On February 1st, 2003 at eighteen seconds past 9:00 AM Eastern Standard Time, the Space Shuttle Columbia broke up during atmospheric entry over Texas. Still traveling at approximately Mach 18.3, the disintegration of Columbia was complete and nearly instantaneous. According to the official accident investigation, the crew had at most one minute from realizing they were in a desperate situation to complete destruction of the spacecraft. Due to the design of the Space Shuttle, no contingency plan or emergency procedure could have saved the crew at this point in the mission: all seven crew members were lost in this tragedy.

While the Space Shuttle, officially known as the Space Transportation System (STS) would fly again after the Columbia disaster, even the program’s most ardent supporters had to admit fundamental design of the Shuttle was flawed. Steps needed to be taken to ensure no future astronauts would be lost, and ultimately, the decision was made to retire the Shuttle fleet after primary construction of the International Space Station (ISS) was complete. There was simply too much invested in the ISS at this point to cancel the only spacecraft capable of helping to assemble it, so the STS had to continue despite the crushing loss of human life it had already incurred.

Between the loss of Challenger and Columbia, the STS program claimed fourteen lives in its thirty year run. Having only flown 135 missions in that time, the STS is far and away the most deadly spacecraft to ever fly. A grim record that, with any luck, is never to be broken.

The real tragedy was, like Challenger, the loss of Columbia could have been prevented. Ground Control knew that the Shuttle had sustained damage during launch, but no procedures were in place to investigate or repair damage to the spacecraft while in orbit. Changes to the standard Shuttle mission profile gave future crews a chance of survival that the men and women aboard Columbia never had.

Determining Risk

During Columbia’s climb to space, a piece of insulating foam came off of the external tank and struck the wing. The impact was observed by Ground Control, but as there was no way to tell how large and heavy the piece of foam was, or what damage it actually caused, the decision was made to continue with the mission as normal. During reentry into the Earth’s atmosphere, this damaged section of wing allowed hot gasses to enter the vehicle: ultimately leading to a structural failure.

It’s impossible to say if knowing the full extent of the damage to Columbia’s wing would have saved the crew. There was still no formal procedure for a Shuttle rescue mission in the event reentry was deemed to risky, and post-incident reports on the event came to the conclusion that putting a rescue mission together on such short notice would have been pushing the very limits of plausibility.

Accordingly, one of the first tasks scheduled for every Shuttle crew to fly after the loss of Columbia was to conduct a thorough examination of the vehicle’s heat shield, paying close attention to the nose cone and leading edges of the wings. This was conducted using sensors mounted to the vehicle’s robotic arm, including a laser depth camera and high resolution cameras. Taking between 5 and 7 hours to complete, these examinations represented a significant loss of productivity for a vehicle that was already extremely expensive to launch and operate. But the fragility of the heat shield left NASA no alternative.

Station As A Safe Haven

With the exception of the mission to repair the Hubble Space Telescope, every Shuttle that flew after the loss of Columbia went directly to the ISS. Gone were the days where the Shuttle flew off on its own to conduct independent research and experiments; it was now firmly a vehicle to take crew and cargo to the ISS and bring them back home. This was a task which the Shuttle was vastly overqualified for, and which is now accomplished with much more simplistic spacecraft at a fraction of the cost.

The reasoning behind always flying to the ISS was simple: if damage to the heat shield was found during the examination, the crew would be able to stay docked to the Station for far longer than the Shuttle itself could have remained aloft. In addition, further examinations of the heat shield would be possible from the Station, allowing Ground Control to better assess the situation.

In the absolute worst case, the Shuttle being too badly damaged to return them to Earth, crew members could then return home via one of the Russian Soyuz capsules which remain docked to the Station at all times.

In Space Repairs

In the event damage to the Shuttle’s heat shield was found, the astronauts needed a way to conduct repairs. A procedure was developed in which a thick gel, described as having the consistency of peanut butter, could be shot into damaged thermal tiles with a device not unlike a caulk gun by an astronaut on an Extravehicular Activity (EVA, or “spacewalk”). Once shot into the damaged area, it would then be smoothed out with a spatula so it was flush with the rest of the heat shield. This operation was no small feat when in a bulky EVA suit, but was tested successfully by astronauts inside the cargo bay of the Shuttle.

In 2005, astronaut Steve Robinson became the first person to ever attempt a repair on the Shuttle’s heat shield. In fact, he was the first astronaut to ever even approach the belly of the Shuttle while in space. As the bottom of the Shuttle is completely smooth, he had to be maneuvered into place at the end of a robotic arm, and carried the absolute minimum amount of tools and equipment to lower the chances of anything floating loose and hitting the spacecraft.

Sending the Shuttle Home Alone

In the event the Shuttle could not be repaired to the satisfaction of Ground Control, the crew could either return to Earth via Soyuz capsule or on a second Shuttle launched to come get them. But what would happen to the damaged Shuttle? At a cost of approximately $2B each, they aren’t the kind of thing you want to just cut loose and let float away. Even if reentry was deemed too dangerous to do with humans aboard, sending it down autonomously was at least worth a shot. The only problem was that the Shuttle, unlike its Soviet-made counterpart, couldn’t actually land without somebody to flip the switches in the cockpit.

Certain tasks like lowering the landing gear or deploying the drogue chute to slow the Shuttle after touchdown could only be performed from the physical controls on the Flight Deck, but the Shuttle’s avionics are located on the Mid Deck. To fix this, NASA engineers created the Remote Control Orbiter Cable (RCO Cable), a 28 foot long wiring harness that would connect the Shuttle’s computers to the controls on the Flight Deck.

To install it, the astronauts would open up panels in the Shuttle’s cockpit, and attach the connectors of the RCO Cable in place of the original switches and buttons. The cable was then run down the hatch to the Mid Deck, and then forward to the avionic bays in the nose. Once the controls on the Flight Deck were physically linked with the computer, the astronauts could depart the Shuttle and Ground Control would be able to remotely command its return. The Shuttle would follow a modified flight path towards Edwards Air Force Base to lessen the chances of possible debris coming down over populated areas, but otherwise the landing would proceed as normal.

The Post-Shuttle Era

The STS program officially ended in 2011. The remaining vehicles in the Shuttle fleet: Discovery, Atlantis, and Endeavour, are now on a permanent “Mission of Inspiration” in museums across the United States. But the lessons learned during the STS program continue to shape manned spacecraft in the era of commercial spaceflight.

All current and purposed spacecraft designs have returned to a more traditional arrangement with the crew vehicle riding atop the booster rocket; the risk of debris damaging a side-mounted vehicle are simply unacceptable. NASA’s safety requirements for the Commercial Crew Program include things like enhanced thermal protection systems and extended abort windows, with an end goal of lowering the odds of losing a crew member to 1-in-270 (down from 1-in-90 with the Shuttle).

The SpaceX Dragon 2 spacecraft is a front-runner in the Commercial Crew Program, and offers many safety features designed to meet or exceed NASA requirements. It has abort capability from the launch pad all the way to orbit, can be remotely operated in case of an incapacitated crew, and has a heat shield so over-built that it can survive multiple reentries before needing replacement.

Spaceflight will never be safe. Nature abhors a vacuum, and as such, crew members aboard a spacecraft will always be putting themselves in a situation where only a mistake or two separates them from death. But with the hard-learned lessons of the Space Transportation System, we’ve identified some of those mistakes and can do everything in our power to ensure they aren’t made again.