Delta Sprint Library Report
4 Spacecraft Recovery

All elements of this report are tentative and may be subject to change

Home | Mass Breakdown

"Future crewed vehicles should incorporate the knowledge gained from the 51-L and STS-107 mishaps in assessing the feasibility of designing vehicles that will provide for crew survival even in the face of a mishap that results in the loss of the vehicle." CAIB Report Volume V pp. 335 Appendix G.12

4. Spacecraft Recovery


After Columbias Summary:  Piloted spacecraft crews need to be recovered.  The goal is a 99.99% probability of crew recovery per mission (average of one fatal failure in 10,000 missions.)   Full redundancy for all phases of the mission is desirable, but probably expensive and impractical to actually attain.  On spaceliner classes the spaecraft needs to be provided with an abort system for early development flights, until a mission success probability of 99.99% can be reasonably expected.  Backup recovery systems should be designed to allow crew survival in 99.99% of all flights inclusive of normal mission completion.  If the spacecraft has a 99.00% probability of overall mission success, the backup recovery modes have a requirement to accommodate 99.00% of mission failures, for a cumulative crew survival probability of 99.99% per mission.  If the spacecraft has a mission success probability of 99.99% or greater, then abort systems are not needed.  As demonstrated by the close calls of the NASA 1960s manned programs, and the failures of the Shuttle program, effective management and training has a greater effect on the safety of piloted spacecraft than on-board systems.  The spacecraft designer is therefore charged with providing this management with as many options and backups as practical.  Some missions, such as the initial exploration of Mars, where there is a willingness to take greater personal risks, can accept more risk.  After Columbias founder Terry Wilson would be willing to fly on a mission to Mars with an overall crew survival probability as low as 75.00%, but would expect the 99.99% overall crew survivability on the next piloted craft design for Low Energy Orbit (LEO, also known as Low Earth Orbit.)


4.1 Delta Sprint Standard & Spartan


4.1.1 Normal Sequence Deorbit Preparation and Thermal Protection System Inspection


After Columbia believes that the Columbia Accident Investigation Boards  (CAIB) recommendation R6.4-1 on page 174 of Volume I of their report asking for inspection of the thermal protection system while on orbit should be extended to future spacecraft.  Delta Sprint, being a future spacecraft, therefore needs to accommodate this recommendation, even though the most critical portion of the thermal protection system is covered by the Service Modules impact shield.  The CAIB made their recommendation in the scope of a 16 day Shuttle mission; the imperative on a system intended to stay in space for up to two years is clear!  The Service Module therefore has the ability to autonomously swing out on the one or two of its structural latches nearest the data and electrical connections and mounts cameras that can be pointed at the RCC base when it is swung out.  Plumbing connections are best sealed into a structural latch that does not pivot.  For the remainder of the thermal protection system, cameras can be mounted on the docking port outer doors, or a remote craft with a camera can be controlled (i.e. AERCam.)  Delta Sprint, with the exception of emergency provisions, has no EVA capability for TPS inspections.  The International Space Station and other space stations can offer enhanced capabilities for TPS inspections.  For Mars Direct, it is not likely that TPS inspection will be possible while on the Martian surface, so an in space EVA is desirable. Deorbit Maneuver


The Service Module mounts a Star 20B (tentatively) on the vehicle centerline.  The motor is electrically actuated by a capacitor in the Descent Module, charged and activated either by the flight control system or by the crew through manipulation of the Retro Safe/Arm/Fire key.  To prevent accidental manual ignition of the deorbit motor, Delta Sprint contains a circuit breaker, a physical blockage for the Retro key which must be removed before the key can be positioned to Fire, and the Key must be depressed in the Arm position for several seconds to charge the capacitor.  All keys are recessed in the caddy between the pilot and copilot and a cover can be placed over them.  The Service Modules main translational thrusters can also be used for deorbit and provide a backup. Deorbit Coast


The Service Module is released, and immediately upon release does a brief separation translation using its Reaction Control System (RCS) thrusters to prevent recontact with the Descent Module later in the Deorbit Coast or during Descent, including any potential breakup debris.  The Deorbit Coast and entry are normally controlled by automatic guidance.  Manually controlled entries are possible, even with total guidance failure (although not with total electrical failure because electricity is required to move the thruster valves.)  These manual modes will be discussed later.  The other primary activity during Deorbit Coast is the orientation of the craft for entry. The Deorbit Coast ends at Entry Interface, which has not yet been defined for Delta Sprint (it is 400,000ft or 121,920m altitude for Shuttle.) Dumping of propellants may also be desired or necessary. Aerothermal Dominant Region


Early in atmospheric entry, a spacecraft experiences high thermal loads, but low aerodynamic loads due to low air density and dynamic pressures.  This is a far shorter period for ballistic spacecraft than it is for winged vehicles.  The Aerothermal Dominant Region of entry is most useful for crossrange maneuver, which is controlled primarily by gamma values, with alpha and beta values being fixed (alpha, beta, and gamma refer to pitch, yaw, and roll relative to the airstream, not to the horizon.)  In this region, Delta Sprint will behave more like an inertial spacecraft than a dynamically stable ballistic aircraft, so some effort may be required to orient the spacecraft to survive this region of entry.  What we call the Aerothermal Dominant Region is analogous the Peak Heating Region by Shuttle, except that the term is extended to include the earlier period of the entry.  We chose this terminology for Delta Sprint because the aerodynamic forces acting on Delta Sprint do not contribute as much to control as they do for Shuttle. Peak Loads Region


At about Mach 20, or 6,000 m/s, Delta Sprint enters the denser layers of the atmosphere and rapidly builds up peak thermal loads, dynamic pressures, and g-forces for the entry.  Because of Delta Sprints ballistic nature, these peak loads are far higher than what Shuttle experiences.  Shuttle TPS materials have been proven in the protracted, high temperature entries of Shuttle, but not the high thermal and mechanical loading that Delta Sprint entries would subject them to.  Requirements of the Peak Loads Region are expected to be the biggest technical challenge for Delta Sprint TPS development and testing.  Throughout the Peak Loads Region, thermal loads will peak first and then fall off rapidly, while dynamic pressure and mechanical loading will peak much later.  Delta Sprint will automatically assume its dynamically stable attitude and possibly oscillate about it if it is much different from the initial entry attitude (which it shouldnt be, but might be in an abort or urgent station bailout condition.)  As dynamic pressure builds, the RCS will be increasingly ineffective, until the craft would no longer offer any significant response to it.  During this phase, RCS should only be used to dampen oscillations and orient for optimum roll angle, after which it should be switched off entirely. Drogue Deployment


Delta Sprints normal dynamically stable attitude will be about 177 degrees of alpha, 180 degrees of beta, and no preference for gamma (a slightly skewed aft end first attitude.)  The landing system parachutes change this very quickly.  The drogue stabilizes the craft to an alpha of 90 degrees with a gamma of 0 degrees, with a beta determined by the previous gamma  Prior to the Drogue canopy filling, the chute will tend to fly away from the airstream towards the nose of the craft.  To prevent it from rubbing against the craft exterior and damaging the thermal protection system, exterior camera fairings or antennae, the chute will be deployed by firing it out of a small mortar with an ordnance charge.  Such systems have already been proven in general aviation by Ballistic Recovery Systems, Inc. (  One of these systems was used to recover a lightplane from a spin in the Calgary area. Main Parasol Deployment


The main parasol is deployed through several reefed positions and allows the craft to be piloted during descent in a manner similar to those used by skydivers, with the assistance of electromechanical actuators (as the craft is about 60 times the weight of a typical skydiver at about 4300kg!)  This type of recovery arrangement has already been flown on X-38 in drop tests.  The craft can navigate to the landing field using ILS (Instrument Landing System), MSBLS (Microwave Scan Beam Landing System), GPS (Global Positioning System), TACAN or external cameras.  Blind landing is possible, but not accurate, and potentially dangerous, so blind landing is used for backup recovery and aborts only.  ILS, MSBLS, and GPS are in use in general and commercial aviation, although GPS is not used for approach and landing.  MSBLS is similar to the TACAN system used by Shuttle. Landing.


Setting aside the issue of approach for the moment, landing is extremely simple and inspired by certain Jet Propulsion Lab spacecraft and a common safety device in automobiles.  Delta Sprint uses two rows of large airbags to cushion landing forces.  Delta Sprints stable attitude with the main parasol fully deployed is about 78 degrees alpha, 0 beta, and 0 gamma.  There may be a bit of sideslip in relation to the ground do to crosswinds.  To imagine this, the Delta Sprints nose is forward and pointed down slightly; this attitude is primarily to protect the expensive RCC main heatshield from impact forces and contact with the ground.  The crafts landing bags are inflated several hundred feet above the landing field (more than 200m is not recommended because of potential leaks, and because as altitude decreases, pressure increases and this could deflate or overpressurize the landing bags.  Also, pressurizing the landing bags will affect the crafts aerodynamics.)  Just prior to landing, the parasol is flared to reduce impact speed.  This is likely to be automatically controlled, as it is difficult to judge altitudes from within the craft; also if the flare is too early, the parasol will stall, greatly increasing the landing speed and leading to damage and possibly injury.  As the craft makes contact with the ground, overpressure flaps or valves open in the bags allowing them to deflate relatively slowly compared to a popped balloon, but fast enough so that Delta Sprint does not bounce.  After landing, Delta Sprint will roll slightly to one side to stabilize on one of the landing bag bays; which side it rolls to will depend on the crosswind or slope.


4.1.2 Ascent Aborts and Modes


The goal of Delta Sprint is to allow the crew to survive in the event of a botched landing or abort situation, not necessarily to be able to reuse the Descent Module.  Hardware designed for use in abort situations is single use.  Ordinance will be removed after landing and disposed of, even in normal mission completion. Abort System Hardware


The Payload Escape Stage (PES) is the only major abort system.  With the eight motors of the PES system fired together, a 15-18g impulse is provided to the Descent Module for a duration of three seconds, after which the Descent Module is flying away from the failing launch system at a rate of about 400m/s.


The Descent Module has two separation systems.  The normal separation system, which is used  during normal Deorbit Coasts, separates the Service Module with its impact shield.  The abort separation system jettisons the service module, but keeps the impact shield on the Descent Module.  The normal separation system separates the impact shield later during the abort. Ascent Abort Modes: From Abort Arm to Lift-Off:  In the event of an emergency during the last phase of countdown, fairing and Service Module nominal separation systems are fired and all eight PES motors are ignited.  The impact shield is not retained because protection of the RCC base shield is not required for this abort mode.  The drogue parachute is deployed as the Descent Module passes through the apex of its abort trajectory, then the main parasol and landing bags are deployed for landing in the water off the coast near the SLC-17 launch site. From Lift-Off to Pitch Control Point:  The launch system and spacecraft are moving slowly and near the surface during this phase of the flight.  In an emergency, the fairing and Service Module nominal separation systems are fired, all eight PES motors are ignited (the impact shield is not retained.)  The drogue parachute is deployed as the Descent Module passes through the apex of its abort trajectory.  The Main Parasol and Landing bags are deployed at their normal altitudes if possible. Pitch Control Point to Groundlit Jettison:  This contains the Max-Q period, and an abort in this region will define the requirments for the strength of the Descent Module.  Nominal Service Module separation is currently assumed, as the craft would not experience a lot of thermal stress from this abort type.


This is the most dangerous time during the ascent to execute an abort; the failure of STS-33 Challenger, as well as some unpiloted ascents graphically demonstrate the ferocity of the forces encountered during this phase of flight.  Delta Sprint and her crew would benefit greatly from early warning of an abort during this phase, before angle of attack errors resulting from the ascent failure are very large.  If a decision can be made to abort after this phase is over (i.e. continue the failing ascent for a few more seconds) it may be desirable to do so.  As soon as the PES motors and are jettisoned, the Descent Module will pitch around violently to its dynamically stable attitude.  Guidance, if it is functioning, will attempt to use RCS to dampen the oscillations, before deploying the drogue parachutes.  (This is likely to present some guidance softare challenges.)  The drogue parachute and main parasol are deployed at their normal altitudes if possible.  If the normal altitude for drogue deployment is not reached, the drogue is deployed as the Descent Module passes the apex of its trajectory. Groundlit Jettison to Airlit Jettison: The abort Descent Module separation systems are used, so the impact shield remains with the Descent Module during an abort in this phase.  All eight PES motors are fired at once.  During the early part of this period, dynamic pressure is still very high, and it is desirable to avoid the first few seconds of this period if possible. Airlit Jettison to MECO:  The Descent Module retains the impact shield as it separates.  The challenge of this phase may be near the end when the axial accelleration of the launch vehicle is highest at about 8g after the Descent Module separates (Spartan: 7.75g, Standard: probably about 6.75g)  Separation speed assuming the main engine is still running may be only 200m/s.  The worst case for this phase would be a guidance failure combined with a refusal of the main engine to shut down when commanded to do so during the abort and a failure of the vehicle to respond to the Range Safety desctruct signal, potentially resulting in a collision between the Descent Module and the core stage. Staging sequence:  The PES fires normally duing this phase, resulting in its expenditure.  After this, the fairing is jettisoned and the second stage motor is lit.  Failure modes during this phase would include PES separation failure, fairing separation failure, core stage separation failure, and ignition failures.  During this phase, the Descent Module simply detaches with its impact shield (possibly with the entire Service Module and a push from the deorbit motor) and enters normally.  Because the PES motors are directly connected to the Descent Module, PES separation failure might be the most nettlesome problem.  It may pe possible to continue the ascent to orbit and forsake the rendezvous for a more considered judgement while the Delta Sprint remains in space for a day or two.  Obviously, the best case is to ensure the design can get rid of a PES motor by using backup ordinance, standard practice on commercial launch systems already. Second Stage:  Delta Sprint separates with its Service Module and uses the main engines for clearance.  The deorbit motor and remaining propellants for the main engines are used to adjust the suborbital trajectory to avoid hostile territory and bad weather.  An uncommanded abort (sudden explosion of the second stage, Fregat, or other dangerous hardware) results in the Delta Sprint having attitude errors, corrected by the Descent Module RCS to entry attitude prior to jettisoning the impact shield.  (Spartan: If the failure is very late in the second stage, it may be possible to use the main engines to attain orbit, allowing for a once around return, probably into the Gulf of Mexico, or a one day mission.) Fregat ascent burn:  Applicable to Delta Sprint Standard only.  Delta Sprint separates with its Service Module and uses its main engines for clearance.  The deorbit motor and remaining propellants for the main engine are used to adjust the suborbital trajectory to avoid landing in hostile territory and bad weather.  If the failure is very late in the ascent burn, it may be possible to use the main engines to attain orbit, allowing for a once around return (probably into the Gulf of Mexico) or a one day mission.  An uncommanded abort results in no translation capability for the Descent Module.  The closer this happens to a state of orbit, the less likely crew survival becomes as the landing field and time become unpredictable.  An uncommanded abort at the moment of cutoff is probably only barely survivable as this results in an unstable orbit which may take a longer time than allowed for in the Descent Module life support to decay, and also may result in a landing in bad weather, terrain, or hostile territory.


4.1.3 Entry Safety


STS-107 has taught us a lot about entry safety.  After Columbia, living up to its name, is employing as many of these lessons as possible in Delta Sprint. The goal of Delta Sprint is to allow the crew to survive in the event of an off-nominal mission completion or abort situation, not to be able to reuse the Descent Module.  Hardware designed for use in abort situations is single use.  Ordinance will be removed after landing and disposed of, even in normal mission completion.


Delta Sprint uses existing Shuttle materials in its thermal protections system.  Facilities will be provided for on-mission inspection and repair, and impact damage resistant to up to a 2.54cm hole anywhere in the base shield assuming layered backup materials have not been compromised.  During ascent an on orbit, the base shield is protected by the Service Module and an impact shield that is a part of it.  Delta Sprint, unlike Shuttle, can allow crew survival in the event of a complete guidance system failure (but not a complete electrical system failure, as electricity is still required to fire thrusters and ordinance.) Entry Safety Hardware Reinforced Carbon Carbon


Reinforced Carbon Carbon (RCC) is a remarkable material and undoubtedly the most effective reusable thermal protection to date.  Tests by the CAIB on 6 June and 7 July 2003 seem to indicate that when this material fails, it fails totally, very much unlike other materials used by the Shuttle.  RCC has been selected as the material for the Descent Modules base shield (tentatively, of course.)  Protecting this material from micrometeoroid and orbital debris (MMOD, by NASA) is an aluminum impact shield.  This impact shield also serves to protect the base shields integrity in the event of a high energy ascent failure where the heat shield is still required to protect the craft during the resulting entry.  Inspection and repair of this material on orbit is a requirement for the Shuttle by the CAIB and therefore for Delta Sprint.  To inspect the base shield, as mentioned earlier, the Service Module can be removed or swung out and the shield inspected by cameras. Tile


Tile as it is called in short, comes in three flavors: HRSI for High Temperature Reusable Surface Insulation, the black tile on the Shuttle.  It is being phased out in favor of the somewhat tougher FRCI, for Fibrous Refractory Composite Insulation.  The final flavor is LRSI, Low Temperature Reusable Surface Insulation, which was made obsolete by AFRSI.  So far, Delta Sprint does not use tile, although it may be needed after further analysis, FRCI would be used in this case.  Tile has proven remarkably robust in action, although not tough by any measure.  On Shuttle, a combination of boundary layer dynamics and simple thickness allows this material to take quite a bit of damage before a threat is posed. Advanced Flexible Reusable Surface Insulation


AFRSI (what stands for the title) is a flexible blanket material used on the Shuttles leeward, low temperature surfaces.  AFRSI is used on most of the Delta Sprints surface above the RCC.  AFRSI was not substantially tested by the failure of STS-107. Backup for the RCC


Delta Sprint intends to protect itself further from RCC damage by adding a layer of FRCI or AFRSI behind it where it does not attach to the structure.  The FRCI or AFRSI behind the RCC panel would be bonded to the structure using the methods employed by the Shuttle.  The goal is to provide for a 2.54cm (1 inch) hole anywhere in the RCC heatshield without heating the primary structure (of 2024 Aluminum) above 120 Centigrade on its outer surface and 80 Centigrade on the inner surface.  The rationale behind this much more stringent requirement (than Shuttle) is that there is far less isolation between the crew and the structure than there is on Shuttle, and the first thing that is found within the pressurized environment just past that 2024 Aluminum shell are lithium-ion batteries and the potable water supply.  Even barring any chance of structural failure, heating of these systems is highly undesirable.  If CAIB recommendations, especially including the ones regarding safety culture, are strictly followed, an entry failure resulting from RCC damage should never again occur.


An alternative to tile type Shuttle materials is ablatives.  Not being able to reuse the Descent Module in the event of RCC damage/repair is acceptable.  Reuse of the RCC material is the main motivation behind making the Descent Module reusable.  If the RCC is already damaged prior to landing, there is little point in building the Descent Modules backups to allow reuse. Recovery Guidance Failure Ballistic Recovery Mode


Delta Sprints angle-of-attack (alpha) is controlled by moving the center of gravity off center from the Descent Modules longitudinal axis.  Ballistic Recovery Mode is placing the center of gravity on the longitudinal axis, which is done for ascent (Angle of attack is 0 degrees base forward.)  Normal entries are configured for an angle of attack of approximately 3 degrees base forward (177 degrees by normal craft axes.)  The center of gravity is reconfigured by manually moving the batteries around hot-pluggable mounts and pumping grey water and potable water fluids among their various tanks in the base of the Descent Module. Dangers of Lifting Recovery Mode and Guidance Failure


In the normal Lifting Recovery Mode, designed to give the craft a degree of crossrange and load limiting ability, can be dangerous in the case of a guidance failure if the craft is rolled over (75-180 degrees).  The dangers of entering in a Lifting Recovery Mode were graphically demonstrated to Terry Wilson when he mistakenly entered a Gemini spacecraft in a heads-up attitude in Orbiter.  This is also what happened to Kevin Bacon (as Jack Swigert) in the Apollo 13 movie where he burnt up the spacecraft by attempting the fly it upside down.  Clearly such attitudes need to be avoided in the event of a post-deorbit guidance failure on Delta Sprint. Manually Controlled Descents


If entry is manually controlled without guidance, this can be accomplished by either  camera view or by window view.  A camera would allow the roll angle to be controlled, while a window controlled entry would fix the roll angle at a safe value likely to target the Delta Sprint to a recovery in either the Atlantic Ocean or the Gulf of Mexico in pre-calculated (and broad) landing fields.  This roll angle would depend on window placement, scales placed on the window, and possibly the height of the pilot (a variable due to certain physiological effects of microgravity exposure.)  Correct pitch and yaw angles are attained by using one or more small ion sensors, which would project an atmospheric prograde indicator on the piloting control panel.  A backup ion attitude indicator can be provided in the crew caddy to allow the crew to verify attitude against guidance predictions and also to control the craft in the event of a guidance failure (one guidance failure mode is a failure of the liquid crystal display (LCD) units the crew uses, backup control modes should not rely on these.) Manually Controlled Deorbits


If guidance fails beyond repair while on orbit, the crew would reconfigure the center-of-gravity to a Ballistic Recovery Mode.  As the Deorbit motor and possibly translation thrusters do not gimbal (assuming Ballistic Recovery Mode mass configuration is maintained through rendezvous) deorbit guidance is required to maintain attitude using pitch thrusters, as the thrust axes would not be aligned with the center of gravity.  Additionally, reconfiguring for Ballistic Recovery eliminates the roll issues discussed above in


Attitude for the deorbit burn is attained via the aforementioned ion stream sensors, confirmed by a quick look out the windows and/or cameras to make sure that the clouds and terrain features are passing beneath towards the nose of the craft.  If a straight retrograde burn from the solid motor leads to an entry too steep, which would overload the crafts thermal protection or structure, then the main translation thrusters can either deorbit the craft, or raise the orbit so that using the deorbit motor leads to an acceptable entry angle.  (Under normal circumstances, guidance would command a yaw. Resulting groundtrack errors from the landing field are compensated for by crossrange maneuvers and orbit phase planning.)


The procedure for actually firing the deorbit motor uses the deorbit motor arming key (Retro key).  The key has three positions: Safe, which means isolates the motor from the guidance system, Arm, which connects the firing circuit to the guidance system, and allows the guidance system to fire the motor automatically, and Fire, which closes the firing circuit, allowing the crew to fire the motor manually.  Normally, there is a block which does not allow the key to be turned to Fire by accident.  This block is removed for manual firing.  To manually fire the motor, the key is turned to Arm, and then pushed down.  Pushing the key down connects the firing capacitor (PIC for pyrotechnic initiating capacitor) to spacecraft power.  This capacitor must be charged before the motor can be fired (turning the key to Fire without charging the capacitor first wont fire the motor.)  Once the capacitor is charged, turning the key to Fire fires the motor, while turning the key to Safe shorts the capacitor through a resistor to discharge it, making the system safe.  An additional safety feature to prevent accidental firing of the motor on the launch pad is a connection to the Operation Safety Managers console.  To arm the motor, the crew positions the Retro Key to Arm, and the Safety Manager sends a signal to open a servo connection which then arms the motor.  This connection remains closed for the rest of the mission, even if the Retro Key is at Safe (the keys own circuit is open.) Landing System/Field Failure


Delta Sprint uses a layered approach to protect the crew from landing system failure, primarily as a concern for damage to landing systems resulting from thermal protection system damage or poor entry attitudes as a result of guidance failures.  These sorts of failures were not illustrated by STS-107, but were illustrated by Vladimir Komarovs catastrophic parachute failure aboard Soyuz 1 on 24 April 1967, in which he was killed when his spacecraft crashed at over 200 knots.  The parachute failure was caused by a bad entry attitude, which in turn was caused by a guidance failure prior to the deorbit burn.


Prior to a bailout condition, all backup systems and modes concentrate around the preservation of the Descent Module primary structure, the failure of which means certain and immediate death of the crew.  This situation decouples prior to landing at subsonic conditions below 12,000m altitude when it is possible for the crew to bailout of the spacecraft. Delta Sprints systems are ordered in chronological order of the phases of flight in which they are most useful.  It is not helpful to list modes in this report because there are too many to list and in the event of an actual failure, Delta Sprint may follow an unpredicted failure track anyway. Reserve Parachute(s)


A round parachute system backing up the parasol system, possibly with reefed modes to ease loading on the spacecraft frame, is used in the event the main parasol fails to deploy properly or needs to be jettisoned.  The resulting landing would be inaccurate, but in the area around the landing field.  For both the parasol and reserve parachute system, the weakest point structurally will be in the connection between the shroud lines and the spacecraft structure, so that in the event of an overload, the Descent Module breaks free and free falls intact, rather than coming apart. Crew Egress Hatches


The Delta Sprint Descent Module has large prominent hatches with structural joints and oversized separation ordinance charges.  They open on their hinges forward so that if opened manually, like the backward opening suicide doors rarely seen on cars, the airstream will tear the hatch off its hinges so that it is no longer an obstacle to bailout.  The ordinance charges are provided in the event that the hatches are thermally distended and expanded into their openings requiring extra force to get them loose (this resulting from perhaps a failure of the AFRSI on the hatch or the outer seal during entry, or a sideways entry attitude.)  There is one hatch on each side of the Descent Module.  The hatches are oval shaped, about 75cm wide by 1m high.  They carry some of the spacecraft loads above normal gravity but need to be relieved of load to allow them to open up to 1.25g.  Blowing the hatches while loaded will result in the structural failure of the Descent Module and the death of the crew. Crew Personal Parachutes and Bailout Procedures


The equipment is similar to crew equipment already used on Shuttle, and the procedures are analogous to the slidepole method implemented during the STS-33 Challenger stand down.  The spacecraft side hatches are opened or blown, and the crew exit the craft.  After allowing the Descent Module to clear, the crew open their personal parachutes and land on those in the manner of ordinary skydivers. Single Use Impact Cushions


Similar to impact cushions used in Apollo and modern construction hard hats, these are built into the seat mounting struts and crush when overloaded.  They are intended to minimize crew injury if the Descent Module should land without its landing bags when coupled with a procedure for crew members to adopt an optimum landing posture. Water Landing Floatation and Egress


The landing bag system cannot be used as a floatation system because they deflate to cushion the landing impact.  The craft should be ballasted so that one of the hatches (possibly the nose docking hatch and docking doors) are above the water when the crew exit the vehicle so that the craft does not flood during crew egress (a lesson learned from Liberty Bell 7 flown by Gus Grissom.) Post Landing Survival Kit


Training, a kit including a small amount of oxygen and food, water purification tablets, pressure suit and personal floatation device, fire starting kit, and procedures manual can be provided for crew survival.  Signalling devices can include an emergency locator beacon, handheld radios or satellite phone, and signal flares.  The material used in the Descent Modules landing bag and parachutes should be brightly colored to aid recovery, and patterned to aid landing range photography during normal landings.  Kits which allow Descent Module materials to be used in the construction of a shelter are also desirable.


4.1.4 In Mission Emergencies


Delta Sprint, as a space station lifeboat, has a requirement for accomodating failures in its target, such as pressure loss, atmospheric contamination (smoke, etc.) if a decision to abandon the station is made as an emergency progresses. Hazardous System and Materials Location


As much as possible, for the complementary purposes of in-flight safety, ground safety, and on-orbit serviceability, as many of the hazardous fluids and systems as possible are located in the Service Module.  Only those hazardous systems which are part of life support or are needed for descent are contained in the Descent Module.


Descent Module Hazardous Systems:

a) Descent Module Reaction Control System (DMRCS)

b) Cabin Pressure Recovery System

c) Electrical System (including Lithium-Ion and Lithium Thionyl Chloride batteries.)

d) Smoke Detectors (radioactive material)

e) Hatch and Latch emergency separation ordnance

f) Solid state life support components (reactive material)


Service Module Hazardous Systems:

a) Deorbit Motor (currently Star 20B)

b) Orbital Maneuvering System (OMS)

c) Service Module Reaction Control System (SMRCS)

d) Lithium Thionyl Chloride batteries for emergency power.

e) Ascent abort separation ordnance

(there may be some small amounts of radioactive material associated with sensors.) Descent Module Fire


Delta Sprint uses lithium hydroxide and lithium perchlorate in its life support systems, both highly reactive materials.  These materials are located in fire resistant racks which can be isolated from the cabin atmosphere and vented into the vacuum of space.  There are two such racks containing life support systems to provide fail-safe redundancy. Deorbit Motor Failure


The currently selected deorbit motor is the ATK Star 20B.  Two types of deorbit motor failure are possible: catastrophic and non-catastrophic.  A non-catastrophic failure is simply that the motor does not fire.  A catastrophic failure is that the motor fires incorrectly or explodes.  In the event of a non-catastrophic failure, the main thrusters are used for Deorbit.  If the motor fails catastrophically, the main thrusters and other propulsive resources in the Service Module may not be available.  The DMRCS may be used to make the resulting deorbit trajectory a bit safer, but if the resulting orbit does not enter the atmosphere, the crew may be stranded on orbit.  Any catastrophic failure of the deorbit motor will be counted as not being survivable for safety analyses.  Deorbit motor failure is not likely without a previous event to damage the motor or firing circuit, resulting in a combination failure. Docking Door Problems


In the event that the docking doors are damaged and/or fail to close after undocking, backup ordinance is used to jettison the doors at their hinges.  Enough thermal protection is provided beneath the docking doors to allow a single use entry at normal entry attitudes for Lifting and Ballistic Recovery Modes.  The Descent Modules thermal protection has less margin for attitude errors however, making a combination failure more dangerous.  Systems mounted to the doors, such as the docking radar and cameras, would be lost, making docking for the Delta Sprint more difficult and risky (i.e. rescue mode.) Space Station Depressurization/Fire


In the case of a rapid space station depressurization, possibly resulting from a collision or fire, Delta Sprint would automatically power up when a station alarm signal is sent to it, its cabin pressure sensors sense a significant decrease in cabin pressure, or smoke/toxin detectors detect toxic combustion products or other contaminants (the cabin is normally open to the station atmosphere.)  The crew, as it enters the Delta Sprint spacecraft during such an emergency, may be suffering from hypoxia or toxicity induced psychosis and depressurization sickness (the bends) related to the emergency.  They may be incapacitated in fine motor and cognitive ability and unable to power up the spacecraft themselves.  A Delta Sprint automatic sequence detects cabin pressure loss or fire and opens a small life support pressurant valve to guarantee a positive pressure between the spacecraft and the space station.  This will cause the docking hatch to seal when it is closed by the crew from inside the spacecraft.  After detecting hatch closure the Delta Sprint will activate a repressurization/contaminant clearing automatic sequence.  Undocking and recovery functions are not automatic and the spacecraft will remain docked to the station.  If the station is venting and in an erratic attitude, undocking may be tricky and need to be a planned and deliberate maneuver to prevent a collision between the spacecraft and tumbling space station after undocking.  After undocking, other sections of Chapter 4 become applicable to the solo Delta Sprint.


Further information on Descent Module guidance and non-hazardous systems is available in Chapter 5.1


4.2 Alternatives


The primary recovery modes are applicable to all of Delta Sprint and Delta Sprint IIs ballistic options.  Other, aerodynamic options are less robust and may affect the applicability a great deal of backup recovery options.


4.2.1 Aerodynamic Planforms and Total Guidance Failure


It is impossible to enter Shuttle to a bailout condition with a complete failure of guidance and impossible to guarantee a runway or other survivable landing with a failure of primary guidance, with the crew flying the Shuttle on the Backup Flight System, although they should be able to fly the Shuttle to a survivable bailout environment.  The only known in flight guidance glitches occurred as a result of combination failures during the breakup of Columbia and those would not have lead to complete loss of guidance if they were to occur under more favorable circumstances.  This, combined with experience in more conventional fields of aviation, show that it is possible to have a guidance system reliable enough that its failure need not be considered in spacecraft design.  Due to other effects of using single use launch vehicles and the likelihood of complex interactions of space station failure with the spacecraft available for evacuation (i.e. a sudden emergency might not have entry software available for Delta Sprint), it is prudent for Delta Sprint to consider total guidance failure in its design.


Applicability of is essentially nil in the X-38 Sprint option (see section 2.2.2.)

4.2.2 Alternate Recovery Options Ablative Thermal Protection

Ablative Thermal Protection materials, which vaporize and erode with use, are currently the baseline for Delta Sprint Planetary, and have been proven in the role of Delta Sprint Standard/Spartan as well via Mercury, Gemini, Apollo, Soyuz, and X-23 PRIME, providing a backup in case Shuttle Thermal Protection materials turn out to be inadequate for the Peak Loads Region of Delta Sprint or carrying ascent loads between the Service Module and Descent Module.  Falling back to ablatives is not desireable as they are much heavier than the Shuttle reusable materials.  Ablative thermal protection materials would also render Delta Sprint a single use spacecraft as they are, by their nature, a single use item. Parachutes

Apollo used three round parachutes, two of which were required for a safe water landing.  It may be possible to use a similar system for Delta Sprint if the parasol turns out to be undesirable. Contact Rockets

Soyuz uses a set of small rockets that fire just before contact with the ground.  This would be a viable, but trickier alternative to Delta Sprints landing bag system, and may be desirable for saving mass. Water Landing

The oceanic splashdown typical of Mercury, Gemini, and Apollo are not considered viable due to the requirement of ships and possibly helicopters to recover the spacecraft.  These assets have major operating costs associated with them.  Saltwater is also corrosive and would probably render Delta Sprint a single use spacecraft if reusable thermal protection materials are chosen.

However, if a small body of water, such as a lake or pond, were targeted, it might be possible to use small launches to tow the spacecraft to a dock, where it can be lifted out by a small crane.  It then would also be possible to land the craft in fresh (possibly treated) water, allowing reuse of the thermal protection system.  The parasol would most likely be required to hit a body of water sufficiently small to achieve these advantages (The Great Lakes would not be viable for a number of reasons.)

(c) 2004 After Columbia