Breaking the [Flight] Rules

The official NASA history of STS-109 can be found on the agency web page: 

STS-109

The last part of that official account reads: 

“After a successful launch, flight controllers in Mission Control noticed a degraded flow rate in one of two freon cooling loops that help to dissipate heat from the orbiter. After reviewing the loop’s performance, mission managers gave the crew a “go” to proceed with normal operations. The problem had no impact on any of the crew’s activities. Both cooling loops performed normally on de-orbit and landing.”

The official NASA description of what happened on STS-109 is a lie.

I should know.  I was there. 

Marianne Dyson and I worked together in Mission Control in the early days of the Space Shuttle program.  She had been in touch with Jim Newman, a crew member on STS-109.  Jim asked her if she knew how she figured in STS-109 even though she was not working in MCC.  Marianne asked me to fill in the story. 

Marianne: ‘I was in the Flight Activities Branch and was the book manager for the Post Insertion (nominal) timeline, Launch Day Deorbit, Loss of FES Deorbit, Loss of 2 Freon Loops Deorbit, and ‘If BFS Omit’ procedures. I was responsible for developing and validating all those procedures for STS-1, 2 and 3.’

These were serious and complex checklist procedures for the astronauts to use in flight.  Post-Insertion covered the period just after launch when the crew was turning the Space Shuttle into an operational orbital outpost.  The Deorbit procedures were all failure responses.  Of all the checklists in the pantheon of Space Shuttle procedures, the very hardest to perform was the dreaded ‘Loss of Two Freon Coolant Loops’ power down and deorbit procedure. 

To understand, a short discussion of the Flight Rules is necessary.  By training and practice the adherence to Flight Rules was burned into the culture of Mission Control.  Careful consideration prior to any mission went into the development, review and approval of Flight Rules.  During a flight, it was considered a cardinal sin to break a Flight Rule.

Buried deep in the book, page 18-105 (or as my electronic version has it, page 1947 of 2053 total pages), the operative words are found in a table (background rationale following in italics): 

Space Shuttle Operational Flight Rules  Volume A   All flights

Rule A18-1001 Thermal Go/No-Go Criteria

 FCL (2)         

Ascent Abort if:          Invoke MDF if:     Enter NPLS if: 

2 Lost                                  —-                               1 Lost

Loss of one Freon loop requires a PLS because the next failure (loss of other Freon loop) could result in loss of crew/vehicle.

Nominal ascent is continued so that more time is available to reconfigure for a one Freon loop entry and also because loss of one Freon loop is not an emergency. If both loops are lost, an emergency entry (ascent abort) is required because all cooling to the vehicle is lost.

If both Freon loops are lost, an emergency entry is required because the FC stack temperatures will reach the specification operational limit of 250 deg F within approximately 50 minutes. In addition, the electrolyte will reach the 25 percent operational limit in approximately 75 minutes. At this point, continued operation of the FC’s is questionable. This assumes . . .

To decode:  this Flight Rule required an immediate abort during the launch phase if two Freon Coolant Loops fail:  either Return to Launch Site, Trans-Atlantic Abort, or Abort Once Around depending on when the failures occurred.  Loss of only one FCL during launch did not require an abort but entered into the next step.

During the ‘on orbit’ phase of the mission, the failure of one of the two freon loops would result in ending the mission, planning a landing at the Next Planned Landing Site (NPLS) which by definition was within 24 hours.  A PLS landing was always to one of our three primary sites:  KSC’s Shuttle Landing Facility in Florida, the Edwards Air Force Base in California, or the White Sands Space Harbor in New Mexico.  Weather and timing would determine which of the three to use.  NPLS minimized the time exposure to the failure of the remaining good loop balanced with the safety of returning to one of the best landing sites.  A third category for some failures involved something called a Minimum Duration Flight but that was not an option for this equipment. 

As an aside, if both of the freon loops were to fail while on orbit, perhaps while waiting for NPLS, other rules mandated an emergency landing as soon as possible.  ELS sites were identified all around the world but did not have the equipment, long runways, and weather forecasting capability that the PLS sites did.

Since my copy of the Flight Rules dates from late in the program, it documents the history of STS-109. Section 18 contains a definition of ‘loss of a freon loop’ with 3 full pages of background ‘rationale’ (all in italic) describing what happened on STS-109 and the subsequent engineering analysis.

The Space Shuttle was an electric airplane; nothing happened without electricity.  There was no control, no anything without the electrical power generated by the three fuel cells.  Batteries were non-existent.  If the fuel cells did not make electricity, the shuttle was a rock. 

Fuel cells combine hydrogen and oxygen to produce electricity, water, and lots of heat.  That heat had to be removed to condense the water vapor in the fuel cells so it could be removed.  If the water was not removed, the fuel cells would ‘flood’ and the chemical process would stop working, electrical generation would cease.  The Freon Coolant Loops (FCL) circulated freon as a fluid to collect the heat generated in various parts of the orbiter and transport it to the radiators or the flash evaporators where the heat was dissipated out into space.  For redundancy the orbiter had been designed with two loops and each of those had two redundant circulating pumps. 

Mission Operations made sure that there was a crew checklist procedure for each and every single item that could break or otherwise fail on the orbiter.  Starting before the first Space Shuttle flight, the Mission Control team built step-by-step procedures which were documented, tested, practiced, and validated.  Which is to say, proven to work properly with either engineering tests or rigorous numerical analysis. 

In a very few cases, there were procedures written for two failures.  Since the loss of both freon loops could be catastrophic in a very short time, quick but complex action had to be taken by the crew.  This was one of the few checklist procedures to address two like-systems failures.  Marianne and a host of other folks worked diligently to provide a way out of that terrible situation.  The Loss of Two Freon Loops procedure required powering down much of the electrical equipment on the orbiter to both conserve electricity and reduce the heat generated which had to be removed.  The checklist was extremely complex, time consuming, and – worst of all – attempts to validate it were unsuccessful. In other words, working the checklist completely ‘right’ was unlikely to succeed. The probability of LOCV was high. 

LOCV – Loss Of Crew and Vehicle.

That is all background to what happened on March 1, 2002. 

STS-109 was a mission to service and repair the Hubble Space Telescope.  The crew and Mission Control team were well trained, excited about the mission, and dedicated to leaving the Hubble in perfect condition.  The Hubble Space Telescope Operations team was anxious to get their instrument fixed.  Prelaunch had been difficult with launch scrubs due to weather and technical issues.  When STS-109 finally left the ground all of us were pleased.

Ascent Flight Director for the mission was my good friend and colleague John Shannon.  The Lead Flight Director was Bryan Austin.  I was assigned to be the Mission Operations Director.  This was a replay of the team on STS-93, when I got launch fever.  I was determined not to fall into that again.  See https://waynehale.wordpress.com/2013/10/31/keeping-eileen-on-the-ground-part-ii-or-how-i-got-launch-fever/

My position as MOD was to coordinate with the other members of the Mission Management Team.  During the countdown and launch, everybody on the MMT except the MOD was in the Firing Room at the Launch Control Center in Florida.  The MMT included the Space Shuttle Program Manager, the JSC, KSC, MSFC, and SSC Center Directors, the Orbiter Project Managers (and project managers of all the other shuttle elements), the Head of the Astronaut Office, the Chief of Space Flight Safety, and almost all the other senior managers in the Space Shuttle Program.  The MMT was charged with making the most important decisions, if time were available, regarding any Space Shuttle flight. The MMT was the only body that was allowed, after deliberation, to change a Flight Rule.

When the Public Affairs Officer refers to ‘mission managers’ he means the MMT.  The MOD is not authorized to act without their direction.  Flight Rules are always to be followed unless the MMT rules otherwise. 

Since the countdown had gone so well, and the launch had been delayed, the MMT was really anxious to get home – back to JSC, MSFC, or SSC – as soon as the launch was over.  After nominal cutoff of the main engines (MECO), the management team had few short speeches, took part in the ceremony of the beans and cornbread, and quickly headed to the Shuttle Landing Facility to board the Gulfstream II management aircraft for the flights home.  Very limited to no communication was available while they were in flight.

In short, those of us in Mission Control were without senior leadership direction for those hours. 

Mission Control never considered ‘ascent’ to be over until after the OMS-2 burn put the orbiter into a stable, non-re-entry orbit, and completed various other critical tasks.  Among those required was closing the ET umbilical doors on the belly of the orbiter; changing the onboard computer system from launch to on-orbit software configuration; opening the payload bay doors and establishing freon loop cooling through the radiators; checking out the star tracker navigation system.  When all those items were completed, the crew was given a ‘go for orbit ops’.  Their first step after that was usually to get out of the bulky launch/entry pressure suits, activate the toilet, and start putting away the chairs on the middeck.

Sometime after MECO, sometime after the MMT got on the airplanes, but before getting a ‘go for orbit ops’, the EECOM (Environmental Electrical, Consumables Manager) spoke up.  Responsible for the cooling on the orbiter, he pointed out that one of the freon coolant loops was not operating at full flow.  The flowmeter in Freon Coolant Loop #1 was showing a flow of only 200 lbs./hour.

The failure limit defined in the Flight Rules was anything less than 211 lbs./hour. 

Technically, legally, analytically, FCL #1 was considered failed. 

Things got very quiet in the Flight Control Room. 

We all knew what that meant. 

At that point, theoretically, the Flight Director should declare a First Day PLS (Planned Landing) and the crew should start working the procedures to land at Edwards AFB on orbit 3.  The timing of the discussion made that dicey; starting down that path would have required a rush job to be ready to retrofire in about 90 minutes.  Also, theoretically, the crew should be directed to perform the Loss of One Freon Coolant Loop power down which was long and involved turning off quite a bit of the redundant equipment. That would leave the vehicle open to other failures. 

The Ascent Flight Director started doing what any good FD will do – asking a lot of questions of the EECOM.  It was the EECOM’s opinion that the Flight Rule was ‘conservative’, the flow rate was just below the limit, and there was enough flow to at least consider continuing.  Flight strongly wanted to get to a stable situation and sort options out. 

There was a short discussion with the crew about potential power down.  They were told to pull out the loss of one freon coolant loop checklist and review it, but take no action just yet.

Here is the crux of the situation:  if the other freon loop – the good one – were to fail, quit, leak, whatever; would the questionable freon loop provide enough cooling to avoid the dreaded 2 Freon Coolant Loop procedure? 

Maybe.

As John remembers it: “Definitely one of those “is it failed or not” cases and of course being stable on-orbit while you figure things out is not a bad idea.” 

The Flight Director turned around and leaned over the MOD console.  John looked at me and said: ‘better tell the MMT’.  But I couldn’t.  They were in the air. 

A decision was required. 

I punted.  I asked John what he recommended.  He was inclined to continue on rather than terminate.  I told him I concurred and the flight should continue.

Later on, I did get to have a long conversation with the MMT.  Much engineering analysis was turned on and worked on very hard during the entire mission. 

FCL #1 never regained full flow during flight.  So much for ‘Both cooling loops performed normally on de-orbit and landing.’

In the end, all the analysis indicated we made the right decision.  As John recently discussed: “This would be a good case for why you have a flight control team instead of just programming the flight rules into a computer. Human judgment and risk trades are critical to spaceflight operations.”

Indeed. 

In a pinch, the low-flowing freon loop would have provided just enough cooling by itself, with an appropriate powerdown, to avoid disaster.

But that does not change the fact that we broke the Flight rule that day.

Weeks after the flight, after all the engineering analysis was complete and double checked, the flight rule was revised.  The new limit at which a FCL is considered failed was 163 lbs./hour, less than the old limit of 211 lbs./hour. New procedures were written and passed validation.  Much work was done in case the situation should ever happened again. 

It never did.

But the decision on STS-109 launch day wasn’t made by ‘the mission managers’.  It was John, EECOM, and me. 

One final change:  when it came my turn to set the rules for the MMT, I added one more step after launch: the MMT had to stay on station at KSC, where there was data and good communications, until after the ‘go for orbit ops’.   

Putting Atlantis At Risk

Warning: A long story that has a lot of technical details – and a moral.

Reflecting on my career as a Space Shuttle Flight Director, there were many difficult decisions to make and sometimes some terrifying results.  Putting peoples’ lives at risk and potentially destroying complex and expensive vehicles paid for by the US taxpayers was a daily possibility for every decision made.  Sometimes the consequences were only clear in hindsight.

Fifteen years in the NASA Space Shuttle Flight Director’s office, I supported missions during the on-orbit phases which was always fun, sometimes frustrating, but only rarely worrisome. 

Prior to launch, during the countdown, all the problems really belonged to the Firing Room team and the Launch Director down in Florida.  They had to prep the vehicle and make sure every little piece was working as it should or the system would scrub for the day.  I had only to think about the weather at the abort landing sites – an interesting problem but almost always clear cut:  Go or No-Go. 

To prepare for the flying part of a shuttle launches, my team and I practiced very hard.  The training team would throw problem after problem into every launch simulation.  (See my earlier post ‘Nexus of Evil’ https://blogs.nasa.gov/waynehalesblog/2010/02/16/post_1266353065166/).  When we could proficiently handle each individual problem, the trainers would throw in combinations of problems, more and more and more.  Until we cried ‘uncle’ and past that.  Until we could respond almost automatically to any number of combinations of multiple situations.  Frequently the training days ended with sweat and pounding hearts as if we had been at the gym instead of sitting comfortably under the air conditioning; the work was mental and sometimes psychological. 

During the launch phase (a bare 8 ½ minutes) there was precious little time to think, the responses had to be conditioned in, automatic almost.  In the end, every one of ‘my’ launches in reality was uneventful with no significant problems.  At the end of a real flight day, I sometimes felt that our training had been wasted.  But we were prepared. 

On the other hand, being the Flight Director for the Entry phase of a Space Shuttle flight was the most nerve-wracking job that I ever had.  Takeoffs are optional, landings are mandatory.  With the shuttle in flight entry and landing was inevitable.  Planning and evaluation of potential opportunities, starting before flight, went on the entire mission.  While the three-team rotation of on-orbit flight controllers worked to make sure that the payloads were deployed, the science experiments were performed, etc., etc., the Entry team and its Flight director would come into MCC every day to plan, evaluate, discuss, and digest all the possibilities. 

Evaluate the situation if anything on the orbiter was broken – rarely.  Talk with the landing site folks at the primary and backup sites to gauge the readiness of equipment and personnel at the runways – regularly.  Spend a lot of time in the weather office looking at forecasts – always.  Did you know that meteorology is an inexact science?  We had the best forecasters in the world, but when the landing was more than a few days away pondering forecasts was an exercise in futility – they always changed. 

As the day of landing grew closer, the forecasts were scrutinized to an increasingly minute degree.  All the senior NASA management felt that they were amateur meteorologist and felt free to provide opinions.  But only one person had to make the decision.  Pressure grew daily.  A lot of time was spent at the coffee pot in the hallway outside mission control debating the options with various astronauts, managers, schedulers, and other interested parties. 

About 3 days before landing, we had to commit to send the convoy team to one of the three sites in the US we guessed to be best.  If Florida, we could use the Shuttle Landing Facility at Kennedy Space Center with its single long runway.  If California, the Edwards AFB/Dryden Flight Research Center where they similarly had a single long paved runway but many other options on Roger’s dry lakebed.  The least used option was New Mexico with the hard-as-concrete gypsum dry lakebed runways at White Sands Space Harbor aka Northrop strip.  We only landing a shuttle at WSSH once and it was always the lowest priority in our thinking, fewest number of personnel, least facilities.

Edwards, like the SLF, had one concrete runway that was twice as wide as any normal big airport featured, twice as long as the typical airport runway, and specially constructed to bear the weight of extremely heavy aircraft landings.  But the concrete runways were singletons:  they pointed one direction.  The problem was that winds could come from any direction; not just straight down the runway but across it.  A crosswind could sometimes exceed the maximum allowable for the shuttle: 12 (later 15) knots (nautical miles per hour).  Without a runway in a different direction, well, the landing site was unusable.  At the SLF, surrounded by the swamp, you had to have the winds just right.

Edwards famously had Rogers Dry Lakebed.  The Air Force annually scribed out a large number of ‘runways’ on the hard surface of the lakebed.  They ‘painted’ with asphalt side stripes, threshold markings, and – for the shuttle – aimpoint markings.  To be considered for a normal landing (not emergency) we also required various indicator lights to be set up on a runway and, for the best change at landing, microwave beam scanning landing system (MSBLS) huts that gave precise angle information to an approaching shuttle.  Unfortunately, at Edwards, there were far more runway options than we had equipment.  Generally, only a couple of the lakebed runways were ‘instrumented’ which put them on the candidate list for places to land. 

Oh, and just one more thing.  Rogers Dry Lake sometimes was not dry.  In most winters the rains filled the lake, not very deep, but enough.  When wet – or even damp – the lakebed surface was too soft to land a shuttle.  The tires would dig in, perhaps snap off, maybe make the vehicle tumble.  So, among the criterion for using runways on the lakebed, the first was they had to be dry and hard.  The Air force provided us with the services of their geologist who use various instruments to test the load bearing characteristics of the lakebed. 

Who would have thought?

Runways are designated by the compass direction they point:  for example, runway 33/15 runs northwest to southeast.  An aircraft on the runway would show its compass heading as 330 degrees (northwest) or if pointed the other way at 150 degrees (southeast). 

STS-37 flew in early April 1991 and Rogers Lakebed was just drying out.  Since the prevailing winds in California blew from west to east, the waters had been pushed to the eastern side of the lakebed and the western side started drying out earlier.  We had some confidence that the most western of the lakebed runways 33/15 might be usable, but the geologist had to do his testing.

Just as an additional consideration, the shuttle program had never used lakebed runway 33/15.  The pilot astronauts took turns in the Shuttle Training Aircraft – which flew the final approach like an orbiter – and spend many hours – days – weeks – practicing landing at the runways likely to be used.  Edwards 33/15 was never on the list.  Nobody had ever trained to land on that runway.  Think about that as a potential problem.  It was not shown in the Flight Maps and Charts book that the commander on orbit could consult and become familiar with. 

As the day of landing approached, it was clear that weather was going to be a problem, as usual.  KSC had No-Go forecasts of rain, low clouds, and wind for several days in a row.  This forecast turned out to be accurate. WSSH similarly had unacceptable landing weather.  Edwards looked really with clear skies and no thunderstorms or rain of any kind in the forecast.  But strong north winds blew almost directly across the concrete runway situated east-west (22/04), far exceeding the crosswind limit.  Only the lakebed runway 33/15 pointed in the right direction, if it was dry and hard enough to use. 

The first or normally planned landing day, when we could not consider using the lakebed runways, I had to make the call to wave off for 24 hours – it was just too bad everywhere.  This was not a hard call.  Its easy when its clear; the hard part comes when its marginal.  Crews generally appreciated a wave off if it was called early – they got a day in orbit to rest from a hard paced mission, look out the windows and take pictures, and generally enjoy being in space.

There were limits on how long the Space Shuttle could stay in orbit:  oxygen, water, food, and the Lithium Hydroxide canisters which removed Carbon Dioxide from the air:  all were limited and being used at a substantial rate.  We needed to land soon.

On the +1 day as we called it, the stakes were higher. 

During the wave off day, the geologist completed his evaluation and reported that the 33/15 runway was hard enough to bear the weight of a shuttle landing.  The ground crews scrambled to move approach lights and other navigational aids – but not the MSBLS – to the end of the runway we might use:  the southern end which would put the wind right on Atlantis’ nose.  They were NOT able to respray the asphalt markings.  Those markings, vital cues for a pilot to make a good landing, had been dimmed by the winter rains.  We sent a seasoned astronaut commander to fly the STA and evaluate – all in all the 33-runway was deemed acceptable. 

Remember, we had never used runway 33 before.  And, as it turned out, never would again. 

No pressure on the Flight Director.  No sirree, no pressure.  Never let them see you sweat. 

On deorbit day April 11 I ordered the crew wake up early enough to try to land at KSC in case the weather cleared.  No such luck.  An hour and a half later would be the first opportunity at Edwards. I spent my time between sitting on the console, pacing back and forth, getting briefings on the STA runs, visiting the weather office in person for updates, and having those ad hoc meetings at the coffee pot. 

Too much coffee was consumed. 

There was only one runway in the continental United States that would be go for a shuttle landing that day.  The wind was right down the runway 12 gust to 18 knots, no crosswind. 

But wait.  It gets more complicated. 

Every hour or so a weather balloon is launched at the landing site and tracked it measure the winds aloft as high as 50,000 ft.  On that day the upper winds were ugly, high and shifting.  Worse, there was a tremendous shear in windspeed and direction just above 10,000 ft.  The measured winds aloft exceeded anything previously analyzed for a shuttle landing.  

No pressure, right.  Don’t let my cardiologist know. 

The Space Shuttle Orbiter is a 100-ton glider that has only one shot at making a successful landing.  After the deorbit burn which occurs an hour before there was no way to delay, no go-around possibility, no second try.  Theoretically possible to ‘redesignate’ to another runway, there wasn’t even an emergency runway with acceptable conditions anywhere near Edwards.  To say that the shuttle would be committed was an understatement. 

During shuttle landings, the autopilot is in control from the start of reentry down to about 70,000 ft.  At about the point the shuttle drops below the speed of sound, the commander takes manual control and flies the rest of the way down to landing – which is only 2 ½ minutes.  Very shortly after taking control, the commander starts a turn to align with the runway.  An imaginary cone in the sky – the Heading Alignment Cone – is mathematically displayed to the commander.  On this approach on April 11, we planned for him to make a right turn of ¾ of a circle – 271 degrees.  Commanders sit on the left of the cockpit so they prefer a left hand turn to see the runway as they turn; we planned for a right hand turn to conserve energy.  This meant the commander he could only look at the instruments for flying cues. 

Every time we got balloon data, the mission control team ran a simulation of an automated landing.  We used the autopilot model because we had no way to predict what a real man-in-the-loop pilot would do.  Use of the autopilot for the final part of entry was not allowed because it had certain well-known limitations, and it would not perform well without a MSBLS – which we did not have installed on runway 33. 

But doing a computer simulation using the autopilot all the way to landing gave us critical information about the affects of the upper air winds on the one and only landing attempt that the commander could make. 

After rolling off the HAC and onto the final approach at about 12,000 feet, the shuttle dives to gain speed, using one of the ‘aimpoints’ painted on the lakebed the commander puts the nose down to a glideslope of 19 degrees – 6 times steeper than commercial airlines.  Gaining speed to about 290 knots until the commander starts his pull up at about 2,000 feet to set up for landing.    

Normally the commander is diving at the ‘nominal aimpoint’ – in this case a large black triangle painted in asphalt on the lakebed surface about 7,500 feet from the runway threshold.  Speed – which is synonymous with energy at this point – is controlled by the rudder/speedbrake on the tail of the orbiter.  The automated system checks to see if there is enough energy to make the landing at the criteria desired – 2500 feet past the threshold at 195 kts.  The automated system will open the speedbrake if the energy is too high and close it down if the energy is low:  15% is the minimum setting if the energy is low; it is desirable to approach with the ‘boards’ open to about 20 to 30%. 

If the energy is evaluated to be low from the balloon data, the commander will change to the ‘close in aimpoint’ which is 6,500 feet from the threshold, thus picking up 1000 feet of margin to touchdown.  In even lower energy situations, the commander can stretch the landing by going as low as 185 kts – which gains another 1000 feet in equivalent touchdown distance.  All this to try to get to our normal touchdown point 2,500 feet past the threshold.

The simulations predicted that the landing would be ‘low energy’.  Using the forecast winds the simulation needed the close-in aimpoint and the speedbrakes were full closed all the way down yielding a touchdown distance of 2380 feet past the threshold at 195 knots.  All ‘go’ by the flight rules but with yellow flags indicating caution all around. 

The only options left for such a low energy day would be allowing the touchdown distance to go as short as 1,100 feet past the threshold – considered the minimum for safety – and holding off landing for another 10 knots of airspeed to 185 knots.  Those were it.  The coin of the realm in these situations is distance past the threshold and our purse was almost empty. 

Using the data from the first balloon – at 4 hours prior to touchdown – the situation had deteriorated.  Again, using close in aimpoint, closed boards, the touchdown distance was predicted to be 1800 feet at 195 knots.  Still ‘go’ but getting a brighter shade of yellow. 

My blood pressure ticked up. 

At Edwards the Shuttle training aircraft was flying mimicking a shuttle landing.  The first approach the aircraft would not go into simulated shuttle mode so no touchdown data came in.  The experienced shuttle commander at the controls reported that the turbulence was not an issue and it appeared to be a good day to land. 

Using the L-2.5-hour balloon data the touchdown prediction had deteriorated to 1300 feet past the threshold – still ‘go’ but close to the 1100 foot minimum required by flight rules. We reported this result to the crew.

On his last dive at the runway, the STA pilot reported simulated touchdown at 1600 feet past the threshold which gave me some very slight sense of relief. 

Time to decide.  It always gets really quiet in Mission Control and all the senior managers had stopped giving advice.  It was my call. 

Knowing that the only runway on the continent where the shuttle could safely land had marginal energy conditions, I gave a “Go for Deorbit” to the Capcom to pass to the crew.  I knew that we could have safely waved off for a second day, but tomorrow’s weather forecasts were about the same.

A few minutes later the crew executed the deorbit burn and we were committed.  COMMITTED. 

While the shuttle was on its way down, we got our last update from the L-1 hour balloon data, touchdown 1800 feet past the threshold. Better. I began breathing again.

As the shuttle approached the HAC, the commander delayed by a fraction of a second turning onto the cone, something that was not at all uncommon.  However, flying outside the HAC increased the distance the glider would have to fly and thus made the energy situation even worse. 

Unbeknownst to us there was another phenomenon at play; the wind shear altitude had dropped from 13,000 feet to just under 10,000 feet.  This change in the wind speed and direction effectively robbed the orbiter of some energy. 

In the shuttle software, at 10,000 feet, there is a check of speed and distance to go which, if it is good, the guidance scheme transitions to what is called ‘approach and land’.  When the wind shear was at 13,000 feet the software detected the energy difference and directed the commander to fly more aggressively to make up energy and the A/L transition occurred on time.  With the wind shear below 10,000 feet, the A/L transition criteria was not acceptable and the guidance did not direct the commander to fly as aggressively. Rolling out on final the wind shear delayed the software transition which then did not indicate to the commander he should fly a more aggressive high lift/drag profile.

Coming down the energy situation just got worse.  The commander could see it, but we in MCC could not.  He pulled up at the right point, lowered the gear at the right point, but it was a long way to the threshold.  Too long.  The speedbrakes were closed and at the point the only option at that point was to hold off landing by holding the nose higher as the speed decreased.  Touchdown finally occurred at 166 knots – the second slowest in shuttle history.  The main gear slapped the lakebed surface some 623 feet short of the threshold of the runway.

Disaster?

We got lucky.  Every runway the shuttle was allowed to use has a 1000-foot underrun – safe space before the threshold.  On the lakebed where the stripes were rather arbitrary there were miles of safe landing space. 

It was a safe landing. 

I was unaware at how bad it had been.

It was several hours later when I got the call.  The first apology I made was to the commander for putting him in that position. 

We had been lucky when they paid us to be smart. 

We spent the next six weeks going painstakingly through the situation. 

I thought I was going to get fired for putting the crew at risk.  But the senior folks decided I had learned a valuable lesson. We had all learned a valuable lesson. 

We made many changes to the entry planning process.  One was to make sure the STA pilot reported if the A/L transition was delayed (it had been delayed during his dives but it was not reported to MCC).  Another was to steepen the glideslope by an additional 2 degrees to increase maximum speed before pullout to 300 kts to give more energy.

We trained the pilots to fly the HAC turn closer, although that had mixed success; that is partly what you get with a human in the loop.

But most important was to re-emphasize to Entry Flight Directors to use extreme caution when committing the orbiter to a landing.

It is not a job for the fainthearted. 

The next time we fly a winged vehicle down from orbit, I hope they don’t have to learn that lesson again. 

Terminal Count

Probably the most heart stopping moments in spaceflight occur at the final stages of a countdown to liftoff.  Will it go or not?  What happens once the engines start?  Success or failure or just wait for another day?  I lived through a number of shuttle launches – and launch attempts – and every time I watch a rocket launch – of any kind – when the clock ticks down to the final minute my heart starts racing.

For the Space Shuttle there were a series of documents which detailed how launch operations were conducted.  The most famous was S0007 (pronounced ‘Sue Seven’ or sometimes ‘S triple balls seven’).  The entire document came in five volumes.  In the days when we worked in paper, it took five 2-inch-thick binders to hold it all.  Every step was numbered and the responsible party was named for each step.  Most of my career was “Houston Flight” and I would answer to the NASA Test Director or the NASA Launch Director or the NASA Operations Manager on their communications ‘loops’ as required. 

In my Flight Director reference book was a copy – shown above – of Figure 13-3 ‘RSLS and GLS Interaction T-38 Seconds to T-0’.  Chockablock with important stuff because a lot happened in those last seconds.  At the final stages, it was all on automatic with the computers in control.

Two programs, the GLS (Ground Launch Sequencer) and the onboard RSLS (Redundant Set Launch Sequencer) played the final duet.  People were just observers, along for the ride.  There were folks that could stop the countdown if they found necessary, which happened several times for the odd items that were not monitored or controlled by the GLS and RSLS.  Memorably were the launch scrubs caused by the hazardous gas detection system (Haz Gas).  Almost everything required by the Launch Commit Criteria was automatically monitored. 

Onboard the Space Shuttle there were five General Purpose Computers.  For the launch phase, computer #5 was running the Backup Flight System.  The BFS was there to take over if there was a total failure of the ‘redundant set’.  The BFS did not have the command capability to launch the shuttle and was really only in listen mode prior to liftoff.  Computers 1 through 4 were all running the same software at the same time in lock step; they comprised the ‘Redundant Set’.  The RSLS was only one of many programs running in the ‘redundant set’ computers during the prelaunch phase also known as Major Mode 101.  To continue to launch – and fly safely – all four computers had to agree.  If any one got out of sync or gave an incorrect command, or failed to listen to the others, the RSLS would detect that and issue a hold so that no launch would occur. 

On the chart the top half details what the RSLS is doing and the bottom half details what the GLS is doing.  Commands could be given once or ‘continuously’ (every computer cycle) for a given period of time.  Likewise, telemetry of critical items could be checked (verified) once or ‘continuously’ (CFVY) every computer cycle of 40 milliseconds for a specified period of time.

Time across the bottom starting at T-50 seconds with the first item:  a command that the GLS automatically commanded the big Liquid Oxygen and Liquid Hydrogen Fill & Drain Valves to close.  The ET should be completely full of propellant and no more would be added.  Looking a little later on the chart at T-34 seconds, the GLS would verify that those valves actually closed.  As always for any verification that failed, an automatic hold would be issued. 

Getting back to the time scale at the bottom, in big bold letters at T-31 seconds was the notation: “LAST AVAILABLE HOLD POINT”.  To this day, whenever I am watching the countdown of any vehicle, whether it matters to that system or not, my heartrate picks up significantly at T-31 seconds.  Like Pavlov’s dog I am conditioned to respond. 

There is also an interesting note in the box: “Onboard RSLS TBO Clock Stops Decrementing at T-6.6 sec; GND Clock continues.”  The RSLS countdown time displayed to the crew notoriously stopped at the command for main engine start.  After that point things either happened – or not -so quickly that human response did not come into play.

In the RSLS section is the long box “CVFY NO SSME 1,2, or 3 PAD DATA PATH FAIL, CHANNEL FAIL, or CONTROL FAILURE (EH, HL, OR MCF AND LIMIT EXCEED)” Each Space Shuttle Main Engine had two computers – prime and backup – which controlled the functions of the engine.  The Redundant Set had to have good data and command links with the SSME controllers – no data path fails.  Each SSME controller had to report that there were no failures in the control channels to its engine valves, and no detected major component failures (MCF), no redline exceedances either high or low on any engine temperature or pressure.  That is a lot to check on every 40 milliseconds from T-20 minutes all the way to T-0. 

Next, we will look at the detailed commands and verifications second by second. 

The GLS deactivates the SRB joint heaters – which were added after Challenger – at T-50 seconds.  At T-40 seconds the GLS cuts ground power to the Space Shuttle so that all the electricity must come from the onboard fuel cells.  Also, at T-40 seconds the GLS verifies that the Gaseous Vent Arm (GVA or the ‘beanie cap’) is fully retracted out of the way.  That beanie cap is on a long arm that stretches out over the nose of the External Tank to remove any vapors.  On the very last shuttle launch, STS-135, the indicator that the GVA was out of the way failed so we had a scary – but short – hold while people in the firing room manually confirmed it was out of the way. 

At T-31 we pass the last hold point – anything after that will be a launch scrub.  At T-31 seconds the GLS sends “LPS Go for auto sequence start”.  Launch Processing System is a generic term for the entirety of the ground system; the ‘auto sequence’ is the RSLS which takes precedence at that point. 

At T-30 seconds the GLS commands the hydraulic power units in the base of the solid rocket boosters to get ready to start; the actual start command comes at T-28 seconds. 

The RSLS, at T-28 seconds is doing a one-time check to see if it received the LPS Go for auto sequence start.  At T-27 seconds the RSLS starts another software sequence to open the orbiter vent doors.  Why?  As the shuttle launches, the outside air pressure decreases with altitude; there are motor actuated doors all along the sides of the shuttle that open to allow the pressure to equalize.  Otherwise, the structure would pop at some point.  Not be good.  Prior to launch, all the orbiter cavities are flooded with dry nitrogen gas to prevent any flammable leaks from catching fire.  Opening the vent doors too early would allow oxygen to get inside and the fire hazard would increase.  T-27 seconds allows all the doors to be fully opened if both electrical motors on each door function properly, operating on just one of the two redundant motors takes longer to open the doors.  If any motor doesn’t work, that door may not be fully open at liftoff and there was a huge debate early in the program about whether that would be OK.  Down at T-7 seconds the RSLS checks to see if all the vent doors are open.  We decided to scrub the launch if any vent door motor failed rather than start opening the doors before the last hold point at T-31 seconds and risk oxygen intrusion during a hold.  More than one flight held at T-31 seconds, there was never a vent door motor failure, so that proved to be a good decision that avoided potential fire hazards. 

At T-26 seconds the GLS commands the Liquid Hydrogen High Point Bleed valve to closed.  It would be bad to lift off with a leak in the LH2 system.   The GLS verifies that valve is closed at T-12 seconds. 

Then there is a blessed five seconds of calm.  It is the last quiet period before everything starts happening, seemingly all at once.

At T-21 seconds the GLS commands the SRB gimbal test.  With the hydraulics pressured up, those big nozzles are swiveled back and forth to make sure they work properly.  Starting at the same time the GLS begins continuously verifying that the SRB hydraulic turbines are running at the proper speed.  There are two turbines in each booster for full redundancy in flight but we decided not to launch unless both were working properly.  I don’t ever recall an SRB hydraulic unit failing in flight (they only run for about 2 and ½ minutes) but when I was the Shuttle Program Manager and found out that there had never been a test with only one turbine running, I mandated that one of the ground test firings in Utah shut down one of the two turbines and measure the gimbal response.  It worked fine.  That test only cost $2 million – which is a story for another day. 

At T-18 seconds the RSLS commands the safe and arm devices – which prevent an inadvertent pyrotechnic event – to arm.  This is for the SRB ignition and the ground umbilical release.  Hazardous phase truly initiated at this point. 

By T-16 seconds the SRB gimbal test should be complete and the nozzles back down at the null position for liftoff so the GLS starts continuously verifying that position down to T-0.  Also, at T-16 seconds the GLS activates the water deluge on the pad, the so called ‘sound suppression’ system.  This has different modes and the first activation is the ‘pre liftoff’ mode which is a trickle compared with what happens immediately after liftoff.

At T-15 seconds the RSLS begins continuously checking that all the pyrotechnic initiator capacitors are fully charged and ready to function.  Also starting at T-15 seconds the RSLS starts continuously checking that all the onboard computers have good data coming in from all over the vehicle (no MDM Return Word bypass). 

At T-12.5 seconds:  the RSLS starts continuously commanding valves in the Liquid Oxygen system that recirculate fluid to open, this continues every 40 milliseconds down to engine start time.  At T-9.5 seconds the RSLS checks to see if those valves are open. 

At T-12 seconds the GLS is also busy; it commands valves to close to terminate the helium fill going to the orbiter and the GLS also does a one-time check to verify that the rudder/speedbrake is in the launch position, the GLS locks down its command system to the SRBs and immediately removes any inhibits that were set.

At T-11 seconds the RSLS commands another software program in the onboard computers to start:  navigation.  The crew sees this as the ‘Eight ball’ display showing attitude goes to vertical.  At the same time the RSLS commands the main engine throttle settings to 100%.  The engines have not started yet, but when they do, they will aim to run at 100% of the rated power level.  For almost all of the shuttle flights ascent flight used 104% (or 104.5% for later flights) but the pad was only certified to 100% so the command to throttle up to 104% was one of the first things that the computers did after liftoff.

At T-10 seconds the GLS fires the ‘sparklers’ at the base of the launch pad to burn off any stray hydrogen vapors before the engines start.  Scrubbing at this point incurs about a week effort to replace those items.

Also, at T-10 seconds the GLS issues the ‘go for main engine start’ discrete.  We did a long study once that showed this was the last critical action of the GLS; a total failure of the ground computing system after this would not stop the shuttle from launching itself.  The RSLS is totally in charge now.

At T-9.5 seconds the RSLS sends ‘start enable’ to the main engines – get ready! At that same point the RSLS checks one time to see if each main engine indicates it is ready.  This is a complicated process that requires terminating liquid oxygen cooling to the engines – which occurred back at T-50 seconds when the valves were closed or really even earlier than this chart when LOX replenish was terminated.  The engines must be chilled to the right temperature for a smooth start and during replenish operations the engines are actually too cold.  When replenish ends, LOX from the External tank starts flowing into the cooling channels; this LOX is in the big 17-inch pipe coming down the outside of the ET.  Since it is outside, the LOX is actually a tad warmer than the LOX which was coming in from the ground tanks.  This allows the engines to warm up just enough so that the temperatures are in the ‘start box’.  When the main engine controller senses the right temperature, it issues the ‘engine ready’ discrete.  This what the RSLS is looking for.  On several flights where we were holding at T-31 seconds (after replenish was terminated) the engine temperature crept higher – out of the ‘start box’ and the engine ready discrete went away.  SCRUB!

Also, at T-9.5 seconds the RSLS starts continuously commanding the Liquid Hydrogen prevalves for each engine to open.  If they are closed, no fuel gets to the engine.  Continuously commanding those valves to the open position every 40 milliseconds until the engine starts.

A fraction later, at T-9.4 seconds the RSLS starts continuously commanding the Liquid Oxygen overboard bleed valves to close and continues this until the main engines start.  Remember the GLS had closed the equivalent on the liquid hydrogen side at T-26 seconds, an eternity ago.

At T-9 seconds the GLS deactivates the Liquid Hydrogen recirculation pumps and a second later at T-8 seconds the GLS shuts off its capability to command anything on the orbiter. 

At T-7 seconds the RSLS verifies that it has received the LPS go for engine start, and verifies that the LOX recirc valves are open, and starts continuous verification – for 0.4 seconds – that the engines are all in ‘engine ready’ mode, checks the vent door positions, and the prevalve positions and then the big show starts.

At T-6.6 seconds the RSLS issues the start commands to each engine:  engine 3, engine 2, engine 1 with 120 millisecond staggers.  The engine gimbals are commanded to override to prevent failures during the engine start transients.  From now to T-0 the RSLS will verify that no main engine controller has issued a ‘shutdown mode’ or ‘post shutdown mode’ discrete.  All the action turns to the main engine controllers which execute a tightly choreographed sequence of valve operations to safely start each engine and bring it up to 100% throttle.  Describing that sequence would take much longer than this paper. 

The forlorn GLS issues its last command to shut down the ground cooling units at T-6 seconds. 

At T-2 seconds the RSLS starts continuously checking to verify each main engine is reporting that it is running at greater than 90% throttle setting; there after the RSLS resets the engine gimbal commands to allow steering after launch to happen

At T-0 the last RSLS commands go out – fire the umbilical release pyros, fire the hold down post pyros, fire the ET vent arm disconnect pyros, and all in the same millisecond command window, fire the SRB ignition pyros.  Then reset all the controllers (Master Event Controllers – MEC) for the pyros.

As a flight director, I knew the next step – coming less than 40 milliseconds seconds after all those commands:  The onboard redundant set computer programs moded to the flight – first stage – phase; Major Mode 102.  The RSLS was done and turned off. 

A young Flight Director on console with the SOO7 document open on the console shelf – red binder.

The Most Important Thing

I have a good friend who flew helicopters in combat for the US Army.

His number one rule is “Don’t Do Stupid.” 

I think this is a good rule to remember. 

We have too much at stake in space exploration – among other fields – to allow people to do ‘stupid’. 

Maybe leaving critical bolts out of an aircraft fuselage.  That would be stupid.

Maybe ignoring foam coming off the rocket at launch.  That would be stupid.

Not checking your flight software in an integrated test.  That would be stupid.

Running out of propellant because your spacecraft control system fired the engines so many times they began to leak.  That would be stupid.

Flying a crew around the Moon when the spacecraft heatshield is suspect.  That would be stupid. 

Hey, the list is a long one. 

And I have been on the bus trip to Abilene along with other well-meaning but totally foolish people.   I’ve actually done stupid. Trust me, it does not turn out well. 

In the field of rocketry and spaceflight the energies are too large and the craft are necessarily frail that careful attention at every step is required. 

So, when listening to the various NASA officials in a press conference recently say over and over again that “Safety is Number 1” you may be surprised to find that I was totally irritated by that repetition.

You see I was schooled by experts in risk.  One of them, James Cameron, gave us a lesson that I will never forget.  He said:

“It’s absolutely necessary to use all of our accumulated knowledge to be as safe as possible, but safety is not the most important thing.  I know this sounds like heresy, but it’s a truth that must be embraced in order to do exploration: the most important thing is to actually go.”

If you want to be perfectly safe, you don’t go exploring.  I don’t think we should be that safe.

But don’t do stupid. 

Flight Delay

A few days ago, I wrote about ‘Protecting the Bird Sanctuary’.  I hope you read it. 

Because I told you that story just to be able to tell this one. 

I put this story in the ‘mostly true’ category – I was the Ascent Flight Director and can attest to my end of it.  But the real story belongs to NASA Astronaut Richard N. “Dick” Richards. 

It all started after Dick was kicked upstairs to a management job, his space flight flying days were over.  In its inestimable wisdom, the NASA senior management decided that a flown astronaut needed to make an appearance in American Samoa to encourage the children there to study science, mathematics, and eventually engineering.  Every astronaut (and many a Flight Director) has been the recipient of just such a public appearance assignment. 

Having completed the requisite talks with schoolchildren and teachers, Dick proceeded to Pago Pago International airport to take the flight to Honolulu and home.  But . . .  the flight was delayed.

By the Space Shuttle.   

How?

This time the shuttle had a very heavy payload which limited its trajectory.  It did not have a rendezvous mission so the launch window was long (2.5 hours or so), and the planned orbital inclination was low – which meant that the ET disposal area was in the central Pacific.

NASA had issued the Notice to Airmen (NOTAM) showing where the ET debris would fall and bracketed the times for the full launch window. 

An immutable principle for a shuttle launch required a safe place to land if one of the three main engines shut down early.  For a good portion of the powered ascent, this meant an abort landing at a designated site on the west coast of Africa or in Spain.  At a Trans-Atlantic Abort (TAL) landing site. 

For this particular flight we only had one TAL site.  Or rather, we only had one TAL site where all the navigation aids, convoy team, lights, etc., were in place.  The other potential TAL sites existed, but were not augmented with the proper resources.  Several of these other runways were out of reach given the trajectory and performance limitations on this flight.  At one the runway was being repaved:  you really would not want to try to land there!  On this day there was only one choice. 

Read the rules – I have attached a few pertinent extracts of the Shuttle Flight Rules.  Reading them, one might ask, ‘how did you ever get to launch a shuttle?’ 

As Mother Nature would have it, that one TAL site had unacceptable weather.  Not horrific, but clearly in violation of the Flight Rules.  In the rule excepts attached, I did not include the Landing Site Weather rule, A2-6 if you want to look it up.  It is the single longest rule in the book (21 pages) and without a doubt the most convoluted. 

The brilliant weather forecasters from the National Weather Service who staffed the Spaceflight Meteorology Group were the best in the business.  They could to make a forecast for a specific spot at a specific time with better than 95% accuracy.  On this day, the Weather officer held out hope that waiting until later in the launch window conditions might improve. 

We were all suited up and ready to play as it were, and had nowhere else to go, so we waited.  The Shuttle systems were all running perfectly, no concerns; the tank was loaded and topped off, no concerns; the weather in Florida was about as perfect as it could get there. 

Meanwhile, back in the Pago Pago airport, the passengers were restless.  The airline Captain for the flight came into the waiting room and explained about the Shuttle External Tank expected to fall directly in their flight path.  He had observed – from a great distance – the breakup of an earlier flight.  That convinced him not to take any chances!

So, the passengers fretted, and waited, and talked.  One of the passengers, in conversation with Dick Richards, asked if Dick could find out how long they might have to wait.  Dick, having been a Capcom on several flights, had the phone number for Mission Control so he called.  His fellow astronaut serving as the Capcom summarized the news about the weather.

Dick got the passengers together and explained it to them at some length.  When he was done, one of them summarized it this way: 

“Here we are in the South Pacific waiting to take off because our flight is delayed waiting for the Space Shuttle to launch from Florida, and the Space Shuttle in Florida is waiting to launch due to bad weather in Africa.”

Yep, that is about it.

I really don’t remember if we waited to the end of the window to launch or scrub.  I guess I need to check that.  I do know that I – the Ascent Flight Director is responsible for the Go/No-Go for Abort landing weather – I was totally unaware of the crowd in Pago Pago waiting on my decision.  Not that it would have made any difference. 

====================================================================

With apologies to the Disney people:

It’s a small world after all
It’s a small world after all
It’s a small world after all
It’s a small, small world

There is just one moon
And one golden sun
And a smile means
Friendship to ev’ryone
Though the mountains divide
And the oceans are wide
It’s a small world after all

It’s a world of laughter
A world of tears
It’s a world of hopes
And a world of fears
There’s so much that we share
That it’s time we’re aware
It’s a small world after all

It’s a small world after all
It’s a small world after all
It’s a small world after all
It’s a small, small world

=====================================================================================

SPACE SHUTTLE FLIGHT RULE A2-1 PRELAUNCH GO/NO-GO REQUIREMENTS

LAUNCH WILL BE NO-GO IF THE FOLLOWING CONDITIONS ARE NOT SATISFIED:

F. ACCEPTABLE LANDING CONDITIONS FOR REQUIRED ABORT LANDING SITES, REF. RULE {A2-2}, ABORT LANDING SITE REQUIREMENTS. IF AN ABORT LANDING SITE IS NOT MANDATORY, ACCEPTABLE LANDING CONDITIONS ARE STILL HIGHLY DESIRABLE AT THAT SITE. CONDITIONS WHICH MUST BE MET ARE:

1. NO VIOLATIONS OF THE LANDING SITE WEATHER CRITERIA (REF. RULES {A4-2}, LANDING SITE CONDITIONS, AND {A2-6} LANDING SITE WEATHER CRITERIA).

2. FOR ALL LANDINGS BUT FIRST OR SECOND DAY PLS, NO VIOLATION OF ENTRY ANALYSIS LIMITS INCLUDING:

a. APPROACH AND LAND TRANSITION (REF. RULE {A4-156}, HAC SELECTION CRITERIA)

b. NORMALIZED TOUCHDOWN DISTANCE (REF. RULE {A4-110}, AIMPOINT, EVALUATION VELOCITY, AND SHORT FIELD SELECTION)

c. TIRE SPEED/ROLLOUT/BRAKING LIMITS (REF. RULE {A4-108}, TIRE SPEED, BRAKING, AND ROLLOUT REQUIREMENTS)

d. NZ AND Q-BAR CONSTRAINTS (REF. RULE {A4-207}, ENTRY LIMITS)

3. ACCEPTABLE GROUND NAVAIDS (REF. RULES {A3-201}, TACAN REDUNDANCY REQUIREMENTS AND ALTERNATE TACAN SELECTION PHILOSOPHY; {A3-202}, MLS; AND {A2-6}, LANDING SITE WEATHER CRITERIA).  FOR THREE STRING GPS FLIGHTS ONLY, AN ACCEPTABLE GPS CONSTELLATION CONFIGURATION IS REQUIRED (REF. RULE {A3-204}, GPS CONSTELLATION).

4. ACCEPTABLE LANDING AND VISUAL AIDS (REF. RULE {A3-203}, LANDING AID REQUIREMENTS).

5. ACCEPTABLE CURRENT AND PREDICTED RUNWAY CONDITIONS (REF. RULE {A4-111}, RUNWAY ACCEPTABILITY CONDITIONS).

6. ACCEPTABLE COMMUNICATIONS FROM THE MCC TO THE REQUIRED ASCENT ABORT SITES. (REF. RULES {A3-52E}, MCC INTERNAL VOICE, AND {A3-156}, MCC/ASCENT ABORT SITE INTERFACE).

7. DAYLIGHT LANDING UNLESS CREW SPECIFICALLY TRAINED FOR NIGHT LANDING AND RELATED LANDING AIDS FUNCTIONAL (REF. PARAGRAPHS 3 AND 4 ABOVE). EXCEPTIONS ARE ALLOWED FOR AOA (IF NOT REQUIRED) AND FIRST DAY PLS.

SPACE SHUTTLE FLIGHT RULE A2-2 ABORT LANDING SITE REQUIREMENTS

CONTINUOUS SINGLE SSME OUT INTACT ABORT COVERAGE IS REQUIRED THROUGHOUT POWERED FLIGHT. PRELAUNCH ANALYSIS MUST DEMONSTRATE THIS CONTINUOUS SINGLE SSME OUT INTACT ABORT COVERAGE EXISTS OR LAUNCH IS NO GO PER RULE {A2-1}, PRELAUNCH GO/NO-GO REQUIREMENTS. THIS CONTINUOUS SINGLE SSME OUT INTACT ABORT COVERAGE MUST INCLUDE SYSTEMS FAILURE TOLERANCE AND BOTH SYSTEMS AND ENVIRONMENTAL PERFORMANCE DISPERSIONS AS REQUIRED. THIS CONTINUOUS SINGLE ENGINE OUT INTACT ABORT COVERAGE MUST BE TO A FULLY ACCEPTABLE LANDING SITE THROUGHOUT POWERED FLIGHT. THERE CAN BE NO PRELAUNCH PREDICTED SINGLE SSME OUT ABORT GAP BETWEEN LAST RTLS AND FIRST TAL NOR BETWEEN LAST RTLS OR LAST INTACT TAL CAPABILITY (TO A GO TAL SITE) AND FIRST PRESS CAPABILITY, AND NO GAP IN SINGLE SSME OUT PROTECTION FOLLOWING FIRST PRESS CAPABILITY NO MATTER WHICH OF THE FOLLOWING CRITERIA IS USED TO DEFINE PRESS CAPABILITY.

A. AN RTLS LANDING SITE IS REQUIRED FOR LAUNCH COMMIT.

B. A TAL LANDING SITE IS REQUIRED FOR LAUNCH COMMIT UNLESS THERE IS RTLS AND TWO ENGINE PRESS CAPABILITY OVERLAP. THEN A TAL LANDING SITE IS HIGHLY DESIRABLE.

IF AN ASCENT INTACT ABORT LANDING SITE IS REQUIRED, THEN ALL LANDING SITE REQUIREMENTS, AS SPECIFIED IN THE FLIGHT RULES, MUST BE SATISFIED.

Protecting the Bird Sanctuary

SPACE SHUTTLE FLIGHT RULE     A2-62       ET FOOTPRINT CRITERIA

DESIGN MECO CONDITIONS AND ABORT MODE BOUNDARIES MUST PROVIDE AN ET IMPACT POINT (IP) FOOTPRINT, INCLUDING 3-SIGMA DISPERSIONS, WHICH SATISFIES THE FOLLOWING CONSTRAINTS:

A. NOMINAL MECO TARGET: THE ET IP FOOTPRINT IS MAINTAINED AT A MINIMUM OF 200 NM FROM ALL FOREIGN LAND MASSES (EXCEPT THE FRENCH-HELD POLYNESIAN ISLANDS, WHERE THE MINIMUM CLEARANCE MAY BE REDUCED TO 60 NM WHEN DICTATED BY MISSION OBJECTIVES) AND 25 NM FROM THE PERMANENT ICE SHELF. ALSO, THE ET IP FOOTPRINT MUST BE MAINTAINED AT LEAST 25 NM FROM U.S. ISLANDS.

 Some days you protect the free world, some days you just protect the bird sanctuary. 

I was recently reminded of our work in keeping the world safe from falling External Tanks as another, current, organization grapples with upper stage disposal. 

The Space Shuttle system was completely reusable with one exception:  the External Tank.  Conceived to be analogous to the fuel drop tanks used by military aircraft, it was expended every mission.  The ET was designed to be both as inexpensive and light weight.  In its Super Light Weight configuration, it weighed 58,000 lbs. empty but could contain half a million gallons (735 tons) of cryogenic liquid hydrogen and oxygen in two separate tanks.  An intertank structure in-between housed a steel I-beam that held the entire flight vehicle together:  the reusable Orbiter holding the crew and the twin Solid Rocket Boosters. 

Theoretically capable of taking the ET all the way into orbit, some ambitious engineers envisioned making a space station out of empty ETs.  Maybe a topic for another blog post in the future.  But the biggest problem with the ET was how to get rid of it safely so that no one could be hurt by it falling back to earth.  The ET was jettisoned at nearly orbital velocity and traveled more than half way around the globe to reenter in a ‘broad ocean area’ where it would break up at around 250,000 feet altitude (45 nautical miles, or 75 kilometers high).  The very thin wall aluminum and foam insulation vaporizing in the heat, many large pieces would still make it down to the ocean surface:  the steel SRB I-beam, the 17-inch diameter LOX and LH2 separation valves, the sturdy structural attach points, and many more pieces. 

A key aspect of this story is the requirement, by tradition, treaty, and standard practice, is that a sovereign nation generally considers the waters withing 200 n. mi. of its shore to be its area of economic and military interest (their Exclusive Economic Zone – EEZ).  So, we were constrained to keep the pieces outside of 200 n. mi. from a foreign ‘land mass’ or in this case, an island.  For US territory we could come to 25 n. mi. from the beach, much closer. 

While the Orbiter used the smaller OMS engines to raise its orbit, the ET was on a ballistic path to destruction.  Early in the program this was a two-burn sequence (aka ‘standard insertion’) resulting in the ET falling into the Indian Ocean.  Later on, to get more performance out of the ET, the cutoff was changed slightly faster so that the Orbiter only needing one OMS engine thrust (aka ‘direct insertion’) to get to orbit while the ET splashed down in the Pacific Ocean.  Direct insertion (DI) was a way to get more payload weight to a higher orbit. 

Many times, NASA aircraft or other resources observed – at a distance – the breakup of the External tanks.  The films of the reentry breakups were spectacular. 

For reference you can watch:   https://www.youtube.com/watch?v=1fkeTULQAps 

Careful analysis of these videos led to a well-documented ‘debris catalog’ which was used in analytical computer programs to predict how far the parts might scatter.   This pattern was the so called 3-sigma debris footprint.  3-sigma because it statistically encompassed 99.74% of all possible scattering of the parts.  Analytically the footprint was almost 1,400 n. mi. long by 30 n. mi. wide (2,500 km by 55 km.)

Of course, the planned inclination of the orbit, and a variable launch window for rendezvous flights (for ISS assembly) caused different swatches of the Pacific Ocean to be under the footprint. 

We always planned very carefully where the ET would go and issued international Notices to Air Men and Notices to Mariners about the location and time when pieces might fall. 

I was the Ascent Flight Director for one mission where the ET re-entered very near Hawaii just after local sunset.  The spectacular breakup was observed by many on the Big Island and (according to what I heard) resulted in a call from the Governor of Hawaii to the NASA Administrator to find out ‘why is NASA bombing our state?’  Perhaps an apocryphal story, but why check? A good story is better than the truth some times. 

Getting ready to assemble the ISS, it was important to maximize the launch window and one way to allow more launch opportunities was to lower the insertion orbit.  In the arcane world of orbital rendezvous, coming in lower allowed more opportunities to launch.  Take my word for it – maybe another blog post for another day – it works.  So, the trajectory analysts looked to insert – which is to say, cut off the Main Engines – when the apogee of the orbit was 122 n. mi. – down from the previous target of 173 n. mi. 

This caused the ET disposal footprint to move from the Central Eastern Pacific – east of French Polynesia and west of Mexico – to a location farther south and west, between New Zealand on the west and French Polynesia on the east.  And unfortunately, the end of the ET disposal footprint extended into French Polynesia.  

Here it might be useful to be familiar with the islands of the South Pacific . . . which I was not.  (Maybe I need to read Michener’s ‘Tales of the South Pacific’). 

Close to the west end of the footprint (the ‘heel’), Pitt Island (New Zealand, population 38), the Bounty Islands (New Zealand, uninhabited bird sanctuary), and Auckland Islands (New Zealand, uninhabited) were close to the footprint but protected.  That is to say, the 3-sigma debris footprint was outside 200 n. mi. from their beaches. 

On the east end of the footprint (the ‘toe’), the French Polynesian islands of Tematangi (population 58), Hereheretue (population 56), Anuanuraro (uninhabited), Anuanurunga (uninhabited), and Nakutipipi (uninhabited most of the year) were also similarly protected.  (Note:  spelling may vary). 

But I imagine those 100 or so people got quite a light show on occasions! 

Several of these islands were considered bird sanctuaries which, we were told, were periodically visited by scientists conducted bird population surveys.  We never knew when people might be there. 

But we had one real infringement problem.  Two French Polynesian Islands were just inside the footprint:  Raivavae (population 900) and Rapa Iti (population 500); left and right of the ground track respectively.  Our 3-sigma footprint – in the sideways or ‘crosstrack’ direction – came just outside 60 n. mi. from those two islands.  This violated the 200 n. mi. limit that we were obliged to protect.  None of our trajectory tricks worked, we were stuck with a violation or loss of possible launch days. 

The analysts calculated that the possibility of an ET fragment – in the crosstrack direction – exceeding 3 sigma dispersion (27.5 n. mi.) by the additional 60 n. mi. was less than 1 x 10^-10 probability. One chance in a very large number.  You have better odds at the lottery.  And remember, we only protected US beaches by 25 n. mi., 40% less distance. 

In one of their rare helpful instances, NASA HQ talked to the Department of State about the situation.  State encouraged us to write a letter asking permission to come within 60 n. mi. of these two islands rather than the standard 200.  Under their tutelage, we drafted a very nice letter asking permission of the French government for this exception.  The letter – a formal diplomatic note – was sent in December of 1998.  Copies of the letter were sent to the South Pacific Forum and the South Pacific Regional Environment Programme.  In the next year, NASA sent teams to visit Tahiti to explain the situation and also presented a summary to the New Zealand embassy in Washington.   

And we waited for a response from the French.

Which never came.

After a year with no response, the State Department effectively told us that the French had been adequately notified and receiving no objection, we could put the plan into operation. 

So, we did.   

I wonder if French ESA astronauts Leopold Eyharts (on STS-122) or Philippe Perrin (on STS-111) directly benefited from the increased launch window.  I will have to research that. 

If you think this is complicated, next consider off-nominal – underspeed and abort – cases where we also had to protect for safe ET disposal. 

I never heard a report of any sightings or objections from folks in the South Pacific. Or the French government.

Except one story.  For another day. 

Reading the Pads

Tradition!  Here we have traditions for everything; how to eat, how to sleep, even how to talk to the crew.

You may ask, how did this tradition start?  I’ll tell you – I don’t know.  But it’s a tradition! 

– with apologies to Sheldon Harnick

One of the oldest traditions in Mission Control is the ‘Reading of the Pads’ in preparation for some critical activity.  In the very oldest days, the crew onboard the spaceship (capsule, shuttle, whatever) needed important information and the only way to get that to them was verbally, via radio.  Later, of course, it became possible to send the information digitally, and frequently right into the software application that needs it – the foremost example is deorbit burn targeting software in the guidance and control computer.  But the tradition of ‘Reading the Pads’ continues.  There is something familiar and comfortable hearing the string of information going up to the crew and in response, the crew reading it back to make sure that they got it right.

When I was a Space Shuttle Flight Director – in very ancient times – we used paper pads that were preprinted with the information titles but which the FDO (Flight Dynamics Officer) filled in by hand.  These peculiar paper pads would make copies – like carbon copies but without the messy carbon paper – but each successive copy got lighter and harder to read.  Colloquially these were called ‘IBM paper’ because, I guess, IBM made them.

Some of your acronym books state that ‘PAD’ is short for ‘preliminary advisory data’ but I think that is nonsense.  They are called pads because they come on a pad of paper. 

There are all kinds of pads for all kinds of purposes.  I have scanned in two artifacts in my files from the STS-62 deorbit:  the Deorbit Manuever Pad and the DEL pad (where DEL really is an acronym for ‘Deorbit Entry Landing’).  You can see the numbers are all handwritten – the original goes to the Capcom, all the rest of us get copies where the numbers show up in blue (Flight Director got the first copy, FDO kept the third, others went, well who knows).  These numbers were all generated shortly before the deorbit burn but the FDO team had been working on them for several hours – or for several days preceding.  Often as the Capcom read the pad up, I would check off each number.  More frequently as the crew read them back down to us, I would check them off again.  Most of my copies have double checkmarks by each entry, this one only has one for some reason. 

Ed Gonzales was the Entry FDO for STS-62 and so he oversaw the team that planned the deorbit and entry and computed all the numbers for the pads.  He was assisted in the trench by Debbie Kessler the Trajectory Officer and Dennis Bentley the Guidance and Procedures Officer – and a whole crew of backroom folks.  Greg Harbaugh was the Capcom who read the pads up and the mission commander, John Casper, read them back. 

I can hear it in my memory like it was yesterday.  The MCC was very still, and all ears were listening to the stream of data and information going up and down.  It was serious business, and we all knew it.

For those of you that are interested in the details, rather than the human drama, there is the explanation:

The Deorbit Manuever Pad has all the information for the engine firings to start the shuttle home:  in this case the crew is told to use both Orbital Maneuvering Engines, that they should be upside down (Thrust Vector Roll 180), the orbiter weight is important in the rocket equation, TIG stands for Time of Ignition – always in Mission Elapsed Time – 13 days 22 hours 23 minutes and 50 seconds after liftoff, the Target in the software algorithm known as Powered Explicit Guidance 4 is hard to explain in a few words but it works out to a total velocity change of 214.1 feet/second which two engines should achieve in 2 minutes and 7 seconds resulting in an ‘orbit’ with an apogee (highest point) of 132 nautical miles and a perigee (lowest point) of -5 nautical miles.  Of course, the shuttle would land right at sea level as an airplane, not an orbital spaceship.

The DEL pad has more information of general use:  If the deorbit burn is delayed more than 4 minutes 30 seconds from the planned Time of Ignition, the crew should not execute the burn and wait for further instructions.  If the OMS engines did not start, then the four smaller Reaction Control System thrusters at the back of the orbiter could be used but should start at about 1 minute 45 seconds after the planned OMS TIG.

During the deorbit burn the crew displays the current perigee (Hp) which starts at about 132 n.mi. counts down to -5 n.mi. at the end of the burn. If there were a failure of the propellant supply to either left or right engine, or if both engines quit, and the perigee at the time of failure is above 86 nautical miles, the crew should stop the deorbit burn.  The orbit will be safe for several revolutions, and FDO will come up with a new plan.

Then the DEL pad gets into some really nasty contingencies – which I am happy to say, were never used (except in training simulations).  If there were a failure after 86 nautical miles but above the target perigee, the aft RCS propellant tanks – which are critical to safe control early in the hypersonic entry – could be used down to at total (left + right) of 98% and still have normal reserves.  Alternatively, if more were needed, the aft RCS propellant could be used down to 31% which provides a minimum use allowance for entry.  If the perigee gets to 11 nautical miles, the crew should flip around and use the propellant in the Forward RCS tanks.  Or if not, the RCS deorbit could be cut off at perigee of + 2 nautical miles rather than the target of -5.

Assuming none of that bad stuff happens, after the deorbit burn the crew will dump the remaining propellant in the forward RCS to 0% reading on the oxidizer tank.  This is accomplished by using the software to fire opposing thrusters on the nose until the tanks are depleted.  It is safer to land with empty tanks in case something untoward happens at touchdown.

Orbiter center of gravity is critical for flying.  Safe aerodynamic control required a left/right (y) cg offset of less than 1.5 inches.  On this day, the expected y cg offset is only 0.7 inches, very safe.  X cg varies as propellant is burned off; at the Entry Interface of 400,000 feet – where the atmospheric drag first exceeds 0.05 g – the X CG is well in the box and moves only 1.8 inches by the time the orbiter decelerates to Mach 3 – another critical point in the aerodynamic control regime.

MCC will talk to the crew through the Tracking and Data Relay Satellite – West starting about 31 minutes before entry interface and stay with that satellite all the way down.  The altimeter setting at KSC’s Shuttle Landing Facility is 30.00 inches of mercury.  The Guidance scheme is predicted to initiate ‘closed loop guidance’ at (13 days) 22 hours 50 minutes and 09 seconds.  The shuttle follows an s-turn approach through the atmosphere and the first direction change (reversal) predicted to occur at a velocity of 19,850 feet/second.  The approach to KSC runway 33 will be a right overhead turn of 211 degrees, the crew will select the Titusville TACAN for navigation channel 059Y and on final approach the Microwave Landing System will transmit on channel 6.  Winds are listed for the crew information; they should expect the speed brakes to be closed (15% is closed) at 3,000 feet and at no point during the entry will the vehicle exceed 1.5 g. 

We had an interesting situation with the Auxiliary Power Units that provide hydraulic power to the aerosurfaces on STS-62, but the plan – pre deorbit – was basically normal, start APU2 first and if it does not start try APU 1.  If neither start, don’t execute the deorbit burn.  The shuttle could fly normally with two hydraulic systems and in a pinch with only one hydraulic system, but the controls could be sluggish. APU fuel was limited but the normal plan was always to start at least one APU prior to the deorbit burn just in case.  If no APUs would start – and no hydraulics were available, then obviously the deorbit should be delayed to figure out what to do next. 

A lot of information on one or two pages.  Some of which, by the time STS-62 flew in March 1994 was previously transmitted digitally, and some of which the crew only got on their pads.

MCC was always silent while the pads were being read up and down.  Only if there was an error did anybody speak.  After good pads, the cacophony on the internal voice loops resumed. 

Now the tension would grow until the final ‘Go for Deorbit’ call went up at TIG -23 minutes.  With the orbiter generally performing flawlessly, all attention was focused on the weather.

But the tradition had been performed. 

Due Consideration

Men wanted for hazardous journey, small wages, bitter cold, long months of complete darkness, constant danger, safe return doubtful, honor and recognition in event of success.

– Apocryphal advertisement attributed to Ernest Shackleton for his 1914 Antarctic Expedition

We cannot truly appreciate a hero until we understand the danger and difficulty of their achievement.  Often we sanitize our heroes by glossing over the scary parts and thus fail to give them due consideration.

April 12 is a day when we celebrate the heroes of space exploration.  I’ve more inclined to celebrate John Young and Bob Crippen for taking the riskiest test flight ever, than that first guy.  But all are heroes who faced great personal danger to achieve great accomplishments.

Like many interested in the space program, I watched the Artemis II crew announcement from JSC.  It was a wonderful event, well-staged, lots of positive speeches, great cheerleading from the entire astronaut office, NASA senior executives, and other public figures.   I think the crew selection was terrific – the four selected are the best of the best which the nation has to offer. 

I am certain that public interest was stimulated by the announcement.  The NASA public affairs folks have certainly learned how to stage an event. 

I was left with a nagging feeling of incompleteness.  The ceremony seemed much like the introduction of new members of some professional sports team.  Or maybe like the winners of some game show were getting their Caribbean cruise tickets. 

Never a word about the dangers or the heroism required to go to the moon.    

The crew were not given their due consideration.

The buildup to the first Teacher-In-Space mission, late 1985, had similar public affairs events highlighted the plans for the mission of Christa McAuliffe.  The tone was all very warm and fuzzy, nothing scary.  When many school children tuned in to watch her launch on January 27, 1986, they were not prepared.  Things did not go well that day, unexpected to those lulled by the happy preliminaries.  Everyone alive then remembers that day with shock and trauma, never expecting that a bad outcome was possible.

Just prior to Apollo 8, the close equivalent to Artemis II, commander of the flight Frank Borman was asked about risk. He compared the risk of Apollo 8 to the risk of being a pilot during a combat tour in Vietnam.  In 1968 everybody understood that meant it was risky business indeed.

The Space Shuttle probability of loss of crew – calculated at the end, after we understood the risks and had made all the safety improvements possible – stood at 1 in 90.  That was just to get to low earth orbit and back.  Not the sort of risk one takes every day.

Going to the moon will be much more hazardous. 

I’ll paraphrase Capt. John Young:  We put people on top of millions of pounds of high explosive chemicals, which we light on fire, to send them a hundred miles up in the sky, going six times faster than a rifle bullet.  What part of that sounds safe to you?   If you are not a little scared, you don’t understand what is going on. 

There is no doubt in my mind that the Artemis II crew are well informed of the risks of their mission.  They are brave in the ultimate sense of the word; willing to risk their lives for a worthwhile goal.  But nobody mentioned that part.  We must acknowledge that.  So that we all know what to expect.  So we can acknowledge the heroism.  So we can give them their due consideration.

I think the risk is worth taking, but it is the crew who are taking the risk for all of us.  General Norman Schwartzkopf, commander during the first Gulf war, entitled his biography ‘It Doesn’t Take A Hero’ meaning that sending troops into danger was not heroic.  Actually going is heroic.  Those of us sending them are not heroes.  They are.  We need to know that their safe return is doubtful.  Honor and recognition are theirs in any outcome. 

We have not journeyed all this way across the centuries, across the oceans, across the mountains, across the prairies, because we are made of sugar candy.

–          Sir Winston Churchill in a speech to the Canadian Parliament.  Dec 30, 1941

———————————————————————————————————————

Other posts I have made regarding the risks of spaceflight:

Blood and Money

https://blogs.nasa.gov/waynehalesblog/2009/09/14/post_1252689927105/

Risk Tolerance

https://blogs.nasa.gov/waynehalesblog/2008/08/22/post_1219444614328/

https://blogs.nasa.gov/waynehalesblog/2010/04/22/post_1271883754935/

https://blogs.nasa.gov/waynehalesblog/2009/09/02/post_1251922430985/

Lessons not to be forgotten

This month contains NASA’s Day of Remembrance as it does each year.  Each year the events that need to be remembered draw more deeply into the past. 

This year is extraordinary because it marks the twentieth since we lost Columbia and her brave crew.

There are many who have come into the human spaceflight community following that accident.  Some are too young to remember the events at all.  Soon, joining the ranks of those who propose to send frail humans into the cosmos, will be ones who were not even born then. 

These fresh faces, building the future, must understand not only what happened but why it happened and how to prevent such ruinous tragedy from happening again.

Ten years ago, at the encouragement of an old friend, Lisa Martignetti (who had her own role to play), I wrote a series of essays encompassing my memories, observations, and thoughts about the tragedy; what came before, how it transpired, and the way ahead.

It is my proposal to start reposting those remembrances, one a day, starting tomorrow January 15 and continuing to the conclusion on February 1.  This pace should allow for some thoughtful reflection each day.

I hope these essays will lead the readers to find a better understanding of the complex nature of failure and – much more importantly – how to avoid making the same mistakes.

I hasten to add that I have not modified these essays from their original content.  My memory grows less precise and I do not want to alter what I had written lest I introduce more error.  There are certainly areas where other eye witnesses remember differently, that is the fact of human experience: we all see the same events from different vantage points and perspectives.  I do not intent to defend or amend what I have written as it is the best my memory can produce. 

Shortly after the CAIB report published when we were trying to learn better ways, I invited a series of speakers to interact with the Shuttle leadership team.  First was Dr. Charles Perrow, a Yale sociologist, who had written a well-respected book entitled “Normal Accidents:  Living with High-Risk Technologies”.  His basic thesis states that complex, tightly coupled technical systems will always fail – that is ‘normal’.  We who had just lived through tragedy were looking for ways to prevent failures in the future.  Dr. Perrow was relentless; he gave us no hope.  He stared us right in the face and said we were attempting the impossible.  We should inevitably expect such a failure to happen again and nothing we could do would prevent it.  Human error would creep in and defeat any protective system we might devise.

We could not accept that.  It was the most disheartening talk ever.  We could not wait to get him to leave so we could make plans to prove him wrong. 

To some extent we succeeded; the remaining shuttle flights were all safe and successful. 

So, is that the end of the discussion?

Lately I have begun to wonder if he was right.  We are building and flying large complex, tightly coupled space systems with younger and less experienced workers.  How can they learn the lesson?  The only lesson I know to keep the wolf at bay, even for a short while, is extreme vigilance from everybody involved.

Please read and reflect on the essays to follow in the hope you can prove Dr. Perrow wrong. 

The View from Mt. Nebo

When I was a child, 5 or 6 years old, I had a recurring dream that I could fly.  Not fly an airplane but fly like a bird.  Although better than any bird because I could traverse continents in minutes and visit strange and exotic places.  All I had to do was stretch out my arms and point my toes and away I went.  There were not daydreams but recurring dreams that I would recall when awake.   Like all dreams they were kaleidoscopic but vivid.  I could recall them in detail when I awoke.  In fact, I can remember some of them even now, decades later.  Friends, schoolmates, or family rarely showed up; mostly they were about the exhilaration of flying and traveling far from home.

 Now I was never foolish enough, in my waking state, to believe I could really fly; never tried to jump off the roof of the house.  But the memory remains.  Possibly many other young children have this same dream.  Maybe some child psychologist can analyze this, but I can’t.  I can only say that they meant freedom and adventure and a future of unlimited possibilities. 

Over time the dreams changed to other things and now my adult dreams are chaotic, symbolic, and quite literally undecipherable, on those occasions where I remember them.

I grew up with the space age.  Three years old when Sputnik launched, the adventure captured my imagination from earliest childhood.  I ravenously consumed every book, article, and news story about the burgeoning space race:  Ranger, Surveyor, Mercury, Gemini, and finally Apollo were the background tapestry of my childhood and my youth.  The moon missions followed by Skylab and ASTP ran into my college years. 

In the midst of this I was captured by the classic science fiction of the era:  written works from Jules Verne, Robert Heinlein, Isaac Asimov, and more.  My generation were all destined for a glorious future traipsing about the universe. Or blowing ourselves to bits in a nuclear holocaust with not much anything in-between.  My impressionable mind was influenced by the classics of science fiction in film and video:  Star Trek, Lost in Space, Space 1999, Destination Moon, The Forbidden Planet, a host of B movies mostly about monsters in space, and the like. Star Trek with its inherent optimism showed a better future to aspire to. (Star Wars came later, just after I married my wife).  I still consider ‘The Moon is a Harsh Mistress’ to be my favorite book and the blueprint for what should have followed. 

After the moon landings while I was still a teenager, I felt bitter disappointment at the decisions not to press on to Mars.  Confusion and complete non-comprehension of any reason to stop.  It all seemed so obvious:  back to the Moon to stay, building bases and colonies, and then on to Mars, the moons of the outer planets, and someday, someday, someday, to the stars. Just waiting for Zefram Cockrane.

Thus passed what we have come to call the Apollo generation:  especially those who worked in the space program during the heady days of the 1950’s all the way through the moon landing and Skylab to ASTP in 1975.

Filled with joy at being selected to work in NASA’s Mission Control just before the first launch of the Space Shuttle Program.  The Space Shuttle was just being completed and a flying taxi to low earth orbit was the obvious next step in the plan, right from the Willy Ley/Werner Von Braun TV specials on The Wonderful World of Disney.   In my early adulthood, it seemed certain that we would do this ‘shuttle thing’ for a few years, followed by building the space station.  That orbiting base would certainly be the assembly point to kick out to lunar bases, on to Mars and then all the rest of the solar system.  I was happy in the prospect of a career spent helping humanity spread throughout our solar system.

Needless to say, it didn’t quite work out that way.

I wonder how Admiral Kirk – or Admiral Picard – would have dealt with budget cuts proposed by the Federation Senate – financial constraints based on the premise that we need to solve problems on earth before we take off for the stars.  Hollywood never wrote that episode for TV.

So, my career was spent in doing my best to cart humans back and forth to low earth orbit, including building a space station that was never going to be the jumping off point for the moon.  I don’t regret it, we did good work, had a couple of really bad days, and hopefully laid the foundation for what is to come.   

We carried the torch, keeping human spaceflight alive to see better days. 

Not yet the Artemis generation, those days to come.  Those of us who labored in the 1980s to 2011 must be called the Shuttle/Station generation. 

Now I approaching my dotage, mostly retired, I serve only by giving Dutch uncle advice to the new generation.  Not exactly contributing in the way I expected.  But watching and hoping that they will succeed where my generation did not.  The generation that is, that came between Apollo and Artemis.  The forgotten generation. 

Watching with surprisingly mixed emotions as Artemis takes flight and shows the promise of success, after all these years.  The Artemis generation now in its initial days. 

I feel empathy for the folks still down in the ISS program; every day doing the science, making sure the station is supplied and equipped, planning EVAs for upgrades, making sure the international team holds together.  It is a 24/7/365 job that has just gotten eclipsed by the Artemis mission.  Keep carrying the torch you station guys.

Finally, there are mixed emotions: Joy and Pride and Gladness that the first Artemis mission has taken place and gone so well. Disappointment and sadness – and just a little bit of anger, too – that it has taken so long.  Jealousy of the folks in Mission Control and the engineering support rooms where I always dreamed I would be. 

Forlorn at the amnesia that has developed over what we accomplished with the Space Shuttle for all those decades.  Did we not set the foundations for today’s generation to succeed?

I think I will concentrate on the pride and joy that we are moving forward after all.

Justification, if you will, for all those years of service in low earth orbit. 

That is my view from Mt Nebo.