A post with a dry technical title—“STS-51-F Abort-to-Orbit (1985)”—passed through Hacker News the other day. Thirty-seven upvotes, eleven comments, an unhurried discussion. The occasion was outwardly inconspicuous: in 1985, one Shuttle flight aborted its ascent—but did not turn back toward the launch pad. It continued onward and did make orbit, just a lower one than planned.
What usually draws me to spaceflight is catastrophe: Challenger, Columbia, the postmortems, the chains of ignored signals. Here the story is inverted. It is not about a system failing and killing people, but about a system failing—and still ending well. Episodes like this are barely remembered: they have no tragedy, no culprit, no memorial. Which makes them all the more useful for seeing how complex machinery actually works.
Out of the Shuttle’s one hundred and thirty-five flights, exactly one aborted its ascent and still flew on. It is worth looking into not for the mission itself, but for the question it leaves behind: how much engineering margin must be built into a machine for an emergency to become an inconvenience rather than a catastrophe?
The Shuttle had an entire ladder of scenarios for when something went wrong during ascent. They were called “abort modes,” but in essence they were rehearsals for a courteous retreat: not “save yourselves,” but “let’s figure out where to land.”
The rungs grew gentler as they went. The harshest was return to launch site (RTLS): the spacecraft keeps flying forward, burning off excess propellant, then turns around in midair and heads back toward Kennedy Space Center. It was both the fastest maneuver and the most dangerous. Astronaut Mike Mullane called it “an unnatural act of physics,” and when John Young, commander of the Shuttle’s first flight, was asked to make RTLS a training scenario for that first mission, he refused, comparing it to Russian roulette: “RTLS requires continuous miracles interspersed with acts of God.”
Next came transatlantic landing (TAL): backup runways in Spain, France, England, the Azores. Then abort once around (AOA), with a landing roughly ninety minutes later. And finally abort to orbit (ATO)—the case where the required altitude is no longer reachable, but a stable orbit above one hundred kilometers is still possible.
Over the program’s thirty years, neither RTLS nor TAL nor AOA was ever needed. All three existed only on paper and in training—though real people and money went into preparing them every time: a week before launch, two C-130s, eight pararescuers, two surgeons, a nurse, and more than a ton of medical equipment flew to the backup airfield in Spain. Exactly once in history, the final and gentlest mode was used. That is the story here.
July twenty-ninth, 1985. Challenger. The Spacelab-2 mission. A seven-person crew—one of the oldest at the time, with an average age of forty-seven and just two space missions among them. On board was a cluster of solar telescopes and spectrometers, one of the most complex scientific payloads the Shuttle had ever carried.
Exactly seventeen days earlier, on July 12, this same crew had already endured a scrub: the launch was aborted three seconds before liftoff, when the cooling valve on the second engine closed too slowly. Pilot Roy Bridges later recalled turning to the commander and showing him his empty palms: “Gordon, I didn’t touch anything. It’s the automatic system.” At the time, they thought their bad luck had run out.
Six minutes after launch on July 29, it became clear that it had not. At five minutes forty-three seconds, the temperature at the outlet of the center engine’s fuel pump crossed the red line, and the onboard computer shut it down. Altitude: around one hundred and eight kilometers. Speed: nearly fifteen thousand kilometers per hour. Too high and too fast now to return to the launch site. Two options remained: landing in Europe, or aborting to orbit.
Flight engineer Story Musgrave opened the checklist to the page headed “SPAIN,” and his neighbor Karl Henize quietly asked, “Where are we going, Story?”—“Spain, Karl.” A second later Musgrave closed the page. “We’re close, but not that close yet.” They passed the European landing window with just thirty-three seconds to spare. Then Houston came over the loop: “Abort ATO.”
At 16:06, commander Gordon Fullerton fired the orbital maneuvering engines for one hundred and six seconds—burning a substantial share of precious propellant, but pulling the spacecraft up into a low stable orbit. They had planned for a circular orbit of around three hundred and eighty kilometers. They got two hundred and sixty-five.
Then came the part that makes this flight worth remembering at all.
Two minutes later, another sensor failed—this time on the third engine. Its readings, too, crossed the red line. The computer, following its instructions to the letter, was supposed to shut down a second engine in succession.
It did not, because of one person’s decision. Jenny Howard, the propulsion officer in Mission Control—later Howard-Stein—had already figured out what was happening: it was not the engines that were failing, but the sensors. They were thin wires whose electrical resistance changed with heat; vibration and overheating had made them start lying. Jenny sent the crew a recommendation to lock out further automatic shutdowns—in other words, to order the computer to ignore the readings from the remaining sensors.
The two surviving engines ran for another forty-nine seconds, shutting down at nine minutes twenty seconds after launch. The spacecraft reached orbit.
This is where it is worth clarifying the scale of what almost happened—but carefully, because the sources themselves do not agree. The plan only covered the Shuttle having one failed engine throughout ascent. If a second had failed within roughly sixty-nine seconds of the first, there would no longer have been enough energy to reach Europe, and the Shuttle did not receive an emergency escape system until after the Challenger disaster. Hence the caution: some accounts explicitly call it a possible loss of crew and vehicle; others flag the same phrase as a claim needing verification. The event itself is beyond dispute. But “how many seconds separated them from death” remains an estimate.
There is another ledger in this story—the one usually hidden behind the excitement over a “successful abort mode.”
ATO left the spacecraft lower, with less propellant for orbital operations. Part of the program had to be cut: they had planned to fly around a deployed plasma-diagnostics instrument, but that was canceled because there was nothing left to maneuver with. The first-ever deployment of Europe’s IPS precision-pointing system could not hold the Sun for a long time—one of America’s biggest newspapers quoted a mocking line: it could not track a coin from two miles away; the instrument “couldn’t hit the broad side of a barn.” They fixed it with software, in flight.
Officially, the mission was still judged a success. More than that—thanks to frugal propellant use, it was extended by seventeen orbits, an extra day beyond its seven-day schedule. Fullerton later said: “We went for seven days and got eight.”
And there is a separate, bitterly funny layer to it. The mission’s most famous payload was not solar physics, but soda cans. Coca-Cola and Pepsi brought their drink systems aboard Challenger—the first cola in space, with the cola wars in full swing. At the last preflight briefing, instead of fresh data about the Sun, the crew got an appearance by NASA’s chief lawyer, who instructed them on how to photograph one another drinking properly. Physicist Loren Acton, who had spent seven years preparing for this mission, threw him out of the room. Coca-Cola won the blind taste test—but the crew, having tried both, preferred ordinary powdered Tang.
It is hard to resist setting another flight beside it. Three years later, in December 1988, Atlantis departed on the secret STS-27 mission. Eighty-five seconds after launch, a piece of insulation broke away from the nose of a booster and struck the spacecraft’s thermal protection.
Using the manipulator arm’s cameras, the crew saw white streaks of damage running along the entire fuselage. Mission Control, studying blurred encrypted images over a slow channel, decided they were imaging artifacts and reassured the crew. It later emerged that more than seven hundred tiles had been damaged, and one near the nose was missing altogether. Mission commander Hoot Gibson, unconvinced by the ground assessment, told his people: “No sense dying all tensed up”—and the crew prepared for reentry as though it would be their last.
Here it is worth stepping off the path of public versions and looking at the cold facts. Both disasters of the program—Challenger and Columbia—began not with a failure, but with an ignored signal that looked, on paper, like “within normal limits.” In 1985, and again three years later, the hardware behaved predictably: sensors were at fault, while the decisive question was whether a person would trust the instruments or their own reasoning. The difference between a successful ATO and a dead crew did not lie in the engines.
Back to the question from the hook: where does the margin come from that turns an emergency into an inconvenience?
The Shuttle’s four abort modes were preparations for different degrees of hopelessness—from turning around above the launch site to quietly accepting a lower orbit. Three of them were never used even once. The very possibility of choosing not to land, but to “land somewhere else, later and worse, but land”—that was the margin. It was designed in advance, trained for, paid for with C-130 flights to Spanish airfields, and kept ready for thirty years for a single day.
The tragedies of spaceflight are remembered by name. Almost no one remembers the quiet success of July 29, 1985: there was no one to mourn and no one to blame. But it is precisely this success that shows what engineering honesty really costs—not a guarantee that everything will be fine, but a prepaid right to choose exactly how badly things will go. No one ever calculated the exact price of that right; it gets written in afterward, and that time it turned out to be cheaper than catastrophe.