From my previous question, you'd have a bad time if it happened. What could cause it to happen, if anything? My parameters are:

  • The engines must STOP, but not destroy the vehicle simply by having stopped. That is, they cannot explode
  • The vehicle may be destroyed as a consequence of other effects, like huge aero forces
  • I'm OK with answers that consider different times in the launch with different failure modes. For instance, I can imagine that contaminated fuel (maybe?) can cause the engines to not ever start in the first place, while a small but significant explosion during MaxQ could (maybe) also cause the failure.
  • 13
    $\begingroup$ The engines would stop non-destructively if they ran out of fuel $\endgroup$
    – Dragongeek
    Commented Nov 5, 2019 at 17:05

1 Answer 1


There were a few common cause, credible failures.

  • Loss of inlet pressure to the engines due to a leak in the External Tank or failure of the tank pressurization system. (This loss of pressure is what caused all three engines to shut down during the Challenger accident, when the External Tank ruptured)

Engine operation was normal until the fuel inlet pressure dropped. As the pressure decreased, the engine responded in a predictable manner. Automatic shutdown of engine 2023 was verified by telemetry data. Data recovered from the salvaged engine 2021 control computer verify that this engine also had begun shutdown. Salvaged control computer data from engine 2020 showed that this engine was within 20 milliseconds of shutdown when the computer stopped. Inspection of recovered engine hardware verified that all engines were shut down in a fuel-lean or oxygen-rich condition which resulted in burn through and erosion of the engine hot gas circuits.

(Rogers Commission Report)

  • Fratricidal damage from an engine explosion, gaseous oxygen heat exchanger fire, or an uncontained turbopump failure. (The engines were quite close to each other in the engine compartment with no shielding between them).

enter image description here

(personal photo of the engine mounts, looking into the Orbiter aft compartment from outside)

  • Early in the program, there was a known failure mode where the disconnect valves in the pipe to the External Tank could slam closed, cutting off all flow to the engines. Pneumatically operated latches were added to hold the valves open after the Challenger accident.

enter image description here

(schematic from the Ascent Pocket Checklist, annotated by me)

  • Early in the program, loss of helium pressurization to the seal in the High Pressure Oxidizer Turbopump due to helium leakage or rupture of the composite overwrapped pressure vessels storing the helium. The engine controller monitored the seal pressure and would shut the engine down if the purge was lost. (Later engine redesigns eliminated the actively purged seal from the pump)

  • Early in the program, problems with the Turbine Discharge Temperature sensors. Erroneous readings from these sensors caused one engine to shut down on mission STS-51F and nearly caused a second shutdown. The sensors were common to all engines and could conceivably have caused all three to fail. (The sensors were later redesigned to be more robust).

  • Running out of propellant. Sub-causes:

    • Performance problem with one or more engines causing excessive consumption of one propellant
    • Leak in the propellant system
    • Human error by launch control personnel - this nearly caused the vehicle to launch on STS-61C with inadequate External Tank propellant loaded to make it to orbit. Propellant depletion sensors in the feedlines would have detected the loss of propellant and caused the onboard computers to shut down all three engines.

On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.

Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).

(Source - you have to click on 61-C at the left to read the writeup)

More far-fetched perhaps:

  • Software error in the General Purpose Computers causing them to issue erroneous shutdown commands
  • Software error in the Space Shuttle Main Engine Controllers (SSMECs)
  • Multiple Alternating Current bus failures causing loss of the SSMECs
  • Combination failures of things listed above
  • Crew error
  • 3
    $\begingroup$ Even more farfetched: electromagnetic pulse during the launch sequence caused by a previously unknown ter... activist organization named You're Going Nowhere. $\endgroup$ Commented Nov 6, 2019 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.