Could the Columbia crew have survived if the RCS had not been depleted?

Question

I ask this question because of a comment made by John Connolly, NASA engineer and director of the International Space University. To quote Connolly, "..when he (Rick Husband) saw that the RCS was saturated, he knew they were dead." This suggests two things to me-

1. The commander and pilot realised that the reaction control system (RCS) was firing constantly and the only thing maintaining reentry profile.
2. If the RCS had enough propellants left to maintain the orbiter within its flight corridor for a while longer, there was the possibility that the crew could have bailed out. This bailout scenario would involve the orbiter descending to an altitude of 25,000 feet (from 200,000 feet), maintaining a nominal deceleration profile, the left wing, or a large part of it, (for drag not lift) remaining attached to the vehicle and the RCS having enough thrust (and fuel) to control the disintegrating orbiter. Apparently the RCS was able to maintain correct drag profile and its saturation was the immediate cause of loss of control, of course along with a lot of other things occurring at that time. That's a lot of "ifs" I know and without one of them (and probably a lot of others) breakup, ballistic reentry and loss of crew is the only other alternative.

Answer 1

You are misreading the accident report. By 14:00:02, the vehicle had already begun to lose structural integrity, it had already begin to lose thermal integrity, and it had completely lost control authority.

I'm going to digress a bit to distinguish between faults, errors, and failures. As a simple example, consider a bit in computer memory that permanently faults to an always one state. Writing a one to that bit has no obvious effects. A program that later reads that bit as a one will do exactly what it is supposed to do because there's no distinction between the one value that was intended to be written and the one value that is read. At some point in time, a program will try to change the value of that bit to zero. That won't work, but the manifestation of this issue won't arise until later when that memory position with an incorrect value is read. The fault manifests as an error this point in time. Nothing untoward might happen immediately after this error occurs. It might take multiple reads before the software takes an incorrect action. This incorrect action is a failure.

Note well: This is the terminology I have been trained to use. Others use different terms. The concept remains the same; there can be a significant time delay between the root cause of a set of problems and when those problems manifest themselves.

In the case of the Columbia, the fault occurred shortly after launch when pieces of foam detached from the external tank and hit the Columbia at a critical juncture, tiles on the wing leading edge. This fault didn't manifest itself until much later, during entry when those tiles started coming loose. Radar showed pieces of debris coming off of the Columbia minutes before the vehicle broke up.

This changed the vehicle's aerodynamics. It also enabled a stream of hot plasma to enter the vehicle, progressively destroying an increasing number of components. The combination of changed aerodynamics and loss of components resulted in the vehicle losing control authority. Attitude control systems are designed not to run anywhere close to requiring an attitude thruster to fire 100% of the time. Saturation means the vehicle can no longer control its attitude. Or as John Connolly put it, "..when he (Rick Husband) saw that the RCS was saturated, he knew they were dead." No extra amount of propellant could have helped.

Answer 2

The RCS wasn't depleted. The RCS firing was a symptom of a main issue, and it happened very late in the timeline, at 13:59:29. The RCS fired after the spacecraft's left yaw went beyond the capacity of the aerodynamic controls to compensate for it, Loss Of Control happened at 13:59:37, just 8 seconds later. The Loss of Control was due to a complete hydraulic failure. From the NASA Report, page 56:

A complete loss of hydraulics would cause the elevons and body flap to move to a floating position, resulting in an uncontrolled pitch-up. RGPC-2 data (approximately 25 seconds later) showed that the hydraulics systems failed, but no time signature was available to confirm when the loss occurred. Video data supported this time for LOC. The Spacecraft Crew Survival Integration Investigation Team (SCSIIT) concluded that the LOC occurred as a result of the loss of hydraulics at GMT 13:59:37 (EI+928). The loss of hydraulics likely occurred when all three redundant hydraulic systems lost pressure due to breaches in the hydraulic lines from thermal damage in the left wing

8 seconds wasn't enough time to run the RCS fuel dry, the shuttle diverged from controlled flight despite the RCS continuing to fire at full - the RCS wasn't powerful enough to counter the forces involved once hydraulics were lost. The system could have had infinite fuel and it would not have made a difference.

Answer 3

Actuator saturation is a control systems terminology. It means that the required (requested) control input exceeds the physical limitations of the actuators.

For example once a valve is fully open you cannot ask for more fluid since it is fully open. But the cooling system might ask for more numerically from the valve due to some excessive heat (a hypothetical situation). Here we say the valve is saturated.

In this case, while not knowing anything about the issue, the terminology refers to the full capacity of the actuator is reached and it is clearly not nearly enough. Because actuator saturation is something you want to stay quite far away as it brings in control instability and the behavior changes from undesirable to unpredictible to destructive in the saturation zone.