On his first space shuttle mission, astronaut Daniel W. Bursch was mildly surprised by the violence of the main engine firing. Bursch, a Navy commander and test pilot, describes a sensation that the shuttle simulator couldn't quite replicate. "It really does feel like these engines are strapped to your back," he says. "On the pad the engines create a lot of noise, a lot of vibration. You can almost feel the shock waves as they develop out of the engine." Bursch's biggest surprise of the day, however, came seconds later, when the engines shut down.

His first reaction was disbelief. "The first thing that catches your attention is the master alarm," he remembers. "It's very loud and it's obvious that something's wrong. Five to ten seconds after it's happened, all the noise has gone away, all the vibration. There's a slight rocking of the vehicle. It's really hard to feel it, but the vehicle continues to sway back and forth."

It has happened only five times in shuttle history: The three main engines on the orbiter ignite, computers monitoring them detect a problem, and the space shuttle onboard computers shut the engines down. June 26, 1984: A main fuel valve actuator in one of the engines stuck. July 12, 1985: A chamber coolant valve refused to close. March 22, 1993: An oxidizer purge valve jammed on a chunk of O-ring. August 12, 1993: A faulty sensor indicated abnormal fuel flow. And, almost exactly a year later, less than two seconds before the solid rockets were to ignite, an oxidizer pump overheated. "We are not willing to lift off if we lose redundancy before we get to T-zero," says John B. Plowden, who manages the Rocketdyne team that services the shuttle's main engines. "That's the way the system is designed."

The T-zero event is the ignition of the solid rocket boosters, propellant-filled towers that generate 71 percent of the thrust the shuttle needs to leave the ground. "When those SRBs light, there is no recall," says Bruce Bartolini, a launch team manager with Lockheed Martin Space Operations. "You're going flying." The liquid-fuel engines ignite 6.6 seconds earlier than the solids, giving the computers a narrow window in which to call off the launch.

"There's too much stuff going on in too short a time for a human being to make a decision and then take action," Bartolini says. Fifty times a second, a computer on each of the three main engines examines close to 30 critical parameters, including sensor function, fuel pressures, temperature, vibration, fuel flow rates, and power status. If all three engines reach 90 percent of maximum thrust by T minus three seconds and all parameters are within limits at T minus zero, the shuttle computers send out commands for pyrotechnics to ignite the SRBs, split the bolts holding the shuttle to the pad, and release the umbilical cord to the external tank. If certain limits are exceeded, the computers command an abort.

A launch pad abort is a safety measure, but it creates a whole new set of problems since it leaves an enormous amount of potential chemical energy sitting on the pad. "The real key to handling an emergency as serious as an engine abort is practice," says Bartolini. "You have to know your procedures, and you have to be willing to execute them. In other words, you can't sit there and say 'I hope this never happens. I don't want to ever have to do that.' It's just like flying airplanes. You have normal and emergency procedures, and you better know your emergency procedures or you're not going to be doing the normal ones for very long."

To keep the launch teams in practice, NASA runs a series of simulations at the Kennedy Space Center in Florida, similar to the mission simulations that train astronauts in Houston. Although the space shuttle countdown is governed by a checklist that fills five volumes and takes three and a half days to execute, the principal training simulation begins at T minus 20 minutes, the point in the countdown when the ground computer network gives the first commands to the computers on the orbiter. (This interaction continues until T minus 31 seconds, when the ground computers hand off the launch sequence to the onboard computers.) Several simulations are run before every launch; the final dress rehearsal, known as the Terminal Countdown Demonstration Test, includes putting the flight crew members on the orbiter and getting them out again. The test always ends with an abort after main engine ignition.

One of the first things you notice about the firing room, where the engineers sit during launch, is its impersonality. There are no family photographs, no kids' drawings taped to the consoles, no cartoons stuck on the side of a computer screen, no houseplants, no newspapers, no note pads. It's as naked as a hospital operating room. When this observation is mentioned to Al Sofge (pronounced SOF-gee), NASA assistant launch director, he shoots back sternly, "This is the firing room. This is where we launch rocketships." After an instant, he adds, "Dan Marino doesn't have a picture of his kid taped to the side of his helmet."

Sofge's football metaphor is apt. The law of the firing room is concentration; its most frequent activity is drill. Although the room's windows provide a view of the launch pad, the launch team members rarely see a shuttle liftoff. They read its status in the numbers on their computer screens.

The firing room looks a lot like mission control, its sister control room in Houston, which takes over from Florida as soon as the shuttle's solid rocket boosters ignite. Banks of gray metal consoles with computer screens fill the basketball court-size room. On each bank of consoles there is a cryptic nameplate: HAZ GAS (hazardous gases), LOX SYS (liquid oxygen system), MPS/SSME (main propulsion systems/space shuttle main engines). About 200 engineers sit at the consoles, immersed in the illusion of a shuttle countdown. The training goal is to make the monitors look exactly as they would if a real launch were under way. The engineers report to the NASA Test Director (NTD) and the Orbiter Test Conductor (OTC), who communicate with the flight crew on the shuttle.

"The last command we give the astronaut flight crew is at two minutes and 30 seconds," says Bartolini. At that point the shuttle begins running solely on internal power, and the OTC tells the astronauts to close and lock their visors and initiate oxygen flow. "He usually gives them a little send-off, and then it gets real quiet. The only talking that's being done is by the ground launch sequencer engineer calling out the different milestones as we go on down and the NTD, who starts calling at one minute, then 45 seconds... on down. Other than that the firing room is extremely quiet. Everybody is looking at their data hoping that they don't get an anomaly."

In today's simulation, everyone gets plenty of anomalies. Data systems engineer Robert Pierce and two math modeling colleagues have loaded the computers with a variety of virtual emergencies. "We're really taking a polished team and putting a high gloss on it," Pierce says. "We plan for things that have a

likely occurrence of happening. 'Likely' for us space nuts is less than one percent. We don't like surprises."

Many of the problems Pierce and his gremlins throw at the launch team occur during a pad abort. After the orbiter's computers command a main engine cutoff, they grind through the procedures for safing the vehicle: starting a spray of water to disperse unburned hydrogen exhausted from the main engines, for example, sealing the hydrogen and oxygen valves to the engines, disarming the explosive bolts on the solid rockets. Progress is reflected on computer screens filled with blue, green, yellow, and--to show exceeded limits or other trouble--red or flashing numbers. The red numbers require engineers to respond according to well-documented procedures.

In one simulated emergency, engineers begin to see temperatures in red because the shuttle's ground cooling unit fails. "You don't want to cook your equipment," Pierce explains. The NTD issues an order to activate backup systems, then another to shut down a series of electronic systems on the shuttle that produce heat. An engineer at the environmental control console manually flips a switch to turn on a chilled-water heat exchanger. Others activate radiators on the inside of the payload bay doors. At another environmental control console, a team lowers the temperature of air being pumped into the payload bay by a purge system.

Next, the NTD orders staff at the LOX and liquid hydrogen consoles to prepare to drain the external tank, a precaution in case power to the shuttle must be turned off. The next step is to reestablish power from the ground in order to shut down the onboard fuel cells, which are major heat generators.

"Then we have a decision point," Pierce says. "Are we still hot?" If so, members of the launch team will continue to turn off the shuttle's various systems. Throughout the process, the NTD is getting updates on temperatures from environmental control engineers. If the temperature doesn't drop to an acceptable range, he will order an emergency power-down and get the crew off the shuttle. Without electrical power on the shuttle, the launch crew no longer sees data from its systems, a situation that would require an emergency egress for the flight crew. "They open the hatch, jump out, run across the arm, and do the slide wire thing," Pierce says.

"The slide wire thing" is the astronauts' escape system: seven flat-bottom baskets that slide down 1,200-foot wires to safety. Each basket is made of steel and heat-resistant fiber surrounded by netting and can carry up to three persons. They slide down wires into catch nets, which drag chains to stop them near a bunker designed to withstand the force of a shuttle explosion.

In a real emergency, the astronauts would take a brisk walk--no more than 50 feet--across the shuttle access arm and fixed service structure to the baskets. Their trip would be complicated by a steady stream of water being sprayed to protect them from flames or heat. To ensure that no one gets lost, crew members are trained to grab a mitt full of each other's spacesuits. A crew of five, for example, splits into groups of two and three. They would follow a "yellow brick road"--gold and black chevrons painted on the metal grate floor--aiming them toward the baskets.

Riding the slide wires has its own risks--ones serious enough that during the abort simulations NASA fills the baskets with weights and dummies rather than people. But the agency has man-rated the system. George Hoggard, a training officer on the pad rescue team, is one of only three people who have ever ridden in a slide-wire basket at the launch pad. The ride began 195 feet above the ground and ended 21 seconds later. The basket reached 53 mph before striking the net.

The only part of the ride Hoggard found unnerving came near the end, when the basket slapped the restraining net with a bang. "It was like a shotgun going off," Hoggard says. "But nothing hurt, so I figured I was still okay." The net and drag chain broke free from their poles, as they were designed to do, and the chain dragged through sand to bring the basket to a gradual stop.

The bunker, located about 30 feet from the end of the slide wire, is stocked with water, oxygen, and medical supplies. But if one of the crew is hurt and needs more than first aid, an M113 armored personnel carrier, parked next to the bunker, can be used to get the astronaut to any of several points for evacuation by helicopter.

Several weeks before scheduled lift-off, the crew members take turns driving the M113, an acquired skill. It takes only a minor miscalculation to make a big mistake, as an astronaut discovered last spring when she took a corner too sharply and drove the M113 into a pond behind one of the launch pads.

The exercise isn't designed to turn astronauts into tank drivers; it's part of building a team, says Captain David M. Walker, four-time space veteran and commander of the five-member STS-69 crew, which was launched on September 7. "It gives us a chance to interact with the fire and rescue people, who are going to be the folks who save our bacon if something goes really wrong," he says.

The astronauts practice emergency egress primarily at the Manned Space Flight Center in Houston. The fastest a crew has evacuated the shuttle mockup there is about two minutes. The exercise begins with a flurry of disconnecting--seat straps, oxygen lines, and communications cords--and culminates with a struggle to get out of a single hatch wearing a full pressure suit saddled with a parachute and life raft. Engineers in the firing room are taught to be ready to override switches accidentally tripped as the astronauts clamber out of their seats. During simulations at Houston, the astronauts wear old helmets because the visors are commonly scratched and cracked from banging into the mockup's instrument panels and bulkheads.

Emergency egress is a last resort. Experience has shown that engine shutdown does not require an egress. "In fact, until we really understand what kind of situation we have outside, many times the safest place for [the crew] is inside with the hatch closed," Al Sofge says. "We could egress the crew into a worse situation than they're in. For example, if you had a hypergolic tank rupture on you and you had a large hypergolic cloud and that's the only problem you have, and your cloud covers the egress route, you may be better off leaving them in the vehicle."

In addition, the flight crew works during a pad abort, at least initially, switching off the auxiliary power units, disarming the reaction control system and orbital maneuvering system, and, most importantly, shutting down the backup flight software. The most recent abort, on mission STS-68, occurred so close to launch that the backup computer began counting up, as though the shuttle had launched. If the computer had not been shut down, the explosive bolts on the solid rockets might have blown at the one-minute 40-second mark, when the SRBs normally separate from the vehicle in flight. The solid rockets hold the shuttle and external tank upright on the pad. Blow those bolts and the tank and shuttle fall over.

Engineers in the launch control center are especially on guard for signs of conditions that could lead to fire or explosion, such as bubbles in the umbilical line that feeds oxygen to the main engines. To remain liquid, oxygen must be kept at -298 degrees Fahrenheit. During an emergency shutdown of the main engines, some of the oxygen being pumped to the engines could warm and begin to boil, creating a bubble that could back up through the plumbing and into the external tank. In the process, that bubble would create a void in the 100-foot line leading to the shuttle engines. "When it bursts at the top of the tank, the LOX [liquid oxygen] will come rushing back into the line leading to the shuttle," says John Sterritt, a Lockheed Martin engineer who leads a team of propulsion experts in the firing room. The sudden pressure could cause the external tank to fail, "like popping a paper bag," he says. "With any kind of ignition source, you'd have a real potential for fire." So Sterritt and his team carefully watch data streams that would indicate heating in the oxygen umbilical.

All the years of practice, as well as the experience of five pad aborts, have made safing the shuttle almost routine. "The procedures have all been refined; the little discrepancies we noticed in the beginning of the program were changed and tested and put in place," says Greg Katnik, lead flight structures engineer for NASA. Katnik was an engineer in the firing room 11 years ago when a hydrogen leak caused flames to lick up the east side of the shuttle during the first abort. The launch team manually turned on the Firex water system to disperse the hydrogen and put out the fire. Since then, NASA has programmed its computers to trigger the water system at the start of a pad abort. An engineer on the launch team also pushes a backup button to make sure the engine is flooded with water. Steel plates have been installed under the access arm to keep flames from reaching the astronauts in case they have to cross to the slide-wire baskets.

After an abort, the critical safing procedures take about 10 minutes, according to Bruce Bartolini. "You then launch into several other sequences which get everything secured and get the crew out. So we're really done about 45 minutes after the abort.

"We're prepared for the emergencies," Bartolini says. "I myself, after I give my last command [at] about two minutes, I have my checklist tabbed, and I turn to the abort procedure and I'm ready to do it."

He admits, however, "that when the call comes, it's still a surprise." In the case of STS-68, the abort came at T minus 1.9 second, so close to launch that the official who announces liftoff said: "We have L...abort."

"It was the French abort," says Bartolini. "L'abort."

He continues, "It was kind of shocking and then it's...you're all business."

It was especially shocking to Daniel Bursch, who was on this mission too. Because he has experienced main engine cutoff (MECO) four times yet flown only twice, his fellow astronauts have dubbed him the MECO Kid. "I'm fully ready for another pad abort," says Bursch, who is scheduled to fly on Endeavour next April. "I said it couldn't happen twice, and it did. Well, it could happen three times."

If it does, the launch team will bring the shuttle back to the vehicle assembly building and spend three weeks changing the engines. Once the engines fire, even for a few seconds, they're removed and serviced. Then the team will send the only reusable launch vehicle operating in the world back to the pad for another try.

Comments