The only part of the ride Hoggard found unnerving came near the end, when the basket slapped the restraining net with a bang. "It was like a shotgun going off," Hoggard says. "But nothing hurt, so I figured I was still okay." The net and drag chain broke free from their poles, as they were designed to do, and the chain dragged through sand to bring the basket to a gradual stop.
The bunker, located about 30 feet from the end of the slide wire, is stocked with water, oxygen, and medical supplies. But if one of the crew is hurt and needs more than first aid, an M113 armored personnel carrier, parked next to the bunker, can be used to get the astronaut to any of several points for evacuation by helicopter.
Several weeks before scheduled lift-off, the crew members take turns driving the M113, an acquired skill. It takes only a minor miscalculation to make a big mistake, as an astronaut discovered last spring when she took a corner too sharply and drove the M113 into a pond behind one of the launch pads.
The exercise isn't designed to turn astronauts into tank drivers; it's part of building a team, says Captain David M. Walker, four-time space veteran and commander of the five-member STS-69 crew, which was launched on September 7. "It gives us a chance to interact with the fire and rescue people, who are going to be the folks who save our bacon if something goes really wrong," he says.
The astronauts practice emergency egress primarily at the Manned Space Flight Center in Houston. The fastest a crew has evacuated the shuttle mockup there is about two minutes. The exercise begins with a flurry of disconnecting--seat straps, oxygen lines, and communications cords--and culminates with a struggle to get out of a single hatch wearing a full pressure suit saddled with a parachute and life raft. Engineers in the firing room are taught to be ready to override switches accidentally tripped as the astronauts clamber out of their seats. During simulations at Houston, the astronauts wear old helmets because the visors are commonly scratched and cracked from banging into the mockup's instrument panels and bulkheads.
Emergency egress is a last resort. Experience has shown that engine shutdown does not require an egress. "In fact, until we really understand what kind of situation we have outside, many times the safest place for [the crew] is inside with the hatch closed," Al Sofge says. "We could egress the crew into a worse situation than they're in. For example, if you had a hypergolic tank rupture on you and you had a large hypergolic cloud and that's the only problem you have, and your cloud covers the egress route, you may be better off leaving them in the vehicle."
In addition, the flight crew works during a pad abort, at least initially, switching off the auxiliary power units, disarming the reaction control system and orbital maneuvering system, and, most importantly, shutting down the backup flight software. The most recent abort, on mission STS-68, occurred so close to launch that the backup computer began counting up, as though the shuttle had launched. If the computer had not been shut down, the explosive bolts on the solid rockets might have blown at the one-minute 40-second mark, when the SRBs normally separate from the vehicle in flight. The solid rockets hold the shuttle and external tank upright on the pad. Blow those bolts and the tank and shuttle fall over.
Engineers in the launch control center are especially on guard for signs of conditions that could lead to fire or explosion, such as bubbles in the umbilical line that feeds oxygen to the main engines. To remain liquid, oxygen must be kept at -298 degrees Fahrenheit. During an emergency shutdown of the main engines, some of the oxygen being pumped to the engines could warm and begin to boil, creating a bubble that could back up through the plumbing and into the external tank. In the process, that bubble would create a void in the 100-foot line leading to the shuttle engines. "When it bursts at the top of the tank, the LOX [liquid oxygen] will come rushing back into the line leading to the shuttle," says John Sterritt, a Lockheed Martin engineer who leads a team of propulsion experts in the firing room. The sudden pressure could cause the external tank to fail, "like popping a paper bag," he says. "With any kind of ignition source, you'd have a real potential for fire." So Sterritt and his team carefully watch data streams that would indicate heating in the oxygen umbilical.
All the years of practice, as well as the experience of five pad aborts, have made safing the shuttle almost routine. "The procedures have all been refined; the little discrepancies we noticed in the beginning of the program were changed and tested and put in place," says Greg Katnik, lead flight structures engineer for NASA. Katnik was an engineer in the firing room 11 years ago when a hydrogen leak caused flames to lick up the east side of the shuttle during the first abort. The launch team manually turned on the Firex water system to disperse the hydrogen and put out the fire. Since then, NASA has programmed its computers to trigger the water system at the start of a pad abort. An engineer on the launch team also pushes a backup button to make sure the engine is flooded with water. Steel plates have been installed under the access arm to keep flames from reaching the astronauts in case they have to cross to the slide-wire baskets.
After an abort, the critical safing procedures take about 10 minutes, according to Bruce Bartolini. "You then launch into several other sequences which get everything secured and get the crew out. So we're really done about 45 minutes after the abort.