CAPE CANAVERAL - NASA is taking steps to prevent a known safety hazard that could tear apart the International Space Station and a docked shuttle, triggering rapid depressurization of both spacecraft and killing all aboard.

But NASA managers opted against a permanent fix because it would take at least three years. The shuttles are to be retired in 2010.

Nonetheless, NASA safety engineers say action being taken will reduce the already remote chance that shuttle steering jets could accidentally ignite while an orbiter is parked at the outpost, generating enough force to rip the joined craft apart.

What's more, an about-face by managers skeptical of the potential for disaster indicates safety engineers are exercising renewed clout in the wake of the 2003 Columbia accident.

"In my mind, this activity was a major success for safety. It's probably one of the top things," said Jeffrey Williams, chairman of NASA's Shuttle Safety Review Panel, which evaluates potential hazards and makes recommendations to managers.

"You always have Doubting Thomases, and wherever we went with this thing, we ran into Doubting Thomases," he said. "But the potential was identified. We confirmed the threat."

The risk also was reported in a 2005 FLORIDA TODAY reviewof agency documents obtained through the Freedom of Information Act.

The review showed the safety panel, and two others in the agency, had recommended changes aimed at preventing inadvertent jet firings.

Shuttle program leaders interviewed by FLORIDA TODAY discounted the slim chance of catastrophe, a probability between one in 10,000 and one in 1 million.

But safety experts later convinced managers that disaster could happen, and that the potential consequences - loss of the $100 billion station, a $2 billion shuttle and their astronaut crews - called for action.

"It was a sales job," Williams said. "We didn't get the Cadillac, but I think we came pretty darn close in getting management focused on what needed to be happening here."

Jets steer shuttle

The problem lies within the shuttle's Reaction Control System, which consists of 38 primary jets and six smaller thrusters in the orbiter's nose and tail.

The system is designed to steer shuttles in space and during the dive back through Earth's atmosphere.

Two electronics boxes called Reaction Jet Drivers route firing commands to the thrusters from the shuttle commander's stick, the ship's computers or Mission Control.

NASA managers have known since the early 1980s that thrusters could fire without being commanded to do so. It has happened five times when shuttles were not docked to other spacecraft.

NASA deemed the risk acceptable then because the crew could recover if the shuttle were accidentally propelled through open space.

The consequences increase when two ships are linked, because the craft could rip apart and crews would have no time to react.

Can fire when 'off'

Since 1995, when shuttles began docking at Russia's Mir space station, astronauts have controlled the hazard by turning off shuttle jet power most of the time the spaceships are joined in orbit. NASA continued that practice during dockings at the international station.

New fears arose after the Columbia accident. Safety studies showed the jets could fire even when power to the thruster system is turned off.

In a phenomenon known as "arc tracking," a short circuit in other shuttle systems could trigger a thruster firing if defective wiring runs through the same bundles as electrical lines leading to Reaction Jet Drivers.

That means the method NASA has used for years to control the risk - turning off shuttle thrusters while docked to a station - could not guarantee prevention of the problem.

Frayed wiring or the failure of transistors in the electronics boxes could prompt an accidental firing.

So could erroneous commands from shuttle computers or devices that relay commands from the computers to Reaction Jet Drivers.

Threat to station

Engineers also determined an unexpected firing lasting 1.5 seconds or longer could produce enough force to snap off station solar wings or radiators.

The hardware holding a docked shuttle to the station also could break.

NASA documents show the hazard is one of the most serious threats to the station, on par with the collision of a visiting spacecraft, a deadly orbital debris strike or a medical emergency.

"Here you have a potential single-point failure that could take out both the station and the shuttle. So it no doubt is going to be their No. 1 risk," Williams said.

NASA took steps aimed at limiting the risk prior to launching Discovery last July on its first post-Columbia mission.

Engineers developed a shuttle computer software patch designed to automatically detect and shut down unintended thruster firings within 1.3 seconds, or before stress on the structures would increase enough to cause catastrophic damage.

Power-producing solar arrays were repositioned to reduce structural loads and prevent possible damage.

Changes made

Those measures will be taken on future shuttle flights, too. But safety experts convinced once-reluctant managers to carry out other recommended changes that were resisted prior to Discovery's launch last summer.

Chief among them: intensified inspections of miles of wiring in bundles containing electrical lines linked to Reaction Jet Drivers.

Special measures are being taken to protect the wiring from chafing so insulation doesn't wear away and expose conductors that could short circuit.

NASA took apart and examined a Reaction Jet Driver and determined that the electronics boxes are not susceptible to age-related failures, Williams said.

Safety experts also recommended, and managers approved, new procedures during flight.

• Ground controllers will scour telemetry data for signs of potential electrical shorts before shuttles dock with or depart from the station.
  
  
• Crews will power some orbiter systems prior to docking, trying to uncover any lurking electrical shorts before a shuttle arrives at station.
  
  
• The amount of time Reaction Jet Drivers are electrically powered before a docking or undocking will be cut from one hour to 20 minutes.
  
  
• "Keep-out zones" will be established for astronauts conducting spacewalks near shuttle nose and tail thrusters.

• A shuttle will not use its 38 larger primary jet thrusters when docked to the station unless the outpost must be hauled to a higher orbit and the orbiter's six, smaller thrusters are out of commission.

Future danger

As a group, the measures are expected to keep shuttle and station crews safe during the agency's second post-Columbia test flight, scheduled to launch July 1.

Once outpost assembly resumes and the station grows larger, renewed dangers will arise.

The larger the station, the less force it will take to break apart the outpost and a docked orbiter if shuttle jets fire inadvertently.

NASA aims to continue extensive inspections and modifications to Reaction Jet Driver wiring as well as cables sharing the same bundles.

A permanent fix -- redesigning the Reaction Jet Driver -- would cost an estimated $36 million and take at least three years to complete.

NASA's shuttle fleet remains scheduled for retirement no later than Sept. 30, 2010.

Published under license from FLORIDA TODAY. Copyright © 2006 FLORIDA TODAY. No portion of this material may be reproduced in any way without the written consent of FLORIDA TODAY.