When a space shuttle shuts down in the last seconds before liftoff, the launch team has its most important work to do.
- By Gregory Freiherr
- Air & Space magazine, January 1996
On his first space shuttle mission, astronaut Daniel W. Bursch was mildly surprised by the violence of the main engine firing. Bursch, a Navy commander and test pilot, describes a sensation that the shuttle simulator couldn't quite replicate. "It really does feel like these engines are strapped to your back," he says. "On the pad the engines create a lot of noise, a lot of vibration. You can almost feel the shock waves as they develop out of the engine." Bursch's biggest surprise of the day, however, came seconds later, when the engines shut down.
His first reaction was disbelief. "The first thing that catches your attention is the master alarm," he remembers. "It's very loud and it's obvious that something's wrong. Five to ten seconds after it's happened, all the noise has gone away, all the vibration. There's a slight rocking of the vehicle. It's really hard to feel it, but the vehicle continues to sway back and forth."
It has happened only five times in shuttle history: The three main engines on the orbiter ignite, computers monitoring them detect a problem, and the space shuttle onboard computers shut the engines down. June 26, 1984: A main fuel valve actuator in one of the engines stuck. July 12, 1985: A chamber coolant valve refused to close. March 22, 1993: An oxidizer purge valve jammed on a chunk of O-ring. August 12, 1993: A faulty sensor indicated abnormal fuel flow. And, almost exactly a year later, less than two seconds before the solid rockets were to ignite, an oxidizer pump overheated. "We are not willing to lift off if we lose redundancy before we get to T-zero," says John B. Plowden, who manages the Rocketdyne team that services the shuttle's main engines. "That's the way the system is designed."
The T-zero event is the ignition of the solid rocket boosters, propellant-filled towers that generate 71 percent of the thrust the shuttle needs to leave the ground. "When those SRBs light, there is no recall," says Bruce Bartolini, a launch team manager with Lockheed Martin Space Operations. "You're going flying." The liquid-fuel engines ignite 6.6 seconds earlier than the solids, giving the computers a narrow window in which to call off the launch.
"There's too much stuff going on in too short a time for a human being to make a decision and then take action," Bartolini says. Fifty times a second, a computer on each of the three main engines examines close to 30 critical parameters, including sensor function, fuel pressures, temperature, vibration, fuel flow rates, and power status. If all three engines reach 90 percent of maximum thrust by T minus three seconds and all parameters are within limits at T minus zero, the shuttle computers send out commands for pyrotechnics to ignite the SRBs, split the bolts holding the shuttle to the pad, and release the umbilical cord to the external tank. If certain limits are exceeded, the computers command an abort.
A launch pad abort is a safety measure, but it creates a whole new set of problems since it leaves an enormous amount of potential chemical energy sitting on the pad. "The real key to handling an emergency as serious as an engine abort is practice," says Bartolini. "You have to know your procedures, and you have to be willing to execute them. In other words, you can't sit there and say 'I hope this never happens. I don't want to ever have to do that.' It's just like flying airplanes. You have normal and emergency procedures, and you better know your emergency procedures or you're not going to be doing the normal ones for very long."
To keep the launch teams in practice, NASA runs a series of simulations at the Kennedy Space Center in Florida, similar to the mission simulations that train astronauts in Houston. Although the space shuttle countdown is governed by a checklist that fills five volumes and takes three and a half days to execute, the principal training simulation begins at T minus 20 minutes, the point in the countdown when the ground computer network gives the first commands to the computers on the orbiter. (This interaction continues until T minus 31 seconds, when the ground computers hand off the launch sequence to the onboard computers.) Several simulations are run before every launch; the final dress rehearsal, known as the Terminal Countdown Demonstration Test, includes putting the flight crew members on the orbiter and getting them out again. The test always ends with an abort after main engine ignition.
One of the first things you notice about the firing room, where the engineers sit during launch, is its impersonality. There are no family photographs, no kids' drawings taped to the consoles, no cartoons stuck on the side of a computer screen, no houseplants, no newspapers, no note pads. It's as naked as a hospital operating room. When this observation is mentioned to Al Sofge (pronounced SOF-gee), NASA assistant launch director, he shoots back sternly, "This is the firing room. This is where we launch rocketships." After an instant, he adds, "Dan Marino doesn't have a picture of his kid taped to the side of his helmet."