When a space shuttle shuts down in the last seconds before liftoff, the launch team has its most important work to do.
- By Gregory Freiherr
- Air & Space magazine, January 1996
(Page 4 of 5)
The astronauts practice emergency egress primarily at the Manned Space Flight Center in Houston. The fastest a crew has evacuated the shuttle mockup there is about two minutes. The exercise begins with a flurry of disconnecting--seat straps, oxygen lines, and communications cords--and culminates with a struggle to get out of a single hatch wearing a full pressure suit saddled with a parachute and life raft. Engineers in the firing room are taught to be ready to override switches accidentally tripped as the astronauts clamber out of their seats. During simulations at Houston, the astronauts wear old helmets because the visors are commonly scratched and cracked from banging into the mockup's instrument panels and bulkheads.
Emergency egress is a last resort. Experience has shown that engine shutdown does not require an egress. "In fact, until we really understand what kind of situation we have outside, many times the safest place for [the crew] is inside with the hatch closed," Al Sofge says. "We could egress the crew into a worse situation than they're in. For example, if you had a hypergolic tank rupture on you and you had a large hypergolic cloud and that's the only problem you have, and your cloud covers the egress route, you may be better off leaving them in the vehicle."
In addition, the flight crew works during a pad abort, at least initially, switching off the auxiliary power units, disarming the reaction control system and orbital maneuvering system, and, most importantly, shutting down the backup flight software. The most recent abort, on mission STS-68, occurred so close to launch that the backup computer began counting up, as though the shuttle had launched. If the computer had not been shut down, the explosive bolts on the solid rockets might have blown at the one-minute 40-second mark, when the SRBs normally separate from the vehicle in flight. The solid rockets hold the shuttle and external tank upright on the pad. Blow those bolts and the tank and shuttle fall over.
Engineers in the launch control center are especially on guard for signs of conditions that could lead to fire or explosion, such as bubbles in the umbilical line that feeds oxygen to the main engines. To remain liquid, oxygen must be kept at -298 degrees Fahrenheit. During an emergency shutdown of the main engines, some of the oxygen being pumped to the engines could warm and begin to boil, creating a bubble that could back up through the plumbing and into the external tank. In the process, that bubble would create a void in the 100-foot line leading to the shuttle engines. "When it bursts at the top of the tank, the LOX [liquid oxygen] will come rushing back into the line leading to the shuttle," says John Sterritt, a Lockheed Martin engineer who leads a team of propulsion experts in the firing room. The sudden pressure could cause the external tank to fail, "like popping a paper bag," he says. "With any kind of ignition source, you'd have a real potential for fire." So Sterritt and his team carefully watch data streams that would indicate heating in the oxygen umbilical.
All the years of practice, as well as the experience of five pad aborts, have made safing the shuttle almost routine. "The procedures have all been refined; the little discrepancies we noticed in the beginning of the program were changed and tested and put in place," says Greg Katnik, lead flight structures engineer for NASA. Katnik was an engineer in the firing room 11 years ago when a hydrogen leak caused flames to lick up the east side of the shuttle during the first abort. The launch team manually turned on the Firex water system to disperse the hydrogen and put out the fire. Since then, NASA has programmed its computers to trigger the water system at the start of a pad abort. An engineer on the launch team also pushes a backup button to make sure the engine is flooded with water. Steel plates have been installed under the access arm to keep flames from reaching the astronauts in case they have to cross to the slide-wire baskets.
After an abort, the critical safing procedures take about 10 minutes, according to Bruce Bartolini. "You then launch into several other sequences which get everything secured and get the crew out. So we're really done about 45 minutes after the abort.
"We're prepared for the emergencies," Bartolini says. "I myself, after I give my last command [at] about two minutes, I have my checklist tabbed, and I turn to the abort procedure and I'm ready to do it."
He admits, however, "that when the call comes, it's still a surprise." In the case of STS-68, the abort came at T minus 1.9 second, so close to launch that the official who announces liftoff said: "We have L...abort."