>That's quite a small timewindow compared to the total burn<br /> />time. What happens if engines run dry before that 8<br /> />seconds, does some other system detect that and do cut<br /> />off?<br /><br />Well, first - it's not necessarily eight seconds. This time is typically eight seconds, but it does vary a little bit... probably a nit-picky thing to say but it's not a fixed number, that was my point. The arming is done when the vehicle reaches a certain velocity, which is typically around eight seconds prior to MECO.<br /><br />Now, the ECO sensors were put in place to protect us only from a circumstance where one of the SSMEs might be consuming too much of one propellant. Case in point - STS-93, which (coincidentally) was Eileen Collins' first flight as Commander - right at liftoff one of the SSMEs blew out a plugged post, and so there was a small amount of one of the propellants (I'm sorry, I don't remember which but I want to say that it was LOX) leaking out of the engine. This was somewhat similar, consumption-wise, to one of the SSMEs consuming its propellant at an unusually high rate. Near the planned MECO, that propellant was running so low that it went dry a couple seconds before the projected MECO time - tripping the two ECO sensors needed to protect the SSMEs. The engines did shut down early, but just in time to prevent them from ingesting vapors that would have resulted in a catastrophe.<br /><br />The ECO sensors are only in place to prevent against such an event. It's possible that an SSME will consume higher than expected propellant, and while it might not be a huge amount, over 500 seconds it adds up and would cause the tank to run dry (even with any reserves used up) a few seconds early. So, if the ECOs are armed 8 or 9 seconds prior to MECO, they will protect the vehicle against a catastrophic loss in such a case.<br /><br />As far as I know, there's nothing to protect the system from running out of propellant say, halfway through flight.