More than three weeks ago, a massive leak in a line carrying liquid hydrogen fuel halted the launch of the space shuttle Columbia. Since then, the leak has baffled NASA engineers and raised questions about testing procedures, quality control and the possible existence of other flawed shuttle hardware.

Engineers cannot explain how the leak sneaked past their multiple barricades of tests and inspections, have not found its location and do not know what caused it. The suspect part, which carries fuel from the huge external tank to the orbiter's main engines, had passed batteries of tests and inspections over a six-year period, including an examination of its valve with a tiny camera.

The incident has evoked chilling echoes of patterns that had developed before the 1986 Challenger accident.

For example, when Columbia's hydrogen line connector was first tested, in 1984, a leak appeared. The test conditions were then altered so the hardware could be approved.

National Aeronautics and Space Administration records show that 33 of the 60 connectors tested to date failed in their first tests but that the test method was changed to allow the part to pass.

And, as before Challenger, engineers frequently cite the record of successful flights as a basis for confidence in the fuel line connectors.

Similar tendencies were condemned by the presidential commission that investigated NASA's handling of problems with leaky O-ring seals -- parts also intended to contain explosive propellants -- whose flaws caused the loss of Challenger and a crew of seven.

Some officials acknowledged that the current case sounds like "pre-Challenger think" but asserted that it is not and that the new shuttle program would not tolerate it.

In fact, NASA's top decision-makers, many former astronauts, recently won praise from an independent panel of safety advisers for their "painstaking approach" in deciding to roll Columbia back to its hangar, delay its astronomy mission by at least two months, massively reshuffle shuttle hardware and generally hold fast to the post-Challenger credo of "safety over schedule."

Still, the leak and other recent glitches have raised concerns about NASA's ability to assure quality and reliability as well as avoid disaster.

The space agency's George Rodney, head of the office of safety and mission quality that was set up after the Challenger investigation to be an internal watchdog, said, "Most {NASA} management is very unhappy . . . and I am very, very unhappy" that the leak was detected so late in the process. "Quite frankly, we don't understand it completely . . . . Now we've got to find out why we didn't catch it."

"There's been tremendous stress on all of us in the program because of the impact . . . of an unknown like this," said Jack Boykin, deputy director of the orbiter program at Johnson Space Center in Houston. "How is it that we somehow did not have enough margin, enough tolerance . . . to preclude this getting to the point that it did?"

The leak set off alarms on May 29 when it flooded the engine compartment of the shuttle Columbia with potentially explosive hydrogen gas as the giant tank was being filled with a half million gallons of liquid hydrogen and liquid oxygen propellants six hours before the scheduled launch. That mission has been delayed until at least mid-August.

The flaw was apparently in a part of the fuel line known as the 17-inch "quick disconnect," which carries liquid hydrogen from the tank through the orbiter's belly to power the orbiter's three main engines during ascent and then separates to let the emptied tank separate from the orbiter.

At that point, 17-inch-wide valves on both orbiter and tank sides slam shut to seal in any remaining propellant.

If a valve shut prematurely during the climb to orbit, the change in pressure would cause a catastrophic accident. To prevent this, NASA has watched the part by means of numerous tests, sensors and other safeguards and, following the Challenger accident, further strengthened the design.

NASA's three shuttles have completed 10 missions since resumption of flights 20 months ago following a major overhaul of the program. The pace had accelerated gradually to the point that the 1990 manifest called for a launch rate as high as the program had achieved just before the 1986 disaster -- nine per year or one every five or six weeks.

NASA officials say they still hope to launch the shuttle Atlantis on a secret military mission in July but have decided to perform an extra test, filling its tank partially with hydrogen next week to make sure its 17-inch connector is sound.

Engineers fear the defect may have threaded its way through the shuttle program, in the form of a flawed batch of metal used to make the part or other weakness in a production process.

"There's almost got to be a possibility that if one {unit} got into a pre-launch countdown before it was detected, there could be another, or in other words a generic flaw," Boykin said.

Engineers investigating the records of Columbia's flawed part found that it, as well as its counterpart on Atlantis, were in a string of eight in a row that failed initial factory leak tests in 1984. A broader look revealed that over the life of the shuttle program, leaks have shown up in the initial performance tests of around 33 of the 60 connectors produced to date, Boykin said.

Engineers concluded, however, that those leaks were in ground test equipment, not flight hardware. For testing, the part of the unit that is attached to the tank and jettisoned each time is bolted to a "slave unit" designed to simulate the reusable half of the connector that is part of the orbiter.

Whenever excessive leakage was detected, the slave unit was removed and a flat plate was substituted and, always, the leaks disappeared.

But some engineers say privately that the substitution altered the condition of the test, taking it further away from simulating actual launch stresses.

"It didn't put the same loads on {the component} as the slave unit," a high-ranking engineer said. "One could argue that it wasn't really like it should have been . . . . We'll have to take a hard look at that test itself."

The orbiter side supplies the mechanical linkages that open and close the valves and exert pressure on the seals. When it is removed and the flat plate used, Boykin acknowledged, "you do remove those potential forces on the flapper shaft itself, the tolerances of the Teflon seals" and other parts.

But, he said, all of those parts "are so overdesigned, by a factor of 5 to 1" that engineers believe they could tolerate worst case conditions.

The tests also failed to duplicate actual launch pad conditions in that they used safe liquid nitrogen instead of the volatile liquid hydrogen, which, at 423 degrees below zero Fahrenheit, is about 100 degrees colder.

But Boykin said data indicate that it is not the colder temperature that counts in revealing unacceptably high leakage but the liquid, rather than gaseous, state of the propellant, be it nitrogen or hydrogen.

Since the Columbia leak occurred, all procedures have been reviewed at all levels, he said, and found to be reasonable. "But once we do our failure analysis . . . we'll stop and play that backwards and see if we can find a flaw in the process that would have allowed us to get this far."

The tank-side connector from Columbia is being tested at a contractor facility in California. If the leak is not found there by Monday, engineers will remove the orbiter half from Columbia -- a more complicated process than removing the tank half -- and continue their search.