Risk reality check
On my second mission, though, I had an experience that recalibrated my perception of risk. My crew of Mike Baker, Terry Wilcutt, Dan Bursch, Steve Smith, and Jeff Wisoff had strapped in with me aboard Endeavour in the predawn hours of August 18, 1994-. At T26 sec, the orbiter’s three main engines roared to life and throttled to full power. I felt the ship sway forward under the surge of thrust, and waited for the swift kick-in-the-pants of the solid rocket boosters igniting at T20.

The massive jolt never came. Instead we heard the blare of the master alarm over the intercom and the dying rumble of the three engines shutting down, at just half a second before booster ignition. As the stack swayed ponderously back and forth, the flight deck crew threw the appropriate switches, and Jeff and I made ready to scramble from our middeck seats, open the hatch, and lead the parade to the escape slide on the far side of the launch tower.

	This escape pole, deployed from a C-141 aircraft, was tested at NASA-Dryden in 1988.

But there was no fire, no pending explosion. Half an hour later I was sitting up calmly in the middeck, parachute off, and eating a peanut butter sandwich. Still, it had been a sobering close call.

Endeavour’s computers had caught the oxidizer turbopump overtemp just before booster ignition, and commanded an orderly shutdown. After an engine change, STS-68 made orbit six weeks later. But the same red-line violation right after liftoff would have been much more serious. With one engine down, we would have been forced into either a “return to launch site” abort (which would entail flying backward through our exhaust plume at Mach 5), an iffy dive into an East Coast runway, or a gliding bailout off the Florida Coast. In all of those cases, our fortunes were tied inescapably to that of the orbiter: Only an intact vehicle could get us into a position for a bailout or emergency landing. Our fate and the orbiter’s were one.

Early crew escape systems
Early U.S. spacecraft adopted crew escape systems that enabled the crew to cut loose from a failing booster during any phase of the launch, or at least until the spacecraft was able to survive on its own. Mercury used an escape-tower-mounted rocket to pull the spacecraft free; Gemini provided its two crewmen with ejection seats (although Tom Stafford has wryly noted his reluctance to find out what happens when triggering an ejection seat rocket in a cabin pressurized with oxygen).

With the Apollo missions came a return to the tower-mounted rocket configuration; in order to escape a dying Saturn V, Apollo’s solid rocket escape motor generated more thrust than Alan Shepard’s Redstone booster. In each of these designs, the crew could theoretically leave the launch vehicle up to the point where the spacecraft itself could return them safely to Earth.

The Soviet Union adopted a similar approach, using an ejection seat in its first-generation Vostok capsule and an escape rocket and tower for its Soyuz (the Voskhod gave up both ejection seats and escape tower when configured for the space “first” of flying three crewmembers in 1964).

Approach and landing tests of the shuttle Enterprise in 1977-1978 featured twin ejection seats for the commander and pilot. These same seats, derived from the SR-71, were part of Columbia’s original design, giving John Young and Bob Crippen on STS-1 some chance to survive a catastrophic break-up out to about Mach 3. Of course, the same ejection seats could be used if the orbiter was nearing subsonic speeds on reentry but could not make a runway.

The crew escape equation changed dramatically after STS-4 in the summer of 1982. With the shuttle deemed operational by NASA, mission specialists expanded the ranks of shuttle crews. The ejection seats, too heavy to be installed for each astronaut on these larger crews, were removed entirely. The unspoken message: The proven shuttle was so safe it no longer needed a crew escape capability.

A little over three years later, that self-assurance disappeared with Challenger in a thunderous fireball over the Atlantic. NASA retrofitted all the orbiters with a crew escape system, but this new design was a compromise between crew protection and the limited time and money available.

To speed a return to flight, NASA de-cided on a bail-out system, giving the crew the limited ability to jump from a gliding orbiter. Rejected for cost and weight reasons were an escape “capsule” built into the crew cabin, multiple ejection seats, and a quiver of tractor rockets to speed astronauts away from a crippled orbiter. In return for this necessary expedient, NASA continued long-term studies of escape system upgrades to better protect the crew.

A lost opportunity
And so the situation remained, from the post-Challenger return-to-flight through the turn of the new century. My colleagues and I all flew the shuttle with full knowledge of its crew escape limitations. We knew that we had no options at all during the first two minutes of ascent; we had to hope the orbiter stayed intact until the solid rocket motors burned out. After booster jettison, we had transatlantic aborts, or at the very least, a “contingency” abort that would get the orbiter, if not to a runway, at least into a bail-out glide.

Once safely in orbit, we knew our reliable ship would get us back home again, and entry became so routine that the landing phase became a technical exercise in hypersonic control and navigation, complemented by a spectacular light show. Gone were the days of John Glenn’s harrowing 1962 return to Earth with a possible loose heat shield. And if in the end we wound up short of the runway, we could always blow the hatch and take to the parachutes.

	In 1980, astronaut Bob Crippen checked out the ejection seat in the Columbia space shuttle.

Some crewmembers always viewed the bail-out option as overly optimistic. On a true “bad day,” getting a six- or seven-person crew out the hatch in an emergency would take several minutes, and few commanders or pilots (by virtue of their front seats, the last to leave) thought they would win the race to the hatch before impact. (As a mission specialist, I was always near the front of the line.) And despite our rigorous escape training, we were all aware that, in some phases of ascent and for most of reentry, there was no point in trying for a bailout. That risk (among many others) was the price of a ticket to orbit.

During the 1990s the NASA Aerospace Safety Advisory Panel continued to emphasize the need for a more robust escape system, but declining budgets kept those ideas in the study phase. NASA instead used available funds to purchase moderately priced improvements to the main engines and cockpit avionics and displays, which offered reductions in flight risk. Crew escape upgrades were expensive, and an orbiter replacement might soon make them unnecessary.

But the reductions in flight risk from the shuttle’s system upgrades were modest ones, not enough to dramatically change the odds facing the crews. In March of this year, after Columbia’s loss, the panel advised NASA that high risk was inherent in the shuttle’s design, and that the crew’s exposure to that risk was significant. After the latest accident, the demonstrated rate of failure of the shuttle system is 1 in 57. With little hope that proposed upgrades to the shuttle’s systems would dramatically increase reliability, the panel concluded that only a crew escape system that works throughout the vehicle’s powered flight envelope could significantly lower the risk of “loss of crew.”

Escape system concepts
Even if NASA began work today on a replacement for the shuttle, the remaining three orbiters would soldier on for at least another decade. And the shuttle must return to flight soon, to supply and continue construction of the space station. What concepts for shuttle escape systems might increase the protection provided to its crews?

A simple upgrade would reinstall ejection seats on the flight deck, perhaps adding middeck seats as well for larger crews. Or NASA could fly only crews of four or fewer, eliminating the need for middeck ejection seats. The seats could provide some escape capability up to about 70,000 ft.

A second concept, called a hybrid, provides two ejection seats for the commander and pilot, while stationing the rest of the crew in an expanded air lock redesigned to serve as an “escape canister.” In an emergency, this rocket-powered canister would blast clear of the forward payload bay, parachuting the astronauts inside to safety. While the capsule could protect its occupants as high as 200,000 ft, above 70,000 ft the front-seaters would have to stay with the orbiter. Clearly this option would come in for some vigorous discussion in the Astronaut Office.

	After Challenger, NASA added this manual bail-out system. With the shuttle in a stable subsonic glide, astronauts clip their harness to the deployed escape pole. As they exit the open side hatch, the steel pole guides them clear of the left wing and initiates parachute deployment. This system is the crew’s only option for escaping a crippled shuttle.

A third option would refit the crew cabin as a detachable forebody capsule, with its own rocket separation and recovery systems. In an emergency, the entire orbiter nose would separate forward of the payload bay and pull clear of the disaster. The “spacecraft within a spacecraft” would provide the crew an escape path through most of powered ascent. The drawback (inherent to some degree in all the designs) is thousands of pounds of added weight (translating directly to reduced payload).

The development schedule is also a negative factor for the complex canister and forebody designs. The time to qualify, test, and integrate such escape systems would take more than five years; perhaps a safer orbiter replacement would be available just a few years later. Nor would any of these options or their variants be cheap: $3 billion-$5 billion would probably be the minimum cost.

Decision time
So what is NASA to do? On one hand, adding a crew escape system to the orbiter diverts funds from developing its safer, more reliable replacement. On the other, an orbiter replacement could easily, depending on congressional and administration funding, be more than 15 years off. (Even the much simpler Orbital Space Plane will take nearly 10 years to become operational.) How long should the astronauts be exposed to the “inherent and significant” risks of flying the shuttle?

The men and women who will next fly the shuttle are said to be of two minds on this question. Only a handful of the corps were active when Challenger was lost, but many of the senior astronauts arrived within a few years of its aftermath. This group has direct experience of the loss of two orbiters and 14 of their colleagues and friends. Many think the time has come for NASA to recognize the shuttle’s vulnerability and retrofit a robust crew escape system.

Some of the more recent arrivals in Houston (about 50 of the astronauts are still waiting for their first flight) argue the same way I once did: “Yes, flying the orbiter is a risky proposition, but we cannot stop flying while we wait for a replacement shuttle sometime in the hazy future. We should accept the risk, even at odds of 1 loss in every 57 flights, and get on with the business of spaceflight.” They echo a favorite saying of Columbia’s Laurel Clark: “A ship is safe in harbor, but then, that’s not what ships are for.”

The Astronaut Office will make its formal recommendations on a crew escape system to NASA this month, but astronauts are not (and never have been) the ultimate decision-makers. Congress will be weighing in as the Columbia Accident Investigation Board releases its report. The loss of another crew, a statistical likelihood given another decade or more of shuttle operations, would generate a whirlwind of congressional and public demands for retribution.

Though it understands the risky nature of spaceflight, the public’s memory is short, and the shock of another accident might very well ground American astronauts for a long time. The taxpayers who fund the shuttle, and their representatives, will have little patience with an agency that does nothing to improve the odds for future shuttle crews. Congress may very well direct NASA to add an escape system to the aging orbiter fleet as soon as possible.

Astronauts will return to flight next year with the manual bail-out system, but the right thing to do is to give crews a capable escape system, and soon. Given the demanding physics of spaceflight and the long-term operations we plan for astronauts on the ISS (and beyond), our space travelers should have at least the same “probability of safe return” as their Rus-sian (and Chinese) counterparts.