That problem forced a delay of the space shuttle's launch on a space station assembly mission until Saturday at the earliest.
If those sensors fail to detect when the external fuel tank is empty, the engines could continue to run dry, and explode.
Based on electrical data seen during fueling Thursday, engineers believe the problem involves an open circuit in the wiring between an electronic box in the shuttle's engine compartment and the sensors at the base of the hydrogen section of the external tank. Given the shuttle's short eight-day launch window, NASA managers Thursday ruled out opening up the engine compartment to attempt any inspections of repairs.
LeRoy Cain, chairman of NASA'S Mission Management Team at the Kennedy Space Center, told reporters late Thursday engineers will meet again Friday to reconsider their options, adding they may not get comfortable with a fly-as-is rationale in time for a Saturday launch.
In the meantime, NASA managers ruled out a fueling test Friday and decided instead to top off the shuttle's onboard supply of liquid hydrogen to power the ship's electricity producing fuel cells. That would permit launch attempts Saturday and Sunday and still provide enough on-board supplies for a two-day mission extension and the addition of a fourth spacewalk.
Three spacewalks are required to connect the European Columbus research lab to the station; to replace a nitrogen coolant system pressurization tank; to install a pair of experiments on the Columbus module; and to move a failed space station gyroscope to the shuttle for return to Earth.
NASA managers want to add a fourth spacewalk if possible to permit a detailed inspection of a stalled solar array rotary joint to help engineers figure out what sort of repairs might be needed to get the joint turning smoothly again. But an additional spacewalk would require a two-day mission extension and that, in turn, is based on how much hydrogen and oxygen is available to power the ship's fuel cells.
A launch on Saturday, assuming the engine cutoff sensor problem can be resolved, would be targeted for 3:43:31 p.m., setting up a docking with the international space station around 12:56 p.m. Monday. The forecast for Saturday calls for a 60 percent chance of good weather, improving to 70 percent "go" on Sunday.
Atlantis' launch window closes Dec. 13 because of power and temperature issues related to the space station's orbit. The window reopens Dec. 30, but senior NASA managers have said launch would be delayed to at least Jan. 2 if the shuttle team misses the current window.
NASA managers had high hopes for a launching Thursday, with a forecast calling for a 90 percent chance of good weather and no technical problems of any significance at pad 39A. After a short 13-minute Mission Management Team meeting, engineers were cleared to begin loading a half-million gallons of super cold liquid oxygen and hydrogen rocket fuel into Atlantis' external tank at 7:06 a.m. A few minutes later, the engine cutoff - ECO - sensors at the base of the tank were covered with supercold propellant.
The ECO sensors are part of a backup system that ensures the shuttle's three main engines don't drain the tank in the event of other problems during the climb to space that might prevent an on-time shutdown.
The ECO sensors can indicate two possible states: wet or dry. If the sensors falsely indicated they are submerged in fuel when, in fact, the tank is dry, the engines could run out of propellant while operating at flight pressures, speeds and temperatures, suffering catastrophic failures.
Based on the logic used in the computer software that monitors the sensors during ascent, two "failed wet" sensors would have no impact. But a third sensor failing wet could trigger a premature engine shutdown to protect against the possibility of the remaining sensor failing in the dry state. Launching with two sensors in the failed wet state would leave no redundancy in the system.
Propellants flow into the tank from the bottom and shortly after the four engine cutoff sensors at the base of the hydrogen section were submerged Thursday, commands were sent to simulate dry conditions to make sure the circuitry responded properly. Voltage readings from two of the sensors immediately indicated a dry state while sensors 3 and 4 showed voltages higher than 13.5 volts, an indication of an open circuit. The readings occurred simultaneously.
"What's currently in the plan is that we'll try to put together an operational workaround plan that we can get comfortable with that will allow us to go fly on Saturday," Cain said. "And it would be with the intent of flying with one or more failures potentially in the system when we go tank up again."
A premature engine shutdown could result in a trans-Atlantic landing. An emergency landing in Spain or France would cause major disruption to the space station assembly schedule and NASA's plans to complete the outpost and retire the shuttle by 2010.
Engineers say the odds of a premature engine shutdown in this case are acceptably remote because multiple failures would be required - ECO sensor failures as well as a leak or problems elsewhere in the system that would cause the shuttle to use up its hydrogen fuel at a higher-than-expected rate.
But not everyone agrees. Some engineers favor rolling Atlantis back to the Vehicle Assembly Building for repairs. NASA Administrator Mike Griffin participated in Thursday's Mission Management Team meeting and presumably will weigh in on how the agency proceeds this weekend.