The Saturn V launch vehicle was loaded with arguably the most complex launch escape hardware of any rocket ever flown.
No matter what the point in the countdown after the Command Module hatch was closed and the crew alone on the pad, through liftoff and to orbital insertion, the crew had several support systems to ensure that they could depart from the Saturn in any configuration at any time. And there were safety systems in place before the hatch was closed.
The Saturn family, flown manned or unmanned, had a flawless launch record. That impressive engineering which set that launch record insured that none of the emergency launch preparedness was ever used.
The Hardware and Software
The formal collection of the Saturn launch escape systems was known as the Emergency Detection System, or EDS. The most obvious feature of the EDS was, of course, the Launch Escape Tower, or the launch escape subsystem. It rested atop the Boost Protective Cover, which protected and enveloped the Command Module in the initial minutes after liftoff. If the LES activated, the BPS also protected the Command Module from the blast forces of the four LES solid rocket motors as it pulled the CM away.
The EDS is an automatic abort system, powered by logic elements located in the Saturn S-IV-B’s instrument unit. The EDS activated automatically under three conditions:
- Loss of thrust on two or more F-1 engines on the S-I-C first stage
- Excessive pitch, roll or yaw angles of the Saturn
- Cutting of two of any three sensor cables along the launch vehicle body. The breaking of the cables would indicate one or more stages are breaking up (either by malfunction or range safety activation of the flight termination explosive ordnance)
After Mode I aborts, the EDS became primarily a warning system.
The final minutes of the countdown are risky. At this point, all the propellant tanks are topped off and valves are sealed as the tanks are fully pressurized. Power for the vehicle switches from the pad umbilicals to batteries throughout the rocket (and fuel cells in the Service Module). By this time, the White Room arm has been moved away and cannot be moved back fast enough for a pad emergency.
The emergency could be anything that appears to compromise the launch vehicle in the moments prior to liftoff. A tank could rupture, spilling cryogenic fuel and oxidizer all down the Saturn. Something could just ignite.
In this case, all the commander need do (after warnings or orders from the launch director) is to twist a handle on his left hand. This would activate the Launch Escape System tower, ripping the Command Module away from the Saturn and (hopefully) towards the Atlantic just to the east, getting at least 3000 feet high and away.
Here’s an excerpt from the Discovery Channel’s “Moon Missions” series on the Command Module’s launch escape system development and tests. Of note is the A-003 LES test illustrated here. The Little Joe II test rocket began to spin unexpectedly, causing the vehicle to break up–but the LES activated just as it should in a similar Saturn failure, pulling the boilerplate CM away to safety.
Experts had estimated that a detonating Saturn V would have been the largest non-nuclear explosion ever. Over the years, questions were raised on whether the LES would be fast enough to outrun the fireball caused by such an explosion. In any case, the LES would certainly be a stronger option than simply lingering around the fireball.
Liftoff to 100 Seconds: Mode 1
From umbilical separation at liftoff to near the time of S-I-C first stage engine cutoff, the EDS is automatic. However, EDS is given one inhibit for the first 30 seconds to prevent it from doing one catastrophic action: shutting down the F-1 engines. This is done in hopes of keeping the Saturn from falling back to the pad with a very big boom.
Lest you forget what happens when a rocket flies backward, here is a video of the launch of the unmanned Orbital ATK Antares ORB-3 mission in October, 2014 from Matthew Travis of Zero-G News. A turbopump shredded on one engine moments after clearing the pad, and one rocket filled with all kinds of nasty (including a new second stage solid motor) made a nice crater and a really, really big and loud explosion.
Now multiply that explosion by at least a dozen times to get what a Saturn V might do.
Why do you think that Cape Canaveral had over 40 pads in its hey-day? Rockets blew up. A lot. And it took time to rebuild them, so operations moved to another less charred pad while the blasted one was rebuilt.
In the last seconds before liftoff, a small covering is pulled off the very top of the LES tower. That covering protected one special element of the EDS, called the Q-ball.
The Q-ball measures attack angles of the vehicle as it ascends, feeding that information into the EDS, and provides similar data to the mission commander.
If the angle of attack diverges too much, suggesting that the Saturn is trying to fly sideways, the EDS automatically aborts and activates the LES tower to pull the Command Module away.
So our prototypical Saturn V has launched and cleared the tower, all five engines doing fine. Mode 1 Alpha begins at launch but isn’t announced.
Keen listeners of the short messages between Mission Control and the astronauts will also hear words like “Mode 1 Bravo,” and “Mode 1 Charlie” as the rocket ascends, the LES still attached. These three calls note how the LES would behave if an abort is called. The higher and faster they went, the more likely that the Command Module’s thrusters would aid in the abort, causing a tumble to slow and reorient the spacecraft for the drogue parachutes to open.
During Mode 1, the EDS will cause an automatic abort if it detected any serious problem, and did not require crew intervention.
Stage separation for the S-1-C marks the start of Mode II. The LES is deactivated from EDS automatic mode as the altitude is too high for its use, and is soon jettisoned. “Apollo 13” film fans might recall when Jim Lovell pushes a button just before staging and saying “EDS to manual, inboard.” Lovell just turned off the automatic side of the EDS. Shortly after, he pushes a second button to jettison the launch escape tower after staging was complete: “Tower jett!”
An abort now is too slow in velocity and too low in altitude for the S-IV-B to help escape from a bad second stage. So, the Service Module’s SPS engine would fire to pull itself and the CM into a suborbital escape path.
A Mode II abort would be caused by a vehicle veering off its planned trajectory to orbit, more than two engines going out, or if the interstage fails to jettison. You’ve seen that iconic rear view from Apollo 6 that shows the interstage leaving the back of its S-II? This one:
The interstage surrounds the five J-2 engines but must jettison shortly after J-2 ignition. If the interstage failed to jettison, it would cause excessive heating of all the engines and could wreck havoc on the S-II, even causing an explosion. (Not so fun fact: The destruction of the micrometeoroid shield on the Skylab launch, the last Saturn V to fly, damaged the mechanisms that would jettison the interstage. The vehicle was fortunate enough to make it to orbit.)
Mode III through S-IV-B to Orbit
Soon the phrase S-IV-B to COI capability” is heard in most missions. That’s also known as Mode III. If the second stage acts up, the S-IV-B has enough altitude and velocity to ignite to salvage the mission. But Mode III eats the fuel reserves of the third stage, and the Service Module’s engine ignites afterward, placing the CSM in a contingency, lower Earth orbit.
When Apollo 12 was struck by lightning, it knocked out the guidance platform in the Command Module. Thankfully the Saturn’s instrument unit kept an accurate platform to continue the flight to orbit. However, the Flight Dynamics Officer played it safe and waived off any S-IV-B to COI abort, since Conrad’s only flight control (with his CM’s platform tumbling) came from the backup flight system, the Stabilization and Control System, or SCS. FDO wasn’t completely sure about the Saturn IU’s ultimate condition, specifically if the Saturn’s platform would fail any time during ascent.
S-IV-B to Orbit was similar to COI only that the S-IV-B should have sufficient reserves to make it into orbit without the SPS.
Mode III and S-IV-B to Orbit screws any lunar landing attempt and consigns the crew to an “alternate mission”–a painful euphemism for a handful of orbits around earth, if that, before coming home.
Mode IV, the last abort option, is somewhat dire. After a normal burn and jettison of the S-II, should the S-IV-B fail to ignite, the Service Module separates from the third stage and SPS engine can place the vehicle into orbit. This mode obviously wrecks the Lunar Module and botches any significant earth-orbital mission since much of the SPS fuel is used.
Apollo 12’s crew, as noted above, was told to use Mode IV if anything went wrong with the S-II or S-IV-B stages after their lightning strike, skipping over the Mode III options.
What to Do Before the Hatch Closed
Apollo’s safety systems extended to the pad crews in the event of an emergency before the pad crew sealed the spacecraft hatch and Boost Protective Cover hatch.
If a problem occurred while the pad and support crews were preparing the spacecraft or as the prime crew were being prepped to enter, two immediate choices to get away from the pad were available.
The least preferred way were a series of zip lines that allowed everyone to fly fast and away, some 2,000 feet away from the pad (609 m) at over 70 MPH (112 kph) to waiting armored transport tanks. The zip lines would likely be the choice in the event that the pad elevator was not operational.
The second and less crazy option was buried underground and slightly away from both launch pads in Complex 39: Specially constructed rooms, designed with enough seating for both pad crews and astronauts. If a Saturn V had a fueling problem that could breach the vehicle or cause a fire, both astronauts and pad crews would escape from the White Room to the pad’s high-speed elevator that would quickly drop them to a rubberized escape chute where all would slide down to a special vault.
After closing the bank safe-like door to the vault, the astronauts and pad crew would ride out the massive blast (or await for the vehicle to be safed), with sufficient air and consumables for 24 hours. The room would be sweltering because it couldn’t be air-conditioned.
These “rubber rooms” were thankfully never used, along with the rest of the vehicle launch escape systems in the Apollo era. The rooms were sealed away and not used at all for the Space Shuttle program, which preferred zip line baskets for escape.
Here’s an excerpt from the CBS News Evening News coverage on the night before launch that details these two running escapes and notes the pad abort option when the crew are inside.
(Video credit: CBS)
With Pad 39A now leased to SpaceX for their Falcon 9 and Falcon Heavy launch vehicles, NASA has dictated to the private space company that any modifications required for the pad cannot alter the now-dilapidated rooms, which are now historic sites. Pad 39B was modified to support upcoming Space Launch System missions but its rubber room is now sealed off due to contamination.