The Apollo Parachute Landing System

8/7/2019 The Apollo Parachute Landing System

1/28

NOAT_,,'r,_P VEI!TURA

TP-131

THE APOLLO PARACHUTE ]._NDING SYSTEM

{NASA-CR-131200) TIE APOLLO PARACHUTELANDING SYSTEM (Northrop Ventura Corp.,Newbury Park, Calif.) 28 p H73-71907

__ Inclas !. _IU0/99 65643 ' _/

T. "_V. KnackeNorthrop Ventura

f

Paper Presented at theAIAA SECOND AEROD'fNAMIC

DECELERATOR SYSTEMS CONFERENCE

El Centro, California

September 1968

This Paper summarizes the work of a dedicated group ofpersonnel from NASA MSC, North American Rockwelland Northrop Ventura.


2/28

NORTHROP VE;TrURA

INTRODUCTION "o

The "Apollo Parachute Landing System" today is probabily themost advanced, most thoroughly engineered and most thoroughly testedparachute system in existence. It stabilizes and decelerates the Apollocommand module after the mission is completed to a descent velocitysuitable for water landing. In addition it provides, together with the LaunchEscape System, the means for safely landing the Apollo crew for allmission abort cases prior to obtaining orbit. The Apollo parachute systemdoes not establish any records in recovered weight, velocity, or altitudeof parachute deployment. However, the unique systems engineeringapproach and the extensive utilization of reliability and systems analysiscombined with advanced design and testing methods have created an out-standing redundant man-rated system capable of safely landing the Apollocrew from pre-lift-off to completed missions.

The system approach started with a design concept that defined aiilandings including normal landing after completed mission and missionabort landings as operational cases and established the ground rule that nosingle component failure should cause loss of crew or mission failure.This somewhe, arbitrary approach was replaced, as the development ofthe parachute system progressed, with a probability approach to the mostor least likeable combinations of parallel or series functions and failuresof components and subsystems. It ruled out those cases that had anextremely low probability of occurrence and required development andtesting _f those combinations with a probability of occurrence above a"significant" level related to total mission reliability. This methodprovided a tlearly defined system reliability approach, and permitted theestablishment of logical design criteria. The resulting parachute systemwas able to cope with the considerable command module weight increasescaused by normal design changes and the added safety measures dictated


3/28

NORTHROP VENTURA

by the command module fire. Landing after completed lunar mission isprimarily a problem of reliability but not of high performance requirements.All limit design cases of high dynamic pressures, large command moduleoscillations and high loads are the result of abort cases, in particular,high altitude abort and pad abort.

The Apollo spacecraft and the subsystems involved in parachutelandings are shown in Figure I and include the Apollo Command Module(CM), the Launch Escape System (LES) with canards and pitch-over controlmotors (PCM}, the boost protection cover (BTC),and the apex cover orforward heat shield. The latter protects the parachute system locatedoutside the crew compartment in the upper part of the command modulearound the LEM adapter docking tunnel.

LAUNCH ESCAPE

BOOST PROTECTIVE COVER

APEX COVER,

COMMAND MODULE

SERVICE MODULE

5-VB

364 FT

Figure I. The Apollo Spacecraft

2


4/28

_ORTHROPVI_'_TURA

The subsequent paragraphs of this report discuss recovery modes,the approach to systems reliability, design criterias based on failureprobability, new approaches to testing of the parachute system, series andparallel redundancy of vital components, and other interesting designdetails.

RECOVERY CONCEPT

The parachute landing system must assure safe landing for twoprimary landing modes: (a) landing after completed mission; and (b) landingsby means of the launch escape system (LES) from the time the Apollo crewis in the spacecraft prior to take-off to approximately 300, 000 feet aftersecond stage booster ignition. Above 300, 000 feet normal landings canbe performed by the Apollo Command and Service Module (CSM) withoutthe launch escape system.

Landings after mission abort involve special problems dependentupon the altitude at which abort takes place: (a) Pad-Abort causes extensivethree axis spacecraft motions at parachute deployment and poses stringentminimum altitude requirementsi (b) medium altitude abort involves complexsequencing modes; and (c) high altitude abort results in maximum dynamicpressures and parachute loads.

The selected emergency escape concept is similar to the Mercuryspacecraft emergency landing system. It consists of a launch escapesystem (LES) that provides the command module with safe vertical andhorizontal separation from the booster or the booster-fireball and assuressufficient altitude for proper, sequential parachute deployment. The sizeof the fireball, in case of an on-the-pad-emergency eliminates the ejectionseat approach used on the Gemini spacecraft.

Early in the program, it was decided to establish the same relia-bility requirements for normal and abort mission landings. This creates

3


5/28

NORTHROP VENTURA

the need of sufficient time for failure sensing and for obtaining adequatealtitude for the deployment of a back-up parachute system in case of amalfunctioning primary system. The latter is especially difficult whenone considers the necessary thrust and time required to cope with abooster tilt-over pad-abort emergency.

It may be of interest to mention here that only four man-ratedsystems exist which use the parachute as the primary means of transpor-tation. These are, besides the Apollo spacecraft, the parachute systemsfor the Mercury and Gemini spacecrafts and the paratrooper parachute.All of these systems use the primary and back-up parachute concept.

PARACHUTE SYSTEM

The final parachute system selected for the Apollo command moduleis shown in Figure 2. Two ribbon drogue parachutes accomplish initialdeceleration and stabilization, with only one parachute being required andthe second parachute providing the back-up mode. Deploying both para-chutes simultaneously eliminates the need for an emergency sensor,

provides for faster CM stabilization and creates more favorable mainparachute deplo)rment conditions. After disconnect the two drogue para-chutes are followed by three pilot parachute deployed Ringsail mainparachutes; two of which will provide the rate of descent necessary forwater landing. A detailed analysis of the probability of two simultaneousmain parachute failures eliminated the necessity for a fourth main para-chute. Again deploying all three parachutes precludes the need for afailure sensor, saves time and altitude and establishes more favorable

landing conditions.

The selection of the particular parachutes is based on general per-formance characteristics as well as on the successful use of these para-

chute types for the Gemini and Mercury parachute landing systems.

4


6/28

NORTHROP V1Er|llJRA

Back -up

l_oEue _.IP.-- IZZ

Chute

t _ _

\ L\l

\

Zqo _ \ ]TO_I_\

16.5-gt-Dia. ConicalRibbon ParachuteOne-Step Re_fi_g

TextileRiser

4-PLySleel Cabte

DROGUE CHUTEASSEMBLY

" Ring SlolI I PiIot Chul*l

Texlile Rtser

' 1-} "_Deploymenl _ g..L _ HI I I Single Steel Cable

"- R_ngaail ParachuteZ-Step Reefing

" 1494

1-_--_.._____ g-Ply Sleel Cable

MAIN P a.R ACHUTEASSF M B LIES

Figure 2. The Apollo Parachute System

NORMAL PARACHUTE DEPLOYMENT

The parachute deployment sequence for landing after completedmission is shown in Figure 3. The recovery sequence starts with the turningoff of the reaction control system and with the ejection of the apex cover atan altitude of 25,000 feet. A 7.2 foot diameter ringslot parachute is usedto support apex cover removal and to prevent recontact between cover andcommand module. The two drogue parachutes are mortar ejected, theindividual attach points provide for a command module hang angle of Z9.5degrees. At I0,000 feet the drogue parachutes are disconnected byordnance cutters and three pilot parachutes are mortar deployed simulta-neously at 90 degrees to the command module vertical; these pilot para-Chutes in turn extract the three main parachutes. The deployment sequenceis controlled by a fully automatic redundant sequencing system with a manualoverride mode available as back-up system at the astronauts discretion.

5


7/28

NORTHROPVENTURA

' "I""

_, .... " F"

, f

/1

!Three Main Plr_chutesExtrlcted by MortarDep|ol'ed Piloz Chatel

Rate of DelcentVv -- 29 ft/.ec

]_eeftd in Two Stepz

iDroEue Chule sDisconnectedThree PilotChules Mor_]rDeployedAlt tude _10, 000 ft

/ I\ , J

T_o DroKue ChuZes

I

i

lApex Co, er Eiected 5tart Of

Mort ar Dep loy ed At by l:Z'yroThr_er _eco_eryT }.6Sec and 7.2-ff-dfa.

Rin_ ._loz ParJchute Allitude: 25. 000 r_Time, 0 .e Velocity: 0.7 Mach

Figure 3. Normal Landing Sequence

ABORT PARACHUTE DEPLOYMENT SEQUENCE

The abort parachute deployment sequences are illustrated inFigure 4. This mode is operational from prior to launch to an altitude ofapproximately 300, 000 feet. Upon abort command the launch escape motorfires and lifts ;:heCM off the Saturn booster. The pitch over motor andthe canards provide horizontal separation, CM turn-around, and a limiteddegree of stability. Fourteen seconds after CM lift-off, the escape tower,boost protection cover, and docking probe separate followed by the timeor altitude controlled parachute deployment sequence depending on thealtitude of recovery initiation. The primary control again is provided bythe automatic redundant sequencing system with an astronaut controlledoverride mode available as back-up. The astronaut, on pad or low altitudeabort, can select to override the drogue parachutes and to deploy the mainparachutes immediately as long as the dynamic pressure and the altitudeare within the allowable main parachute deployment limits.

6


8/28

HORTHROPVENTURA

H IGH ALT ITUDE A_ORT

ClnardlAbort |1 Sec

_'ct Tower

BPC + Dockln|ProbeT_me ]4 Sec

Deploy C_n_ rds|I ._.ec

/

Eject IAunch EJCUpe

*

Dllconn_-ct _ '

LOW ALTITUDE ABORT \_

Figure 4. Abort Landing Sequences

PARACHUTE DEPLOYMENT ENVELOPE

The operational parachute deployment envelope defines the twoprimary regions of drogue parachute and main parachute deployment, see

Figure 5. At the final phase of a completed mission the command moduleafter reentry, descends in stable attitude. At an altitude of approximately25,000 feet and below 124 psf an automatic sequencing system deploys thetwo drogue parachutes (normal reentry region in Figure 5). The astronautmay deploy the drogue parachutes up to 40, 000 feet altitude if flight con-ditions make it advisable to do so.

In case of high altitude abort command module motions can result

in dynamic pressures as high as 204 psf; this precludes manual deploymentof the drogue parachutes above 25,000 feet. Pad abort and low or mediumaltitude abort require parachute deployment at altitudes as low as 3, 000feet at dynamic pressures in the I0 to 100 psf range.


9/28

NOilTHROPVErIIUR._

I0

A LTTTUD'_(1000 FT)

Z0

q = _I PSF/

DE P [ ,O Y _,| ENT EN v-_ I _'PEq " IZ4 PF;F

IIIP, II A 1 .TIT Ui3F_AR_RT R IF'C;T(3N

D;K P lmOYb.l EN T I _"

O R_ .{ AI . I KN TR Y RKC, IC)"C

Z /zz.,',, .. a

I I | [ I i J0.! O.Z 0.1 0.4 0.'_ 0.6 0.7

M ACH ,_0.

Figure 5. Parachute Deployment Envelope

The main parachute deployment region is defined by the cross-hatched area in Figure 5. Automatic simultaneous disconnect of the twodrogue parachutes and deployment of the three main parachutes by meansof mortar ejected pilot parachutes occurs at ll,000 feet. Main parachute

deployment by automatic control may occur in abort cases between 10, 000to 18,000 feet dje to aneroid sensor lag and ascent and descent hysteresis.

It is interesting to note that during the interval from drogue para-chute disconnect to main parachute canopy stretch a dynamic pressureincrease of Z0 psf can occur in vertical descent.

The command module during reentry is stabilized by a redundantreaction control system (RCS). Use of a chemically active fuel preventsuse of the RCS after parachute deployment. Lack of RCS stabilizationduring abort causes command module motions in pitch, roll and yaw.This complicates parachute deployment, causes nonsynchronous mainparachute deployment and opening, and increases individual parachute loads.All these conditions were considered in determining parachute deploymentand load condition.

8


10/28

t"lORTltROP V1EI_URA

SYSTEM APPROACH

A qualitative system analysis at the start of the Apollo programdefined a parachute system consisting of one drogue parachute and twomain parachutes as the primary system for successful normal landing.A second drogue parachute and a third main parachute, formed a back-upreserve that permitted failure of one drogue and/or one main parachutewithout loss of crew or command modules. Potential single point failures

within the recovery system were to be avoided to the maximum possibleextent. A minimum factor of safety of 1.35 was defined for all componentsand parachute stages.

This design rule concept was supplemented as the project progressedby a statistical approach to the probability of occurrences of single andmultiple parallel and series failures. An extensive reliability analysiswas performed that i'ncluded mission abort, sequencing failures, parachuteand component failures, command module attitude and motions at parachutedeployment, pyro-mechanical failures due to premature action as well asdue to lag of action, aerodynamic interference between parachutes, etc.This system reliability assessment utilized a computerized mathematicalmodel that included sensitivity studies, calculations of the reliabilitycontributed by all components and subassemblies to the system and areliability apportionment for the parachute subsystem.

A flight mode probability analysis concluded that cases where asystem failure occurred with less than a "significant" probability neednot be considered as a design case. This probability analysis was appliedin a logical fashion by looking at each component, subassembly, and sub-system and considering:

What is its failure mode?Its probability of failure?

fIts test history?


11/28

f_ORTHROP I/IE_TVRA

Its complexity ?Can it be inspected and checked?Gan its failure or impending failure be detected?Is it active (relay, ordnance, etc.) or passive (structure)?

Table 1 shows a typical probability analysis for actual flight modesof which 12 different modes were investigated. Similar approaches wereused to analyze various parachute cluster deployment modes shown inFigure 6. The superiority of a parachute cluster with independently deployedparachutes (system I) in comparison to the more conventional deploymentapproaches, systems II and Ill, is obvious.

Table I. Probability of Parachute Load and Failure Occurrence

FlightM,Jde

t(1)

No, ofPdr_chutPn

n r) _M

_O SM

ID 2M

ID _M

ZD ZM

ZD ]M

k_fa i . P ar ac hu te_-_s,_ z.,_--_.-iR_,ered Ree f('d ]

_ZK. nn _Z_ nn.!I

> zl.oonl>_.onn> Z_.,'_oo < Z_ onn!

< Z _,0001< t. _, n_Oi

< ZK 000 < Z t nllo

< ,%_,OnO < _ +,.non

C,,_menl

I",,HII I.ad ismarginal

(]] Flli_h! Mode h HiKh allit,lde ab:,rl, mlx|mul'_ _vnarfl_ _r_l_l?_ g, rlrnQlle discnnnec! and main par_rh,,r*deplovmen! al unravnrable CM allihld


12/28

NORTHROP VEHTURA

._v[N i

ii ,_l. ,fT.._ T

J_' %, 'c

L._ 11

rret_ w_r tewP_E_T e.e_uw

Figure 6. Reliability Comparison of Parachute Cluster Systems

DESIGN CRITERIA

The results of this probability analysis were then used to establishground rules and design criteria with each case jointly agreed upon withthe prime contractor North American Rockwell Corporation and NASAMSC, the responsible Government agency. Following design rules andcriteria are being applied:

l) All mission aborts are operational modes.

2) The primary system consists of a single drogueparachute and two main parachutes with a redundantdrogue parachute and a redundant main parachuteserving as back-up.

3) No single component failure shall cause loss of crewor mission.

ll


13/28

NORTHF_OP VE_TURA

4) The probability of occurrence of parallel failuressuch as loss of two drogue parachutes shall beminimized to the maximum extent possible.Failures such as loss of one drogue parachuteand one main parachute are to be considered.

s) The total parachute landing system reliability mustbe equal to or better than 0. 99994.6) Components or assemblies that control active functions

such as ordnance devices, aneroids or relays must bedesigned for prevention of premature functioning aswell as nonfunctioning.

7} A minimum factor of safety of 1.35 must be provenfor all structural components and parachute loadstages in ultimate load tests.

s) All parachutes shall be independently deployed andshall utilize active deployment means.

DESIGN LOADS

An analysis of the parachute deployment envelope and of the designcriteria indicates that the maximum drogue parachute and main parachutedesign loads do not occur at normal reentry but at abort conditions com-bined with other failure modes.

The probability analysis described previously determined thatfollowing combinations, of events, component failures and anomalies pro-duced the maximum drogue parachute design loads:

High altitude abortOne drogue parachuteUnfavorable command module attitude and motions atdrogue parachute deployment.

12


14/28

NORT_fROP VENTUFLA

The maximum main parachute design loads are produced byfollowing combinations :

High altitude abort

Single drogue parachuteTwo main parachutesDifferential main parachute deployment due tounfavorable CM attitude at parachute extractionMaximum differential reefing cutter timeAerodynamic blanketing between reefed parachutesresulting in a lag and lead parachute condition.

These combinations not only affect the reefed parachute load butall subsequent load stages as well. The maximum loads of the reefeddrogue and main parachutes are not caused by the same combination ofevents; this necessitates an extensive analysis and mutual agreementsamong all agencies involved. It may be mentioned here that as soon ascommand module motions in three axes become important a six-degree-of-freedom computer program is desirable for determining maximumdesign loads. Figure 7 shows the calculated parachute loads occurring atnormal reentry, the maximum calculated "design loads" based on acombination of anfavorable events and the ultimate load calculated to be

1.35 times the design load.

A requirement, new in parachute development, is the need forproving in tests that all parachute stages will withstand the ultimate loadof i. 35 times the design load.

Actual ultimate load test points are shown in Figure 7 to documentcompliance with the stringent test requirements.

13


15/28

F.'GRTHROPVENTI_RA

0/ o\,01_ /r% "" _ ._oh ."/ "R /_,/J " _"/ \ 0 o/ _- -_ Ri' / , ,,- /\o,,/I _ / / -%, .---UL"_rMATE t.n,DS

2OTi / /h . _ / ro / % H,C,H*L''TUOEAeORT'Tokg_:0":i_TE li_ / / / .oc,,MP,I% // /t_ /. /

r

'o Ill oMAIN DROCU_ 0 SUCCESSFUL TEST

PARACHUTE CHUTE DC DROGUE C]IUTEMP MAIN pARACHUTE

100 ZOO 100DYNAMIC "PR 'ES_UBE q . PSF"

Figure 7. Drogue Parachute and Main Parachute Loads

DEVELOPMENT ANT') QI]Ai,TFTCATION TESTS

Testing of the Apollo parachute system introduces problems notnormally encountered in testing of parachute systems. The design limitloads for both the drogue parachute and the main parachute are calculatedvalues that cannot be obtained in aircraft drop testswith a free failingApollo command module test vehicle. Instrumented cylindrical testvehicles (ICTV) and a parachute test vehicle (PTV) that duplicated theApollo CM parachute deck but had a much smaller vehicle diameter weresubstituted. These test vehicles besides being more ec0nomical wereable to reach after aircraft drop velocities in vertical descent thatpermitted to obtain the design as well as ultimate parachute loads.

Test procedures were greatly complicated by the requirementsthat all components and parachute stages had to demonstrate a minimumfactor of safety of I. 35 in vertical tests and that component failures hadto be duplicated in tests.

14


16/28

NORi'HROlI VI[NTURA

Final qualification tests were conducted with spacecraft end itemhardware and a geometrically and dynamically similar Apollo boilerplatetest vehicle. Important operational modes and specific points of theparachute deployment envelope, see Figure 5, were selected as testconditions.

ICTV's and PTV's were dropped from B-52 and B-66 aircraft, amodified C-133 aircraft was used for dropping the boilerplate test vehicles.Single and multiple programmer parachutes established vertical trajec-tories and test conditions for individual parachute tests or consecutivetests of drogue and main parachutes at the same test mission. An Apolloboilerplate parachute test vehicle prior to and after test is shown inFigures 8 and 9.

Figure 8. Apollo Boilerplate Vehicle Ready for Test

15


17/28

NORTItRCP VE_ITU RA

Figure 9. Apollo Boilerplate Vehicle After Test

PARACHUTE LOAD TESTS

Design load and ultimate load tests were conducted with singleand multiple drogue parachutes and main parachutes using ICTV's and PTVtest vehicles. Ultimate loads of the first reefed parachute stage can beobtained by parachute deployment at a high dynamic pressure. Thisapproach fails to produce ultimate loads in subsequent reefed stages sincethe dynamic pressure at the end of the first reefing stage always approachesthe same value independent of the starting point. This problem was solvedby increasing the weight of the test vehicle, by decreasing the length ofthe reefing.tlme or by a combination of both methods.

It was found during these tests that the wake of the test vehiclehad a pronounced effect not only on the drag area of the drogue parachutein the wake of the forebody but surprisingly also on the dynamic load

16


18/28

N_RH_ROP VEI_IJRA

factor C K. This is indicated by the data in Figure I0 which shows forvarious test vehicles the drogue parachute drag areas, the dynamic load

factor C K and typical parachute force traces. The turbulent wake not onlydecreases the drag area but increases notably the load fluctuations andthus the dynamic load factor. These data have to be taken into account inorder to predict what loads obtained behind an ICTV or PTV are equivalentto load predictions for the command module.

It was impossible to predict parachute test loads with the desired accuracyof 5 percent. This requires not only proper load prediction methods butalso proper test conditions through programmer parachutes and timedelays, accurate on-board instrumentation measurements, and accuratemeteorological and range instrumentation data that can be coordinated withthe on-board telemetry measurements. It was found that the technologyof parachute testing requires notable improvements before test data canbe predicted, obtained, and evaluated with an accuracy approaching 5 per-cent.

]. 4

r.., nar_t I.ZL_cl

Factor ].CZ

Date post:	09-Apr-2018
Category:	Documents
Upload:	bob-andrepont
View:	243 times
Download:	2 times

The Apollo Parachute Landing System

Documents