December 1988. The Space Shuttle program had barely returned to flight after Challenger. Atlantis was carrying a secret military payload – and its crew was about to discover that the spacecraft protecting them from the inferno of reentry might already be badly damaged.

On December 2, 1988, Space Shuttle Atlantis thundered away from Launch Complex 39B at Kennedy Space Center.

There were five astronauts aboard: Commander Robert “Hoot” Gibson, pilot Guy Gardner, and mission specialists Richard “Mike” Mullane, Jerry Ross, and William Shepherd.

Their mission, STS-27, was unusual from the beginning.

It belonged to the Department of Defense.

Much of what the crew would do in orbit was classified. NASA officially described STS-27 simply as the third Shuttle mission dedicated to the Department of Defense. Even such basic details as the spacecraft’s orbital altitude remained classified. Contemporary reports identified its primary payload as a military reconnaissance satellite, widely reported to be a Lacrosse radar-imaging spacecraft.

But the secrecy surrounding what was inside Atlantis’ payload bay would soon collide with something much more important.

The condition of the spacecraft itself.

Eighty-Five Seconds

For the astronauts, the ride to orbit appeared successful.

But launch photography told a different story.

Approximately 85 seconds after liftoff, a piece of ablative insulating material from the nose cap of the right solid rocket booster broke loose.

It struck Atlantis.

The spacecraft continued climbing.

The boosters separated.

The main engines eventually shut down.

Atlantis reached orbit.

There was no alarm announcing what had happened. No warning light appeared telling the astronauts that the spacecraft’s thermal armor might have been compromised.

But something had hit them.

And it had hit them hard.

NASA’s later investigation concluded that material from the right solid rocket booster’s nose cap was the most probable cause of the severe damage that followed.

The crew would soon learn that reaching orbit had only completed half their journey.

They still had to come home.

The Shuttle’s Achilles’ Heel

The underside of a Space Shuttle was covered with thousands of thermal protection tiles.

They looked almost mundane – small black blocks covering the belly and portions of the wings.

But during reentry they stood between the aluminum spacecraft and temperatures capable of destroying it.

The tiles were extraordinary insulators.

They were also fragile.

A serious impact could crack one, gouge one, or knock one away completely.

And if a critical area of the thermal protection system were breached, superheated gas could reach the structure underneath.

Fourteen years later, the world would learn exactly how catastrophic such a breach could become when Columbia was lost during STS-107.

In December 1988, however, Atlantis and its five astronauts were about to experience an eerie preview.

The Crew Looks Outside

After launch imagery revealed the debris strike, Mission Control asked the crew to inspect the spacecraft.

Fortunately, Atlantis carried the Shuttle’s Remote Manipulator System – the Canadarm – with a television camera that could be maneuvered around portions of the Orbiter.

The astronauts began looking.

What appeared on their monitor was deeply unsettling.

The right side of Atlantis was scarred.

Tile after tile showed evidence of impact.

Commander Hoot Gibson would later describe the spacecraft as looking as though it had been “blasted by a shotgun.”

According to an account later related by Gibson, his reaction on seeing the damage was even more chilling:

“We are going to die.”

The astronauts could see the damage directly on their onboard display.

Mission Control needed to see it too.

And that was where the unusual nature of STS-27 created another problem.

Secrecy Gets in the Way

STS-27 was not an ordinary NASA mission.

Because of its national-security classification, normal methods of transmitting imagery from the spacecraft could not simply be used without regard to security requirements.

The inspection imagery had to be transmitted through an encrypted system.

The result was disastrous for image quality.

The pictures received on the ground were substantially degraded.

The astronauts were looking at one thing.

Engineers on Earth were effectively looking at something else.

NASA’s later historical account says the crew could clearly see extensive damage on their monitors, but encryption significantly degraded the imagery transmitted to the ground. As a result, controllers did not appreciate the true severity of what the crew was seeing.

That created one of the most dangerous situations possible in a complex organization:

The people experiencing the problem and the people evaluating the problem were working from different versions of reality.

The crew was alarmed.

The ground was considerably less concerned.

And there was another uncomfortable fact.

Even the robotic arm could not provide a perfect inspection of every critical surface.

They did not truly know the complete condition of the heat shield.

Yet eventually, there was nothing left to inspect.

Atlantis had to return to Earth.

There Was No Rescue Coming

Today it is tempting to imagine some elaborate contingency plan.

Perhaps another Shuttle could have been launched.

Perhaps the crew could repair the damage.

Perhaps they could wait in orbit while engineers developed a solution.

The reality was far harsher.

STS-27 flew in 1988.

There was no International Space Station waiting nearby.

The Shuttle did not yet possess a mature capability for repairing major thermal-protection damage in orbit.

And Atlantis could not remain in space indefinitely.

Sooner or later, five astronauts would have to point the damaged spacecraft toward Earth and fire the engines.

The moment of truth would come during reentry.

Turning the Damaged Side Toward the Fire

Reentry is an unforgiving process.

After the deorbit burn, the Shuttle became a glider committed to returning to Earth.

There was no second attempt.

As Atlantis descended into increasingly dense atmosphere, kinetic energy was transformed into enormous amounts of heat.

The black thermal tiles underneath the Orbiter now had to perform the function for which they had been designed.

The same tiles the crew had seen battered and scarred.

The astronauts could do little except monitor the spacecraft.

Gibson later recalled watching the instruments during the peak-heating portion of the descent, looking for evidence that the right wing or surrounding structure was beginning to fail.

Atlantis kept flying.

The temperatures climbed.

The spacecraft held together.

Eventually the worst of the heating passed.

Then came California.

At 3:36 p.m. Pacific time on December 6, Atlantis touched down on Runway 17 at Edwards Air Force Base.

Four days, nine hours and approximately five minutes after leaving Earth, STS-27 was safely home.

Only then could anyone walk underneath the spacecraft.

What they found changed the story completely.

707 Wounds

The damage was extraordinary.

Postflight inspection recorded 707 tile damage sites.

Of those, 298 were greater than one inch in at least one dimension.

NASA investigators described it as the most severe thermal-protection-system damage experienced by the Shuttle program to that point.

And then there was the damage that mattered most.

One tile was gone.

Completely.

Beneath the missing tile, the metal had been exposed directly to the heat of reentry.

It had begun to melt.

Yet Atlantis survived.

Why?

Partly because of extraordinary luck.

A Few Inches of Luck

The missing tile happened to sit over a thick aluminum access plate associated with an L-band navigation antenna.

That plate provided far more thermal protection than the ordinary spacecraft skin would have provided at many other locations.

It absorbed enough of the punishment to prevent the damage from progressing catastrophically into the Orbiter.

The Columbia Accident Investigation Board later examined STS-27 while studying NASA’s history with debris strikes.

Its report made the significance unmistakable: according to Gibson’s later testimony, had the missing tile not been located over that substantial aluminum plate, a burn-through may have occurred.

Consider what that means.

Move the impact slightly.

Lose a different tile.

Expose a more vulnerable section of aluminum structure.

And the history of the Space Shuttle program might contain another date alongside January 28, 1986, and February 1, 2003.

December 6, 1988.

Atlantis did not survive because the original assessment of the damage was correct.

Atlantis survived despite the fact that the damage was worse than the ground understood.

The Uncomfortable Echo of Columbia

STS-27 became especially haunting after the loss of Columbia in 2003.

During STS-107, debris struck the Shuttle during ascent.

The spacecraft reached orbit.

The crew continued its mission.

The seriousness of the damage was not fully appreciated.

And the consequences appeared only when the vehicle encountered the extreme heating of reentry.

The Columbia Accident Investigation Board specifically examined STS-27 as part of its investigation into the Shuttle program’s history of debris strikes and described the event as one that foreshadowed STS-107.

There is an important difference.

Atlantis came home.

Columbia did not.

But perhaps that difference made STS-27 more dangerous as an organizational lesson.

Because when a system survives a serious failure, survival can easily be mistaken for evidence that the system was never truly in danger.

It is one of the most deceptive outcomes in engineering:

A bad decision followed by a good result. Nothing reinforces complacency more effectively.

The Secret Mission’s Real Lesson

STS-27 is remembered as a successful mission.

Technically, it was.

Atlantis completed its classified Department of Defense objectives.

The crew returned safely.

The spacecraft flew again.

But success is an incomplete description of what happened.

A piece of booster insulation struck the Orbiter during ascent.

Hundreds of thermal-protection tiles were damaged.

The astronauts saw evidence that frightened them.

The imagery reaching engineers on Earth understated what the crew could see.

One tile disappeared entirely.

The metal underneath began to melt.

And an unusually thick aluminum plate happened to be sitting in precisely the right place.

That final fact may have separated an extraordinary close call from catastrophe.

There is a tendency to study accidents because accidents leave wreckage, investigations and names engraved on memorials.

Near misses are easier to forget.

They leave something much more deceptive behind:

a functioning system.

STS-27 reminds us that survival does not necessarily prove a system was safe.

Sometimes it proves only that the final barrier did not fail.

Sometimes it means circumstances were forgiving.

And sometimes the distance between a successful mission and a national tragedy is measured not in miles –

but in inches.