on the brain board.
     Sure there was reason to be impatient! Even now somebody with a map just like his, and a pin where Kzanol had inserted his sapphire marker, might be racing to put in a claim. The control of an entire slave world, for all of Kzanol’s lifetime, was his rightful property; but only if he reached Thrintun first.
     He typed: “How long to recharge the battery?”
     The brain board thudded almost at once. But Kzanol was never to know the answer.

     Suddenly a blinding light shone through the back window. Kzanol’s chair flattened into a couch, a loud musical note rang, and there was pressure. Terrible pressure. The ship wasn’t ever supposed to use that high an acceleration. It lasted for about five seconds. Then —
     There was a sound like two lead doors being slapped together, with the ship between them.
     The pressure eased. Kzanol got to his feet and peered out the rear window at the incandescent cloud that had been his fusor. A machine has no mind to read; you never know when it’s going to betray you —

     The brain board thudded.
     He read, “Time to recharge battery:” followed by the spiral hieroglyph, the sign of infinity.
     With his face pressed against the molded diamond pane, Kzanol watched the burning power plant fade among the stars. The brain must have dropped it the moment it became dangerous. That was why it had been trailed half a mile behind the ship: because fusors sometimes exploded. Just before he lost sight of it altogether, the light flared again into something brighter than a sun.
     Thud, said the brain. Kzanol read, “Reestimate of trip time to Thrintun:” followed by a spiral.
     The shock wave from the far explosion reached the ship. It sounded like a distant door slamming.

     There was no hurry now. For a long time Kzanol stood before his wall map, gazing at the sapphire pin.

B. NERVA ENGINE SAFETY METHODS

     Two types of countermeasure techniques are being actively considered for application to the NERVA engine program. These are: (1) poison wire, and (2) explosive destruct.

     The poison wire system involves insertion of a number of wires containing a material of high neutron cross-section into the coolant-channels of the reactor core. These wires would be inserted prior to completion of engine installation. Prior to engine startup the wires would be withdrawn from the core and disposed of outside of the nozzle structure.

• 

• 

• 

• 

• 

• 

• 

• 

(ed note:an "excursion" is when the nuclear chain reaction oscillates enough to generate a short pulse-width surge of neutron flux above the maximum flux limits of the control system. It is sort of like when an automobile start backfiring, except with atomic energy instead of petrol. It means the reactor is starting to get out of control and you'd better do something quick before the engine does its impression of Chernobyl.

Flood poisioning is analogous to flooding the firebox of a steam engine with cold water to extinguish all the burning coal.)

5-12 Emergency Flood Poisoning

Multiple excursions do not necessarily mean widespread physical destruction of the reactor core. Ordinarily, emergency safety systems would become activated upon sensing the first excursion pulse. The most effective excursion-abort safety system is based on “flood poisoning,” In emergency situations, great quantities of neutron absorber materials are dumped into the reactor. This poison flooding promptly chokes down the fission process…and keeps it down. Subsequent excursions cannot occur.

The design concept is to store the flood poison materials outside of the core. These poisons may be powder, pellet, or gaseous in form. They may be one or a combination of the strongest absorber materials previously listed. These poisons would not be functionally related to, nor would they be integral with, the regular control system. They are strictly for emergency use only.

The poisons are stored under high pressure with suitable piping from storage to a manifold around the reactor pressure vessel head. From this manifold, there would be connections to each of the verniering plenums in the control drums around the core. During normal pneumatic verniering, the regulating pressures would be lower than the storage pressure of the flood poisons. Upon release signal, the pneumatic controllant would be overcome by the high pressure of the flood poison. The result: all control drum plenums would be “flooded” with strong neutron absorbers. The quantity of flood poison to override all of the control drums, regardless of their ΔC positions, can be computed. This is simply a matter of comparing macroscopic absorption cross sections such that

Σ_p » Σ_d + Σ_e

Here, the subscripts are p for flood poison, d for control drums, and c for core.

(ed note: the symbol » means "much greater than")

One arrangement of how the flood poisoning scheme might be adapted to rocket reactors is shown in Figure 5-13. Note particularly the excursion sensors. They are threaded into the pressure vessel wall where they are exposed simultaneously to propellant cooling and fission heating. Upon a fission excursion, one or more of the sensors actuates a pneumatic valve which releases the flood poison into the control drum plenums.

When released, the flood poisons would absorb many more neutrons than the normal controllant materials. Since these poisons are predominantly capture-gamma emitters, they would ernit gamma rays in profusion. There would be localized regions of very high gamma heating. As a consequence, special after-cooling of the flood poisoned control drums is required.

After the excursion neutron flux is choked clown, the flood poisons could be removed. This could be done via a vacuum pump and suitable piping (indicated in Figure 5-13). The removed poisons could either be reclaimed and restored under pressure, or they could be dumped overboard. By removing the poisons, the propulsion reactor could be operated normally again.

(ed note: Remember that an anti-criticality destruct systems {ACDS} is designed to destroy a reactor before the reactor has ever been powered up, while a post operation destruct system {PODS} is designed to destroy a reactor after the reactor has been powered up.

For ACDS the reactor has not been powered up so it is relatively non-radioactive. Chopping it into coarse sub-critical bits will do.

For PODS the already fired reactor is dangerously radioactive. Minimum acceptable solution is to blast the reactor into infinitesimal 1 mm particles, and preferably smaller.

A bifunctional destruct application can be used for either ACDS or PODS.

Pure ACDS are designed to be "ejectable". ACDS is used to destruct a reactor before it has ever powered up, it is never used afterwards. So immediately prior to the first reactor power-up you want to jettison the ACDS. This is because [A] the ACDS is just so much penalty-weight after the reactor has powered and [B] it is dangerous to carry a high-explosive device attached to your reactor one second longer than you have to.

PODS and bifunctional destructs are not ejectable, since an occasion for their use may happen at any time in their entire service life.)

ABSTRACT

     The candidate explosive type NERVA engine anticriticality destruct systems (ACDS) have been preliminarily tested and studied. This report summarizes the status resulting from work accomplished through 15 June 1963.

     The Mark A concept and small ejectable Mark D concepts have demonstrated achievement of the ACDS dispersion criterion (course chop) and indicated superiority over all other ejectable ACDS concepts considered.

     The multiple projectile Mark D concept has demonstrated superiority over all PODS concepts (Post Operation Destruct System) considered for bifunctional destruct application (capable of being used for either phase of operation, this is difficult to design).

II. SUMMARY

     The ACDS is required to render the reactor essentially harmless in the event an accident to, or malfunction of, the NERVA engine occurs prior to its operation. The purpose of the ordnance-type Anticriticality Safety System (ACSS) is to divide the reactor core into subcritical fragments, and to disperse these fragments so that none of the portions can combine in a geometry that could become critical in a moderating environment (i.e., so no clumps of reactor fragments can attain critical mass, start a chain reaction, and make radioactive death).

     A tentative criterion was established for assessing the effectiveness of an ACDS based upon critical concentrations of fueled core material when immersed in a moderating environment such as water (i.e., if the fragments fall into water, a smaller density of core fragments will go critical and start a nuclear chain reaction). This criterion, in terms of practical test techniques, established that the maximum quantity of fueled core material allowed to fall within any surface area represented by a circle 25 inches in diameter, should be less than 12.5 lb (5,700 grams, any more than that and the blasted stuff will go critical and start spraying deadly radiation everywhere).

     The maximum core-fragment concentrations resulting from preliminary tests of the various concepts were compared and evaluated. From this, a series of tests for each of three destruct system concepts were conducted in an effort to further demonstrate the explosive feasibility. The three concepts were the Mark A, the Mark C, and the single-projectile Mark D/J, all of which are described in detail in the technical discussion portion of this report. Component tests were conducted in support of these concept tests to develop and evaluate the functional capabilities of the individual explosive components so that the competing concepts would have an equal chance for success. No attempts were made to optimize the systems studied; rather, the emphasis was placed on demonstrations of explosive charge configuration feasibility.

     The Mark A concept (in Test AC-155) demonstrated successful achievement of the anticriticality dispersion criterion against a full-scale, semi-accurate target. (for ACDS, less than 12.5 lbs within a 25 inch circle) Although several tests of the Mark C concept were conducted, none were successful in attaining the necessary dispersion against a reasonably simulated engine. Two tests (AC-129 and AC-154) of the internally emplaced explosive projectile concept (Mark D/J) met the dispersion criterion. Tests of this concept were conducted by assembling the test model with the simulated projectile statically in place within the core.

     The feasibility of propelling an explosively loaded projectile into a full-scale, simulated engine target in support of the Mark D/J concept was demonstrated in two concurrent PODS program (Sub-Subtask 1.6.5) tests (post-operational dispersion of core into 1 mm fragments) conducted at the Aberdeen Proving Grounds.

     All of the ACDS concepts depend, to some degree, upon the ability of the core material to transmit confinement-rupture loads and core fragmenting and dispersion forces; consequently, the correlation of material characteristics established by the Fragmentation Research program is important to the success and basic understanding of the various destruct mechanisms (graphite rods were used as core simulating material for destructive testing, since real reactor core with uranium-235 and everything is too expensive to just blow up).

     The selection of the Mark A system (Figure 1) for use as the primary, ejectable ACDS was essentially based on a comparative analysis of the Mark A and the ejectable Mark D/J concepts. The major considerations were:

• Total system weight
• System response time
• Initiation reliability
• Ejectability
• Integration and emplacement

• 

     Although the aft-mounted, single projectile Mark D/J concept is the more efficient system, as far as the amount of explosive needed to accomplish the anticriticality destruct task, the Mark A concept is more desirable from all important feasibility aspects considered during selection of the ejectable ACDS, The Mark A concept will, then, receive a concentrated design and physical property determination effort to be completed and presented in the Milestone 25 report.

     Selection of the forward-mounted Mark D/J concept for the bifunctional destruct system (a destruct system that can be used either pre- or post-operation) was determined by a different set of considerations, since some of the above are not applicable to a bifunctional system. The main consideration is dictated by the postoperation destruct criteria. PODS concept feasibility and development progress to date, as described in the Milestone 30 report, has indicated that the Mark D/J concept, installed above the NERVA engine shadow shield, will be the proposed explosive destruct system on which further development work should proceed during CY 1964.

     Comparison of all Mark D/J PODS test results with the anticriticality destruct criterion indicated that excessive fragment dispersion or a condition of "overkill" exists. The PODS test program incorporated multiple explosive charges statically simulating launched projectiles, each of a size considered adequate for accomplishment of the anticriticality dispersion criterion. Selection of the required number of bifunctional projectiles to satisfy this criterion is then solely dependent upon whether the RIFT interstage structure is to be defeated also by ACDS action or is to be removed independently by systems furnished by the RIFT contractor. It may not be technically feasible to defeat the confining effects of the interstage structure by any method other than fragment penetration produced by massive overkill.

(ed note: Translation: if you only need one explosive charge to destruct a pre-operation core, but you need five charges to destruct a post-operation core, there is a problem using the same system bifunctionally for both pre- and post-operation destruction. Five charges pre-operation will disperse the bits of the core over a much wider area than is desired: "overkill")

     Integration of the Mark D/J concept into a bifunctional capability becomes merely a modification of the control and fire system (CFS), There is little weight penalty involved and no ejection requirement, which makes the selection of this concept for the bifunctional destruct system appear most advantageous. Further design and analysis work will proceed on the bifunctional Mark D/J concept; the cumulative results of this effort will be presented in the Milestone 25 report.

III. TECHNICAL DISCUSSION

     The long range objectives of this program are to develop an explosive destruct system that will render the reactor core harmless in the event either an accident to, or malfunction of, the NERVA engine should occur prior to its operation in the RIFT and subsequent missions.

     The immediate objectives were: (1) to determine the feasibility of achieving the tentative ACDS performance criteria, and (2) to select the ejectable ACDS concepts best suited for further studies and preliminary design. This discussion presents preliminary descriptions of several explosive concepts that have been studied, tested, and show promise of meeting the tentative ACDS performance criteria. The conclusions presented are based upon the results of tests performed with full-scale simulated NERVA engines and design studies reflecting presently available NERVA engine data.

A. ANTICRITICALITY DESTRUCT CRITERIA

     A power excursion, with the associated release of contaminating fission products, could result if the nonoperating NERVA engine were placed by accident, or a result of malfunction, into a highly moderating environment such as water or liquid hydrogen. A concurrent chemical explosion of the propellant could widely disperse the nuclear material, creating a difficult (if not impossible) problem of decontaminating the surrounding launch facilities. Should a similar malfunction occur during traverse of the shallow Atlantic Ocean shelf, the resulting nuclear excursion would produce fission contamination that could be spread by strong tides to inhabited shores. However, should the NERVA engine fall into deep water beyond the Atlantic shelf wide dispersion of fission products could occur without producing a hazardous situation.

     To preclude these hazards prior to NERVA engine start-up, the destruct system must: fracture the reactor core into subcritical fragments, and disperse these fragments so that none of the portions could combine in a geometry which could become critical in a moderating environment.

     Criticality studies have evolved a literal interpretation of the three-dimensional geometric dispersion criterion for submerged nuclear material. The tentative ACDS criterion evolved from these studies, incorporating a factor of safety, established an approximate quantity of 12.5 lb of the fragmented fuel-element material (or test simulant) as the maximum amount which can be allowed to fall within a 25-inch diameter flat circular area for a successful destruct operation.

B. NERVA ENGINE SAFETY METHODS

     Two types of countermeasure techniques are being actively considered for application to the NERVA engine program. These are: (1) poison wire, and (2) explosive destruct.

     The poison wire system involves insertion of a number of wires containing a material of high neutron cross-section into the coolant-channels of the reactor core. These wires would be inserted prior to completion of engine installation. Prior to engine startup the wires would be withdrawn from the core and disposed of outside of the nozzle structure.

     Several conceptual methods were suggested for the use of high explosives to accomplish the anticriticality destruct task. The concepts employ various types of charges such as linear shaped, curvilinear shaped, conical shaped, and explosive projectiles. Some utilize only one charge configuration while others employ different configurations in their most promising combinations.

     Externally placed high explosive destruct systems are designed to convert chemical energy into kinetic energy which is transmitted through the engine pressure vessel and associated internal components rupturing the outer structures and fragmenting the core material. Under such circumstances, the breakup and dispersion of the core material is a combination of the effects of: (1) explosive jet action produced by the impact of minute particles of matter moving at extremely high velocities, causing cutting and external separation of structural material; (2) intense shockwaves produced by the detonation of high explosives, causing further fracturing and spalling of the cut material; (3) intense localized pressure and temperature regions near the engine pressure vessel, produced by great volumes of hot expanding explosives gases; (4) mechanical impact by structural members that have been accelerated to high velocity by the action of explosive gas pressures; and (5) collision and interaction between neighboring fragments traveling along intersecting courses at high velocities.

     The internal burster type explosive projectile concepts are designed to carry the high explosive into the reactor core prior to initiation. These concepts create a highly confined, rapidly attenuated explosion within the core which causes the graphite elements to be crushed against the massive engine pressure vessel and reflector structures. The confinennent structure tends to fail in a predictable manner determined by the explosive charge parameters and the manner by which the structure is loaded, thereby allowing the contained high-pressure gases and fractured core material to be released and dispersed through the rapture zones. The inserted projectile explosive charge effects contribution to core breakup and dispersion are somewhat different from those systems using externally placed explosive components. The primary effects are a combination of: (1) intense, localized explosive Shockwaves, produced by the detonation of high explosives; (2) intense, localized pressure and temperature region, produced by great volumes of hot, expanding explosive gases momentarily confined by the massive pressure vessel and reflector structure; (3) mechanical impact by small projectile-casing fragments that are propelled at high velocity through the core material by the action of explosive gas pressure; and (4) collision and interaction between neighboring fragments at high velocities.

C. EXPLOSIVE DESTRUCT CONCEPTS

     Various explosive destruct concepts are depicted in Figures 2A and 2B and are discussed below,

• 

• 

1. Mark A

     The Mark A configuration consists of an external linear cutting charge array, distributed over the pressure vessel, combined with an aft entry conical shaped charges. In this concept, a configuration of curvilinear and linear shaped charges are attached to the engine pressure vessel in such a manner that sections can be ejected from the engine prior to its startup if the ACDS is not required to function. The placement of the charges is such that, at initiation, the major structural integrity of the engine is destroyed by the curvilinear and linear shaped charges. The conical shaped charges, located to fire through the engine aft closure into the core mass accomplish the core fragmentation and dispersion. Provisions for ejection of the explosive charges are incorporated in the mounting attachments.

2. Mark C

     The Mark C concept consists of multiple conical shaped charges installed externally on the engine, directed to fire into the core mass. Upon initiation, the resulting jets penetrate the engine and disperse the core as required by the destruct criteria. Radial forces developed by the jet interaction with the core were expected to rupture the pressure vessel. This concept is considered ejectable.

3. Mark D

     The Mark D concept consists of internal burster projectile(s) launched from tube(s) located either aft of the nozzle closure or forward of the shadow shield (bifunctional system: ACDS/PODS), In this concept, the projectile, having an armor-piercing ogive, is propelled from a gun or launcher at a velocity sufficient to permit adequate core penetration prior to delayed initiation of the contained high-explosive charge. Ejection provisions are possible for this concept. The bifunctional projectile design (required to achieve the critically small PODS fragment-size criterion) is larger than the optimum size required to satisfy the present ACDS dispersion criterion, hence, an "over-kill" condition is produced. No ejection capability is required for the bifunctional design,

4. Mark J

     The Mark J concept consists of a single deep-penetrating shaped charge combined with a follow-through internal burster projectile. This concept is similar to the Mark D concept, including its capability of bifunctional operation as either an ACDS or a PODS. The aft-entry-type Mark J concept also can be ejected from the engine prior to startup if the ACDS is not required to function. As in the Mark D concept, a projectile is launched into the core where it is detonated to produce fragmentation and dispersion effects. However, in this concept, a path of entry is opened for the projectile by the hypervelocity jet of a conical shaped charge placed in front of the projectile launch tube. Reduced projectile velocities can be used with this concept, but the launcher and projectile design criteria would be changed somewhat. However it appears that there is no significant change in total system weight between the two internal burster concepts.

(ed note: The only difference between the Mark D and Mark J concepts is Mark D penetrates core using armor-piercing nose and Mark J uses a shaped charge)

5. Other Concepts

     Other ACDS concepts were studied and tested. They were determined to be infeasible after preliminary study or failed during test to produce adequate fragmentation or dispersion, As a result, such concepts are no longer being considered. However, should significant changes be made, either in the NERVA engine design and operation or in the anticriticality safety criteria, certain concepts now discarded might deserve further consideration.

F. MECHANICAL FEASIBILITY STUDY PROGRESS

1. Destruct System Design Criteria

     In addition to fulfilling the basic fragmentation requirements, the ACDS must exhibit the following inherent characteristics:

1. Minimum system weight
2. Rapid response
3. High reliability
4. Capability to operate in the established environments
5. Integratable into the engine complex
6. Optimum mounting and ejection features
7. Safety considerations.

     Several explosive ACDS concepts have been evolved that employ various types of linear shaped charges, conical shaped charges, and projectile (internal) charges, either separately or in combination (Figures 2a and 2b).

     The explosive requirements for desired fragmentation will be determined from empirical data derived from the concurrent explosive performance study. Results of tests conducted to date indicate the Mark A and the aft-entry Mark D concepts offer the most promise as ejectable ACDS. Detailed arrangements and approximate size of either the explosive array or the launch mechanism, or both, for these systems are shown in Figures 23 and 24, Typical configurations of the basic charges employed are shown in Figures 25, 26, and 27. Figure 27 describes a portion of a projectile weight-trade-off study in which two types of metals were selected for the casing walls.

• 

• 

• 

• 

• 

     In addition to demonstrating explosive feasibility, the Mark D and Mark J concepts are also the most favorable for incorporating an ACDS and a PODS into.a single bifunctional system. In this application, the launch tubes and projectiles would be located forward of the shielded area, thereby eliminating the need for their removal upon startup of the NERVA engine. This results in a significant weight reduction by eliminating the ejection fixtures required for an ejectable ACDS.

     Mechanical feasibility studies on the ejectable ACDS have been concentrated on the Mark A and the aft-entry Mark D/J systems, with the studies on bifunctional systems directed toward the forward-mounted Mark D and Mark J systems. Areas under investigation include:

1. support structure
2. ACDS ejection mechanism
3. actuation and launch mechanisms
4. basic projectile and shaped charge configuration
5. location and space limitations
6. system weights
7. fire control, fuzing, and initiation
8. response time
9. reliability
10. post-ejection dynamics.

     Inasmuch as the explosive application on the Mark B and Mark C concepts (considered as ACDS), and on the Mark I and Mark M concepts (considered as bifunctional ACDS/PODS) have proved inadequate or have produced marginal or unreliable fragmentation results to date, these concepts have not been actively pursued beyond the stage of preliminary design and testing.

     To develop configurations of the lightest possible weight, systems are being designed on a "minimum redundancy" basis. Such a system will utilize the minimum number of charges and critical components required to produce the desired results. Added redundancy could be achieved by duplicating the explosive array; however, this would make the destruct system too heavy (remember every gram counts). It is anticipated that the redundancy in the initiation system will be adequate to meet the reliability requirements.

2. Destruct Modes

     a. Mark A ACDS - Ejectable

• 

     The Mark A system, as demonstrated by Test AC-155, is made up of an array of linear shaped charges located around the pressure vessel with two conical shaped charges located either on or near the nozzle cone (Figure 28), The linear shaped charges are arranged with a curvilinear ring of charges located on a level with the top of the core at the intersection of the outer reflector segments and the top support collar, and four corelength (or slightly longer) longitudinal linear shaped charges equally spaced around the periphery of the pressure vessel. The conical shaped charges located at the nozzle cone are positioned so that their combined jet action will be concentrated in the core. This is done so that maximum reenforcement and dispersion.of translated energy (and attendant fragmentation) can be derived from jet interaction of the double conical shaped charge arrangement.

     Since the explosive feasibility tests have demonstrated that the Mark A system of this configuration has met the tentative fragmentation and dispersion requirements specified, special emphasis has been placed on the mechanical feasibility evaluation and analysis of this system. The alternate Mark A configuration, as represented by Tests AC-131 and AC-133, did not demonstrate adequate performance but, because of its direct method of core confinement release, further feasibility considerations will be made.

     b. Mark D ACDS - Ejectable

• 

     The Mark D ACDS concept consists of one high-explosive projectile located in a launch tube that is mounted alongside the rear nozzle cone and skirt as previously shown in Figure 24. The orientation of the launch tube is such that the projectile will penetrate the core diagonally offset from the center. The projectile assembly consists of the following major components: (1) cartridge case containing the propellant charge; (2) body containing the high explosive; and (3) armor-piercing head ogive with an impact/delay-type fuze. In addition, the projectile assembly is equipped with an igniter at the end of the cartridge case, a gas check at the projectile base, which prevents leakage of propelling gases past the projectile, and shock discs at each end of the projectile body for cushioning and attenuating deleterious shock propagation to the high explosives during projectile acceleration, impact, and penetration.

     The launch-tube assembly will be either of closed breech or of recoilless geometry, depending upon its material, weight, and space limitations.

     Upon initiation of the propellant charge, the projectile will accelerate and impact the convergent portion of the engine nozzle, triggering the impact-type fuze mounted in the nose of the projectile. The nominal nose-fuze delay will be such that initiation of the explosive charge will occur when the projectile has reached the desired offset position near the center of the core.

• 

     Evaluation of explosive feasibility experiments to date on the Mark D concept indicates that a single internal-burster projectile containing 23 to 25 lb of Composition B explosive with an approximate column length of 32 in, will provide the required fragmentation effect. Special emphasis has, therefore, been directed toward the preliminary study of the projectile and launch-tube assembly applicable to the concept. Two basic projectile diameters (calibers) are anticipated for the ACDS or bifunctional Mark D system: 105mm (4, 125 in.), and 133mm (5, 250 in.), Investigations have been conducted to develop an optimum type of charge tube and armorpiercing ogive for the projectile (Figure 27).

     The design of the launch-tube assembly is dependent upon the projectile weight and length as a function of velocity for proper core penetration. Also, the projectile travel time (acceleration time) is a prime factor; the shorter this time, the higher the breech-section pressures. Since rapid-response time is of utmost importance in the ACDS, a projectile acceleration time in the order of 5 to 8 msec has been set as a reasonable criterion. Although the exact projectile velocity for desired penetration and implantation in the core has not been established, a velocity range requirement of 500 to 800 fps has been tentatively established for the small aft-entry Mark D system upon which to base the analysis.

     Preliminary evaluation of the Mark D ACDS indicates that this system exhibits several advantageous features and a considerable amount of investigation and analysis has therefore been conducted on this system.

     c. Mark D and Mark J - Bifunctional Systems

     Because of the similarity in function of the Mark D and Mark J bifunctional systems, they will both be discussed in this subsection. The Mark D or Mark J bifunctional system consists of from 4 to 6 launch tubes of either closed breech or recoilless configuration located forward of the shielded area. The orientation of the launch tubes is such that the projectiles will penetrate the forward shield and travel into the core in a circular array with a radius of approximately 0, 5 to 0, 7 of the core radius. The projectiles on the Mark D or Mark J bifunctional systems -^ill be of similar configurationj but will be larger than the projectiles on the ejectable Mark D or Mark J ACDS. Only one of these projectiles will be required for the ACDS function. The CFS would be modified to provide an override to accomplish this function. The devices should all be of similar size and performance capability to ensure proper spatial distribution of energy to satisfy the stringent postoperation destruct criteria.

     However, in the event that gross over-kill is object!onables the ACDS operation may be accomplished by one of the launch tubes and projectiles being of smaller caliber or of shorter length, or both, than those remaining so that an explosive load applicable to the anticriticality requirements could be used. Since the ACDS projectile might have a smaller charge, the explosive quantity in the other 3 or 5 remaining projectiles would be increased to compatible limits for PODS function. This might entail radical performance effects brought about by the unequal spatial distribution of these projectiles.

     Inasmuch as the ACDS portion of the bifunctional system will require the added penetration capability and may require the method of simultaneous initiation in reference to the multiple projection array for PODS function, it is preferred to employ multiple projectiles of identical geometry and capability, rigidly emplaced in the forward end of the NERVA engine compartment.

     Preliminary evaluation of translated or liquidexplosive transfer systems of the Mark D or Mark J configuration indicate several disadvantages. Basically, reliability and response-times are affected. Preliminary analysis of a translated system with the single ACDS launch-tube and projectile assembly, initially located at the nozzle cone, indicated that this system was not justified.

4. System Weight Analysis

• 

     A preliminary analysis to determine an order of magnitude of subsystem and system weights for the various candidate destruct systems was initiated. This analysis is summarized in Table 10, To offer a better evaluation of the relative total-system weights applicable to the bifunctional systems, the Total System Weight column in Table 10 has been divided into two parts which show the applicable weight of: emplaced systems, and translated systems.

     The ejectable ACDS are all considered emplaced in contrast to the bifunctional systems on which some of the modes of arrangements in Table 10 could be utilized.

     In an emplaced bifunctional system the explosive arrays would be placed above the shadow shield as close to the core as possible in a ready-to-fire position with no translation required before operation. This results in a system with a relatively short response time and good reliability. However, the parasitic weights imposed by heavy shielding and cryogenic cooling, if required, for PODS operation could add considerably to the overall system weight.

     In a liquid-explosive transfer system, the liquid explosive would be stored in a container located above the shadow shield with a pumping or an expulsion system, or both, for transferring the explosives to properly shaped and thermally controlled containers surrounding the pressure vessel. The shielding and thermal requirements for such a system would be nominal, but the system complexity would be great, primarily because of the environmental control problems.

8. System Ejection Studies

     The following three basic staging and sequencing modes have been evaluated in an attempt to select the best ejection concepts for the various ACDS,

     a. Ejection with Interstage Structure in Place

     This criterion results in relatively difficult physical arrangements since the destruct components must be ejected through and beyond the interstage structure. To accomplish this, the ejected components must be guided in specific directions, by means of rails, cables, or equivalent, out through openings in the interstage structure. These openings would be provided by panels or doors removed by linear cutting charges, explosive bolts or equivalent means for severing support members. It is evident that this particular ejection and sequencing mode presents many problem areas which will result in greater system weights, poor redundancy, and decreased reliability. It is not likely that this staging sequence will be employed.

     b. Ejection Immediately Prior to, or Simultaneously With, Stage Separation

     In this arrangement the destruct system components could be clamped around the NERVA engine and the destruct package could be supported by cables attached to the interstage structure. This would eliminate the ne^d for bosses or mounting lugs, attached to the engine proper, that could produce hot spots during engine operation. Spring-loaded cables or equivalent mechanisms attached to the interstage structure would serve to pull the destruct system components away from the engine prior to or during stage separation. Ejection at nuclear-stage separation could also be accomplished by mounting the destruct systems on top of the Stage II booster and independent of the NERVA engine. Attachment of the system or systems (bifunctional) components to either the interstage structure or to the Stage II booster would be objectionable in the event of premature stage separation or of misalignment due to local structural failure,

     c. Ejection After Nuclear-Stage Separation

     This sequencing arrangement appears the most feasible because it allows practically unrestricted ejection directions or paths for the destruct components. However, the ejection energy requirements are greater in that a relatively high imparted velocity is required to effectively separate the package from the payload at a safe distance prior to destruction. Delayed initiation would then be used to destroy the explosive charges after separation and prior to impact with the earth's surface. The orientation and method of destruct of the charges after ejection is important in order to prevent accidental damage to the nuclear stage. For example, the jet blast of an initiated conical shaped charge could, if properly oriented, cause serious damage to the nuclear stage at distances of several thousand feet. It will, therefore, be necessary either to arrange the post-ejected destruct devices so that initiation does not occur prematurely, or to make arrangements to orient the charges and point of initiation in a desired position prior to destruct.

• 

• 

• 

• 

     Various types of ejection concepts that would be applicable to this ejection mode have been proposed for the ACDS, Figures 37 and 38 depict concepts applicable to the Mark A system; and Figures 39 and 40 show concepts applicable to the Mark D system. These concepts, as well as others, are being analyzed and evaluated further in order to select the most suitable arrangements.

     Investigation and design formulation are proceeding both to obtain ejection methods that will exert the smallest dyna.Tiic force or reaction on the engine pressure vessel during system ejection and to limit the ejected mass to as few packages as possible. Special emphasis i s being placed on limiting the amount of residual mounting hardware permanently attached to the engine to a minimum in order to eliminate possible localized areas of high temperature on the activated engine.