There were a few common cause, credible failures.
- Loss of inlet pressure to the engines due to a leak in the External Tank or failure of the tank pressurization system. (This loss of pressure is what caused all three engines to shut down during the Challenger accident, when the External Tank ruptured)
Engine operation was normal until the fuel inlet pressure
dropped. As the pressure decreased, the engine responded in a
predictable manner. Automatic shutdown of engine 2023 was
verified by telemetry data. Data recovered from the salvaged engine
2021 control computer verify that this engine also had begun shutdown.
Salvaged control computer data from engine 2020 showed that this
engine was within 20 milliseconds of shutdown when the computer
stopped. Inspection of recovered engine hardware verified
that all engines were shut down in a fuel-lean or oxygen-rich
condition which resulted in burn through and erosion of the engine
hot gas circuits.
(Rogers Commission Report)
- Fratricidal damage from an engine explosion, gaseous oxygen heat exchanger fire, or an uncontained turbopump failure. (The engines were quite close to each other in the engine compartment with no shielding between them).
(personal photo of the engine mounts, looking into the Orbiter aft compartment from outside)
- Early in the program, there was a known failure mode where the disconnect valves in the pipe to the External Tank could slam closed, cutting off all flow to the engines. Pneumatically operated latches were added to hold the valves open after the Challenger accident.
(schematic from the Ascent Pocket Checklist, annotated by me)
Early in the program, loss of helium pressurization to the seal in
the High Pressure Oxidizer Turbopump due to helium leakage or rupture of the composite overwrapped pressure vessels storing the helium. The engine controller monitored the seal pressure and would shut the engine down if the purge was lost. (Later engine redesigns eliminated the actively purged seal from the pump)
Early in the program, problems with the Turbine Discharge Temperature
sensors. Erroneous readings from these sensors caused one engine to shut down on mission STS-51F and nearly caused a second shutdown. The sensors were common to all engines and could conceivably have caused all three to fail. (The sensors were later redesigned to be more robust).
Running out of propellant. Sub-causes:
- Performance problem with one or more engines causing excessive consumption of one propellant
- Leak in the propellant system
- Human error by launch control personnel - this nearly caused the vehicle to launch on STS-61C with inadequate External Tank propellant loaded to make it to orbit. Propellant depletion sensors in the feedlines would have detected the loss of propellant and caused the onboard computers to shut down all three engines.
On January 6, 1986 during the second launch attempt of STS-61C, the
MPS liquid-oxygen inboard fill-and-drain valve was not commanded
closed because the liquid-oxygen (LOX) loading automatic sequencer
(terminal countdown sequencer / control software) did not receive the
closed-switch indication from the replenish valve as required by the
prerequisite control logic. This resulted in the automatic sequencer
initiating a hold at launch minus 4 minutes 20 seconds. The ground
operator verified replenish-valve closure using flowrate and other
parameters, but did not close the inboard fill-and-drain valve prior
to issuing the resume command to the automatic sequencer at launch
minus 2 minutes 55 seconds. This allowed LOX to drain back out of the
external tank through the tail service mast vent-and-drain valves
until the ground operators noticed the inboard fill-and-drain valve
was still open and manually closed the valve. Although unknown at the
time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently
drained out of the external tank.
Another hold was initiated by ground personnel at launch minus 31
seconds to review the previous out-of-sequence loading termination and
obtain a 5-minute liquid-oxygen drain through the main engines. During
the hold, the liquid-oxygen main engine temperature dropped below the
engine start requirement of 168.3 degrees Rankine by approximately 3
degrees. The engine limit was exceeded because the amount of LOX lost
overboard through the fill-and-drain valve caused the colder,
more-dense LOX to be drawn in from the external tank. The countdown
was recycled to launch minus 20 minutes and oxygen replenish flow was
reestablished. The launch was scrubbed when it was determined that the
vehicle could not be recycled within the allowable launch window. If
the launch had occurred, the reduced LOX quantity in the external tank
would have caused early SSME shutdown due to LOX depletion resulting
in a Trans-Atlantic Abort Landing (TAL).
(Source - you have to click on 61-C at the left to read the writeup)
More far-fetched perhaps:
- Software error in the General Purpose Computers causing them to issue
erroneous shutdown commands
- Software error in the Space Shuttle Main Engine Controllers (SSMECs)
- Multiple Alternating Current bus failures causing loss of the SSMECs
- Combination failures of things listed above
- Crew error
