by Paul Dye
I made it a point to spend a lot of time in the dome while this issue was being worked out—after all, the mission was planned, everyone was trained, and this was the long pole in our tent regarding a Go or No Go for launch. These sessions went on for a couple days until we felt we had a workable procedure and were comfortable with launching. It was fun to help the guys develop a new way of flying and watching as we looked for pitfalls and uncertainty in what might happen—and meanwhile develop new criteria for when we could dock and when we had to knock it off. In the end, we were comfortable that we had a plan that would work. It turned out that we didn’t need any of it—the Mir was stable when we got there and the docking went just fine. But the training process, once again, gave us a deeper knowledge of our available options and operational redundancy.
Training was also used as a method of certifying the flight procedures and rules that were specific to a mission. Although most of the generic procedures were carried from flight to flight with only minor updates (usually related to changes in hardware or software), we always had new and unique procedures for the specific mission, and these had to be proven in some way or another. The sign-off for noncritical procedures often happened during tabletop reviews. That is, the crew, controllers, engineers, and trainers sat down in a conference room and walked through the procedures line by line to make sure that everything was correct. If everyone was happy, then they were signed off. Small errors were often caught by someone, which made the time-consuming and tedious process worthwhile.
Fly the Plan
Planning a mission took a large number of organizations. It really took parts of the entire agency. Training for the mission, however, was mostly the province of the MCC teams and the crew (and all the associated training organizations that were part of Mission Operations). But once it came time to fly, the entire NASA community once again got involved—flying a mission was just a huge endeavor.
It was necessary, of course, to have a focal point for flight, and that point was the Mission Management Team (MMT). The MMT consisted of the senior managers of all the organizations involved in the flight, and it was chaired by the Shuttle Program Manager (or more accurately their deputy for operations). The MMT could number up to two dozen members at times, because flying a Shuttle affected a lot of people. Mission Operations, Engineering, the science community, the launch teams at KSC—these were the big ones and the most obvious. But there were also payload representatives, the manager of the ISS program (when we were flying to the Station), the EVA Program Office, and other organizations such as NASA Safety and Mission Assurance. While the flight control team—or more accurately, the on-console Flight Director—had real-time authority to make any decision they felt necessary for the safety of the crew and the success of the mission (as defined in the flight rules), the MMT had overall authority for non-real-time direction of the mission.
Essentially, any major decision that was not already covered in the pre-mission flight rules (and couldn’t wait until a meeting of the MMT was convened) was the prerogative of the Flight Director. This is what we were paid to do (as well as a thousand other things, of course). Familiarity with all the decisions that went into planning the mission was what gave us the ability to make those decisions, if necessary. If, however, a situation arose that wasn’t already talked about in the pre-mission time frame and didn’t have a premade decision to cover it—and there was time to get the MMT to weigh in—we tried to do that. After all, the Flight Director didn’t actually “own” the mission—the program did, and it was only right for the MMT to make critical decisions that might change the direction of the flight.
This all sounds nice and clear-cut, but in reality it wasn’t. If a situation arose that demanded a complete change in direction, it was the job of the flight control team to lay out the various options, determine the implications of each possible course of action, and make a recommendation to the MMT on what they thought was the best way to go. Oftentimes, it took quite a bit of education, and answering lots of questions, to get the MMT headed in the proper direction. The good news, of course, is that the MMT was generally composed of people who once worked in the trenches—as flight controllers, Flight Directors, engineering systems managers, mission scientists, and the like. So rarely were we starting from scratch when it came to bringing the MMT up to speed. The MMT was also the body of folks that were briefed before the mission (or at least they were supposed to be the ones who were briefed) and who approved the plans for the flight—both nominal and off-nominal.
For much of the Shuttle program, the head of the MMT was a former Flight Director. This meant the MMT was led by someone who knew how to wrangle a decision out of a group of technical people. At times the MMT would be led by someone who did not have a lot of operational background, and that could really slow things down as they were brought up to speed so that they could understand the implications of a decision. More often than not, however, the MMT followed the recommendations of the experts from the various organizations, such as MOD and the flight control team.
Once the decision was made to launch, KSC had the responsibility for the vehicle—and all operational decisions—until T-0 (Time Zero), when the explosive bolts fired and the vehicle lifted off. At that point, control shifted to Houston, and MCC took over. The ascent phase of flight was an eight-and-a-half-minute ride of high energy that required a huge number of decisions, all of them made with no time to consult anyone outside the team. The flight controllers had to know their stuff, know their nominal and off-nominal procedures, and be able to recognize failures with enough time to take action. Coming off the launch pad, you had a number of different options. If everything went fine, you could make it into your nominal planned orbit. If you had problems with an engine (or engines), or anything that prevented reaching the planned orbit, you could hopefully still limp into a safe low orbit—this was known as an ATO—Abort to Orbit.
If you had a problem with engines or systems that required you to get back on the ground as soon as possible and you were still not going too fast, the Shuttle could be turned around in a complex procedure that was called the Return to Launch Site Abort (RTLS). John Young, the famed astronaut from the Apollo era, used to refer to the successful execution of an RTLS as, “Ten consecutive miracles, followed by an act of God.” The RTLS involved turning the vehicle around backward, flying into the exhaust plume as you slowed it down, and then, after coming to a “stop” about 300 miles offshore, continuing to thrust so as to build up velocity for a ride back toward the Cape. During this time, the Shuttle is lofted up to about 400,000 feet in altitude, the fuel supply is emptied, and the External Tank is dumped before establishing a gliding flight that hopefully has enough energy to make it back to the KSC runway. It was jaw dropping when described, and we executed it tens of thousands (more like hundreds of thousands) of times in simulations over the life of the flight program. But we never flew one. For a pilot, it was a challenge to fly in the simulator with a good crewmember (or two) to help, and it was quite exciting to try on your own. Letting the computer fly most (or all) of the tricky part helped.
If you had a problem that prevented you from making it around Earth at least once, yet you had gotten up enough speed such that you were no longer able to make it back to the Cape, then you could fly a Transatlantic Abort (TAL). This took you across the Atlantic to a landing site in Spain, France, Morocco, or some other runway in Eastern Africa. Executing this maneuver would take the Shuttle across the Atlantic in twenty-five minutes or less, an astonishing feat to fans of early aviators like Charles Lindbergh.
Finally, if you had too much energy to get slowed down for a TAL, but not enough to make it to an ATO, then you could do an AOA—an Abort Once Around. This took you around the planet in ninety minutes to land at White Sands, New Mexico. It was less challenging procedurally than either an RTLS or TAL, but it exposed you to systems failures (such as a cabin leak or loss of cooling) for a longer period of time.
The most
interesting thing to me as an ascent flight controller was that as the ascent went on and your abort mode options dropped away, life got simpler because you had fewer branches of a decision tree to go down. This was true not only as you passed abort points, but it was just as true as you experienced system failures. The more failures you had, the fewer options you had left until you reached the point where if anything else failed you were out of luck. At that point, there were no more decisions to be made. You just had to cross your fingers and watch from that point on.
When the Shuttle made it into orbit, the crew and ascent teams had a couple hours’ worth of procedures to perform in order to change the Orbiter from a rocket ship into a space station. These tasks effectively activated the systems that allowed the Shuttle to operate and work in space. This involved turning off a lot of equipment that would not be needed again (such as the main engines), or that wouldn’t be needed again until entry (such as the hydraulics), as well as activating things that were necessary to stay in space. The most important of these tasks was opening the payload bay doors so that the radiators could see space and provide cooling. During ascent, the vehicle used the flash evaporators to keep the systems from overheating, but the water supply for those wouldn’t last very long if you couldn’t get the radiators working—so that was high priority.
After cooling, there were computers to reconfigure (we didn’t need all five General Purpose Computers [GPCs] running ascent software anymore—one for Guidance, Navigation, and Control [GNC] and one for Systems Management [SM] was sufficient until you got into rendezvous or entered into another flight-critical phase). You had to get the crew out of their suits, stow the seats, and unstow all the orbit equipment. The Remote Manipulator System (RMS) needed to be checked out if it was going to be used (as it always was after the Columbia accident), and the communications systems had to be deployed to the orbit configuration. This time period was called post-insertion and there was an entire checklist dedicated to it. When the crew reached the point where we knew that we could sustain the vehicle in orbit at least until the next day, the crew was given the “Go for Orbit Ops” and everyone could relax a little bit.
The typical Shuttle mission in the later years lasted about ten days, whereas earlier missions averaged about a week. Regardless, the timelines were always packed to get the most out of them, and the crew and ground teams quickly settled into a routine. The MCC worked twenty-four hours a day, of course, and three shifts were required to operate a normal mission. Each shift worked for eight hours, plus an extra hour for handing over to the next team. It rarely worked out this cleanly, of course—the challenge was that we always tried to keep the ground teams synced with the crew. The vagaries of orbital mechanics and sunrise/sunset times at launch and landing sites meant that we were usually shifting the crew by an hour or a half hour a day, meaning we had to shift the ground teams as well. The result was that sometimes you got a string of eight- or ten-hour shifts. It wasn’t until the ISS era (with its routine sync to Greenwich Mean Time) when flight control teams settled into a reliable shift schedule that never changed.
It was customary for the Lead Flight Director to take whichever shift had the key elements of the mission occurring during that time. More often than not, this was the crew’s morning—what we called the Orbit 1 shift. But it was not unheard of for some major events (such as satellite deploy) to be scheduled in the crew’s afternoon and, in that case, the Lead Flight Director might take Orbit 2 for the mission. The one constant was the planning shift, which occurred while the crew was asleep—except, of course, on those missions where we split the crew into two shifts and ran a twenty-four-hour-a-day operation on orbit. In such cases there was little difference between the three MCC shifts. The routine (if you could ever call any Shuttle mission routine) was to execute the plan you came up with preflight to the best of your abilities, recognize failures or hiccups to the plan as they occurred, and then replan the next day (or the entire mission) in an effort to zero in on accomplishing the mission goals. The crew and all the teams worked together to make that happen.
In aviation (and spaceflight), the old saying that you should “plan your flight and fly your plan” has been proven to be correct and necessary time and time again. Last-minute changes that are not driven by the need to address failures usually end up causing problems—or at least they cause more trouble than they are worth. Getting “creative” in the middle of a flight usually means that you’re improvising a plan without taking the time to think about the implications of those changes—and that rarely works out for the better. While it is nice to take advantage of opportunities when they arise, those opportunities often come with traps and pitfalls that you don’t expect.
One example is a story I was told when I first went to work for JSC as a co-op student. Several of the members of the section where I was assigned had recently been involved with the Skylab reentry in 1979. Skylab had been left in orbit by its last crew in the first half of the 1970s. The orbit had decayed a bit each year, as orbits always do. Atmospheric drag slows any orbiting object down, and slowing it down drops the altitude. A lower altitude has more drag, and eventually the object slows below orbital speed and enters the atmosphere. NASA’s stated plan had been to have the Shuttle flying before the orbit got dangerously low, and to use the Shuttle to attach a booster to keep the space station from reentering. Unfortunately, the Shuttle was delayed, and it became apparent that nothing was going to save the Skylab. So a small team of flight controllers was organized to reactivate it and see what they could do about making the entry as controlled as possible.
It sounded like a science fiction episode. In today’s terms they basically had to hack the old and degenerating systems to get enough power to run the computers and communication systems, and then bring up the gyros and sensors to see if they could control the attitude. Without enough fuel to actually fly the craft, all they could do was control the drag—make it greater or less, depending on the attitude. If you flew it in a streamlined attitude, you could keep it up longer by generating some lift. If you flew it in an attitude for maximum drag you could increase its rate of descent. If you tumbled it, you got essentially a ballistic reentry with a known trajectory.
The team figured out pretty well how to fly it this way, and when it came down to the endgame, their plan was to tumble the spacecraft and turn off the computers and telemetry once the trajectory was known. Their target would be a mid-ocean graveyard somewhere in the world. In the final weeks, it became apparent that a good disposal site was in the Indian Ocean, and they set up their plan to tumble the spacecraft over the continental United States and turn everything off. It was a plan that assured a good final watery resting place for any debris that survived all the way down to Earth’s surface.
Unfortunately, at the last minute (according to the story I was told), a directive came from a high-level official, someone who had not been involved in the planning and, thus, did not know all the details and reasoning behind the scheme. This individual wanted the team to go ahead and tumble it, but to leave the telemetry on so that the breakup could be recorded. This had been thought of by the team, of course, but they had not had enough time to look at all the systems implications, all the ins and outs of the software to see what the spacecraft might do in that configuration. They objected to the change because of the old “plan your flight and fly your plan” rule. They were told to leave the telemetry system on.
True to form, fate stepped in. They tumbled the spacecraft as planned and turned off the guidance computer. Skylab went out of contact as it left the US, but when they next saw it from the Ascension Island tracking station in the middle of the South Atlantic, it was once again flying in the low drag, high lift attitude. Later analysis (after the reentry) showed that there was some computer code that looked for a case where the spacecraft was tumbling and because normally that was a “bad” thing, it reactivated the attitude control and set it to the last previous commanded configuration—which in
this case was low drag.
The result of this last-minute change to the plan is that Skylab flew in low drag mode through the entry, which meant that it flew farther than predicted. As a result, instead of ending up in the middle of the Indian Ocean, it flew to the eastern edge of it… some pieces actually ended up hitting land in Australia. No one was hurt, but it was embarrassing—and all because someone in power, without operational experience, decided that the carefully thought-out plan should be changed with little thought. Plan the flight… then fly the plan!
Planning the mission, training for it, and then executing it—that is what we did for over three decades. It is important to note one additional thing could be added to this mantra—and that is to learn from what you did and then bend that learning back into the next planning process, the next training sequence, and the next flight. We never stopped learning. Most of the learning was captured in mission debriefs. Debriefs occurred all across the organization—from official crew debrief sessions to unofficial intradiscipline debriefs. Debriefs could take weeks to complete. Some might even occur a month later, after data had been retrieved and analyzed. The results of all these debriefs were captured in organizational documents that informed future missions and made the Shuttle flight program better every time.
The prevailing philosophy was that making a mistake in and of itself was not a big problem. The problem came if you failed to learn from that mistake or made the same mistake twice because you ignored it the first time. From mission to mission, or from day to day within a given mission, there were always things to be learned and efficiencies to be gained. Oftentimes, the lessons learned in planning or training weren’t good enough to tell us what we really needed to know. This meant we had to climb the learning curve in short order as we went zinging around Earth every ninety minutes.
