I ask this question because of a comment made by John Connolly, NASA engineer and director of the International Space University. To quote Connolly, "..when he (Rick Husband) saw that the RCS was saturated, he knew they were dead." This suggests two things to me-

  1. The commander and pilot realised that the reaction control system (RCS) was firing constantly and the only thing maintaining reentry profile.
  2. If the RCS had enough propellants left to maintain the orbiter within its flight corridor for a while longer, there was the possibility that the crew could have bailed out. This bailout scenario would involve the orbiter descending to an altitude of 25,000 feet (from 200,000 feet), maintaining a nominal deceleration profile, the left wing, or a large part of it, (for drag not lift) remaining attached to the vehicle and the RCS having enough thrust (and fuel) to control the disintegrating orbiter. Apparently the RCS was able to maintain correct drag profile and its saturation was the immediate cause of loss of control, of course along with a lot of other things occurring at that time. That's a lot of "ifs" I know and without one of them (and probably a lot of others) breakup, ballistic reentry and loss of crew is the only other alternative.
  • 25
    $\begingroup$ Saturation in this context means that 'firing at full power it could not provide enough thrust to maintain control', not 'out of fuel'. So to keep Colombia controllable would have needed larger RCS thrusters not just bigger tanks. Can I suggest an edit clarifying if your question is on 'how much fuel did Columbia have left at breakup' or 'how much bigger would the RCS have to have been to maintain flight down to bail out'. $\endgroup$ Apr 5, 2021 at 9:47
  • 2
    $\begingroup$ Thank you GremlinWrangler. At 14:00:02 an alarm message went off indicating that the RCS had failed most likely due to RCS fuel being exhausted. A few seconds before major structural breakup. (Columbia Crew Survival Investigation Report). It may well be just a coincidence or an indication of other issues, but with jets firing continuously it's most likely fuel did run out. $\endgroup$
    – Ashley
    Apr 5, 2021 at 11:30
  • 3
    $\begingroup$ @Ashley The Columbia Crew Survival Investigation Report says that at 14:00:02, "This Class 2 alarm message may not be the result of the actual vehicle condition since the message was generated based on data from a sensor path that contained noise. If valid, the message is used to indicate when an RCS jet has failed on or failed off, or is leaking. The failed off condition could be an indication that the fuel was exhausted." It does not say that fuel being exhausted is the most likely cause. The alarm might not even have been valid due to hot plasma burning the vehicle from the inside. $\endgroup$ Apr 5, 2021 at 21:33
  • 2
    $\begingroup$ Re your first point, "The commander and pilot realised that the RCS was firing constantly and the only thing maintaining reentry profile." That is incorrect. The RCS jets on the Orbiter didn't provide enough anywhere close to the torque needed to maintain attitude shortly after entry interface. That is why the Orbiter was outfitted with hydraulically controlled aerosurfaces. The RCS jets augmented the primary aerosurface controls when the vehicle was in the atmosphere. $\endgroup$ Apr 5, 2021 at 21:42
  • 3
    $\begingroup$ The important thing here is that even if there had been an infinite supply of fuel for the RCS it would have made no difference: the RCS was simply not powerful enough (anywhere near) to keep the vehicle under control. $\endgroup$
    – user21103
    Apr 7, 2021 at 9:08

3 Answers 3


You are misreading the accident report. By 14:00:02, the vehicle had already begun to lose structural integrity, it had already begin to lose thermal integrity, and it had completely lost control authority.

I'm going to digress a bit to distinguish between faults, errors, and failures. As a simple example, consider a bit in computer memory that permanently faults to an always one state. Writing a one to that bit has no obvious effects. A program that later reads that bit as a one will do exactly what it is supposed to do because there's no distinction between the one value that was intended to be written and the one value that is read. At some point in time, a program will try to change the value of that bit to zero. That won't work, but the manifestation of this issue won't arise until later when that memory position with an incorrect value is read. The fault manifests as an error this point in time. Nothing untoward might happen immediately after this error occurs. It might take multiple reads before the software takes an incorrect action. This incorrect action is a failure.

Note well: This is the terminology I have been trained to use. Others use different terms. The concept remains the same; there can be a significant time delay between the root cause of a set of problems and when those problems manifest themselves.

In the case of the Columbia, the fault occurred shortly after launch when pieces of foam detached from the external tank and hit the Columbia at a critical juncture, tiles on the wing leading edge. This fault didn't manifest itself until much later, during entry when those tiles started coming loose. Radar showed pieces of debris coming off of the Columbia minutes before the vehicle broke up.

This changed the vehicle's aerodynamics. It also enabled a stream of hot plasma to enter the vehicle, progressively destroying an increasing number of components. The combination of changed aerodynamics and loss of components resulted in the vehicle losing control authority. Attitude control systems are designed not to run anywhere close to requiring an attitude thruster to fire 100% of the time. Saturation means the vehicle can no longer control its attitude. Or as John Connolly put it, "..when he (Rick Husband) saw that the RCS was saturated, he knew they were dead." No extra amount of propellant could have helped.

  • 6
    $\begingroup$ I like this answer, just one minor nitpick: it can be confusing to call the reinforced carbon-carbon panels at the edge of the wing tiles since many people will associate the term tiles with the ceramic tiles. $\endgroup$ Apr 5, 2021 at 18:00
  • 28
    $\begingroup$ @JörgWMittag By your logic, everyone is already dead. $\endgroup$
    – void_ptr
    Apr 5, 2021 at 20:27
  • 13
    $\begingroup$ @Fattie: everybody dies... eventually. If that counts as being dead, then we're all dead. Going back to Jörg's comment, the more accurate thing to say is that they were "doomed", if we're going to nit-pick and take things literally instead of idiomatically. $\endgroup$ Apr 6, 2021 at 2:53
  • 11
    $\begingroup$ @JörgWMittag No, they were dead the moment they decided to re-enter with the damaged tiles on the wing of the spacecraft. If they'd noticed the damage and remained in orbit until it could be repaired (maybe docking with the ISS or something), they might have lived. $\endgroup$
    – nick012000
    Apr 6, 2021 at 3:31
  • 7
    $\begingroup$ @nick012000 If I recall things correctly, orbital mechanics of Columbia's mission precluded the possibility of an ISS rendezvous. $\endgroup$
    – T.J.L.
    Apr 6, 2021 at 13:02

The RCS wasn't depleted. The RCS firing was a symptom of a main issue, and it happened very late in the timeline, at 13:59:29. The RCS fired after the spacecraft's left yaw went beyond the capacity of the aerodynamic controls to compensate for it, Loss Of Control happened at 13:59:37, just 8 seconds later. The Loss of Control was due to a complete hydraulic failure. From the NASA Report, page 56:

A complete loss of hydraulics would cause the elevons and body flap to move to a floating position, resulting in an uncontrolled pitch-up. RGPC-2 data (approximately 25 seconds later) showed that the hydraulics systems failed, but no time signature was available to confirm when the loss occurred. Video data supported this time for LOC. The Spacecraft Crew Survival Integration Investigation Team (SCSIIT) concluded that the LOC occurred as a result of the loss of hydraulics at GMT 13:59:37 (EI+928). The loss of hydraulics likely occurred when all three redundant hydraulic systems lost pressure due to breaches in the hydraulic lines from thermal damage in the left wing

8 seconds wasn't enough time to run the RCS fuel dry, the shuttle diverged from controlled flight despite the RCS continuing to fire at full - the RCS wasn't powerful enough to counter the forces involved once hydraulics were lost. The system could have had infinite fuel and it would not have made a difference.

  • 3
    $\begingroup$ Indeed, inspection of at least one of the cockpit panels that made it to the ground (relatively) intact indicated that the crew was working a (perceived, at least) hydraulics problem shortly before the breakup... $\endgroup$
    – Digger
    Apr 7, 2021 at 15:37
  • 2
    $\begingroup$ This is where I disagree with the 'knew they were dead' part @Digger. Knew they were in deep doogy-doo yes, dead probably not, as it could have been instrumentation. They worked the problem to the end. $\endgroup$
    – GdD
    Apr 7, 2021 at 16:24

Actuator saturation is a control systems terminology. It means that the required (requested) control input exceeds the physical limitations of the actuators.

For example once a valve is fully open you cannot ask for more fluid since it is fully open. But the cooling system might ask for more numerically from the valve due to some excessive heat (a hypothetical situation). Here we say the valve is saturated.

In this case, while not knowing anything about the issue, the terminology refers to the full capacity of the actuator is reached and it is clearly not nearly enough. Because actuator saturation is something you want to stay quite far away as it brings in control instability and the behavior changes from undesirable to unpredictible to destructive in the saturation zone.

  • 1
    $\begingroup$ +1. Knowing something about the issue, what saturation means in this case is that one (and eventually more than one) RCS thruster was commanded on 100% of the time. The valves to RCS thrusters were either open or closed, no in between. However, the thruster controllers ran at a significantly faster rate than did the attitude control flight software. The command from the flight software to the thrusters was in terms of percent on-time for the next attitude control FSW step. Saturation in this case meant commanding 100% on-time. This in turn meant the control system had lost control authority, $\endgroup$ Apr 8, 2021 at 1:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.