Throughout its 30-year career, consciously or unconsciously, the space shuttle was acknowledged to be one of the most dangerous piloted space vehicles ever brought to operational status. Although its first four teams of astronauts had ejection seats, their usefulness and survivability were questioned from the outset, and from STS-5 and the increase in crew size their inclusion became so impractical that they were done away with. Little escape capability of substance was available until after the separation of the Solid Rocket Boosters (SRBs), two minutes into flight, and NASA engineers worried constantly about the dangers of a failure of the shuttle’s three main engines. On five occasions, between June 1984 and August 1994, a handful of shuttle crews heard over the intercom a four-letter acronym that shook them to the very core: RSLS, denoting a Redundant Set Launch Sequence, indicative of a harrowing engine shutdown on the pad, right before launch.
In those final seconds, the vehicle was at its most hazardous: fully-fueled, crewed, and ready to go. However, as the roar of the engines died, the astronauts were faced with two dire possibilities: to sit tight aboard the vehicle and await the arrival of recovery forces or to attempt a “Mode One Egress,” evacuating their ship, possibly running through an invisible blaze of hydrogen flames, and taking a series of slidewire baskets to safety. It was truly a devil’s bargain. This weekend’s history articles will explore the events of those five on-the-pad launch aborts and what they meant for the men and women who endured them.
“T-31 seconds … We have a Go for autosequence start … Discovery’s computers now taking over primary control of vehicle critical functions until liftoff … ”
The calm, measured tones of NASA commentator Mark Hess provided an assurance that shuttle launches had become the stuff of routine. It was 26 June 1984, and after a false start the previous day all seemed to be proceeding normally as the final seconds ticked away to the launch of Mission 41D, the maiden voyage of the new orbiter, Discovery. Strapped into the flight deck were astronauts Hank Hartsfield, Mike Coats, Mike Mullane, and Steve Hawley, whilst downstairs on the middeck were Judy Resnik and McDonnell Douglas engineer Charlie Walker, flying as part of a commercial contract with NASA. The crew arrived in Florida aboard a fleet of four T-38 jets on the afternoon of 22 June, with liftoff anticipated three days later. They circled over the launch complex and alighted on the runway of the Shuttle Landing Facility. Flying, relaxing, spending time with family members, and running through checklists consumed their final hours on the planet.
“ … T-15 seconds and counting … ”
Darkness still covered the Kennedy Space Center when the crew repeated the time-honored ritual in the small hours of the 26th. “The van starts out slowly,” Charlie Walker told the NASA oral historian of his journey to the pad. “We wind our way through the parking lot and out onto the access road to the pad. There’s this police escort, of course, in front of you, with lights flashing and everything, so you feel like you’re on top of the world already … Then we arrive out at the launch pad and, at the base of the pad, security waves you on. You don’t have to show all your badges and everything this time; they know who you are. At the bottom of the crawlerway, you can get the view … the first time we’d really seen it clearly without the rotating service structure around it and so it’s an awesome experience, knowing that you’re going to ride this thing into space and there’s your spaceship waiting for you out there. Go up the ramp, the police car leading the way, and you just get to the top of the ramp, and the thing that I noticed first was really different … was that there was like only one or two other people there. Now, every other time you’ve been out there, there’s dozens and dozens of people all around and conversation going on; but now it’s silent, except for the wind, maybe some seabirds now and then. As you get up closer to the vehicle, you begin to hear the vehicle. You begin to hear the Shuttle and the External Tank.” Months of training had reached their climax; they were really going to fly today.
“ … ten … We have a Go for main engine start … ”
The preparations proceeded remarkably smoothly for the second attempt. The countdown had moved crisply: built-in holds at T-20 minutes and T-9 minutes were passed and, at 8:39 a.m. EST, with five minutes to go, Mike Coats reached down and switched on Discovery’s three Auxiliary Power Units. The trio of hydraulic pumps hummed perfectly to life. “The meters showed good pressure,” recalled Mullane in his memoir, Riding Rockets. “Discovery now had muscle.” The computers automatically commanded a final series of checks of the main engines and the elevons on the wings. With two minutes to go, the astronauts closed their visors. Hartsfield shook Coats’ hand and wished them all good luck, reminding them to keep their eyes focused on the instruments. Thirty-one seconds before liftoff, the ground launch sequencer handed over control of the countdown to the shuttle’s computers. In the darkened middeck, Resnik and Walker clasped hands. The Solid Rocket Boosters underwent their final nozzle steering checks, and at ten seconds a flurry of sparks from the hydrogen burn igniters gave way to a familiar low-pitched rumble.
“ … seven, six, five … we have main engine start … ”
Inside Discovery’s cabin, the astronauts felt the immense vibration as turbopumps awoke, liquid oxygen and liquid hydrogen flooded into the engines’ combustion chambers, and they roared to life … and then, suddenly and shockingly, were arrested by the blaring sound of the master alarm. Something had gone badly awry. Two of the main engines—No. 2 and No. 3, closest to the aft body flap—had blazed to life, but the No. 1 engine, directly at the “top” of the pyramid, had failed to ignite. “The vibrations were gone,” wrote Mullane. “The cockpit was as quiet as a crypt. Shadows waved across our seats as Discovery rocked back and forth on her hold-down bolts.” From the pilot’s seat, all Coats could hear was the screeching of disturbed seagulls outside. Two red lights on the instrument panel indicated that the Number Two and Three engines had indeed shut down, but the indicator for the Number One remained dark.
Instantly, Coats, whose responsibility as pilot was to monitor the engines during ascent, jabbed his finger repeatedly onto the button to shut it down. The status indicator did not change; it remained dark. Downstairs, Walker’s eyes were focused intently on the procedures for “Mode One Egress,” the instructions for opening the side hatch and evacuating the vehicle. Several miles away, on the roof of the Launch Control Center, the astronauts’ families were watching the unfolding drama … and they were perplexed. “A thick summer haze had obscured the launch pad,” wrote Mullane. “When the engines had ignited, a bright flash had momentarily penetrated that haze, strongly suggesting an explosion. As that fear had been rising in the minds of the families, the engine-start sound had finally hit … a brief roar.” The sound echoed off the walls of the Vehicle Assembly Building (VAB) and was gone. Within seconds, it became clear what had happened.
“ … we have a cutoff … we have an abort by the on-board computers of the orbiter Discovery … ”
Over the intercom, the astronauts heard the worrisome words “RSLS Abort,” meaning a “redundant set launch sequence.” This pointed inevitably to a main engine problem, which had forced their automatic shutdown by the General Purpose Computers. Intuitively, the crew knew that safeguards existed to prevent the SRBs from igniting—if that had happened, it would have killed them all—but they also knew that only a few seconds existed on the countdown clock. “A couple of seconds in the world of electronics is a lifetime,” said Mullane, “and I’m sure that all the safety devices had rotated to prevent [the solids] from igniting … but in the back of your mind, you’re thinking, ‘What happens if those ignite?’” The situation was by no means under control. As if the indication that the Number One might still be burning was not enough, Launch Control now told the crew that there was a fire on the pad and the suppression equipment had been activated.
The decision over whether to unstrap and make an emergency evacuation of the orbiter was now in the hands of Commander Hank Hartsfield. Downstairs on the middeck, Judy Resnik had unstrapped and was peering through the window in Discovery’s side hatch. She could see no fire. The astronauts would have to run across the access arm to a set of seven baskets which would whisk them from the pad to safety. Listening to the communication loop, Hartsfield elected to sit tight. It was a decision which probably saved their lives. Hydrogen burns “cleanly,” invisible to the human eye, and it had already begun to ignite combustible materials on the pad surface. Subsequent inspections would reveal scorched paint all the way up the launch pad structure, as far as the crew access arm. Years later, Walker would praise Hartsfield for not having ordered a Mode One Egress that day. In his conversations with the launch director after the abort, Hartsfield realized that a lot of doubt also existed over the reliability of the baskets, and that had informed their judgment to keep the crew aboard the orbiter.
At the press site, Mark Hess’ commentary continued: “We have an indication two of our fire detectors on the zero level; no response … They’re side by side, right next to the engine area … The engineer requested that we turn on the heat shield firewall screen between the engine valve and Discovery’s three main engines … ”
From the flight engineer’s seat, Steve Hawley injected a spark of humor into the proceedings. “Gee,” he said, in his thick Kansan drawl, “I thought we’d be a lot higher at MECO!”
There had been a Main Engine Cutoff, but not at the edge of space; Discovery remained firmly shackled to Earth. T-zero had not been reached and so the SRBs had not been commanded to ignite. Hawley’s joke “broke the ice and got everybody laughing,” said Mike Coats, but did little to dissipate a pervasive sense of gloom that their mission had been aborted just four seconds before liftoff. Gloom is often associated with bad weather and rain, and when the 41D crew finally saw the light of day and made their way out of the orbiter, they did so in a torrential downpour … not of rain, but of the waters of the fire suppression system. The entire gantry was soaked, drips from every pipe and platform, the white room ankle-deep in water. As Coats walked out of the elevator at the base of the pad, it was like walking underneath a waterfall. “We got completely soaked to the skin,” he explained years later. “Then we got in the astronaut van, which was air-conditioned and very cold. As we were driving away, there’s a window in the back of the van and all of us were looking back at the shuttle on the launch pad, shivering and soaking wet, like drowned rats.”
Hartsfield’s disappointed crew was exhausted. “After a launch abort,” Mullane told the NASA oral historian years later, “you could take a gun and point it right at somebody’s forehead, and they’re not even going to blink, because they don’t have any adrenaline left in them; it’s all been used up.” Mike Coats took his wife and children to Disney World, where, later that afternoon, they found themselves queuing for the Space Mountain ride. Replacement of the troublesome main engine would require a return to the VAB, and that prompted a delay until August at the earliest. After another postponement on the 29th, the maiden crew of Discovery finally set off on 30 August. It was an unfortunate prelude to the stellar, 39-flight career of NASA’s most-flown shuttle.
For Story Musgrave, the flight engineer on Challenger’s Mission 51F, his ascent to orbit on 29 July 1985, was arguably dramatic, when the shuttle suffered a hair-raising main engine shutdown 108 km above Earth … after already enduring its own RSLS abort on the pad, three weeks earlier. “The ground made the call ‘Limits to Inhibit’,” he recalled to a Smithsonian interviewer, years later, “which is, for us, an extremely serious omen, [because it] means the ground is seeing problems that are going to shut you down. I’m looking through the procedures book and thinking we’re going to land at our transoceanic abort site in Spain. I’m rehearsing all the steps and my hands are moving through the book and I’m thinking ‘We’re going to Spain. Things are bad!’”
The emergency, which occurred five minutes and 45 seconds after launch, arose when temperature readings for the No. 1 engine’s high pressure turbopump indicated “above” its maximum redline, prompting Challenger’s computers to shut down the engine. At this stage of the ascent—with just three minutes remaining to a nominal main engine cutoff (MECO)—the shuttle was too high and too fast to return to an emergency landing back at her launch site in Florida. This meant one of two things: either a Transoceanic Abort Landing (TAL) in Europe or a tricky maneuver known as an Abort To Orbit (ATO), whereby Challenger would burn her twin maneuvering engines to augment the two remaining main engines and limp into a low, but stable, orbit. Musgrave’s initial focus was upon the page of his checklist that dealt with requirements for a touchdown at Zaragoza Air Base—a joint-use military and civilian installation with a NATO-instrumented bombing range—in the autonomous region of Aragon, north-eastern Spain. Zaragoza had been designated a TAL site in 1983 and was assigned to 51F because the orbital inclination of 49.5 degrees placed it near the nominal ascent ground track, thus allowing the most efficient use of available main engine propellant and cross-range steering capability. As Musgrave flipped through the procedures that he would recite to Commander Gordon Fullerton and Pilot Roy Bridges for a diversion to Zaragoza, astronaut Karl Henize, seated to his right, was becoming nervous.
Henize had good reason for his nervousness. The TAL mode was the second available abort after the Return to Launch Site (RTLS) contingency option and encompassed the six-minute period from shortly after SRB separation until, theoretically, main engine cutoff. It utilized one of three landing sites—one in France and two in Spain—which provided emergency support for just-launched shuttles following orbital insertion inclinations between 28.5 and 57 degrees. Flight rules dictated that the TAL option would only be selected in the event of a premature main engine shutdown or other major malfunction—for example a significant cabin pressure leak or cooling system failure—which prevented the vehicle from continuing into space and completing at least one orbit. Had the command been given from Mission Control that day, Gordon Fullerton would have rotated the abort switch on his instrument panel in the TAL/AOA position and depressed the abort push button next to the selector switch; Challenger’s computers would then have automatically steered the spacecraft toward the plane of the European landing site.
“He didn’t know what was going on,” Musgrave said of Henize’s reaction during those seconds. “He looks over and sees the top of my page: SPAIN. He’s looking, poor Karl, and I’m going down the checklist that I’ll be reading to the guys in the front seats when we abort. Karl’s looking over at me and I sense a really severe stare. Then he dares ask: ‘Where we going, Story?’ I just looked at the top of the page and said ‘Spain, Karl.’ Then I quickly retracted it. ‘We’re close, but not yet.’”
Eventually, the call came from Mission Control: “Abort ATO; Abort ATO.” Challenger had achieved sufficient velocity and altitude to undertake the next available option: the Abort to Orbit. In fact, she had missed the closure of the TAL “window” by just 33 seconds! At 4:06:06 p.m. EST, some six minutes and six seconds into the ascent and hurtling towards space, Gordon Fullerton fired the OMS engines for 106 seconds, consuming a large quantity of much-needed propellant, but permitting the shuttle to continue into a lower-than-planned orbit. Two minutes later, at 4:08:13 p.m., the No. 3 main engine data indicated excessively high temperatures. If the “Limits to Inhibit” had not already been applied, the computer would have it shut down. The “inhibit” command effectively instructed the computers to ignore the over-temperature signals and prevented them from shutting down the No. 3 engine. The two remaining engines fired for an additional 49 seconds, shutting down nine minutes and 20 seconds after launch. “We never did get the call for the transoceanic emergency landing,” said Musgrave, “and we ended up making it to orbit and finishing the mission.”
This incident represented the only in-flight shutdown ever experienced by the shuttle, and it came as a surprise because all main engine parameters had been normal during the countdown, ignition sequence, and the first few minutes of the flight. At approximately two minutes into Challenger’s ascent, at about the same time as the SRBs were jettisoned, data from Channel A—one of two measurements of the Number One engine’s high pressure fuel turbopump discharge temperature—displayed characteristics indicative of the beginning of failure. Its measurement began to drift and, at three minutes and 41 seconds after launch, the Channel B sensor failed. However, its sibling continued to drift, approaching and then exceeding its own redline limit some five minutes and 43 seconds into the flight, which triggered the shutdown.
The high pressure fuel turbopump discharge temperature data from Channel B of the No. 3 engine, meanwhile, began to climb and passed its own redline just over eight minutes after liftoff. Measurements from its Channel A remained within prescribed limits and, said NASA’s post-mission report, all other operating parameters relating to the No. 2 and 3 engines were deemed normal. Post-mission analysis suggested that the problem was not with the No. 1 engine itself, but faulty sensors that incorrectly indicated an overheating situation. According to Bill Taylor, then head of the main engine project at the Marshall Space Flight Center in Huntsville, Ala., these sensors were extremely thin wires, whose electrical resistance changed as they heated up. Otherwise, the performance of the SRBs in propelling Challenger into orbit was described as “nominal.” However, gearbox nitrogen pressures in one of the Shuttle’s Auxiliary Power Units had exceeded their maximum allowable levels and, during a post-launch sweep of the Cape Canaveral beaches, a fragment of spray-on foam insulation, apparently from the External Tank, was discovered.
As they settled into orbit, the seven-man crew barely had chance to reflect on what had been not just been an eventful day, but a crisis-filled month. Originally scheduled to head for space at 3:30 p.m. EST on 12 July, they had been thwarted by the second on-the-pad RSLS main engine shutdown, only seconds before liftoff. “At T-7 seconds,” recalled Bridges, “the main engines start with a rumble from far below. As the person in charge of all engines, I watch the chamber pressure indicators come to life and surge towards 100 percent. I think ‘Wait, what’s this?’ The left engine indicator seems to be lagging behind. Before I can say a word, it falls to zero, followed by the other engines. With less than three seconds before our planned liftoff, we have an abort. The groans from the rest of the crew are now audible. I take a quick look around to see if there’s anything else to be done and notice Gordon Fullerton turning to look at me. The thought crosses my mind: ‘Gordo probably is thinking I’ve done something to screw it up’. I show him both hands, palms up, and say ‘Gordo, I didn’t touch a thing. It was an automatic shutdown’.”
The 12 July shutdown, executed because the Number Two main engine’s chamber coolant valve was slow in closing from 100 percent open to the 70 percent required for startup, necessitated a 17-day wait for a second launch attempt. When one of two command channels failed to execute the closure, fortunately, the backup took over without incident. However, flight rules dictated that both channels had to be fully functional for the countdown and liftoff to proceed.
It was a shutdown which might have saved their lives and which gave them the opportunity to try again, 17 days later. Six months after that, in the worst and most public disaster ever witnessed in America’s human space program, Challenger was lost in a fireball that was initially thought to stem from a main engine failure. Even when an SRB fault was identified as the primary cause, the engines remained of enormous concern to NASA … and in the 17-month period from March 1993 to August 1994 no less than three more shuttle crews would sit through RSLS aborts, including one unfortunate soul who did so twice.
The second part of this article will appear tomorrow.