STS-125 Mission Preview:
STS-400: Just in Case
By WILLIAM HARWOOD
CBS News Space Consultant
When the space shuttle Atlantis blasts off on NASA's final mission to service the Hubble Space Telescope, the shuttle Endeavour and a four-man crew will be standing by for launch on a mission space agency managers hope will never be needed: an emergency rescue flight to bring the Atlantis astronauts back to Earth if heat shield damage or some other problem prevents a safe re-entry.
Unlike flights to the International Space Station, the Atlantis astronauts, working in a very different orbit, cannot seek "safe haven" aboard the lab complex if Columbia-class damage is incurred during the climb to space or later, due to impact with space debris. In either case, Endeavour could mean the difference between life and death for Atlantis' crew.
"There are very small odds we would, in fact, have a problem on ascent for which the remedy would be a launch on need shuttle, a rescue shuttle," former NASA Administrator Mike Griffin said the day Hubble Servicing Mission 4 was announced. "But against the very small probability that it could occur, we will carry that rescue option in the manifest. ... The safety of our crew conducting this mission will be as much as we can possibly do."
With post-Columbia improvements to the shuttle's external tank foam insulation, along with improved imaging, damage detection and repair techniques, the odds of any sort of non-repairable damage are believed to be relatively remote. The major concern for the Atlantis astronauts - not counting the main engines, solid-fuel boosters, hydraulic power plants and malfunctions in other critical systems - is the debris environment in low-Earth orbit.
At orbital velocities of 5 miles per second, impacts by even small bits of satellite wreckage or even faster micrometeoroids are potentially catastrophic. As a result, the International Space Station is stocked with enough supplies to support a visiting shuttle crew until a rescue mission could be launched.
But that isn't an option for the Atlantis astronauts. They cannot reach the space station and the shuttle can only carry enough supplies to keep the crew alive for 16 to 25 days, depending on when damage is detected and when a decision is made to mount a rescue mission.
In the wake of the 2003 Columbia disaster, then-Administrator Sean O'Keefe canceled the final Hubble servicing mission - the only non-station flight left on NASA's manifest - arguing the threat posed by external tank insulation, the lack of a safe haven option and the absence of reliable repair techniques made the flight too risky. He based his decision in part on a recommendation from the Columbia Accident Investigation Board calling for autonomous inspection and repair capability for non-station flights.
Griffin, O'Keefe's successor, reversed that decision after NASA engineers and astronauts had demonstrated credible heat shield repair techniques and modified the shuttle's external tank to minimize foam shedding. Asked in a recent interview if he still believed the rescue mission, known as STS-400, was necessary, Griffin said yes, but not because of engineering concerns.
"When we made the decision, the odds were 1-in-473 that we would have a problem on the shuttle for which a rescue shuttle was the solution," Griffin said. "Now, there are a lot of problems you can have on the shuttle, right? There are a lot of ways you can die on the shuttle, which is what gives you the overall shuttle PRA (probabilistic risk assessment) of about 1-in-75 or so. So
you're roughly five-and-a-half, six times likelier to die on the shuttle for some reason that the backup shuttle can't save you from than you are to die from one the backup shuttle can save you from. ... From a statistical point of view, it makes no real sense to have a backup shuttle.
"However, here's the flip side. ... Those numbers cannot be explained to politicians or the general public. And should we have a failure with those 1-in-473 or whatever odds it was, should we have a failure that the rescue shuttle could have saved you from and we had not done it, the consequence to NASA would have been incalculable. We would appear to have been cavalier with human life, we would appear to have not taken every possible precaution, we would appear to have been coldly calculating the odds and rolling the dice with people's lives. And the appearance of behaving that way, in my judgment, was unacceptable. I could not risk that for NASA."
In short, no matter how unlikely, if a rescue mission was needed and NASA did not have that option, "you could never in a million years explain ... why it was we thought those were good odds," Griffin said.
But with a launch-on-need mission - no matter how unlikely it is to be needed - post-Columbia inspection techniques and heat shield repair procedures, a flight to the Hubble Space Telescope carries roughly the same risk as flights to the International Space Station.
"There are a lot of shuttle failures that the station can't save you from, also," Griffin said. "So having the station as a safe haven addresses some issues, but it doesn't address most of the ways in which you can die on shuttle. If you get a debris strike after you undock from the station, you're done. You can have lots of kinds of problems on ascent that the station can't save you from. So when we looked at it on a numerical basis the Hubble mission, with the launch-on-need shuttle, it was just about equivalent to a station mission."
Atlantis commander Scott Altman said he and the crew agreed with Griffin's assessment of the odds. Even so, he welcomed the addition of a rescue flight.
"There are a lot of numbers out there floating around about the risk and how do you quantify that and live with it," he told CBS News. "I look at it kind of as a big picture thing. We've put this mission together and we've tried to have an answer for each part of the problem. Can we keep from having damage by eliminating debris? Have we done the best that we can, if we have debris, can we find out where it hit and what damage it did? So we've got an inspection plan for that. Then, if it does damage, can we repair it? And we have a repair plan for that. "Now you're sort of laying things out and you're saying 'OK, I'm feeling pretty good, I can do this, this and this. Now what's your answer if the damage is too big to repair?' And now I have an answer, and that's the launch-on-need mission. I agree that it is a very low probability, but it's nice to know when you go out there to strap that machine to yourself that when you launch, you have all these answers available to you to make sure that we are doing everything possible to look toward our future safety."
STS-400 Flight Plan
Flight Day 1:
Flight Day 2:
Flight Day 3:
Flight Day 4:
Flight Day 5:
Flight Day 6:
Flight Day 7:
Damage detection, of course, is the key to any decisions regarding repair or rescue.
Columbia was destroyed during re-entry Feb. 1, 2003, when super-heated air entered a hole in a left wing reinforced carbon carbon - RCC - leading edge panel that was caused by impact with falling external tank foam insulation during launch 16 days earlier. In the wake of the mishap, NASA implemented a broad range of upgrades to minimize foam shedding, to spot any damage that might occur anyway and to develop techniques and procedures for spacewalking astronauts to repair damaged heat shield tiles and even reinforced carbon carbon. The RCC nose cap and wing leading edge panels experience the most extreme heating - more than 3,000 degrees Fahrenheit - during re-entry.
NASA now tracks shuttle launchings with high definition television cameras, C-band radar that can detect falling debris and sensors mounted behind the RCC wing leading edge panels that can record impacts. The day after launch, a 50-foot-long orbiter boom sensor system - OBSS - is mounted on the end of the shuttle's robot arm for a detailed inspection of the nose cap and wing leading edge panels using a laser scanner and high-resolution cameras. During approach to the International Space Station, the shuttle is flipped over in a rendezvous pitch maneuver, or RPM, allowing the lab crew to photograph the orbiter's belly with powerful telephoto lenses capable of spotting any damage significant enough to cause problems during re-entry.
All space station assembly mission flight plans now include a block of time reserved for a so-called "focused" inspection if anything unusual is spotted during earlier inspections. Finally, another nose cap/wing leading edge inspection is carried out after the shuttle undocks from the space station to look for any signs of damage from micrometeoroid or space debris impacts that might have occurred since the first inspection the day after launch.
If damage is seen during any of these inspections, and if engineers conclude it can be repaired, the astronauts have tools and equipment on board to resurface or fill in damaged tiles and even to patch small cracks or holes in RCC panels. If the damage is not repairable, the astronauts on space station assembly flights can move into the lab complex and await rescue.
The Hubble servicing mission is the only flight on NASA's shuttle manifest that does not go to the space station. In this one case, a second shuttle - Endeavour - will be prepped and ready for launch to rescue the Atlantis astronauts if necessary, eliminating the need for safe haven aboard the space station.
The only inspection technique that will not be available to the Atlantis crew is the rendezvous pitch maneuver that is carried out during final approach to the space station. Instead, a new set of inspection procedures was developed to accomplish the same purpose using Atlantis' robot arm and the OBSS boom. The additional procedures will take several hours longer than those used for a space station flight, but engineers say the end result will be the same.
The RPM is carried out early in a mission and as such, only provides insight into ascent debris damage. The primary threat for the Atlantis astronauts, given the new techniques that duplicate what is normally achieved with the RPM, is impacts from space debris and micrometeoroids. The space station orbits at an altitude of about 220 miles while Hubble circles the globe at an altitude of 350 miles. The space debris environment - bits of junk from old satellites and rocket bodies - is worse at Hubble's altitude than the station's.
"Remember now, the RPM, it's prime purpose is to inspect the bottom of the vehicle for ascent debris damage," said Paul Hill, director of mission operations at the Johnson Space Center. "What we have more of on HST is statistically higher risk of orbital debris because of the higher altitude. So the RPM really isn't designed or placed in the mission to catch that. That's more of a long-duration thing and our greater concern for that kind of damage we pick up with the late inspection."
Lead flight director Tony Ceccacci said the Atlantis astronauts will spend their first two days in orbit giving the shuttle a thorough inspection.
"On flight day one, after we do the RMS (robot arm) checkout, we're going to do an upper crew cabin survey just with the RMS end effector, so that'll get everything we need there," Ceccacci said. "And of course, it'll meet the requirement of detection and all that.
"What we're going to do on flight day two is, we added in a belly tile survey. It's an additional two hours 10 minutes of survey ops. ... They've developed the survey that meets all the required detection requirements. So what we'll wind up doing is we'll be doing the starboard wing leading edge and there's a point where we break out of that and then do starboard part of the belly. That takes about 30 minutes or so there.
"After we finish the belly up, that starboard belly portion, we'll go ahead and finish up the starboard wing leading edge, go ahead and do the nose cap after that and then go to the port wing leading edge. And there's a point in there that we break out and do about 96 minutes of belly survey. Then after that, we go back into the port wing leading edge survey and get that done and then we're done for the day."
An analysis of the threat posed by space debris at the Hubble Space Telescope's 350-mile-high altitude shows Altman and his crewmates will not face a dramatically higher risk from orbital debris than previous Hubble missions, NASA officials say.
While the overall risk of impact damage is about three times higher for a Hubble mission than a flight to the International Space Station, it is not as bad as flight planners initially feared.
"We know we're accepting a little higher risk for this flight," Steve Stich, manager of the orbiter project office at the Johnson Space Center, said in an interview. "That's why we've tracked it very carefully."
Even factoring in debris from a satellite collision in February between a defunct Russian Cosmos satellite and an Iridium telephone relay station, the mean odds of a catastrophic impact during the Hubble mission are on the order of 1-in-229, which is well below the 1-in-200 threshold that requires an executive-level decision by NASA's leadership.
A preliminary analysis put the odds at 1-in-185, but the numbers improved after recent radar observations and consideration of the shuttle's orientation in space during the Hubble mission. The planned orientation, or attitude timeline, reduces the crew's exposure to impacts that could damage critical areas of the ship's heat shield, the coolant loops in the shuttle's cargo bay door radiators and cockpit windows.
"The numbers changed recently from three factors," Stich said. "One, they went back and looked at the radar data and they took some more measurements and they found the debris environment isn't quite as severe. So that led to a reduction in the number.
"Two, we got an attitude timeline update that had higher fidelity breakdowns of the periods of time where we're going to be in attitudes to protect Hubble from the sun, and that was a factor in reducing that number. The third thing was, we actually were able to model HST in the payload bay and sometimes the HST actually provides a shield for the wing leading edge."
Analysts took a conservative approach to the February satellite collisions, factoring in twice the amount of debris predicted by computer models. As it turns out, the amount of wreckage from the Iridium satellite was, in fact, roughly twice the predicted value. But radar tracking shows debris from the Cosmos matches the computer model's prediction. The overall risk was reduced accordingly.
Flight planners also built in an orbit adjustment rocket firing after Hubble is released that will lower one side of the shuttle's orbit. That will effectively lower the risk a bit more.
Taking all that into account, the analysis generated a broad range if risk values, from a maximum of 1-in-173 to a best-case scenario of 1-in-313. The mean value, 1-in-229, assumes a late inspection on flight day nine and a reasonable chance of damage that could be successfully repaired.
"We've looked at Hubble very closely and we've done everything we can to mitigate the risks, the attitudes that we're flying, of course we've got our repair capability, we have launch on need (emergency rescue mission) ready and we've got late inspection," Stich said. "And for late inspection, for the hot (wing leading edge) panels, we've actually improved that inspection to get better resolution for panels 8 through 11 that actually drive the risk. So we've done everything we can to mitigate the risk."
MMOD risks for previous Hubble servicing missions cover a wide range of values, from 1-in-150 for a flight in 1993 to 1-in-761 for a mission in 1999. For the most recent mission in 2002, the MMOD risk was 1-in-365. But those numbers don't take into account post-Columbia inspection procedures and a better understanding of the debris environment in general.
"The bottom line is, since return to flight this one is in the ball park" with past Hubble missions, an official said.
The Hubble servicing mission originally was planned for last October, but the flight was delayed to May when a data processing system on the telescope broke down. Going into that launch campaign, shuttle Program Manager John Shannon told reporters NASA planned to do everything possible to reduce exposure to MMOD damage.
"Because we recognize it as a significant risk, we have already taken all the actions we can as far as attitude timeline in putting the vehicle in a position where if we get micrometeoroid or orbital debris pieces coming at the vehicle, the come typically along the velocity vector," Shannon said.
"So you'll see with our attitude that we'll typically put the shuttle main engines toward the velocity vector (in the direction of travel). It protects the windows and the payload bay and the Freon loops and the RCC (nose cap and wing leading edge panels). So they have optimized the attitude timeline as much as they can for this mission. And we'll do our inspections, so we will know by the end of the mission if anything is required to go repair or not."
To put the MMOD numbers in perspective, the MMOD risk for the most recent space station assembly flight was 1-in-332. The two flights before that came in at 1-in-333 and 1-in-339 respectively.
"The 1-in-200 is a fairly arbitrary number that was decided upon kind of by consensus to make sure we have the discussion and that the discussion takes place at the right level," Shannon said. "When you get to a risk greater than 1-in-200, it was decided that decision should be made at the agency level."
Based on the latest analysis, that will not be necessary for Atlantis' flight. But the analysis highlights the increased risk the Atlantis astronauts will face because of the unique nature of their mission.
If all else fails, NASA will launch Endeavour on the STS-400 rescue mission. Endeavour was hauled to pad 39B April 17 for work to ready the ship for a quick-response launch. If a rescue mission isn't needed, Endeavour will be moved to pad 39A for launch in June on a space station assembly mission.
But at the moment Atlantis lifts off, Endeavour will be ready for a launch within seven days. If a non-repairable heat shield problem is discovered during the post-launch inspection on flight day one or two, Endeavour could take off within about five days and be on the scene for a crew rescue within a week of the problem's discovery.
If no problems are seen during the post-launch inspection, Endeavour's processing will be put on hold with the shuttle ready for the start of a three-day countdown at any point thereafter. The Atlantis astronauts plan a second heat shield inspection on flight day nine, after Hubble is deployed. A decision on whether a wing leading edge repair might be needed would be expected the next day, after analysis of imagery and laser scan data.
If entry critical damage is seen, the Atlantis astronauts would implement initial electrical power-down procedures, NASA would start Endeavour's three-day countdown and flight planners would work out the details of a repair attempt. A repair spacewalk would be conducted on flight day 12 and, if the damage turned out to be beyond the crew's ability to fix, Endeavour would be launched the next day, the thirteenth day of Atlantis' mission. With Endeavour safely in orbit, the Atlantis crew would implement a so-called Group C+ powerdown, an option that would disable critical heaters and other systems and eliminate any chance of bringing Atlantis safely back to Earth.
The Atlantis crew will only have enough supplies to last about 25 days on their own, but that assumes the extreme Group C+ powerdown was ordered after the initial heat shield inspection. If a non-repairable problem is discovered during the late inspection, only 16 to 19 days of capability would be available. In that case, Endeavour could still reach Atlantis in time to pull off a rescue, but there would be little margin for error in the event of launch delays or other problems.
"You've picked the most challenging scenario, and that's the late inspection," Altman told CBS News. "The good news is, it's also one of the least likely scenarios to generate a need for a rescue vehicle. But we even have an answer for that. Now, it's not tremendously robust, we only have so much power left at the end of the mission by the time we do that late inspection, but the shuttle is being processed to the point where it could get off the pad quickly enough that it could rendezvous with us, even with the orbit adjust, and have a chance to transfer between the two vehicles and come home on the launch-on-need vehicle."
But it is not a sure thing. While it works on paper, bad weather or launch delays caused by technical problems could prevent Endeavour from reaching Atlantis in time to help. In the worst-case scenario, Endeavour would only have two days or so to get off the pad. After that, it would be too late.
Shannon said the shuttle team "worked very hard to develop repair capabilities for micrometeoroid/orbital debris damage, we've got plugs we can put in the reinforced carbon carbon (wing leading edge panels), we've got the non-oxide adhesive we can put over any cracks or any kind of holes. I think 400 is there more for an ascent debris kind of situation, some kind of a really gross ascent problem like we had on Columbia. 400 would be very effective for that kind of case.
"For the MMOD case where we saw something during late inspection, if it were a case where we did not think we had repair capability for it, it's questionable whether 400 could get off the pad in time to go do any kind of a rescue. ... I think our protection for MMOD lies in our repair capability. We've spent a lot of time doing hypervelocity impacts on RCC materials, doing our repairs and putting them in the arc jet facility and we've had outstanding results. So we feel very comfortable about what we have.
"It would take a very rare, and very significant, large-size damage from MMOD in a critical area to cause us to have to consider 400 for that kind of case."
But what if the unthinkable happened? What if ascent debris or a piece of space junk damaged Atlantis' heat shield beyond the crew's ability to fix it? In that case, Endeavour might be the crew's only hope.
Only four astronauts would take off aboard Endeavour: Commander Chris Ferguson, pilot Eric Boe, flight engineer Stephen Bowen and Robert Kimbrough, all veterans of recent shuttle flights. Endeavour's lower deck would be rigged with supplies and collapsed seats that would be set up later, four in one row and three in the next, for the Atlantis crew. One extra-large spacesuit would be stowed for use by Altman.
As with Atlantis' mission, an MMOD analysis was carried out for STS-400. Because a rescue mission would be shorter, the odds are better, from a worst-case 1-in-278 to a best-case of 1-in-503. The mean value is 1-in-367.
Shuttle dockings or satellite rendezvous procedures normally are carried out on the third day of the mission to conserve propellant and give the astronauts time to adjust to weightlessness. But in this case, Ferguson would oversee a hurried two-day rendezvous, approaching the damaged shuttle from below much like a normal space station approach. For planning purposes, Atlantis would be assumed to be disabled and its own robot arm unavailable. Instead, Endeavour's robot arm would be used to lock onto Atlantis to hold the two shuttles together.
"Instead of flight day three, we're going to rendezvous on flight day two," said flight director Paul Dye. "We built this so we could get to (Atlantis) as quickly as possible in case we had a weather delay or anything else, we wanted to make sure we designed the mission to get there as fast as possible. So it's a normal ascent, except right after ascent we'll be making sure we do our rendezvous tools checkout.
"Then, instead of doing the tile inspection on flight day two like we've been doing since return to flight, we'll actually do the rendezvous on flight day two and grapple (Atlantis). Then we'll go ahead on flight day three, do the first EVA where we'll transfer a couple of folks across. Then on the next day after that, we'll do the last (EVA) to get everybody else across. At the end of that day, that's flight day four, we'll release the 125 orbiter and Tony's team will go ahead and deorbit that using commands from the ground. Then we'll do an inspection of our vehicle after that ... and folks here on the ground will take a look at that and approve us for entry and we'll be coming home on flight day seven."
Only the Atlantis astronauts would participate in the three spacewalks needed to get the crew members from the crippled orbiter to Endeavour. The spacewalkers would make their way along safety tethers attached to Endeavour's robot arm to get from the Atlantis airlock to Endeavour's. All seven of the Atlantis astronauts conducted training runs in NASA's Neutral Buoyancy Laboratory at the Johnson Space Center to familiarize themselves with the operation.
The rescue plan was designed "to be bomb proof," Dye said. "You don't want to do something fancy on a rescue mission, you want to do what you know. The fact that it's a rescue mission alone is what makes it pretty unique and interesting. But within it, we try and make it built out of components of things that we know how to do all the time."
Atlantis will only carry four spacesuits to orbit. To get all seven crew members from Atlantis to Endeavour, the Atlantis crew will have to stage three spacewalks, moving crew members and spacesuits - including Altman's, carried aloft aboard Endeavour - back and forth as required to get all seven across. Tomas Gonzales-Torres, the lead spacewalk officer for Hubble Servicing Mission No. 4, said the first spacewalk would involve Megan McArthur, Andrew Feustal and John Grunsfeld.
"The 400 crew will pre-position the extra-large suit in their airlock," said Gonzales-Torres. "So all three crew members will come out of the (Atlantis) airlock and then they'll go over to the 400 vehicle. At this point, Megan will go inside the airlock on the 400 side and then the crew will retrieve the extra large, spare EMU. Megan will actually repress (Endeavour's airlock) by herself at this point. Once she's inside the 400 vehicle, that crew will help her get out of the suit and then reconfigure that suit to be, again, pre-positioned inside the 400 airlock.
"While that's going on, John and Drew will be transferring the extra-large suit back over to the 125 vehicle (Atlantis). Once Megan's suit is ready to go, (Grunsfeld and Feustal) will depress that airlock and retrieve her suit. Then again, the crew will transfer that suit over to the 125 vehicle. They'll close that hatch and then both ingress on the 400 vehicle. So we'll have two suits that will be repressed by themselves on the 125 vehicle and then at the end of the EVA, John, Drew and Megan will be on the 400 vehicle.
"At the start of the second EVA, John will be pre-positioned in the airlock for the 400 vehicle and then (Mike) Massimino and Greg Johnson will be positioned in the 125 vehicle. The (Atlantis) crew will come out. John will have an extra suit, which was Drew's, in the (Endeavour) airlock with him. So Massimino and Ray J (Johnson) will come over to the 400 vehicle and along with John, they'll get the extra spare suit from the 400 vehicle, again, which was Drew's, bring that back to the 125 vehicle and then the crew will split up. Massimino will repress with the one extra suit on the 125 vehicle and John and Ray Jay will repress on the 400 vehicle.
"At this point, we have three suits and three crew members remaining on the 125 vehicle. And we'll have Scooter (Altman) in his extra-large suit, which was launched up on the 400 vehicle, and then we'll have Massimino and Bueno (Mike Good). And all three of them will do that last EVA and all three of them will get transferred over to the 400 vehicle."
Grunsfeld said one major advantage for the Hubble crew "is that we have four very experienced spacewalkers, two of which are going out for the first time but have demonstrated in the (training pool) their extremely good qualifications for doing a spacewalk. Four sevenths of the crew is already highly trained for spacewalks. The transfer operations, if we ever did get into a rescue situation, are straightforward compared to anything we're doing on the nominal mission."
For the return to Earth, all seven Atlantis astronauts will strap in on Endeavour's lower deck.
"It's 'lay on the floor' kind of seating," Dye said. "There are elements of seats that plug onto the floor, then the harnesses attach down there. You wouldn't really recognize it as seats, but they are. They'll all be on their backs."
Atlantis would be left with its flight deck systems configured for remote operation from the ground. After Endeavour''s departure, flight controllers would face the unwelcome task of commanding Atlantis to make a steep re-entry over the Pacific Ocean, ensuring an atmospheric breakup well away from any populated areas or shipping lanes.
And with that, the space shuttle program would come to an end. With the program already scheduled for retirement in 2010, NASA would not have time - not to mention political support - for another failure investigation and corrective action.