Credit: Ben Cooper/Spaceflight Now

Hoping critical fuel sensors will work properly the second time around, NASA managers today tentatively rescheduled the shuttle Atlantis for a delayed launch Sunday afternoon to kick off a high-profile mission to deliver Europe's Columbus research module to the international space station. With forecasters predicting a 70 percent chance of good weather, liftoff is targeted for 3:21 p.m. assuming no major problems turn up in a final round of engineering reviews Saturday.

"The team has taken a very thorough and measured approach to this," said shuttle Program Manager Wayne Hale. "We're very cognizant of the fact that you don't like to accept risk at the launch site, we don't want to get launch fever. Even though the Columbus is out there loaded in the payload bay and everybody is anxious for us to launch that guy, we want to make sure when we go launch it is safe, or at least as safe as it ever is in this normally risky business."

The long-awaited flight was delayed Thursday when two of four engine cutoff sensors in the hydrogen section of the shuttle's external tank failed to respond properly during fueling. A third sensor later acted up during the de-tanking procedure. NASA managers considered launching Atlantis as is Saturday, but after a long debate they tentatively decided to proceed toward an attempt Sunday if additional reviews show the plan is safe and if all four sensors are operating properly.

While engineers do not know what might be causing the problem, past experience with balky sensors shows they tend to work normally during subsequent fueling operations.

In addition, the shuttle's launch period - normally about five minutes long - will be shortened to around one minute right around the moment Earth's rotation carries the launch pad into the plane of the space station's orbit. That will minimize the amount of propellant needed to catch up with the lab complex and provide a reserve to protect against unexpected failures and additional sensor problems that might otherwise trigger a premature engine shutdown.

As an additional precaution, new instrumentation designed to monitor the health of the engine cutoff - ECO - sensors will be used in mission control during ascent to keep tabs on the circuits in case of failures that might require action by the crew.

"The crew office, the flight crew actually came with a very positive proposal in my view today," Hale said. "They said let us tighten up our launch commit criteria and require all four of these sensors to be working, plus the new instrumentation we've added that measures voltage in the middle of this system, which is new on the last couple of flights, require all four of those measurements to be working. And if all of that stuff is working and we restrict our launch to a very short window around the most optimum time to give ourselves the maximum performance benefit, then with some new flight rules that the mission operations people back in Houston are implementing, the flight crew believes it would be acceptably safe for us to go fly with some additional risk."

Not everyone agreed. But Hale sided with the flight crew office, saying "I personally believe this is a great proposal."

"However, we want to run down a number of the technical aspects," he said. "We are still facing a situation where we don't know root cause. If we tank the vehicle up and we have these sensors act up again, we certainly would want to stand down again because that's outside our experience base. So the proposal is on the table."

NASA's MIssion Management Team plans to reconvene at 1 p.m. Saturday to review final engineering assessments. If no major problems are found, the team will proceed toward a launch attempt Sunday.

"If we find this proposal that the flight crew office has offered allows us to fly with acceptable risk, we'll try to tank up the vehicle and launch on Sunday," Hale said. "If, on the other hand, as we think about it and review it for the next several hours and think this is not a good plan, then we will stand down and do something different. So it's the nature of spaceflight. Here we are. When I come down for a shuttle launch, I always pack enough clothes to last through the entire launch window. I hope you guys did."

Engineers do not yet know what caused ECO sensors 3 and 4 to fail a test during fueling Thursday and they don't know if the devices or associated circuitry will malfunction again Sunday. NASA has a flight rule exception that permits a launch with three of four operational ECO sensors but because the system aboard Atlantis is considered suspect, engineers today decided to require four operational sensors for a launch to proceed.

If any one of the sensors fails after fueling Sunday, the launch will be called off.

Under the revised timeline, engineers will begin pumping a half-million gallons of super-cold liquid oxygen and hydrogen rocket fuel into the shuttle's external tank at 5:56 a.m. Sunday. The four engine cutoff sensors at the base of the tank will be submerged in liquid hydrogen, at minus 423 degrees Fahrenheit, by 6:41 a.m. and tests to confirm their health will begin shortly thereafter.

The three-hour fueling process should be complete by 8:56 a.m. and the astronauts - commander Steve Frick, pilot Alan Poindexter, flight engineer Rex Walheim, Leland Melvin, Stan Love and European astronauts Hans Schlegel and Leopold Eyharts - are scheduled to begin strapping in around 12:01 p.m.

Launch is targeted for 3:21:00 p.m. Assuming an on-time liftoff, Atlantis will dock with the space station around 12:08 p.m. Tuesday. The European Space Agency's Columbus module will be attached to the station during a spacewalk the next day.

Frick and company plan three spacewalks to prepare the Columbus module for attachment to the station; to move an empty nitrogen tank and a failed gyroscope to the shuttle for return to Earth; and to install two external experiments on the hull of the new lab module.

NASA managers want to add a fourth spacewalk if possible to permit a detailed inspection of a stalled solar array rotary joint to help engineers figure out what sort of repairs might be needed to get the joint turning smoothly again. But an additional spacewalk would require a two-day mission extension and that, in turn, is based on how much hydrogen and oxygen is available to power the ship's fuel cells.

Engineers took advantage of the Thursday launch delay to top off the shuttle's on-board fuel cell hydrogen supply. As a result, NASA can make two launch attempts Sunday and Monday before standing down for 72 hours to re-load hydrogen and oxygen for the fuel cell system. That would permit a final launch try Dec. 13, the day the shuttle's launch window closes for the year.

Assuming a launch Sunday and a two-day mission extension, Atlantis would return to the Kennedy Space Center on Dec. 22. And in all cases, the launch strategy assumes all four ECO sensors work properly when submerged in cryogenic propellant.

The sensors in question are part of a backup system intended to ensure a safe engine shutdown if some other problem caused the shuttle to use its hydrogen fuel faster than expected.

LeRoy Cain, chairman of NASA's Mission Management Team at the Kennedy Space Center, told reporters late Thursday the problem appeared to be an open circuit somewhere in the wiring between an electronic component in the shuttle's engine compartment and the sensors at the bottom of the hydrogen tank.

Given access problems and an eight-day launch window that closes for the year Dec. 13, the MMT ruled out opening the aft for any possible inspections or repairs. Instead, NASA focused on developing possible workarounds that would permit launching Atlantis as is with two or more suspect low-level cutoff sensors.

The ECO sensors would only be needed late in the climb to space if some other problem - a leak, for example, or a hydrogen-rich mixture ratio in the main engines - caused the shuttle to burn up its hydrogen supply faster than expected. Without the ECO sensors, the engines could drain the tank and suffer catastrophic oxygen-rich shutdowns. The ECO sensors are in place to ensure a safe engine shutdown before any damage could occur.

Atlantis could launch with just two operational ECO sensors. But in that case, one additional failure could trigger a premature engine shutdown because the software has to protect against the possibility that the remaining sensor could fail or indicate the wrong state.

NASA has had major problems with the ECO sensors in the initial post-Columbia flights and the agency recently developed new instrumentation to provide voltage readings that can show whether the sensors, which only indicate whether they are wet or dry, have changed state. The instrumentation is used during countdowns to monitor the sensors, but the data is not yet implemented in any ascent procedures.

Given the problems with Atlantis' ECO sensors, Cain asked engineers to look into the possibility of using that instrumentation during the climb to space to give flight controllers a way to assess the health of the sensors in flight. That would provide the insight needed to order a manual engine shutdown if needed.

The odds of the multiple failures that would have to occur to trigger an abort in this context are considered remote. The shuttle's flight computers only monitor the state of the sensors during the final seconds of powered flight when the tank is nearly empty. But NASA managers could not agree today to launch Atlantis with two of four sensors. Instead, they tentatively decided to fill the tank for a Sunday attempt and proceed to launch but only if all four sensors are operating normally.

But even if all four ECO sensors are operating normally at launch, there is still additional risk.

"The additional risk, of course, is that these sensors have not functioned as we expected them to," Hale said. "And even if they do come back and function well the next time we tank, which has been our experience, there is some risk that once you launch and you get into the shake, rattle and roll of actual flight that these sensors might once again start failing, presumably to this open circuit state, so you would lose this low-level protection.

"And then, if you had lost enough sensors so that you didn't have low-level protection - I'm talking about the whole circuit involved here - then if you incurred some other problem that would cause you to run short on hydrogen fuel, you would be forced to either take the abort action or you would be facing a catastrophic event.

"We would like to have certainty," he said. "We would like to know root cause. We are not likely to have certainty or root cause and be able to launch in this window. So we're thinking about our options and whether the risks involved are acceptable or not."

Assuming the MMT opts to proceed, here is a revised countdown for Sunday's launch activity (in EST; crew times TBD):

EST...........EVENT

12:06 AM......Fuel cell activation
12:56 AM......Booster joint heater activation
01:26 AM......MEC pre-flight bite test
01:41 AM......Tanking weather update
01:56 AM......Final fueling preps; launch area clear
02:56 AM......Red crew assembled
03:41 AM......Fuel cell integrity checks complete

03:56 AM......Begin 2-hour built-in hold (T-minus 6 hours)
04:06 AM......Safe-and-arm PIC test
05:11 AM......Mission management team tanking meeting
05:26 AM......Test team ready for ET loading
05:56 AM......Resume countdown (T-minus 6 hours)

05:56 AM......LO2, LH2 transfer line chilldown
06:06 AM......Main propulsion system chill down
06:06 AM......LH2 slow fill
06:36 AM......LO2 slow fill
06:41 AM......Hydrogen ECO sensors go wet
06:46 AM......LO2 fast fill
06:56 AM......LH2 fast fill
08:51 AM......LH2 topping
08:56 AM......LH2 replenish
08:56 AM......LO2 replenish

08:56 AM......Begin 2-hour 30-minute built-in hold (T-minus 3 hours)
08:56 AM......Closeout crew to white room
08:56 AM......External tank in stable replenish mode
09:26 AM......Astronaut support personnel comm checks
10:01 AM......Pre-ingress switch reconfig
11:26 AM......Resume countdown (T-minus 3 hours)

11:31 AM......Crew departs O&C building
12:01 PM......Crew ingress
12:51 PM......Astronaut comm checks
01:16 PM......Hatch closure
02:01 PM......White room closeout

02:06 PM......Begin 10-minute built-in hold (T-minus 20m)
02:16 PM......NASA test director countdown briefing
02:16 PM......Resume countdown (T-minus 20m)

02:17 PM......Backup flight computer to OPS 1
02:21 PM......KSC area clear to launch

02:27 PM......Begin final built-in hold (T-minus 9m)
02:57 PM......NTD launch status verification
03:12:00 PM...Resume countdown (T-minus 9m)

03:13:30 PM...Orbiter access arm retraction
03:16:00 PM...Launch window opens
03:16:00 PM...Hydraulic power system (APU) start
03:16:05 PM...Terminate LO2 replenish
03:17:00 PM...Purge sequence 4 hydraulic test
03:17:00 PM...IMUs to inertial
03:17:05 PM...Aerosurface profile
03:17:30 PM...Main engine steering test
03:18:05 PM...LO2 tank pressurization
03:18:25 PM...Fuel cells to internal reactants
03:18:30 PM...Clear caution-and-warning memory
03:19:00 PM...Crew closes visors
03:19:03 PM...LH2 tank pressurization
03:20:10 PM...SRB joint heater deactivation
03:20:29 PM...Shuttle GPCs take control of countdown
03:20:39 PM...SRB steering test
03:20:53 PM...Main engine start (T-6.6 seconds)
03:21:00 PM...SRB ignition (LAUNCH)