# Failure to jettison the Apollo launch escape system

In Apollo, was there a contingency plan if the LES (Launch Escape System) failed to jettison? The BPC (Boost Protective Cover) would have prevented the parachutes deploying so the stack would have had to go into orbit, but once there what could the astronauts have done about it? With the BPC in place could they even have opened the Command Module hatch without blowing it open? Would that have meant they were unable to close it again?

From your question, I think you're describing an otherwise nominal mission where the launch escape system just doesn't seperate, but the booster is able to keep flying and put the spacecraft into orbit. There are two systems which could have failed:

• the bolts holding the launch tower and BPC in place
• the jettison motor to remove the tower + BPC

From the Apollo Experience Report - Launch Escape Subsystem (NTRS, Technical Note D-7083)

During a normal launch, jettison of the LES (fig. 1) was initiated manually. Normally, the tower-leg explosive bolts and the tower-jettison motor were ignited simultaneously. The LES and the boost protective cover were pulled out of the path of the oncoming launch vehicle. The lateral-separation maneuver ensured a minimum miss distance of 150 feet. For worst-case conditions, the LES could separate and avoid recontact with the launch vehicle. If the tower-jettison motor malfunctioned, the launch-escape motor could be used for the LES jettison without impairing the safety of the crewmen.

So it seems there was a override to fire the launch system itself to remove the cover+tower if the jettison motor didn't work. This was tested on AS-102/SA-7.

However, this doesn't explain what would happen if the bolts connecting the BPC/LES failed to fire, rather than the jettison motor failing. The solution to that seems to have been making the system very reliable, with redundant circuits and two independent charges per bolt, but the Apollo Operations Handbook is clear that there was only one method available here: "The TWR JETT switches are the only controls that will initiate the detonators of the frangible nuts" (section 2.9.4.8.4). I suppose this is ultimately the case for any system to seperate stages - if you can't add an alternative mechanism, you just make sure the one you have is very, very reliable. There is a good summary of the methods taken to make them reliable in "Apollo Spacecraft Pyrotechnics" (NTRS, NASA TM-X-58032).

But if it did happen? Looking at the Apollo 15 abort checklist, you'll see that if the tower failed to jettison (4-02), the crew were advised to run through all the sequence again and failing that, explicitly told to proceed to orbit. (There is no instruction given for what to do if the tower fails to jettison after being used in an abort - presumably there simply was no alternative at that point).

This suggests there was some consideration of what to do next, but it's not covered in the on-board guidance - there may well be some written process for what to do next, but I haven't found it. Presumably there was an assumption that they would at least be safe on orbit and that would give time to discuss the problem and consider next steps.

• Given how many of the Apollo folks came from the world of aircraft testing, "Gain altitude and buy us time to make a plan" sounds awfully familiar. Apr 21 at 19:36

Summary: There was no alternative to the launch escape system; it relied on redundancy and testing. But there were two ways to detach the LES.

There were two different mechanisms to separate the LES from the command module. During a normal flight, the frangible nuts connecting the legs of the LES to the CM would be detonated. During an emergency escape, the docking ring would be blown off -- the same mechanism used to separate the lunar module at the moon prior to discarding it. Source: Apollo Experience Report: Spacecraft Pyrotechnic Systems, NASA Tech Note D-7141, p. 8.

Although there was only one tower jettison motor, it had many redundancies. There were two exhaust nozzles, and there were two igniters:

The igniter assembly was ignited by means of redundant (two) pyrotechnic igniter cartridges.

Apollo Experience Report: Launch Escape Propulsion Subsystem, NASA Tech Note D-7083, p. 5

Even if that failed during a normal flight,

If the tower-jettison motor malfunctioned, the launch-escape motor could be used for the LES jettison without impairing the safety of the crewmen.

p. 6

The tower jettison motor was thoroughly tested:

The static-test-firing phase of the qualification-test program was conducted on 21 tower-jettison motors, including 15 motors that were tested environmentally.

p. 8

The even more than the 20 test firings of the launch escape motor itself! Two of these tests had an unacceptably long ignition time, but the problem was traced to an inadequate electric current in the testing apparatus, not a problem with the motor itself.

Finally, the entire LES was tested with two pad abort simulations (PA-1 and PA-2), plus four flights (A-001 to A-004) of the Little Joe II -- a rocket designed specifically to test the LES. Tower jettison was also tested on two Saturn booster test flights with a boilerplate command module (AS-101 and AS-102), plus four Apollo tests flights with an actual but uncrewed command module (AS-201, AS-202, Apollo 4, Apollo 6).

the stack would have had to go into orbit, but once there what
could the astronauts have done about it?


The LES is jettisoned shortly after the Saturn V second stage is ignited. It is simply not powerful enough to get the spacecraft to orbit, even if you waited until the last second.

With the BPC in place could they even have opened the Command Module
hatch without blowing it open? Would that have meant they were unable
to close it again?


The portion of the boost protective cover which went over the hatch was the "hatch panel". It was hinged, attached to the hatch, and opened and closed with the hatch. There would be no problem opening or closing the hatch with the hatch panel in place.

The hatch panel covers the CM hatch and is made of fiberglass honeycomb sandwich material with a layer of Armalon bonded to the inside surface. A window permits crew visibility from inside the CM.

Apollo Experience Report: Spacecraft Structure Subsystem, NASA Tech Note D-7780, p. 5

If you're thinking about the astronauts individually parachuting from the capsule, that was never considered. Nor would there have been time to do so, nor would it be practical in their spacesuits. No other alternative to the LES was devised.

I suppose one can always design a scenario which is not survivable. However, the Apollo launch escape system was arguably the most thoroughly tested and reliable escape system of any spacecraft.

• (Sorry, I don't know how to quote a portion of the reply.) I wasn't talking about the LES taking the spacecraft into orbit; I was picturing a normal launch except that the LES didn't jettison; thus the S-II and S-IVB would have performed as usual. Nor was I thinking about the astronauts parachuting back; my hatch question pictured them performing an EVA to somehow release the LES manually. Oct 30 '20 at 13:48