Close-up view of Discovery’s three main engines—still exhibiting evidence of scorching from their momentary ignition on 26 June 1984—in the wake of the shuttle program’s first RSLS abort. (Credist: NASA).

Close-up view of Discovery’s three main engines—still exhibiting evidence of scorching from their momentary ignition on 26 June 1984—in the wake of the shuttle program’s first RSLS abort. (Credits: NASA).

Throughout its 30-year career— consciously or unconsciously— the space shuttle was acknowledged to be one of the most dangerous piloted space vehicles ever brought to operational status. Although its first four teams of astronauts had ejection seats, their usefulness and survivability were questioned from the outset, and from STS-5 and the increase in crew size their inclusion became so impractical that they were done away with. Little escape capability of substance was available until after the separation of the Solid Rocket Boosters (SRBs), two minutes into flight, and NASA engineers worried constantly about the dangers of a failure of the shuttle’s three main engines. On five occasions, between June 1984 and August 1994, a handful of shuttle crews heard over the intercom a four-letter acronym that shook them to the very core: RSLS, denoting a Redundant Set Launch Sequence, indicative of a harrowing engine shutdown on the pad, right before launch.

In those final seconds, the vehicle was at its most hazardous: fully-fueled, crewed, and ready to go. However, as the roar of the engines died, the astronauts were faced with two dire possibilities: to sit tight aboard the vehicle and await the arrival of recovery forces or to attempt a “Mode One Egress,” evacuating their ship, possibly running through an invisible blaze of hydrogen flames, and taking a series of slidewire baskets to safety. It was truly a devil’s bargain. This weekend’s history articles will explore the events of those five on-the-pad launch aborts and what they meant for the men and women who endured them.

STS-41D

“T-31 seconds … We have a Go for autosequence start … Discovery’s computers now taking over primary control of vehicle critical functions until liftoff … ”

The calm, measured tones of NASA commentator Mark Hess provided an assurance that shuttle launches had become the stuff of routine. It was 26 June 1984, and after a false start the previous day all seemed to be proceeding normally as the final seconds ticked away to the launch of Mission 41D, the maiden voyage of the new orbiter, Discovery. Strapped into the flight deck were astronauts Hank Hartsfield, Mike Coats, Mike Mullane, and Steve Hawley, whilst downstairs on the middeck were Judy Resnik and McDonnell Douglas engineer Charlie Walker, flying as part of a commercial contract with NASA. The crew arrived in Florida aboard a fleet of four T-38 jets on the afternoon of 22 June, with liftoff anticipated three days later. They circled over the launch complex and alighted on the runway of the Shuttle Landing Facility. Flying, relaxing, spending time with family members, and running through checklists consumed their final hours on the planet.

Clad in their blue flight suits, the STS-41D crew included America’s second female astronaut, Judy Resnik (Credits: NASA).

Clad in their blue flight suits, the STS-41D crew included America’s second female astronaut, Judy Resnik (Credits: NASA).

“ … T-15 seconds and counting … ”

Darkness still covered the Kennedy Space Center when the crew repeated the time-honored ritual in the small hours of the 26th. “The van starts out slowly,” Charlie Walker told the NASA oral historian of his journey to the pad. “We wind our way through the parking lot and out onto the access road to the pad. There’s this police escort, of course, in front of you, with lights flashing and everything, so you feel like you’re on top of the world already … Then we arrive out at the launch pad and, at the base of the pad, security waves you on. You don’t have to show all your badges and everything this time; they know who you are. At the bottom of the crawlerway, you can get the view … the first time we’d really seen it clearly without the rotating service structure around it and so it’s an awesome experience, knowing that you’re going to ride this thing into space and there’s your spaceship waiting for you out there. Go up the ramp, the police car leading the way, and you just get to the top of the ramp, and the thing that I noticed first was really different … was that there was like only one or two other people there. Now, every other time you’ve been out there, there’s dozens and dozens of people all around and conversation going on; but now it’s silent, except for the wind, maybe some seabirds now and then. As you get up closer to the vehicle, you begin to hear the vehicle. You begin to hear the Shuttle and the External Tank.” Months of training had reached their climax; they were really going to fly today.

“ … 10 … We have a Go for main engine start … ”

The preparations proceeded remarkably smoothly for the second attempt. The countdown had moved crisply: built-in holds at T-20 minutes and T-9 minutes were passed, and, at 8:39 a.m. EDT, with five minutes to go, Mike Coats reached down and switched on Discovery’s three Auxiliary Power Units. The trio of hydraulic pumps hummed perfectly to life. “The meters showed good pressure,” recalled Mullane in his memoir, Riding Rockets. “Discovery now had muscle.” The computers automatically commanded a final series of checks of the main engines and the elevons on the wings. With two minutes to go, the astronauts closed their visors. Hartsfield shook Coats’ hand and wished them all good luck, reminding them to keep their eyes focused on the instruments. Thirty-one seconds before liftoff, the ground launch sequencer handed over control of the countdown to the shuttle’s computers. In the darkened middeck, Resnik and Walker clasped hands. The Solid Rocket Boosters underwent their final nozzle steering checks, and at 10 seconds a flurry of sparks from the hydrogen burn igniters gave way to a familiar low-pitched rumble.

“ … seven, six, five … we have main engine start … ”

Inside Discovery’s cabin, the astronauts felt the immense vibration as turbopumps awoke, liquid oxygen and liquid hydrogen flooded into the engines’ combustion chambers, and they roared to life … and then, suddenly and shockingly, were arrested by the blaring sound of the master alarm. Something had gone badly awry. Two of the main engines—No. 2 and No. 3, closest to the aft body flap—had blazed to life, but the No. 1 engine, directly at the “top” of the pyramid, had failed to ignite. “The vibrations were gone,” wrote Mullane. “The cockpit was as quiet as a crypt. Shadows waved across our seats as Discovery rocked back and forth on her hold-down bolts.” From the pilot’s seat, all Coats could hear was the screeching of disturbed seagulls outside. Two red lights on the instrument panel indicated that the Number Two and Three engines had indeed shut down, but the indicator for the Number One remained dark.

The “white room” and crew access arm, aligned with Discovery’s middeck ingress/egress hatch, are clearly visible in this image. Had a “Mode One Egress” been called, the 41D astronauts would have been required to run to the slidewire escape baskets … and risk immersion in invisible hydrogen flames (Credits: NASA).

The “white room” and crew access arm, aligned with Discovery’s middeck ingress/egress hatch, are clearly visible in this image. Had a “Mode One Egress” been called, the 41D astronauts would have been required to run to the slidewire escape baskets … and risk immersion in invisible hydrogen flames (Credits: NASA).

Instantly, Coats, whose responsibility as pilot was to monitor the engines during ascent, jabbed his finger repeatedly onto the button to shut it down. The status indicator did not change; it remained dark. Downstairs, Walker’s eyes were focused intently on the procedures for “Mode One Egress,” the instructions for opening the side hatch and evacuating the vehicle. Several miles away, on the roof of the Launch Control Center, the astronauts’ families were watching the unfolding drama … and theywere perplexed. “A thick summer haze had obscured the launch pad,” wrote Mullane. “When the engines had ignited, a bright flash had momentarily penetrated that haze, strongly suggesting an explosion. As that fear had been rising in the minds of the families, the engine-start sound had finally hit … a brief roar.” The sound echoed off the walls of the Vehicle Assembly Building (VAB) and was gone. Within seconds, it became clear what had happened.

“ … we have a cutoff … we have an abort by the on-board computers of the orbiter Discovery … ”

Over the intercom, the astronauts heard the worrisome words “RSLS Abort,” meaning a “redundant set launch sequence.” This pointed inevitably to a main engine problem, which had forced their automatic shutdown by the General Purpose Computers. Intuitively, the crew knew that safeguards existed to prevent the SRBs from igniting—if that had happened, it would have killed them all—but they also knew that only a few seconds existed on the countdown clock. “A couple of seconds in the world of electronics is a lifetime,” said Mullane, “and I’m sure that all the safety devices had rotated to prevent [the solids] from igniting … but in the back of your mind, you’re thinking, ‘What happens if those ignite?’” The situation was by no means under control. As if the indication that the Number One might still be burning was not enough, Launch Control now told the crew that there was a fire on the pad and the suppression equipment had been activated.

The decision over whether to unstrap and make an emergency evacuation of the orbiter was now in the hands of Commander Hank Hartsfield. Downstairs on the middeck, Judy Resnik had unstrapped and was peering through the window in Discovery’s side hatch. She could see no fire. The astronauts would have to run across the access arm to a set of seven baskets which would whisk them from the pad to safety. Listening to the communication loop, Hartsfield elected to sit tight. It was a decision which probably saved their lives. Hydrogen burns “cleanly,” invisible to the human eye, and it had already begun to ignite combustible materials on the pad surface. Subsequent inspections would reveal scorched paint all the way up the launch pad structure, as far as the crew access arm. Years later, Walker would praise Hartsfield for not having ordered a Mode One Egress that day. In his conversations with the launch director after the abort, Hartsfield realized that a lot of doubt also existed over the reliability of the baskets, and that had informed their judgment to keep the crew aboard the orbiter.

STS-41D astronaut Judy Resnik rehearses procedures for operating the slidewire baskets on Pad 39A. Such procedures would be followed in the event of an evacuation from the orbiter (Credits: NASA).

STS-41D astronaut Judy Resnik rehearses procedures for operating the slidewire baskets on Pad 39A. Such procedures would be followed in the event of an evacuation from the orbiter (Credits: NASA).

At the press site, Mark Hess’ commentary continued: “We have an indication two of our fire detectors on the zero level; no response … They’re side by side, right next to the engine area … The engineer requested that we turn on the heat shield firewall screen between the engine valve and Discovery’s three main engines … ”

From the flight engineer’s seat, Steve Hawley injected a spark of humor into the proceedings. “Gee,” he said, in his thick Kansan drawl, “I thought we’d be a lot higher at MECO!”

There had been a Main Engine Cutoff, but not at the edge of space; Discovery remained firmly shackled to Earth. T-zero had not been reached and so the SRBs had not been commanded to ignite. Hawley’s joke “broke the ice and got everybody laughing,” said Mike Coats, but did little to dissipate a pervasive sense of gloom that their mission had been aborted just four seconds before liftoff. Gloom is often associated with bad weather and rain, and when the 41D crew finally saw the light of day and made their way out of the orbiter, they did so in a torrential downpour … not of rain, but of the waters of the fire suppression system. The entire gantry was soaked, drips from every pipe and platform, the white room ankle-deep in water. As Coats walked out of the elevator at the base of the pad, it was like walking underneath a waterfall. “We got completely soaked to the skin,” he explained years later. “Then we got in the astronaut van, which was air-conditioned and very cold. As we were driving away, there’s a window in the back of the van and all of us were looking back at the shuttle on the launch pad, shivering and soaking wet, like drowned rats.”

Hartsfield’s disappointed crew was exhausted. “After a launch abort,” Mullane told the NASA oral historian years later, “you could take a gun and point it right at somebody’s forehead, and they’re not even going to blink, because they don’t have any adrenaline left in them; it’s all been used up.” Mike Coats took his wife and children to Disney World, where, later that afternoon, they found themselves queuing for the Space Mountain ride. Replacement of the troublesome main engine would require a return to the VAB, and that prompted a delay until August at the earliest. After another postponement on the 29th, the maiden crew of Discovery finally set off on 30 August. It was an unfortunate prelude to the stellar, 39-flight career of NASA’s most-flown shuttle.

STS-51F

For Story Musgrave, the flight engineer on Challenger’s Mission 51F, his ascent to orbit on 29 July 1985, was arguably dramatic, when the shuttle suffered a hair-raising main engine shutdown 108 km above Earth … after already enduring its own RSLS abort on the pad, three weeks earlier. “The ground made the call ‘Limits to Inhibit’,” he recalled to a Smithsonian interviewer, years later, “which is, for us, an extremely serious omen, [because it] means the ground is seeing problems that are going to shut you down. I’m looking through the procedures book and thinking we’re going to land at our transoceanic abort site in Spain. I’m rehearsing all the steps and my hands are moving through the book and I’m thinking ‘We’re going to Spain. Things are bad!’”

The emergency, which occurred five minutes and 45 seconds after launch, arose when temperature readings for the No. 1 engine’s high pressure turbopump indicated “above” its maximum redline, prompting Challenger’s computers to shut down the engine. At this stage of the ascent—with just three minutes remaining to a nominal main engine cutoff (MECO)—the shuttle was too high and too fast to return to an emergency landing back at her launch site in Florida. This meant one of two things: either a Transoceanic Abort Landing (TAL) in Europe or a tricky maneuver known as an Abort To Orbit (ATO), whereby Challenger would burn her twin maneuvering engines to augment the two remaining main engines and limp into a low, but stable, orbit. Musgrave’s initial focus was upon the page of his checklist that dealt with requirements for a touchdown at Zaragoza Air Base—a joint-use military and civilian installation with a NATO-instrumented bombing range—in the autonomous region of Aragon, north-eastern Spain. Zaragoza had been designated a TAL site in 1983 and was assigned to 51F because the orbital inclination of 49.5 degrees placed it near the nominal ascent ground track, thus allowing the most efficient use of available main engine propellant and cross-range steering capability. As Musgrave flipped through the procedures that he would recite to Commander Gordon Fullerton and Pilot Roy Bridges for a diversion to Zaragoza, astronaut Karl Henize, seated to his right, was becoming nervous.

Challenger roars, with seeming perfection, toward orbit on 29 July 1985. Less than five minutes into the ascent, her crew would brush disaster by a mere whisker (Credits: NASA).

Challenger roars, with seeming perfection, toward orbit on 29 July 1985. Less than five minutes into the ascent, her crew would brush disaster by a mere whisker (Credits: NASA).

Henize had good reason for his nervousness. The TAL mode was the second available abort after the Return to Launch Site (RTLS) contingency option and encompassed the six-minute period from shortly after SRB separation until, theoretically, main engine cutoff. It utilized one of three landing sites—one in France and two in Spain—which provided emergency support for just-launched shuttles following orbital insertion inclinations between 28.5 and 57 degrees. Flight rules dictated that the TAL option would only be selected in the event of a premature main engine shutdown or other major malfunction—for example a significant cabin pressure leak or cooling system failure—which prevented the vehicle from continuing into space and completing at least one orbit. Had the command been given from Mission Control that day, Gordon Fullerton would have rotated the abort switch on his instrument panel in the TAL/AOA position and depressed the abort push button next to the selector switch; Challenger’s computers would then have automatically steered the spacecraft toward the plane of the European landing site.

“He didn’t know what was going on,” Musgrave said of Henize’s reaction during those seconds. “He looks over and sees the top of my page: SPAIN. He’s looking, poor Karl, and I’m going down the checklist that I’ll be reading to the guys in the front seats when we abort. Karl’s looking over at me and I sense a really severe stare. Then he dares ask: ‘Where we going, Story?’ I just looked at the top of the page and said ‘Spain, Karl.’ Then I quickly retracted it. ‘We’re close, but not yet.’”

Eventually, the call came from Mission Control: “Abort ATO; Abort ATO.” Challenger had achieved sufficient velocity and altitude to undertake the next available option: the Abort to Orbit. In fact, she had missed the closure of the TAL “window” by just 33 seconds! At 4:06:06 p.m. EDT, some six minutes and six seconds into the ascent and hurtling towards space, Gordon Fullerton fired the OMS engines for 106 seconds, consuming a large quantity of much-needed propellant, but permitting the shuttle to continue into a lower-than-planned orbit. Two minutes later, at 4:08:13 p.m., the No. 3 main engine data indicated excessively high temperatures. If the “Limits to Inhibit” had not already been applied, the computer would have it shut down. The “inhibit” command effectively instructed the computers to ignore the over-temperature signals and prevented them from shutting down the No. 3 engine. The two remaining engines fired for an additional 49 seconds, shutting down nine minutes and 20 seconds after launch. “We never did get the call for the transoceanic emergency landing,” said Musgrave, “and we ended up making it to orbit and finishing the mission.”

This incident represented the only in-flight shutdown ever experienced by the shuttle, and it came as a surprise because all main engine parameters had been normal during the countdown, ignition sequence, and the first few minutes of the flight. At approximately two minutes into Challenger’s ascent, at about the same time as the SRBs were jettisoned, data from Channel A—one of two measurements of the Number One engine’s high pressure fuel turbopump discharge temperature—displayed characteristics indicative of the beginning of failure. Its measurement began to drift and, at three minutes and 41 seconds after launch, the Channel B sensor failed. However, its sibling continued to drift, approaching and then exceeding its own redline limit some five minutes and 43 seconds into the flight, which triggered the shutdown.

The high pressure fuel turbopump discharge temperature data from Channel B of the No. 3 engine, meanwhile, began to climb and passed its own redline just over eight minutes after liftoff. Measurements from its Channel A remained within prescribed limits and, said NASA’s post-mission report, all other operating parameters relating to the No. 2 and 3 engines were deemed normal. Post-mission analysis suggested that the problem was not with the No. 1 engine itself, but faulty sensors that incorrectly indicated an overheating situation. According to Bill Taylor, then head of the main engine project at the Marshall Space Flight Center in Huntsville, Ala., these sensors were extremely thin wires, whose electrical resistance changed as they heated up. Otherwise, the performance of the SRBs in propelling Challenger into orbit was described as “nominal.” However, gearbox nitrogen pressures in one of the Shuttle’s Auxiliary Power Units had exceeded their maximum allowable levels and, during a post-launch sweep of the Cape Canaveral beaches, a fragment of spray-on foam insulation, apparently from the External Tank, was discovered.

Challenger’s three main engines splutter and die in the shuttle program’s second RSLS pad abort on 12 July 1985. Her actual launch, 17 days later, although it successfully delivered the STS-51F crew into orbit, would be equally harrowing (Credits: NASA).

Challenger’s three main engines splutter and die in the shuttle program’s second RSLS pad abort on 12 July 1985. Her actual launch, 17 days later, although it successfully delivered the STS-51F crew into orbit, would be equally harrowing (Credits: NASA).

As they settled into orbit, the seven-man crew barely had chance to reflect on what had been not just been an eventful day, but a crisis-filled month. Originally scheduled to head for space at 3:30 p.m. EST on 12 July, they had been thwarted by the second on-the-pad RSLS main engine shutdown, only seconds before liftoff. “At T-7 seconds,” recalled Bridges, “the main engines start with a rumble from far below. As the person in charge of all engines, I watch the chamber pressure indicators come to life and surge towards 100 percent. I think ‘Wait, what’s this?’ The left engine indicator seems to be lagging behind. Before I can say a word, it falls to zero, followed by the other engines. With less than three seconds before our planned liftoff, we have an abort. The groans from the rest of the crew are now audible. I take a quick look around to see if there’s anything else to be done and notice Gordon Fullerton turning to look at me. The thought crosses my mind: ‘Gordo probably is thinking I’ve done something to screw it up.’ I show him both hands, palms up, and say ‘Gordo, I didn’t touch a thing. It was an automatic shutdown.’”

The 12 July shutdown, executed because the Number Two main engine’s chamber coolant valve was slow in closing from 100 percent open to the 70 percent required for startup, necessitated a 17-day wait for a second launch attempt. When one of two command channels failed to execute the closure, fortunately, the backup took over without incident. However, flight rules dictated that both channels had to be fully functional for the countdown and liftoff to proceed.

It was a shutdown which might have saved their lives and which gave them the opportunity to try again, 17 days later. Six months after that, in the worst and most public disaster ever witnessed in America’s human space program, Challenger was lost in a fireball that was initially thought to stem from a main engine failure. Even when an SRB fault was identified as the primary cause, the engines remained of enormous concern to NASA … and in the 17-month period from March 1993 to August 1994 no less than three more shuttle crews would sit through RSLS aborts, including one unfortunate soul who did so twice.

In the pre-dawn gloom of 18 August 1994, Space Shuttle Endeavour sat on her seaside launch pad at the Kennedy Space Center, Fla., bathed in million-candlepower xenon floodlights, as the final seconds of the countdown to her voyage into orbit evaporated. Although STS-68 would be her seventh flight, it was in many ways a repeat of her sixth, for the orbiter carried the massive Space Radar Laboratory for observations of the Home Planet. Barely four months earlier, on STS-59, Endeavour had flown SRL-1, and on STS-68 she would monitor changes between late spring and late summer. For astronaut Tom Jones, who flew both, the second flight offered him the chance to seize a new record for the shortest span—just 120 days—between a pair of missions. Alas, for Jones, today would bring him cruel fortune … and for his crewmate, Dan Bursch, it would be crueler still.

The closest the shuttle ever came to a launch at the time of abort was T-1.9 seconds, on 18 August 1994. So close was the shuttle to launch, the on-board General Purpose Computers had already moded to their 102 ascent software configuration at the time of the abort (Credits: NASA).

The closest the shuttle ever came to a launch at the time of abort was T-1.9 seconds, on 18 August 1994. So close was the shuttle to launch, the on-board General Purpose Computers had already moded to their 102 ascent software configuration at the time of the abort (Credits: NASA).

STS-68

Liftoff of STS-68 was scheduled for 6:54 a.m. EDT. After strapping in and checking their equipment, Jones and fellow astronaut Jeff Wisoff, seated on Endeavour’s middeck, killed a little time by playing rock, scissors, paper. As the countdown resumed ticking from the T-9 minute hold, the astronauts had been heartened to learn that Range Operations had given them a green light to go. Weather was good, as were the systems and payloads aboard the orbiter herself. Launch Director Bob Sieck wished the crew good luck, to which Endeavour’s commander, Mike Baker, responded with a heartfelt thanks for getting them ready to fly this important “Mission to Planet Earth.” A few minutes later, Pilot Terry Wilcutt reached over and activated the ship’s Auxiliary Power Units. “Here comes the vibration of the vehicle,” Jones wrote in his memoir, Skywalking, “flight control surfaces moving, engines are cycling now with the hydraulics.”

Endeavour was primed and ready to go—or so it seemed.

“Go for Autosequence Start. Endeavour’s on-board computers now have primary control of all the vehicle’s critical functions … ”

As the countdown ticked to the all-important T-31 seconds, control of the final stages was handed off from the Launch Control Center to Endeavour’s General Purpose

The STS-68 crew departs the Operations and Checkout Building, bound for the launch pad (Credits: Spacefacts/Joachim Becker).

The STS-68 crew departs the Operations and Checkout Building, bound for the launch pad (Credits: Spacefacts/Joachim Becker).

Computers. It was they, and they alone, which would monitor hundreds of separate sensors and execute decisions as to whether the mission would fly today. The disembodied voice of the launch announcer echoed from loudspeakers, crisply acknowledging the seconds as they worked their way backwards toward the ignition of the three main engines, the ignition of the twin Solid Rocket Boosters (SRBs), and a date with a high-inclination orbit to radar-map the Home Planet for the next 10 days or so.

“12, 11, 10, nine, eight, seven … ”

At 10 seconds, the darkness was punctuated by the bright cascade of sparks from the swirling hydrogen burn igniters, as they fired off to disperse unburnt gas in the vicinity of the main engine nozzles.

“We have a Go for main engine start … ”

With a familiar rumble and a sheet of translucent orange flame, Endeavour’s three main engines thundered to life. From the roof of the Launch Control Center, several miles away, Jones’ wife, Liz, together with their two children, the other crew families, and a handful of astronaut escorts braced themselves for the upcoming crescendo of sound and vibration. “In the growing light of dawn,” Jones recalled in Skywalking, “she saw the gout of orange exhaust flare beneath the orbiter and saw the steam billow from the flame trench as the engines spooled up to full power.”

“We have three main engines running … ”

All seemed normal. Then, with shocking abruptness, something went wrong.

“Three, two, one … and … we have main engine cutoff. GLS safing is in progress.”

As the Ground Launch Sequencer automatically kicked in to “safe” the vehicle, the three blazing engine bells suddenly fell dark and silent. For the third time in less than 18 months (and only the fifth occasion in the shuttle’s operational history), a Redundant Set Launch Sequencer (RSLS) abort had been called, after engine start, producing a hazardous on-the-pad shutdown. However, whereas previous aborts had occurred at around T-3 seconds, STS-68 had gotten down to a mere 1.9 seconds ahead of liftoff. Almost immediately, cooling water was sprayed onto the hot engines and the attention of everyone in the Launch Control Center was riveted upon the Main Propulsion System (MPS) fire detectors; if any of them had tripped, the abort carried the prospects of turning into a bad day, for a invisible hydrogen fire at the base of the main engines could easily spread across the pad and trigger an explosion. And that would demand a “Mode One Egress”: a hairy evacuation of the astronauts from the orbiter to ride slidewire baskets to safety.

“We have a cutoff of the main engines. The countdown clock has stopped.”

In the seconds which followed, an urgent flurry of acronym-laden communications passed between engineers, controllers, and managers in the Launch Control Center, and with the astronauts themselves aboard Endeavour.“We have main engine cutoff … RSLS safing is in progress … All three main engines are in post-shutdown standby … GLS is Go for orbiter APU shutdown … ”

The gathered spectators at the Cape watched in horror and alarm as the famous countdown clock starkly read T-00:00:00, yet no shuttle ascended into the heavens and only a large smudge of grey cloud rose ominously above Pad 39A. Then came the call which brought a measure of calm to the proceedings: “No MPS fire detectors tripped.”  There was no evidence of fire on the pad, meaning a “Mode One Egress” of the vehicle would probably be unneeded. The white room was moved back into position alongside Endeavour’s crew access hatch, to facilitate the departure of Baker and his men. Pilot Terry Wilcutt shut down the three APUs. Through Endeavour’s tiny side hatch window, Tom Jones could clearly see the Pad 39A gantry visibly swaying backwards and forwards; the vehicle was still rocking from the “twang” effect induced by the ignition of her main engines.

Following an engine replacement, Endeavour roared into orbit on 30 September 1994 (Credits: NASA).

Following an engine replacement, Endeavour roared into orbit on 30 September 1994 (Credits: NASA).

Had the engine shutdown been triggered a couple of seconds later—after SRB ignition—it would have placed the crew in an unenviable situation of having to perform the shuttle program’s first Return to Launch Site (RTLS) abort, riding the boosters for two minutes until their expiry, then separating from them and the External Tank to perform an emergency landing, back at the Kennedy Space Center. “The RTLS is a daunting prospect for the crew,” wrote Tom Jones. “We would have to fly the orbiter and attached ET through half an outside loop, then ride backward through our exhaust plume at Mach 5. Ditching the empty tank, we would then try to make it back to the Kennedy runway. No shuttle crew had ever flown such an emergency approach. None wanted to be the first to try.”

Since the Mission Management Team looked upon an RSLS in the same manner as an actual launch, the abort demanded a complete re-inspection of all main engines in the VAB engine shop and would produce a delay of approximately six weeks. Meanwhile, Dan Bursch, sitting in the flight engineer’s seat behind Commander Mike Baker and Pilot Terry Wilcutt, was even more unlucky, having also sat through the STS-51 pad abort, almost exactly a year earlier. Now, his STS-68 crewmates teased him without mercy and, according to Jones, “he lamented that no one would bother coming to another of his launch attempts.” In fact, Bursch would gain an unenviable reputation as the only astronaut to sit through two RSLS aborts in his career. In the hours and days which followed, the attention of technicians focused upon a problem with the No. 3 main engine’s High Pressure Oxidizer Turbine. One of its sensors detected a dangerously high discharge temperature, which exceeded the rules of the Launch Commit Criteria, and Endeavour’s computers halted the countdown after the Engine Start Command had been issued.

For the astronauts, it seemed their best bet of getting off the ground on 30 September was to convince Endeavour that the unlucky Dan Bursch was not aboard. As a result, when the STS-68 crew arrived at the Kennedy Space Center, a couple of days before launch, Bursch ensured that he climbed out of his T-38 jet in an appropriate “Groucho Marx” disguise. Things did not seem to be going well, for all of them, save Jeff Wisoff, had colds. In spite of the jinxed nature of their flight, 30 September turned out to be charmed, and Endeavour rose perfectly at 7:16 a.m. EDT, right on the opening of the 2.5-hour launch window. It was the last RSLS on the pad, with significant upgrades planned for the main engines in the following years … but the brutal truth was that the shuttle could never be operational or routine and would never be truly safe.

STS-55

More than seven years passed before the next RSLS abort, which came at the end of an otherwise uneventful processing flow of Columbia for STS-55, a joint U.S.-German Spacelab science mission. Shortly after arriving at the launch pad in early February 1993, an issue with tip-seal retainers on the main engines’ liquid oxygen turbopumps had come to light, necessitating their replacement, but by the morning of 22 March the astronauts and the vehicle were ready to go. The attempt to launch the mission that day proceeded smoothly, tracking a liftoff at 9:51 a.m. EDT. All seven astronauts were suited and transported to the pad, took their seats aboard the orbiter, and marched smartly through their checks. With 31 seconds remaining on the countdown clock, as planned, Columbia’s computers assumed primary control.

Six and a half seconds before liftoff, the ignition of the three main engines got underway with a low-pitched rumble. Within three seconds—dramatically, and accompanied by gasps from the assembled spectators and dignitaries—all three abruptly shut down. Subsequent analysis would point to the incomplete start of the No. 3 engine; a liquid oxygen pre-burner check valve had suffered a leak in the final seconds, causing the purge system to be pressurized above its maximum allowable limit of 50 psi. The culprit: a tiny fragment of rubber, trapped in an engine propellant valve. …

Columbia’s engines flare to life on 22 March 1993—20 years ago this week—in the third RSLS abort of the shuttle program (Credits: NASA).

Columbia’s engines flare to life on 22 March 1993—20 years ago this week—in the third RSLS abort of the shuttle program (Credits: NASA).

With unburnt hydrogen still lingering underneath the hot engine bells, the risk of a fire or explosion was very real. Seconds after the shutdown, the “white room” was automatically moved into position, alongside Columbia’s crew access hatch, preparatory to an evacuation. Although the astronauts had trained to escape from a pad abort and slide to a fortified bunker, the danger of having them evacuate Columbia and run through an invisible hydrogen holocaust prompted controllers to instruct them to remain aboard the orbiter. For 40 tense minutes, Commander Steve Nagel and his men remained strapped into their seats as ground personnel deactivated all electronic components. Paramedics were rushed to the pad as a precautionary measure, but for the astronauts all was well—albeit eerily still—within the swaying cabin. “I’d convinced myself,” Nagel said, “and all my crew that we were going to fly.” When the brief noise of the engines died, he called over the intercom to announce the abort to his crewmates. “I wouldn’t call it fear,” he said later about those adrenaline-charged moments. “There’s a couple of moments wondering what’s happened, because all you see on-board are red lights, indicating an engine shutdown. You know the computers shut down the engines, but you don’t know why or exactly what went wrong with them.”

The situation was equally tense in the Launch Control Center, where ashen-faced Launch Director Bob Sieck watched the proceedings. “Your initial reaction,” he said in the aftermath of the abort, “is to make sure there are no fuel leaks or that there’s nothing that’s broken that’s causing a hazardous situation. Really, it was one of those nice, boring countdowns … until the last few seconds. What did work, and worked very well, were the safety systems on-board. As a result, the crew is safe and the vehicle is on the pad and safe as well.” Nonetheless, the STS-55 crew emerged from the orbiter looking visibly shaken by the incident. It was becoming increasingly likely that a delay of at least several weeks would be needed to remove, replace, and test the engines, and on 30 March NASA announced the next shuttle mission—STS-56, a time-critical flight, scheduled for early April. In the meantime, Columbia’s engines were replaced with a set earmarked for the next mission of Endeavour, and STS-55 finally got its chance to fly on 26 April 1993.

STS-51 

“T-minus 30 seconds … ”

The words of the launch commentator at the Kennedy Space Center on the morning of 12 August 1993 were calm and measured, as all eyes focused upon Space Shuttle Discovery as she entered the final portion of the countdown to fly STS-51. The mission—a nine-day flight to deploy a NASA advanced communications satellite and release and retrieve an ultraviolet telescope, atop a Shuttle Pallet Satellite, as well as perform a spacewalk—had already been postponed twice, with the astronauts already aboard the vehicle. On 17 July, a flaw in a pyrotechnic initiator controller, needed to trigger the release of the SRBs from the launch platform, had forced the first scrub. Troubleshooting later identified a thermal instability issue in a solid-state switch card in the ground support equipment, and after replacement and testing the launch was rescheduled for the following week.

“Standing by to activate the sound suppression water system in five seconds … ”

The second attempt to get Discovery into space on the 24th also proved fruitless, due to an out-of-specification turbine “underspeed” condition in a hydraulic power unit in the right-hand booster. As a result, the countdown was automatically halted at T-19 seconds and the attempt was scrubbed. Due to the July-August Perseid meteor shower, associated with Comet Swift-Tuttle, NASA decided to stand down from making a third launch attempt until the second week in August. It was known that the Perseid debris field would pass closest to Earth on the 11th, and the launch was rescheduled for 9:10 a.m. EDT the following day.

By 12 August, Discovery and her five-man crew were ready to go. The astronauts had closed and locked their visors and their eyes were focused intently on their instruments. Despite a two-and-a-half-minute hold in the countdown at T-5 minutes, due to lost synchronization lock between the Mission Control in Houston and the Merritt Island Launch Area, everything proceeded smoothly. With five minutes remaining on the countdown clock, Pilot Bill Readdy reached over and switched on the Auxiliary Power Units. The trio of hydraulic pumps hummed to life, bringing life, muscle, and control to the shuttle’s hydraulics. The shuttle’s on-board computers automatically commanded a final series of checks on the three main engines and the elevons on the wings. Thirty-one seconds before launch, control of the countdown was handed off to Discovery’s General Purpose Computers.

Discovery rockets into space on 12 September 1993, exactly a month after her harrowing pad abort (Credits: NASA).

Discovery rockets into space on 12 September 1993, exactly a month after her harrowing pad abort (Credits: NASA).

“T-minus 10, nine, eight, seven … ”

The mission for which they had spent the last 18 months training was finally about to begin. Seated at the front of the flight deck, Readdy and Commander Frank Culbertson were the only veteran members of the crew, but behind them was Mission Specialist Jim Newman, who had been a simulation supervisor before his selection as an astronaut. “Sim Sups” have long gained a measure of notoriety among astronauts, since they are responsible for introducing all manner of contingencies and failures into training exercises to keep the crews’ skills sharp. According to Tom Jones in Skywalking, Newman could not resist bringing a little of his Sim Sup expertise into astronaut candidate training. During one simulator session with Jones and legendary astronaut John Young, Newman mischievously pushed the main engine shutdown switches with his “swizzle stick.” This obliged Young to execute an abort landing in a simulated Ben Guerir, Morocco. Jones wondered what Newman was playing at. “Why would you want to kill an engine on the most senior astronaut, the first man to command the shuttle?” he wrote with incredulity. “Finally, Newman lost it; he burst out laughing as he confessed that he was the real culprit. Newman, the former instructor, had just been keeping his hand in, feeding Young one last malfunction. What surprised me was that John loved the practical joke.”

“Go for main engine start … ”

Now, on 12 August 1993, Newman was experiencing the final seconds of a countdown for real. Inside the cabin, the astronauts felt the immense vibration as turbopumps awoke, liquid oxygen and hydrogen flooded into the engines’ combustion chambers, and they roared to life … and then fell silent.

“ … Three … We have a main engine cutoff … Safing in work … ”

Abutting Newman’s left shoulder at the rear of Discovery’s flight deck was Dan Bursch, who would go on to become the only astronaut to endure two of these hair-raising aborts. The communications loop from the Launch Control Center carried a flurry of messages. As the RSLS abort was commanded, Discovery’s three main engines were verified to be in “Post-Shutdown Standby,” and Bill Readdy acknowledged the call to perform the shutdown of the orbiter’s Auxiliary Power Units. No fire detectors on Pad 39B were tripped during the incident, which would later be traced to a faulty fuel-flow sensor in Discovery’s No. 2 main engine. The engine had posted a “major component failure,” caused by the sensor glitch about 0.6 seconds after ignition. “This condition,” noted NASA’s official STS-51 Mission Report, compiled and published after the flight, “caused a miscompare which violated the Launch Commit Criteria … As a result of the failure, the engines were shut down and safing activities were initiated.”

“Orbiter access arm now back in position … ”

Shortly thereafter, the five disappointed astronauts departed Discovery, aware from previous RSLS events that their launch had been called off for several weeks at best. The main engines were replaced and an attempt was provisionally scheduled for 10 September, but this was itself slipped until the 12th. Liftoff was, recalled Jim Newman, “exhilarating,” but the RSLS had given him and his crewmates a grueling rite of passage.

From June 1984 until August 1994, five shuttle crews sat through such aborts on the pad, with Atlantis left as the only orbiter not to suffer one in her career. By the middle of the 1990s, upgraded main engines and improved processing and inspection techniques ensured that no other RSLS situations hit the program, although STS-93 in July 1999 came close to a shutdown after liftoff. The shuttle’s fallibility was evident and the dangers of the main engines remained just that—a danger—until the very end of its career.

– By Ben Evans