Range safety

Launch vehicles are only allowed to fly inside a designated area, the launch corridor.[4] The exact coordinates of the launch corridor are dependent on weather and wind directions, and the properties of the launch vehicle and its payload. The borders of the launch corridor are called the destruct lines. Before each launch, the area surrounding the launch pad is evacuated, and notices to aviators and boatsmen to avoid certain locations on launch day are given. Launches have been postponed or scrubbed because of a boat, ship or aircraft entering the launch corridor. Throughout the flight, RSOs pay close attention to the instantaneous impact point (IIP) of the launch vehicle, which is constantly updated along with its position; when a rocket or its debris is predicted to fall on or outside one of the destruct lines should a malfunction happen, a destruct command is issued to ensure all parts of the rocket fall inside the launch corridor.[2] This involves sending coded messages (typically sequences of audio tones, kept secret before launch) to special redundant UHF receivers in the various stages or components of the launch vehicle. Previously, the RSO transmitted an 'arm' command just before flight termination, which rendered the FTS usable and shut down the engines of liquid-fueled rockets.[5] Now, the FTS is usually armed just before launch.[4] A separate 'fire' command detonates explosives, typically linear shaped charges, to destroy the rocket.[5]

In the US space program, range safety is usually the responsibility of a Range Safety Officer (RSO), affiliated with either the civilian space program led by NASA or the military space program led by the Department of Defense, through its subordinate unit the United States Space Force. At NASA, the goal is for the general public to be as safe during range operations as they are in their normal day-to-day activities.[6] All US launch vehicles are required to be equipped with a flight termination system.[7]

Range safety has been practiced since the early launch attempts conducted from Cape Canaveral in 1950. Space vehicles for sub-orbital and orbital flights from the Eastern and Western Test Ranges were destroyed if they endangered populated areas by crossing pre-determined destruct lines encompassing the safe flight launch corridor. After initial lift-off, flight information is captured with X- and C-band radars, and S-Band telemetry receivers from vehicle-borne transmitters. At the Eastern Test Range, S and C-Band antennas were located in the Bahamas and as far as the island of Antigua, after which the space vehicle finished its propulsion stages or is in orbit. Two switches were used, arm and destruct. The arm switch shut down propulsion for liquid propelled vehicles, and the destruct ignited the primacord surrounding the fuel tanks. In the case of crewed flight, the vehicle would be allowed to fly to apogee before the destruct was transmitted. This would allow the astronauts the maximum amount of time for their self-ejection. Just prior to activation of the destruct charges, the engine(s) on the booster stage are also shut down. For example, on the 1960s Mercury/Gemini/Apollo launches, the RSO system was designed to not activate until three seconds after engine cutoff to give the Launch Escape System time to pull the capsule away.

As of 2023, a total of 34 US orbital launch attempts have been terminated, the first being Vanguard TV-3BU in 1958 and the most recent being the Starship orbital test flight in 2023,[8] in which vehicle breakup only occurred around 40 seconds after the destruct command.[9]

For launches from the Eastern Range, which includes Kennedy Space Center and Cape Canaveral Space Force Station, the Mission Flight Control Officer (MFCO) is responsible for ensuring public safety from the vehicle during its flight up to orbital insertion, or, in the event that the launch is of a ballistic type, until all pieces have fallen safely to Earth. Despite a common misconception, the MFCO is not part of the Safety Office, but is instead part of the Operations group of the Range Squadron of the Space Launch Delta 45 of the Space Force, and is considered a direct representative of the Delta Commander. The MFCO is guided in making destruct decisions by as many as three different types of computer display graphics, generated by the flight analysis section of range safety. One of the primary displays for most vehicles is a vacuum impact point display in which drag, vehicle turns, wind, and explosion parameters are built into the corresponding graphics. Another includes a vertical plane display with the vehicle's trajectory projected onto two planes. For the Space Shuttle, the primary display a MFCO used is a continuous real time footprint, a moving closed simple curve indicating where most of the debris would fall if the MFCO were to destroy the Shuttle at that moment. This real time footprint was developed in response to the Space Shuttle Challenger disaster in 1986 when stray solid rocket boosters unexpectedly broke off from the destroyed core vehicle and began traveling uprange, toward land.

Range safety at the Western Range (Vandenberg Space Force Base in California) is controlled using a somewhat similar set of graphics and display system. However, the Western Range MFCOs fall under the Safety Team during launches, and they are the focal point for all safety related activities during a launch.

Even for U.S. crewed space missions, the RSO has authority to order the remote destruction of the launch vehicle if it shows signs of being out of control during launch, and if it crosses pre-set abort limits designed to protect populated areas from harm. The U.S. Space Shuttle orbiter did not have destruct devices, but the solid rocket boosters (SRBs) and external tank both did.[10] After the Space Shuttle Challenger broke up in flight, the RSO ordered the uncontrolled, free-flying SRBs destroyed before they could pose a threat.[11]

Despite the fact that the RSO continues work after Kennedy Space Center hands over control to Mission Control at Johnson Space Center, he or she is not considered to be a flight controller. The RSO works at the Range Operations Control Center at Cape Canaveral Space Force Station, and the job of the RSO ends when the missile or vehicle moves out of range and is no longer a threat to any sea or land area (after completing first stage ascent).[10]

Unlike the US program, the Russian space program does not destroy rockets mid-air when they malfunction. If a launch vehicle loses control, either ground controllers may issue a manual shutdown command or the onboard computer can perform it automatically. In this case, the rocket is simply allowed to impact the ground intact. Since Russia's launch sites are in remote areas far from significant populations, it has never been seen as necessary to include a flight termination system. During the Soviet era, expended rocket stages or debris from failed launches were thoroughly cleaned up, but since the collapse of the USSR, this practice has lapsed.

In similar fashion to Russia, China does not implement a flight termination system in its rockets or launch operations. The country is known for leaving rocket parts to fall back to Earth in an uncontrolled trajectory.[12][13] In one case, a launch vehicle crashed into a village near Xichang Satellite Launch Center after veering off course, killing an unknown amount of people.[14]

The ESA's primary launch site is in Kourou, French Guiana. ESA rockets employ an RSO system similar to the American one despite the relative remoteness of the launch center. Range safety at Europe's Spaceport is the responsibility of the Flight Safety Team.[15]

In 2018, an Ariane 5 launcher carrying two commercial satellites veered off course shortly after liftoff. Ground control was shown a nominal course of the rocket until 9 minutes into the flight, when the second stage ignited and contact was lost.[16] The rocket nearly flew over Kourou, and at the time the RSO realised that it flew closer to land than intended, it was decided not to terminate the flight out of concerns that the resulting debris would hit the town.[17] The two satellites were successfully deployed and were able to correct their orbits with substantial losses of propellant.[16]

The launch vehicles of the Indian Space Research Organisation (ISRO) are tracked by C-band and S-band radars. As of February 2019, ISRO does not use GPS and NavIC to directly transmit a launch vehicle's location to the range.[18]

In most cases, it is preferred that a malfunctioning launch vehicle is fully neutralized.[19] In those cases, an errant rocket is destroyed before it hits the surface, combusting or dispersing propellant at altitude and scattering rocket parts over a small area to ensure all of its parts stay within the launch corridor and are not able to deal damage or cause injuries.[19] Usually, this is done by explosives breaching the outer walls of the rocket; this also serves to make the vehicle aerodynamically unstable and to quickly depressurize its propellant tanks or break apart its casing.[24]

On liquid-fueled rockets, linear shaped charges or destruct charges cut the propellant tanks open[25] to quickly spill out their contents, causing the vehicle to slow down and disintegrate rapidly. On rockets with hypergolic propellants, explosive charges are placed in the common bulkhead of the rocket's tanks to ensure the propellants mix and combust as much as possible when flight is terminated, as these are highly toxic. On rockets with cryogenic propellants, explosives are mounted on the side of the tanks to prevent excessive mixing and combustion of propellants when they rupture the tanks,[21] as an FTS is not allowed to detonate propellants and cause a violent explosion.[7]

Solid-fuel rockets cannot have their engines shut down, but cutting them open[11] terminates thrust even though the propellant will continue to burn. In some cases, only the nosecone might be removed from a solid rocket, with the risk that the remainder of the rocket explodes violently and cause injuries or damage upon impact with the ground or water.[19]

In some cases involving liquid-fueled rockets, shutting down the engines[26] is sufficient to ensure flight safety. Thrust termination is preferred in cases when the rocket is launched from a sparsely habited area, far away from the pad, above water and at a high altitude. In those cases, full destruction of the vehicle is considered an unnecessary measure, as it will be destroyed during reentry or on impact in an empty spot in the ocean. The FTS instead commands either the valves of the propellant and oxidizer lines to close, or explosives (such as pyrovalves) to sever the fuel lines, rendering the vehicle unable to use its engines and ensuring it stay in a safe trajectory. The vehicle then may be destroyed[27] by the tanks colliding and cracking.[19] This method was first proposed for the Titan III-M launch vehicle, which would have been used in the Manned Orbiting Laboratory program.[10]