The space shuttle fleet is grounded until technicians find and fix a vexing problem with engine cutoff (ECO) sensors—a component that NASA now realizes has likely never worked throughout the 26-year history of the shuttle program.

Attempts to launch Atlantis were halted on Dec. 6 and 9 because of sensor problems. This has not yet slowed International Space Station assembly, but it could if the shuttle delay also affects future flight schedules. The ECO problem is also forcing a reexamination of safety philosophy on redundant systems throughout the shuttle orbiter.

Debate about what to do with the ECO system caused managers to totally reverse positions within 24 hr.—swinging first toward flying without relying on half of the sensors, to the current assessment that the whole ECO system must be functioning and fully redundant. Some top managers initially eyed flying with no ECO sensors operational, given that they believed new data indicate the system has always been unreliable.

A new wholesale review of redundant system safety is being contemplated as a result of a recurrence of the ECO hydrogen sensor system problems that managers thought had been fixed through earlier, exhaustive efforts.

The malfunctions are already delaying the launch of the European Columbus laboratory to the ISS. More than 750 European aerospace guests had traveled to the Kennedy Space Center for the Columbus launch, says Alan Thirkettle, ESA Columbus program manager.

The Astronaut Office already weighed in with more conservative guidelines when managers initially considered flying Dec. 9 with relaxed ECO rules, relying instead on increased Mission Control vigilance of new Atlantis instrumentation that monitors voltage off each sensor. That idea however, was rejected within a day, in part because of Astronaut Office opposition.

The ECO problem, which everyone thought had been fixed, has actually “been hanging like a cloud over us for the last two years,” says Bill Gerstenmaier, NASA associate administrator for space operations.

“It seems to me likely that we have been flying the entire history of the shuttle program with a false sense of security and that we never had reliable protection from a [catastrophic] liquid hydrogen low-level engine cutoff,” says Wayne Hale, shuttle program manager.

“That is a really sobering thought,” he says in the e-mails obtained by Aviation Week & Space Technology.

The engine cutoff protection was to be provided by the hydrogen ECO system that failed in the Atlantis countdowns and during preparations with three other missions since 2005.