Significant Incidents & Close Calls in Human Spaceflight
A product of the JSC SMA Flight Safety Office
PROGRAMS
HUMAN ERROR
THE STORY
THE TEAM
ACRONYMS
OTHER INTERACTIVE FSO TOOLS
HELP
Click an entry on the timeline below for more information.
Click it again to close the window.
1960s
1970s
1980s
1990s
2000s
2010s
UNITED
STATES
Mercury
1961-1963
Apollo 1966-1975
Space Shuttle 1981-2011
Gemini
'64-'66
Skylab 1973-1979
X-15 1959-1968
<-----Apollo Soyuz Test Project (ASTP) 1975
U.S./RUSSIA PARTNERSHIP
Shuttle-Mir
1994-1998
International Space Station 1998-present
RUSSIA
Vostok
1960-1963
Voskhod
1964-1966
Salyut 1971-1982
Mir 1986-2001
Soyuz 1967-present
COMMERCIAL
SpaceShipOne----->
SpaceShipTwo
2010-present
As of 2017
Mercury Program | 1958-1963
Initiated in 1958 and completed in 1963, Project Mercury was the United States' first human spaceflight program. The objectives of the program, which made six crewed flights from 1961 to 1963, were:
The Mercury spacecraft was a cone-shaped one-man capsule with a cylinder mounted on top. It was 2 meters (6 ft, 10 in) long, 1.9 meters (6 ft, 2.5 in) in diameter, and a 5.8-meter (19 ft, 2 in) escape tower was fastened to the cylinder of the capsule. The blunt end was covered with an ablative heat shield to protect it against the 3,000 degree heat of entry into the atmosphere. The Mercury program used two launch vehicles: a Redstone for the suborbital and an Atlas for the four orbital flights. Prior to the crewed flights, uncrewed tests of the booster and the capsule were made carrying a chimpanzee.
See NASA's Project Mercury website for more information:
http://www.nasa.gov/mission_pages/mercury/missions/program-toc.html
Apollo Program | 1966-1975
The Apollo program was designed to land humans on the moon and bring them safely back to Earth. Six of the missions (Apollos 11, 12, 14, 15, 16, and 17) achieved this goal. Apollos 7 and 9 were Earth-orbiting missions to test the command and lunar modules, and did not return lunar data. Apollos 8 and 10 tested various components while orbiting the moon and returned photography of the lunar surface. Apollo 13 did not land on the Moon due to a malfunction, but did return photographs. The six missions that landed on the moon returned a wealth of scientific data and almost 400 kilograms of lunar samples. Experiments included soil mechanics, meteoroids, seismic, heat flow, lunar ranging, magnetic fields, and solar wind experiments.
The Apollo spacecraft, including the command module (CM), service module (SM), and lunar module (LM), could accommodate a crew of three and was launched on a Saturn V rocket. The Saturn V launch vehicle itself consisted of three stages:
See the Smithsonian National Air & Space Museum web site for more information on the Apollo program and its missions:
http://airandspace.si.edu/explore-and-learn/topics/apollo/
Space Shuttle Program | 1981-2011
The space shuttle was the first reusable space vehicle developed by NASA in the 1970s. The space shuttle consisted of three major flight elements:
Five orbiter flight vehicles were built (Columbia, Challenger, Discovery, Atlantis, and Endeavour) and flew a total of 135 missions between April 1981 and July 2011.
For more information see the NASA Space Shuttle interactive web site:
www.nasa.gov/externalflash/the_shuttle
Project Gemini | 1964-1966
Project Gemini was an intermediate project between Project Mercury and the Apollo Program to develop and demonstrate capabilities needed for crewed missions to the moon. Objectives included:
The Gemini spacecraft was a larger version of the capsule used for Project Mercury and was launched using a Titan II rocket. Ten crewed missions were flown between March 1965 and November 1966. These missions developed the systems and procedures needed to make the Apollo Program a success. For more information see:
http://science.ksc.nasa.gov/history/gemini/gemini.html
Skylab | 1973-1979
Skylab was the United States' first space station and consisted of three major elements:
Skylab was designed to orbit 270 statute miles (235 nautical miles) above the Earth's surface where astronauts would conduct scientific observations in human adaptation/life sciences, human system design, solar astronomy, Earth resources, science, technology, and applications. A carefully planned series of biomedical and behavioral performance experiments were designed to evaluate crew's physiological responses and aptitudes in space under zero-gravity conditions and their post-mission adaptation to Earth's environment. Progressively longer missions were planned to determine the increments by which mission duration could safely be increased.
Three separate crews spent a total of 171 days onboard the Skylab space station between May 1973 and February 1974. Ten extravehicular activity (EVA) excursions (spacewalks) totaling more than 41 hours were also conducted during this period.
For more information on Skylab see:
http://history.nasa.gov/SP-400/contents.htm
X-15 | 1959-1968
Part of the X-plane series of experimental aircraft was flown during the 1960’s by the US Air Force and NASA and was the first operational spaceplane. The X-15 was designed to reach the edge of outer space and return data for use in further aircraft and spacecraft design.
The X-15 was carried aloft and drop launched from a B-52 mother ship. A hybrid vehicle, it had controls for aerodynamic flight as well as a reaction control system that used rocket thrusters. Features included heated windows to prevent icing and a forward headrest for periods of high deceleration.
See NASA's Armstrong X-15 fact sheet for more information:
https://www.nasa.gov/centers/armstrong/news/FactSheets/FS-052-DFRC.html
Apollo Soyuz Test Project (ASTP) | 1975
The Apollo Soyuz Test Project was a joint U.S. and Soviet Union project to test the compatibility of rendezvous and docking systems and the possibility of an international space rescue. On July 15, 1975 the United States launched a Saturn IB rocket with a modified Apollo command and service module and three crew members onboard. The Apollo spacecraft rendezvoused and docked with a Soyuz spacecraft and its crew of two on July 17 and conducted joint operations for nearly two days before undocking and returning to Earth.
For more information on the Apollo Soyuz Test Project see:
http://www.nasa.gov/apollo-soyuz/overview
Space Shuttle-Mir Program | 1973-1979
The Shuttle-Mir Program was a joint U.S. and Russian program to share resources and assets for the further development and advancement of human spaceflight and microgravity research. From February 1994 to June 1998 space shuttles made 11 flights to the Russian space station Mir, and American astronauts spent seven residencies onboard Mir. Space shuttles also conducted crew exchanges and delivered supplies and equipment to the Mir space station.
For more information on the Shuttle-Mir program see:
http://www.nasa.gov/mission_pages/shuttle-mir/
International Space Station | 1998-present
The International Space Station is a multi-nation microgravity research laboratory operating in low Earth orbit. The first element was launch in November 1998 (Russian Functional Cargo Block - FGB) and final assembly was completed in 2010. The International Space Station has been continuously occupied since November 2000 and in its present configuration can accommodate a crew of six. Approximately four crewed flights and four to six uncrewed cargo resupply flights to the International Space Station are required per year to support crewed operations onboard the station. The International Space Station continues to be a test bed and springboard for advancements in space exploration, enabling research and technology developments that will benefit human and robotic exploration of destinations beyond low Earth orbit, including asteroids and Mars.
For more information on the International Space Station see:
http://www.nasa.gov/mission_pages/station/main/onthestation facts_and_figures.html
Voskhod | 1964-1966
Voskhod was the second Soviet spaceflight project, with only two manned flights in 1964-1965. Vokshod was simply a modified Vostok; able to carry up to 3 crew members. Some vehicle issues included:
The Voskhud was replaced by the new design Soyuz spacecraft, which is still in use today.
See the Voskhod entry on Astonautix.com for more info:
Salyut | 1971-1982
The Salyut series of space stations, also known as the Long-duration Orbital Station (ДОС) in Russia, was derived from the Soviet Almaz space station design. The program began in the fall of 1969, with the first successful Salyut reaching orbit in April 1971. The primary functions of the Salyut space stations were to conduct military surveillance, scientific and industrial experiments, and engineering tests to help develop the second-generation space stations. Salyut 7 (ДОС-6) was home to 10 cosmonaut crews, including six long-duration crews (longest stay time being 237 days) before being abandoned in 1986. Portions of the Salyut design were adapted for use on the Mir (ДОС-7) and ISS (ДОС-8).
For more information see:
Mir Hardware Heritage, by David S. F. Portree, NASA Reference Publication 1357.
Mir Space Station | 1986-2001 |
Mir was a Soviet Union/Russian space station consisting of seven main elements/modules (Mir base block, Kvant I, Kvant II, Kristall, Spektr, Priroda, and docking module) which were launched separately and attached on orbit between 1986 and 1996. The station served as a microgravity research laboratory in which crews conducted experiments in biology, human biology, physics, astronomy, meteorology, and spacecraft systems with a goal of developing technologies required for permanent occupation of space. The station normally housed three crew members, but was capable of supporting as many as six for up to a month. After 15 years of operation the Mir space station was de-orbited and fell into the South Pacific Ocean on March 23, 2001.
For more information on the Mir space station see:
Vostok | 1960-1963
Vostok was the Soviet counterpart to the American Mercury project, with the goal of placing a human in low earth orbit and returning him safely to earth. The first human in space, Yuri Gagarin, launched on Vostok 1 on April 12, 1961. There were 8 total and 6 manned spaceflights in the program, which lasted from 1961 to 1963. The longest flight lasted nearly 5 days. The last 4 flights were also launched in pairs, only 1 day apart. The vehicle consisted of:
The Vostok was designed for an extremely rough reentry, and the cosmonaut would eject at approximately 7000 meters (23,000 ft) and finish descent via parachute separately from the descent module. This was the abort plan, which covered all phases except the first 40 seconds after liftoff. The Vostok was spherical and had heat protection on all surfaces due to its limited control capability. This design meant the astronaut experienced 8 to 9 g during reentry.
See the Vostok entry on Astonautix.com for more info:
http://astronautix.com/v/vostok.html
Soyuz Program | 1967-present
The Soyuz (Union) series of spacecraft were designed by the Soviet Space Program in the 1960s, first flown in 1966, and the fourth generation are currently flying. Originally built as part of the Soviet Manned Lunar Program, today they are used as the launch vehicle for transportation to and from the International Space Station. The Soyuz spacecraft consists of three parts:
The Soyuz carries up to 3 crew and will provide habitable conditions for 30 person days. The reentry module is protected by heat-resistant covering on the portion facing earth during reentry. Deceleration is by atmosphere, then a braking parachute, and finally a main parachute at landing. There are also solid fuel braking engines which fire at 1 meter above the ground. The Soyuz MS is the last planned upgrade to the series. Its maiden flight was July 2016; and upgrades included more efficient solar panels, better telemetry system, and a lighter and more fuel efficient approach and docking system.
See the Soyuz entry on Astonautix.com for more info:
http://astronautix.com/s/soyuz.html
SpaceShipOne | 2003-2004
SpaceShipOne is a three-place, high-altitude research rocket, designed for sub-orbital flights to 100 km altitude. The unique configuration allows aircraft-like qualities for boost, glide, and landing.
SpaceShipOne was designed to:
See the SpaceShipOne entry on Scaled composites website for more information:
http://www.scaled.com/projects/tierone/
SpaceShipTwo | 2010-present
Unveiled to the public in 2009,Virgin Galactic announced the first space program for tourists. If successful, Virgin Galactic plans to expand into providing commercial point-to-point travel via suborbital spaceflight.
Objectives of SpaceShipTwo are:
The SpaceShipTwo spaceplane will launch from the mother ship (WhiteKnightTwo) at an altitude of 15,000 meters (50,000 ft or 9.5 miles) and reach supersonic speeds within 8 seconds. After 70 seconds of rocket propulsion, the rocket engine will shut down and the spaceplane will glide to it's expected apogee of approximately 110 km (68 miles) in the lower atmosphere. The crew cabin is 3.7 meters (12 ft) long and 2.5 meters
(75 ft) in diameter.
http://www.virgingalactic.com/human-spaceflight/our-vehicles/
STS-108,109,110
12/5/01 - 4/8/02
Gemini 6
12/12/1965
Soviet Altitude
Chamber O2 Fire
3/23/1961
1/9/1990
STS-32
11/21/1997
STS-87
5/22/1969
Apollo 10
5/24/1962
Mercury MA-7
8/17/1997
Soyuz TM-25
Gemini 5
8/29/1965
Skylab 4
2/8/1974
Soyuz TM-5
9/6/1988
STS-9
12/8/1983
STS-3
3/30/1982
STS-110 | 4/8/2002 | Crew: 7 | Related or Recurring event
SUMMARY:
Incorrect adjustments to the controller software resulted in SSME underperformance.Also occurred on STS-108 and STS-109.
EVENT DESCRIPTION:
Prior to STS-108 a change had been made to the controller software coefficient for the Space Shuttle Main Engine (SSME) to compensate for an observed measurement bias in the SSME main combustion chamber pressure sensor, which controls the SSME fuel/oxidizer mixture ratio. The pressure chamber sensor was biased high causing the flight software to lower the chamber pressure by decreasing the liquid oxygen flow rate. To correct the high bias a coefficient in the equation was adjusted to compensate. Because of communication errors between ground systems engineers and deficiencies in the flight software verification and validation processes, the software coefficient was adjusted in the wrong direction, resulting in even larger dispersions in the mixture ratio and SSME performance.
The error in the coefficient was discovered during post-flight reconstruction of the data from STS-108. The cause of the error remained unknown until after STS-110. The erroneous coefficient was flown on three consecutive flights (STS-108, STS-109, and STS-110) resulting in a slight SSME underperformance on each flight, and was fixed with the proper coefficient and independent verification prior to STS-111. The error in software and resulting mixture ratio wasn't severe enough to cause any significant impacts to SSME performance, and all three flights achieved proper orbits. However, if the software error had been larger, more severe impacts to the missions and crew safety could have occurred, including a premature engine shutdown/failure resulting in on-pad or ascent abort, loss of mission.
SOURCES:
Gemini 6 | 12/12/1965 | Crew: 2
SUMMARY:
Main engine shutdown. Booster left unsecured on pad. Crew elected not to eject. Launched 3 days later. After the failed launch attempt, review of engine data and an inspection of the number 2 engine revealed that a plastic dust cover had been inadvertently left on the oxidizer gas generator inlet port causing blockage of oxidizer to the gas generator. Ground procedures were modified to ensure removal of dust covers during engine assembly.
EVENT DESCRIPTION:
There was a main engine shutdown during the attempted launch on December 12,1965.
About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.
The rocket malfunction detection system sensed an anomaly since there was no upward motion associated with the start of the clock and triggered engine stop. The booster was left unsecured on the pad with the crew inside. The crew members elected to remain in the capsule until the gantry was returned.
A successful launch occurred three days later.
SOURCES:
Altitude Chamber O2 Fire | 3/23/1961 | Crew: 1 | Loss of Crew
SUMMARY:
Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.
EVENT DESCRIPTION:
On March 23, 1961 a cosmonaut in an altitude chamber was removing the sensors that had been attached to him during an experiment. He cleaned the places where the sensors had been attached with cotton wool soaked in alcohol, and without looking threw away the cotton wool. The cotton wool landed on the ring of an electric hot plate in the oxygen-charged atmosphere of the chamber. In conditions of high oxygen concentration, normally non-flammable substances can burn vigorously. The cosmonaut's training suit caught fire. Unaccustomed to the vigor of high-oxygen fires, the cosmonaut would only have spread the flames further by attempting to smother them. The doctor on duty noticed the conflagration through a porthole and rushed to the hatch, which he could not open because the internal pressure kept the inward swinging hatch sealed. Releasing the pressure through bleed valves took several minutes and the cosmonaut later died in the hospital from the burns.
SOURCES:
STS-32 | 1/9/1990 | Crew: 5 | Loss of Attitude Control
SUMMARY:
Erroneous state vector up-linked to flight control system, causing immediate and unpredictable attitude control problems.
EVENT DESCRIPTION:
An erroneous state vector up-linked to the flight control system on January 9, 1990 causing immediate and unpredictable attitude control problems.
At 17:23:46:51 Greenwich Mean Time, during a crew sleep period, a state vector update was commanded by the ground prior to the loss of signal. The uploaded state vector was erroneous, and the orbiter began to execute a multi-axis rotation at three degrees per second with a number of thruster firings. The rotation continued until the acquisition of signal period, about 10 minutes later, when the crew was awakened and instructed to switch to manual Digital Auto Pilot to arrest the unwanted rates. A good state vector was then uplinked.
SOURCES:
STS-87 | 11/27/1997 | Crew: 6
SUMMARY:
Spartan satellite deployed without proper activation.
Recapture with RMS unsuccessful. Later captured by EVA crew.
EVENT DESCRIPTION:
Deployment of the SPARTAN satellite on November 21, 1997 occurred without proper activation.
A crew input via the Payload and General Support Computer was not received by the spacecraft. Lack of telemetry and onboard verification procedures left this condition undetected by the Mission Control Center and flight crew. The SPARTAN was grappled with the Remote Manipulator System, removed from the Release/Engage Mechanism, and released per the flight plan.
The missed command step resulted in the failure of the SPARTAN to execute an expected preprogrammed maneuver ("pirouette") about 2.5 minutes after deploy. Attempts to re-grapple the SPARTAN after the deployment were unsuccessful. A previously scheduled extravehicular activity (space walk) had to be changed to manually recapture the satellite.
SOURCES:
Space Shuttle Missions Summary
Apollo 10 | 5/22/1969 | Crew: 2
SUMMARY:
Switch misconfiguration resulted in lunar module control problems.
EVENT DESCRIPTION:
In May 22, 1969 a switch misconfiguration resulted in lunar lander control problems.
During the Lunar Module (LM) last pass, within eight miles of the moon and prior to the jettison of the LM Descent Stage, the Commander (while wearing a space suit) started to troubleshoot an electrical anomaly.
The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.
The attitude indicator was going to the red zone and in danger of tumbling the inertial platform. The Commander was able to grab the hand controller, switch to manual control, jettison the Descent Stage, control the LM Ascent Stage, and finally dock with the CSM.
SOURCES:
Mercury MA-7 | 5/24/1962 | Crew: 1
SUMMARY:
RCS depletion at 80,000 ft.
EVENT DESCRIPTION:
This incident on May 24, 1962 involved the use of double authority control and the accidental actuation of the fly-by-wire high thrust units during certain maneuvers. The manual-system fuel was depleted near the end of the retrofire maneuver, and the automatic-system fuel was depleted at about 80,000 and 70,000 feet. Because of the early depletion of automatic-system fuel, attitude control during re-entry was not available for the required duration. Attitude rates built up after the Automatic Stabilization Control System became inoperative because of the lack of fuel, and these rates were not sufficiently damped by aerodynamic forces. The pilot chose to deploy the drogue parachute manually at an altitude of approximately 25,000 feet to stabilize the spacecraft.
To avoid the same situation on later flights, Mercury MA-8 and subsequent spacecraft contained a switch which allowed the pilot to disable and reactivate the high-thrust units at his discretion. An automatic override reactivated these thrusters just prior to retrofire. Additionally, a revision of fuel management and control training procedures was instituted for subsequent missions
SOURCES:
Mercury 7 Description & Analysis
Soyuz TM-25 | 8/17/1997 | Crew: 3
SUMMARY:
Landing rockets fired at heat shield separation rather than at landing.
EVENT DESCRIPTION:
On August 17, 1997 the landing rockets on Soyuz TM-25 fired during heat shield separation rather than during landing. This failure resulted in a harder landing than normal.
The Mir with the docked Soyuz was experiencing high humidity levels in the atmosphere. Water condensing on the connectors in the Soyuz electrical box controlling the circuit probably caused a short circuit, which caused the rockets to fire when the system was armed at heat shield physical separation. Changes were made to either seal the connectors or separate the connectors to prevent a short from applying electrical power to the rockets when the system is armed.
The design has two primary types of inhibits. One inhibit consists of three mechanical switches that physically disconnect the firing circuit when the heat shield is attached. These switches are spring loaded and move approximately 20 mm as the heat shield is deployed to close the firing circuit. A minimum of two out of three switches must be closed for the initiating system to function. In addition to these mechanical inhibits, logic in the electronics prevents the ignition command from being sent until after the heat shield is deployed. Nominally the soft landing motors are ignited when the gamma ray altitude/velocity sensor detects proximity to the ground. The system automatically initiates either four or six motors depending on the velocity. Each motor has 1 kg of propellant and burns for approximately 0.1 to 0.14 seconds.
SOURCES:
Gemini 5 | 8/29/1965 | Crew: 2
SUMMARY:
Erroneous entry data uplinked; crew manually corrected entry flight profile.
EVENT DESCRIPTION:
During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.
SOURCES:
Skylab 4 | 2/8/1974 | Crew: 3
SUMMARY:
Incorrect circuit breakers opened, resulting in the loss of the automatic control.
EVENT DESCRIPTION:
On February 8, 1974 while preparing foar entry, the crew inadvertently opened the stabilization and control system (SCS) pitch and yaw circuit breakers instead of the service propulsion system pitch and yaw circuit breakers. The vehicle was in an apex forward configuration for service module jettison. The commander attempted to orient the vehicle to the proper heat shield forward attitude for entry. The control commands produced no effect due to the SCS being inadvertently unpowered, and the vehicle failed to change attitude. The crew switched to “manual reaction control system direct” and oriented the vehicle to the proper attitude. The circuit breakers being in close proximity and similarly labeled, increased the potential for human error.
The failure to orient the heat shield forward would have caused loss of crew.
SOURCES:
Soyuz TM-5 | 9/6/1988 | Crew: 2
SUMMARY:
Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.
EVENT DESCRIPTION:
Two de-orbit burn attempts failed and nearly led to the loss of the crew. The crew was confined to the descent module due to the orbital module being jettisoned prior to the first deorbit attempt. The first deorbit burn was prevented by a sensor glitch which disappeared after seven minutes, and then the burn started. However, the crew manually shut down the burn after three seconds.
A second burn two revolutions later occurred on time for six seconds, then stopped, and the crew manually restarted the burn. However, after an additional 60 seconds it was cut off by the autopilot. The crew manually interrupted the command sequence shortly before the descent/equipment module separation pyros were to have been fired, preventing an erroneous firing. The main cause of the crew's problems was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel.
SOURCES:
STS-9 | 12/8/1983 | Crew: 6
SUMMARY:
A. Two APUs caught fire during rollout.
B. GPC failed on touchdown.
C. Incorrect flight control rechannelization on rollout.
EVENT DESCRIPTION:
A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.
B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.
C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.
SOURCES:
STS-3 | 3/30/1982 | Crew: 2
SUMMARY:
Pilot induced oscillation during derotation. Stronger than predicted winds contributed.
EVENT DESCRIPTION:
On March 30, 1982 during orbiter derotation on rollout, the vehicle pitched up to approximately six degrees after having been down to -3 degrees pitch. This pitch up occurred because the pilot was preventing premature nose wheel contact. The planned late transition from autoland to manual control did not provide sufficient time for the pilot to feel the vehicle response, and attempts by the pilot to make minor trajectory adjustments resulted in a touchdown sooner than intended and at a higher than planned airspeed (225 Keas vs. 195 Keas). Subsequently, the derotation after main landing gear touchdown started at too high an airspeed and required the pilot to try and stop it at too low a pitch angle. The rapidly changing elevator trim requirements made it difficult to avoid over-controlling in this situation.
On all future missions, manual takeover from autoland was not planned to occur between the start of the preflare maneuver and touchdown. Flight procedures and crew training were also revised to be more explicit about keeping the nose up until the vehicle slows to 180 knots.
SOURCES:
WHAT IS IT?
Competitive struggles during the Cold War between the United States and the Soviet Union laid the groundwork for advances in high altitude flight, rocketry, and human performance. Human spaceflight reached its first defining success more than 50 years ago, when cosmonaut Yuri Gagarin became the first man to orbit the Earth in April 1961. In November 2000, a multi-national crew moved aboard the International Space Station. By November 2011, the former Cold War rivals had collaborated to surpass 10 years of continuous presence in space. Now a new record of continuous space habitation is established daily. The Significant Incidents and Close Calls in Human Spaceflight chart presents a visual overview of major losses and close calls spanning the history of human spaceflight. It heightens awareness of the risks that must be managed as human spaceflight continues to advance.
HOW DOES IT WORK?
Each box on the chart represents an event. The events are grouped by flight phase and ordered chronologically within each phase. Three types of events are highlighted: loss of crew, crew injury, and related or recurring events. Events with one or more crew fatalities are highlighted in red. Crew injury or illness and/or loss of vehicle or mission is designated by orange shading. Related or recurring events are set apart by yellow shaded boxes.
WHY DO WE HAVE IT?
The Significant Incidents and Close Calls in Human Spaceflight chart is maintained by NASA Johnson Space Center's Flight Safety Office to raise awareness of lessons learned through the years. It provides a visible reminder of the risks inherent in human spaceflight and is intended to spark an interest in past events, to inspire people to delve into lessons learned, and to encourage continued vigilance. Distributing this information as widely as possible will help to ensure the lessons of history are incorporated into new designs, so that future accidents may be prevented.
WHAT IS THE BONDARENKO STORY?
Two fatal events highlight the importance of sharing information. On March 23, 1961 Soviet cosmonaut Valentin Bondarenko lost his life after being severely burned in an altitude chamber fire. The incident occurred during a routine training exercise, when Bondarenko attempted to throw an alcohol swab into a waste basket, but hit a hot plate instead. The oxygen-rich environment quickly ignited. Rescue efforts were thwarted because internal pressure prevented rescuers from opening the chamber's inwardly swinging hatch for several minutes. By the time the pressure was released and the hatch could be opened, Bondarenko had been hopelessly burned. He died hours later.
Six years later, three U.S. astronaut's lives were lost during a test in the Apollo crew module, which contained an oxygen-rich atmosphere. An electrical short caused a fire that spread quickly throughout the cabin. Again, rescue efforts were delayed due to the buildup of pressure behind an inwardly opening hatch. Unlike the Soviet altitude chamber oxygen fire, the crew did not die due to burns from the fire, but from cardiac arrest caused by smoke inhalation. However, in both the Bondarenko and Apollo events, high levels of oxygen caused the fires to spread rapidly, and pressure against inward-opening hatches slowed rescue efforts. Neither cabin was equipped with effective fire-suppression equipment.
Information about the Bondarenko incident was not known in the U.S. until 1986 – more than 20 years after it happened. Would access to this information have led to design changes that could have saved the Apollo astronauts’ lives? Although that question can never be answered, these events underscore the importance of sharing information and maintaining awareness of past events in the effort to prevent future tragedies.
EXECUTIVE SPONSOR
TEAM LEAD
RESEARCH & INFOGRAPHIC DESIGN
GRAPHIC/WEB DESIGN
Dennis Pate
Joanna Opaskar
Faisal Ali
David Teltschik
Gail Skowron, Ph.D.
Patrick Huckaby
OTHER CONTRIBUTORS
Everett Cole
Andy Foster
Rufus Jackson
Gary Johnson
Tim Kassebaum
Barbara Kress
Jennifer Reister
David Salvador
Meredith Smith
Paula Smith
PAST CONTRIBUTORS
Bob Bobola David Bradt Stuart Monteleone Phillip Lewis Rusty Sheier Erin Stevenson Keith Tischler Ashley Tomi Amaris Vigil Ed Weissblatt Bill Wood Bill Stockton
AC
AC
AGS
APU
ATO
[BMP]
CRS
CDRA
CFU
CMG
CO2
CRS
CO
CPM
CSA-SP
CSM
DM
EMU
EPS
ET
EV
EVA
FC
FCMS
[FGB]
FSO
GIRA
GNC
GPC
GPS
H2
IMU
ISS
ITCS
KOH
LCO
LH2
LIRS
Air Conditioner
Alternating Current
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Commercial Resupply Service
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Carbon Dioxide
Commercial Resupply Services
Carbon Monoxide
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Command/Service Module
Descent Module
Extravehicular Mobility Unit
Electrical Power System
External Tank
Extravehicular
Extravehicular Activity
Fuel Cell
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Hydrogen
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Potassium Hydroxide
Launch Control Officer
Liquid Hydrogen
Low Iodine Residual System
LM
LOAC
LOC
LOV
MDF
MEC
ME
MetOx
MLG
MLM
MMOD
MSFC
N2O4
NSI
O2
OM
OSMA
PAL
PAPI
PASS
PIC
PPCO2
RCC
RCS
RMS
RS
RTLS
SMA
SFOG
SM
SRB
[SRV-K]
SSME
SSP
TPS
U.S.
Lunar Module
Loss of Attitude Control
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Engine
Metal Oxide
Main Landing Gear
Multipurpose Laboratory Module
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
Nitrogen Tetroxide
NASA Standard Initiator
Oxygen
Orbital Module
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reinforced Carbon-Carbon
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Service Module
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
United States
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox.
https://www.mozilla.org/en-US/firefox/new/
GENERAL USAGE - Click or tap an event for a pop-up with additional information. Click or tap the event again to close the pop-up.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
SOURCES INFORMATION
Source documents require Adobe Acrobat to view.
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
Related/Recurring event
CHALLENGER
Crew Losses
COLUMBIA
Crew Losses
ON-PAD ABORT EVENTS
1984-93
1962-70
POGO EVENTS
TPS ENTRY EVENTS
1981-2003
MIR COLLISON EVENTS1994-1997
FIRE/OVERHEATING EVENTS
1971-2008
DOCKING ANOMALIES
SOYUZ LANDING EVENTS 1967-1993
SERVICE/DESCENT MODULE SEPARATION
FAILURES 1961-2008
ASCENT DEBRIS
Other debris events have
occurred on:
Late Release Orbiter Tyvek Covers
ISS CARGO MISSION FAILURES
2011-2016
MEDICAL EVACUATIONS 1976-1987
1981-96
SRB SEAL EVENTS
1965-2016
EVA INCIDENTS SUMMARY
*toxic byproducts released
STS-108,109,110
12/5/01 - 4/8/02
STS-91
6/2/1998
Soyuz TM-9
2/11/1990
STS-51L (Challenger)
1/28/1986
Other SRB gas seal anomalies:
STS-2, 6, 41B, 41C, 41D, 51C, 51D, 51B, 51G, 51F, 51I, 51J, 61A, 61B, 61C, 42, 71, 70, 78
STS-51F
7/29/1985
Soyuz 18-1(18a)
4/5/1975
Apollo 13
4/11/1970
Other significant pogo events:
Apollo 4, 6, early Titan II
Apollo 12
11/14/1969
Gemini 10
7/18/1966
STS-61C
1/6/1986
STS-41D
6/26/1984
Soyuz T-10-1 (T-10a)
9/26/1983
Other on-pad abort events:
STS-51F, 55, 51, 68
STS-1
4/12/1981
Skylab 2
5/25/1973
Apollo 1 (AS-204)
1/27/1967
Gemini 6
12/12/1965
Soyuz MS-10
10/11/2018
Progress M-12M (44P)
8/24/2011
Other ISS cargo mission failures:
Progress M-27M & MS-04, Cygnus CRS Orb-3, Dragon CRS SpX-7
STS-117
6/8/2007
STS-114
5/26/2005
STS-93
7/23/1999
STS-124
5/31/2008
STS-95
10/29/1998
STS-116 and STS-125
STS-114, 115, 118, 119, 124, 126
12 EVAs resulted in crew injury:
Gemini 10, Apollo 17, Salyut 7 PE-1, Salyut 7 VE-3, STS-61-B EVAs 1&2, STS-37, Mir PE-9, STS-63, STS-97/4A, STS-100/6A EVAs 1&2, STS-134/ULF6
Apollo 14
1/31/1971
Apollo 13
4/13/1970
Soyuz MS-09
8/30/2018
ISS, Increment 38
12/11/2013
Soyuz TMA-18 (22S)
9/23/2010
ISS, Increment 17
4/30/2008
ISS, Increment 15
6/10-18/2007
ISS, Increment 13
8/2006
ISS, Increment 10
2/2005
ISS, Increment 5&6
mid 2002-2/03
ISS, Increment 2-4
4/01-3/02
ISS, Increment 4
2/2002
ISS, Increment 2
8/2001
STS-104
7/2001
ISS, Increment 2
4/24/2001
STS-99
2/2000
ISS, Flight 2A.1
5/1999
X-15, 3-65-97
11/15/1967
SpaceShipOne, 16P
9/29/2004
SpaceShipOne, 14P
5/13/2004
Soviet Altitude
Chamber O2 Fire
3/23/1961
Navy Chamber
11/17/1972
5/16/1963
Mercury MA-9
3/16-17/1966
Gemini 8
4/23/1967
Soyuz 1
10/1969
Soyuz 6
8/24/1976
Soyuz 21
10/16/1976
Soyuz 23
4/12/1979
Soyuz 33
11/21/1988
STS-2
12/8/1983
STS-9
1/9/1990
STS-32
11/24/1991
STS-44
9/12/1993
STS-51
4/6/1997
STS-83
7/17/1997
Mir
11/21/1997
STS-87
10/29/1998
STS-95
7/21/1969
Apollo 11
5/22/1969
Apollo 10
Salyut 7
1985
Mir EO-2
1987
Salyut 5
8/25/1976
2/26/2011
STS-133
2/10/2010
STS-130
4/22/1983
Soyuz T-8
5/26/1973
Skylab 2
4/23/1971
Soyuz 10
8/28/1974
Soyuz 15
Mir
6/25/1997
Mir
8/30/1994
Mir
1/14/1994
7/30/1966
M21-D21
1/25/1966
SR-71
10/31/2014
SpaceShipTwo, PF04
12/17/2003
SpaceShipTwo
Flight 11P
5/24/1962
Mercury MA-7
7/24/1975
Apollo ASTP
8/17/1997
Soyuz TM-25
4/10/2017
Soyuz MS-02
Mir
STS-40*
STS-35*
STS-28*
STS-6*
Salyut 7
Salyut 6
Salyut 1
10/1994
6/1991
12/1990
8/1989
4/1983
9/1982
1979
6/1971
2/24/1997
Mir*
2/26/1998
Mir*
10/10/2008
9/18/2006
3/2005
ISS
ISS*
ISS
Mercury MA-6
2/20/1962
Mercury MA-7
2/20/1962
Voskhod 2
3/19/1965
Gemini 4
6/7/1965
Gemini 5
8/29/1965
Apollo AS-201 Test
2/26/1966
Apollo 11
7/24/1969
Soyuz 11
6/30/1971
Skylab 4
2/8/1974
Soyuz 33
4/12/1979
Soyuz T-11
10/2/1984
Soyuz TM-5
9/6/1988
Soyuz TMA-11 (15S)
4/9/2008
Soyuz TMA-10 (14S)
10/21/2007
Soyuz 5
1/18/1969
Voskhod 2
3/19/1965
Vostok 5
6/19/1963
Vostok 2
8/7/1961
Vostok 1
4/12/1961
STS-107 (Columbia)
2/1/2003
STS-51D
4/19/1985
STS-1
4/14/1981
Other significant STS TPS anomalies:
STS-6, 41B, 51G, 27*, 28, 40, 42, 45
*Most severe tile damage to date
STS-134
6/1/2011
STS-108
12/7/2001
STS-90
5/3/1998
STS-37
4/11/1991
STS-51D
4/19/1985
STS-9
12/8/1983
STS-3
3/30/1982
Soyuz 15
8/28/1974
Apollo 15
8/7/1971
Apollo 12
11/24/1969
Mercury MR-4
7/21/1969
2/1/1993
Soyuz TM-15
8/10/1992
Soyuz TM-14
10/10/1991
Soyuz TM-12
4/27/1989
Soyuz TM-7
12/10/1982
Soyuz T-7
7/31/1980
Soyuz 36
10/16/1976
Soyuz 23
4/5/1975
Soyuz 18-1 (18a)
1/18/1969
Soyuz 5
STS-97
11/30/2000
ISS, Increment 58
2/1/2019
Soyuz 64S
10/15/2021
Russian ASAT
11/14/2021
Roscosmos Nauka
7/29/2021
SpaceX Crew-2
11/9/2021
ISS Atmospheric Leak
8/21-25/20
Boeing OFT-1
12/20/2019
STS-112
10/7/2002
Boeing OFT-2
7/31/2021
4/24/1967
Soyuz 1
STS-110 | 4/8/2002 | Crew: 7 | Related or Recurring event
SUMMARY:
Incorrect adjustments to the controller software resulted in SSME underperformance.Also occurred on STS-108 and STS-109.
EVENT DESCRIPTION:
Prior to STS-108 a change had been made to the controller software coefficient for the Space Shuttle Main Engine (SSME) to compensate for an observed measurement bias in the SSME main combustion chamber pressure sensor, which controls the SSME fuel/oxidizer mixture ratio. The pressure chamber sensor was biased high causing the flight software to lower the chamber pressure by decreasing the liquid oxygen flow rate. To correct the high bias a coefficient in the equation was adjusted to compensate. Because of communication errors between ground systems engineers and deficiencies in the flight software verification and validation processes, the software coefficient was adjusted in the wrong direction, resulting in even larger dispersions in the mixture ratio and SSME performance.
The error in the coefficient was discovered during post-flight reconstruction of the data from STS-108. The cause of the error remained unknown until after STS-110. The erroneous coefficient was flown on three consecutive flights (STS-108, STS-109, and STS-110) resulting in a slight SSME underperformance on each flight, and was fixed with the proper coefficient and independent verification prior to STS-111. The error in software and resulting mixture ratio wasn't severe enough to cause any significant impacts to SSME performance, and all three flights achieved proper orbits. However, if the software error had been larger, more severe impacts to the missions and crew safety could have occurred, including a premature engine shutdown/failure resulting in on-pad or ascent abort, loss of mission.
SOURCES:
STS-91 | 6/2/1998 | Crew: 6
SUMMARY:
Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.
EVENT DESCRIPTION:
After the launch of STS-91 on June 2, 1998, a channel A main engine pressure chamber sensor froze. The sensor was disqualified by engine control software when the sensor exceeded allowable limits during the max Q engine throttle down sequence however the sensor remained qualified for engine redline monitoring since the reading was still within reasonableness limits / operational range for the sensor. The channel B sensor and the main engine performed nominally throughout ascent. If an engine problem had occurred, the channel B sensor would have displayed the correct information and indicated the proper corrective action. However, the channel B sensor would have been ignored due to the frozen channel A sensor.
The post-flight inspection revealed that contamination from a seal leak check caused the sensor to freeze. Marshall Space Flight Center (MSFC) project engineering suggested adding a V-seal leak check prior to the acceptance test, to ensure the newly added V-seal was installed properly. However, MSFC project engineering was unaware that performing the leak check would require the manufacturing personnel to plug the chamber pressure port with Viton. After the flight, the sensor was still plugged with a piece of Viton.
If the main engine pressure chamber sensor froze later in the flight, logic errors may have triggered a premature engine shutdown and a return to the launch site abort. Post-flight software changes were implemented to prevent this from occurring on subsequent flights. Additionally, a one-time flow check verified the reliability of the Lee-Jet for all engines in the fleet. A corrective action requires post-Lee-Jet installation flow check and borescope inspection for future engine builds. Lastly, the V-seal leak check was eliminated in future engine builds.
SOURCES:
Soyuz TM-9 | 2/11/1990 | Crew: 2
SUMMARY:
DM insulation torn loose on ascent; contingency EVA repair.
EVENT DESCRIPTION:
During the docking of Soyuz TM-9 on February 11, 1990, the TM-8 crew aboard Mir noticed three of the eight descent module's thermal blankets had partially detached near the heat shield during ascent. This raised five concerns:
A rescue mission with a cosmonaut aboard Soyuz-TM 10 was considered, but not executed. The temperature of TM-9 was stabilized by the Mir directing it into alignment with the sun.
Four months later, the Kristall module (90-048A) arrived with the special tools needed to repair the decent module. Cosmonauts were able to secure the blankets out of the sensor's line of sight after an EVA longer than seven hours. The success of the EVA led to a nominal entry upon mission completion.
SOURCES:
STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event
SUMMARY:
SRB seal failure.
EVENT DESCRIPTION:
On January 28, 1986 a combustion gas leak developed in the right solid rocket motor aft field joint shortly after solid rocket booster ignition. The resulting hot gas plume exiting the joint impinged upon the SRB lower attachment strut and adjacent external tank structure weakening the structure to the point of failure.
Seventy-four seconds into flight, the Space Shuttle Challenger broke up.
All seven crew members were lost.
SOURCES:
Other SRB Seal Events | Related or Recurring event
SRB gas sealing anomalies have also occurred on:
STS-2 November 12, 1981
STS-6 April 4, 1983
STS-11 (STS-41B) February 3,1984
STS-41C April 6,1984
STS-41D August 30, 1984
STS-51C January 24,1985
STS-51D April 12, 1985
STS-51B April 29, 1985
STS-51G June 17,1985
STS-51F July 29, 1985
STS-51I August 27, 1985
STS-51J October 3, 1985
STS-61A October 30, 1985
STS-61B November 26,1985
STS-61C January 12, 1986
STS-42 January 22, 1992
STS-71 June 27, 1995
STS-70 July 13, 1995
STS-78 June 20, 1996
SOURCES:
Space Shuttle Missions Summary
STS-51F | 7/29/1985 | Crew: 7 | Abort to Orbit
SUMMARY:
Temperature sensor problems resulted in SSME1 shutdown at T+5:45.
EVENT DESCRIPTION:
On July 29, 1985 at T+5:43, both temperature sensors for the Space Shuttle Main Engine (SSME) 1 high pressure fuel turbopump showed readings exceeding the redline limit. This resulted in a premature shutdown of SSME 1 and declaration of an Abort to Orbit condition, the first in program history. At T+8:13, one of the two temperature sensors on SSME 3 indicted a high reading, but auto-shutdown was inhibited to assure STS-51F achieved an acceptable orbit.
These events were a result of confirmed instrumentation failures. The temperature sensors were removed for engineering analysis following the flight, and a new configuration sensor was used on subsequent engines.
SOURCES:
Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission
SUMMARY:
Electrical fault caused premature firing of half of the 2nd stage separation bolts, resulting in the inability to fire the remaining ones. Staging failure resulted in abort sequence being used at T=295 seconds.
EVENT DESCRIPTION:
During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches. When the core first stage burned out, it could not be cast off as designed.
Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.
The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice. After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.
One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.
SOURCES:
Apollo 13 | 4/11/1970 | Crew: 3
SUMMARY:
2nd stage center engine shutdown due to pogo oscillations.
EVENT DESCRIPTION:
During the April 11, 1970 launch of Apollo 13 severe pogo oscillations were experienced. Acceleration at the engine attachment reached an estimated 34 g (the accelerometer went out of recordable range) before the engine's combustion chamber low-level pressure sensor commanded an engine shutdown.
SOURCES:
Prevention of Coupled Structure Propulsion Integrity Case File
Apollo 6 | 4/4/1968 | Crew: 0 | Related or Recurring event
EVENT DESCRIPTION:
On April 4, 1968 at two minutes after launch, two engines on the Saturn V first stage experienced severe pogo oscillations. After the flight it was discovered that the F1 engines on the first stage had a natural vibration frequency of 5.5 hertz, and the vehicle vibrated at a frequency that peaked at 5.25 hertz, causing the whole vehicle to vibrate. To solve this problem helium gas was used to partially fill a valve cavity in the liquid oxygen lines on the first stage to act as a shock absorber and dampen engine vibration in the lines. Pogo was previously encountered on Apollo 4 and early in the Gemini program.
SOURCES:
Apollo 12 | 11/14/1969 | Crew: 3
SUMMARY:
Lightning strike on ascent.
EVENT DESCRIPTION:
During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.
Light rain was falling, but weather conditions did not indicate any thunderstorm activity. There were seven miles of visibility with cloud break estimated at 800 feet and overcast conditions at 10,000 feet.
At 11:22am, T+36 seconds, the crew saw a bright light.
At T+36.5 seconds many errors occurred: Fuel Cells 1, 2, and 3 disconnected; Main Buses A and B were under-voltage; Alternating Current (AC) Buses 1 and 2 overloaded. The warning lights and alarm came on in the cabin, indicating failure of the Inertial Stabilization System.
At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.
The potential effect on the vehicle was induction into wiring, depending on the location and rate of change of potential and direct current flow in grounding. The high negative voltage spike (delta voltage/delta time) caused the Silicon Controlled Rectifiers to trip on the Fuel Cell and AC Inverter overload sensors. Failures occurred in four Service Module Reaction Control System helium tank quantity measurements, five thermocouples, and four pressure/temperature transducers.
Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.
SOURCES:
Gemini 10 | 7/18/1966 | Crew: 2
SUMMARY:
1st stage oxidizer tank exploded at staging. No discernible effects. Nominal ascent.
EVENT DESCRIPTION:
On July 18, 1966, 1.2 seconds after booster engine cutoff, tracking cameras displayed an amber cloud and an unusual amount of debris. The evidence indicated the first stage oxidizer tank ruptured after the normal staging sequence.
This event had no detectable effect on the operation of the second stage.
SOURCES:
STS-61C | 1/6/1986 | Crew: 7
SUMMARY:
System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.
EVENT DESCRIPTION:
On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.
Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).
Corrective action incorporated in response to this close call included modifications to automatic sequencer software to prevent the prerequisite control logic from blocking LOX inboard fill-and-drain valve close commands, updates to countdown procedures and launch constraints to verify closure of the inboard fill-and-drain valve after replenish valve closure and prior to tail service mast vent-and-drain valve opening, monitoring and initiation of holds if the fill-and-drain valve closed indication is lost, implementation of helium repressurization “pulse purge” if ET ullage pressure drops below 0.25 psi, and verification of minimum ET ullage pressure rise rate at T-120 seconds.
A subsequent launch attempt on January 7, 1986 was scrubbed at the T minus 9 minute hold due to weather constraint violations at TAL sites. However, during post launch scrub operations a broken Ground Support Equipment (GSE) LOX temperature probe was found lodged in SSME #2 pre-valve post-detanking. This temperature probe had failed (off-scale high reading) during LOX loading but due to the absence of any mechanical failure history, the failure was assumed to be electrical in nature and the temperature data from this probe was not mandatory for pre-launch loading operations. The broken temperature probe would have prevented closure of pre-valve during flight, at MECO, resulting in an uncontained SSME failure and possible loss of crew, loss of vehicle.
As a result of the broken GSE LOX temperature probe, all GSE LOX temperature probes were inspected and screened for improper welds, monitored during pre-launch operations for any anomalies, and eventually replaced with redesigned probes. A coarse debris screen was also added upstream of the LOX prevalve to prevent large debris from entering into the prevalve.
SOURCES:
MER Report | Anomaly PR | LO2 Temerature Probe Incident | Mission Report | Close Call
STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event
SUMMARY:
During the launch attempt on June 26, 1984 all aspects of launch countdown were nominal until T-4 seconds when an irregular operation of the Space Shuttle Main Engine (SSME) 3 main fuel valve resulted in an engine shutdown and pad abort condition.
EVENT DESCRIPTION:
The SSME 3 main fuel valve failed to open when commanded and leaked hydrogen for approximately 21 minutes following the shutdown. After the abort, fire was seen on the starboard side of the body flap for approximately 12 minutes. The aft base heat shield water deluge system was activated and was able to extinguish the fire. Damage to the orbiter was mostly confined to the body flap despite invisible flames of burning hydrogen reaching 190 feet.
The Mobile Launcher Platform sustained minor scorching damage to a few purge ducts and one burnt ground wire. The cause of the main fuel valve anomaly was attributed to contamination in the hydraulic actuator that was likely present at time of installation.
Additional inspection and ground tests were implemented to detect valve anomalies prior to installation into flight engines. Real-time monitoring of valve operation prior to engine start was also enhanced, and ultraviolet fire sensors were added.
SOURCES:
Space Shuttle Missions Summary
Soyuz T-10-1 (T-10a) | 9/26/1983 | Crew: 2 | Loss of Vehicle/Mission | Related or Recurring event
SUMMARY:
Pad booster fire/explosion. Capsule Escape System used.
Crew: 2
EVENT DESCRIPTION:
Shortly before liftoff on September 26, 1983 fuel spilled around the base of the Soyuz launch vehicle and ignited the vehicle. Launch control activated the escape system, but the control cables were burnt.
Twenty seconds later ground control activated the escape system by radio command. By this time the booster was engulfed in flames.
Explosive bolts fired to separate the descent module from the service module. Explosive bolts also fired to separate of the upper shroud from the lower shroud. The escape system motor pulled the orbit module and descent module, still encased within the upper shroud, away from the booster at 14 to 17g of acceleration.
Seconds after the escape system activated, the booster exploded, destroying the launch complex.
The descent module separated from the orbital module and dropped free from the shroud. The descent module heat shield was discarded to expose the solid-fueled landing rockets. A fast-opening emergency parachute was deployed and landing occurred about four km from the launch pad.
SOURCES:
Other On Pad Aborts | Related or Recurring events
On pad aborts have also occurred on:
STS-51F: On July 12, 1985 the first launch attempt of STS-51F was aborted at T-4.2 seconds. The chamber coolant valve on Space Shuttle Main Engine 2 needed to move from the 100% open setting to the 70% open setting required for startup, but the valve responded slowly. The launch was aborted and the vehicle safely shut down.
STS-55: On March 22, 1993 the third launch attempt of STS-55 was aborted at T-3 seconds when the Space Shuttle Main Engine (SSME) 3 oxidizer preburner purge pressure exceeded the maximum pressure. The monitor detected that the combustion product pressure exceeded the 50 psi redline due to one of the five check valves in the purge system leaking. The launch was aborted and the vehicle safely shut down. All three SSMEs were replaced before the next launch attempt.
STS-51: On August 12, 1993 the first launch attempt of STS-51 was aborted at T-3 seconds because of a disagreement in the turbine fuel flow sensors of Space Shuttle Main Engine (SSME) 2. At 0.6 seconds after ignition SSME 2 experienced a failure of the fuel flow meter channel A2 speed pickup coil sensor (loss of redundancy) to respond to the start transient. The main engine controller used the A and B flow rate measurement data for closed-loop thrust/mixture ratio control, and the failure of either the A or B measurements resulted in lockup of the preset engine mixture ratio. As a result of the failure, the engines were safely shut down. All the main engines were replaced before the next launch attempt.
STS-68: On August 18, 1994 the first launch attempt of STS-68 was aborted at T-1.9 seconds. The abort was triggered after the discharge temperature of the high pressure oxidizer turbopump in Space Shuttle Main Engine (SSME) 3 exceeded the redline temperature, causing the main engine controller to issue a shutdown of SSME 3, followed shortly by the General Purpose Computers issuing a shutdown of the other two engines.
SOURCES:
STS-1 | 4/12/1981 | Crew: 2
SUMMARY:
SRB ignition pressure wave caused TPS and structural damage.
EVENT DESCRIPTION:
During the April 12, 1981 launch of STS-1, a higher than expected solid rocket booster ignition pressure wave caused damage to both the thermal protection system and structure.
SOURCES:
Skylab 2 | 5/25/1973 | Crew: 3
SUMMARY:
Instrument unit erroneously sent a command to switch the launch vehicle from internal to external power.
EVENT DESCRIPTION:
On May 25, 1972 at launch commit (T-0 in the launch countdown, at which point the hold-downs are released), an erroneous momentary cutoff signal was sent by the Saturn 1B electrical support equipment and confirmed by the recording of a thrust failure indication and cutoff start indication. The erroneous signal’s duration was not sufficient to trigger the cutoff relay. Had the cutoff relay been energized, an improper automatic cutoff sequence would have occurred, resulting in the vehicle switching to external power without cutting off the engines. This configuration would have caused the vehicle to launch without electrical power and resulted in loss of mission or vehicle.
Analysis revealed the indications to be a momentary re-energization of the launch bus due to remake of the launch bus contactors. To prevent a recurrence, two normally closed commit relay contacts were added to inhibit the thrust failure cutoff circuit after launch commit. Additional changes were made to the automated power transfer circuitry to prevent a “power transfer to external” for the time period after launch commit until a command to cut off the S-1B stage engines was given.
SOURCES:
Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew
SUMMARY:
Crew cabin fire (electrical short + high pressure O2 atmosphere).
EVENT DESCRIPTION:
On January 27, 1967 the crew cabin of Apollo 1 caught fire during a test with three crew members inside. The cabin was filled with a pure oxygen atmosphere and pressurized greater than ambient pressure (16.7 psi). Over the course of several hours, the oxygen permeated all materials in the cabin, which had been tested to the normal flight pressure of pure oxygen (5 psi). When the fire began it spread rapidly. Due to the pressure in the cabin, the crew members could not open the hatch to escape. Technicians in the room outside the capsule attempted to open the hatch but were driven back by the heat and smoke. Some technicians donned the available gas masks, but the masks were designed to protect against hypergolic propellant fumes, not smoke. Consequently, these technicians lost consciousness after a short time in the smoke-filled room.
All three crew members were lost.
The fire was caused by an electrical short from an unprotected wire. A subsequent review of all wiring dioded to both Main Bus A and B identified a problem with an environmental control system instrumentation wire powered from Main Bus A and B. The wire was routed over plumbing lines on the crew compartment floor, located below the left-hand crew seat, going into the left-hand equipment bay, between the environmental control unit and the oxygen panel. This Teflon-insulated wire should have had a protective Teflon overwrap, but closeout photos showed that the overwrap had slipped down, no longer providing protection. The commander likely contacted this wire with his foot when he turned to change his communications cable. The most probable initiator of the fire is an electrical arc from this wire, which was unprotected from external damage.
Factors contributing to this accident include:
- Failure to identify the test as hazardous
- Inward-opening hatch which could not be opened during periods of increased cabin pressure
- Inadequate ground safety procedures and emergency equipment
- Last-minute changes to operational test procedures
- Unsatisfactory communications overall
- Lack of control of combustible materials
- Deficiencies in engineering, workmanship, and quality control
SOURCES:
Gemini 6 | 12/12/1965 | Crew: 2
SUMMARY:
Main engine shutdown. Booster left unsecured on pad. Crew elected not to eject. Launched 3 days later. After the failed launch attempt, review of engine data and an inspection of the number 2 engine revealed that a plastic dust cover had been inadvertently left on the oxidizer gas generator inlet port causing blockage of oxidizer to the gas generator. Ground procedures were modified to ensure removal of dust covers during engine assembly.
EVENT DESCRIPTION:
There was a main engine shutdown during the attempted launch on December 12,1965.
About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.
The rocket malfunction detection system sensed an anomaly since there was no upward motion associated with the start of the clock and triggered engine stop. The booster was left unsecured on the pad with the crew inside. The crew members elected to remain in the capsule until the gantry was returned.
A successful launch occurred three days later.
SOURCES:
Progress M-12M | 8/24/2011 | Crew: 0 | Loss of Mission
SUMMARY:
Anomaly in fuel pressurization system led to shutdown of 3rd stage engine. Vehicle failed to reach orbit.
EVENT DESCRIPTION:
On the August 24, 2011 flight of Progress M-12M (44P) an anomaly in the fuel pressurization system led to the shutdown of the third stage engine. The engine shutdown resulted in the vehicle failing to reach orbit and crashing in the Altai Mountains.
A root cause has yet to be conclusively determined. A blockage of the third stage fuel lines is believed to be the leading cause due to manufacturing and processing.
Progress is an uncrewed vehicle which uses the same third stage rocket segment as the crewed Soyuz capsule.
SOURCES:
Other ISS cargo mission failures | Loss of Mission
Cargo Misson Failures also occurred on:
Cygnus CRS Orb-3: On October 28, 2014 an explosion in the first stage engine LO2 turbopump during ascent resulted in loss of launch vehicle and spacecraft
Progress M-27M (59P): On April, 28 2015 a failure in upper stage just prior to spacecraft separation resulted in catastrophic damage to the spacecraft and loss of mission.
SpaceX Dragon CRS SpX-7: On June 28, 2015 overpressurization and structural failure of the second stage LO2 tank during ascent resulted in loss of launch vehicle and spacecraft.
Progress MS-04 (65P): On December 1, 2016 a catastrophic failure of the third stage engine oxidizer pump during powered flight resulted in destruction of the upper stage and spacecraft
SOURCES:
Cygnus CRS Orb-3
- Orb-3 Accident Investigation Report
- Space News article on Antares Failure
Progress M-27M (59P)
- M-27 Roscosmos Press Service
- Progress M-27M Mission Updates - Spaceflight 101
- Progress failure probe narrows in on separation from rocket – Spaceflight Now
- Roscosmos determines cause of Progress M-27M cargo craft failure - SpaceFlight Insider
SpaceX Dragon CRS SpX-7
- SpaceX CRS-7 Investigation Update
- SpaceX failure adds another kink in station supply chain - Spaceflight Now
- SpaceX Falcon 9 failure investigation focuses on COPV struts - NASA Spaceflight
Progress MS-04 (65P)
STS-117 | 6/8/2007 | Crew: 7
SUMMARY:
Thermal blanket damage. EVA performed to repair damage.
EVENT DESCRIPTION:
On June 8, 2007 during ascent, a thermal blanket covering the port orbital maneuvering system (OMS) pod was damaged.
An unplanned extravehicular activity, a high risk operation, was performed to repair the damaged blanket, so the blanket could effectively prevent potential damage to the vehicle from heating during entry. Failure of the thermal protection during entry could have resulted in overheating of the OMS and catastrophic structural failure of the vehicle and loss of crew.
The blanket was repaired by inserting pins between the thermal blanket and the surrounding shuttle tiles. A surgical stapler was also used in fastening the two thermal blankets together.
SOURCES:
STS-114 | 5/26/2006 | Crew: 7
SUMMARY:
Bird strike on External Tank.
Loss of foam from External Tank PAL ramp.
TPS gap filers protruding. Removed during third mission EVA.
Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.
EVENT DESCRIPTION:
STS-114 encountered four close-call events.
SOURCES:
A) News Article | B) C) D) Space Shuttle Missions Summary | D) NSI Anomaly | B) C) D) Mission Report | C) D) MER Report
D) MER-33 Forward Attach Shear Bolt NSI
STS-93 | 7/23/1999 | Crew: 5
SUMMARY:
At T+5 a short on AC1 Phase A
resulted in loss of SSME1 Controller A and SSME3 Controller B.
SSME3 H2 leak: early LOX depletion and shutdown.
EVENT DESCRIPTION:
STS-93 encountered two close-call events.
SOURCES:
STS-124 | 5/31/2008 | Crew: 7 | Related or Recurring event
SUMMARY:
Pad 39-A flame trench suffered significant damage causing about 3,500 refractory bricks to be blown away from the flame trench wall.
EVENT DESCRIPTION:
On May 31, 2008 during the launch of STS-124, the Pad 39-A flame trench suffered significant damage causing about 3,500 refractory bricks to be blown away from the flame trench wall. The bricks scattered away from the flame trench beyond the pad perimeter fence. This debris could have damaged the vehicle or the launch complex.
Pad generated debris is a concern for any spaceflight, due to the potential for debris to travel in a manner that can damage the vehicle or the launch complex.
SOURCES:
Kennedy Space Center Annual Report FY2008
STS-95 | 10/29/1998 | Crew: 7 | Related or Recurring event
SUMMARY:
Drag chute door separated during launch and impacted main engine bell.
EVENT DESCRIPTION:
On October 29, 1998 during the main engine ignition sequence, the drag chute panel fell away from the vehicle. Video of the launch confirmed the drag chute door detached three seconds prior to liftoff and hit the engine nozzle of Space Shuttle Main Engine (SSME) 1.
The remains of the door were found during a post-launch pad inspection, revealing that at least one aluminum shear pin used to attach the door sheared. The root cause of the shearing was a combination of the high pressure environment caused by SSME ignition and a low margin hinge pin. The drag chute door struck the nozzle of the center main engine but did not do any appreciable damage to the engine or vehicle. Concerns about the status and condition of the chute contained in the drag chute compartment resulted in the decision not to deploy the chute during landing.
As a precautionary measure, two subsequent missions used a solid closeout panel bolted over the drag chute compartment and did not utilize the drag chute. All flights following these missions used Inconel instead of aluminum as shear pin material.
SOURCES:
STS-116 | 12/10/2006 | Related or Recurring event
STS-125 | 15/11/2009 | Related or Recurring event
Debris from the flight vehicle or the launch facility poses a risk to all crewed space launches.
Other significant ascent debris events have occurred on:
STS-116:
On December 10, 2006, during ascent, booster trowelable ablative (BTA) around the solid rocket booster (SRB) left hand aft booster separation motor (BSM) nozzle liberated and was seen striking the bottom of the orbiter shortly after SRB separation began. The root cause of the observed debris liberation was determined to be stress buildup in the thermal protection system (TPS) and BTA closeout configuration at the aft BSM exit cone. The failure mechanism that produced the forward transport of the BTA was a hinging effect on the liberated BTA coupled with plume expansion at altitude, which projected the debris forward to where it struck the orbiter.
The BTA closeouts around the aft BSM nozzles were modified to eliminate the failure mechanism that caused the forward debris transport as well as limit the size and release angle of BTA liberated at SRB separation.
STS-125:
On May 11, 2009 during ascent the Wing Leading Edge Impact Detection System (WLEIDS) recorded two impacts on the starboard chine, which was confirmed by video imagery analysis.
Damage detected during on-orbit inspection was below the damage tolerance threshold.
SOURCES:
STS-116 Debris Report | STS-116 IDBR-01 | STS-125 Debris Report | STS-125 MER Report | STS-125 Mission Report
Late Release Orbiter Tyvek Covers
During the ascent phase of:
STS-114 | 7/26/2005
STS-115 | 9/9/2006
STS-118 | 8/8/2007
STS-119 | 3/15/2009
STS-124 | 7/31/2008
STS-126 | 11/14/2008
The Tyvek covers for the reaction control system jets released later than intended. The late release resulted in the Tyvek reaching a higher velocity than designed, thus posing a higher risk of damage to the orbiter.
Tyvek covers were used to keep rain water and other debris out of the reaction control system jets while the shuttle was on the launch pad.
SOURCES:
STS-114 MER Report | STS-115 MER Report | STS-118 Debris Report
STS-119 MER Report | STS-124 MER Report | STS-124 Debris Report
Apollo 14 | 1/31/1971 | Crew: 3
SUMMARY:
Multiple failed docking attempts. Contingency procedures developed to mitigate risk of recurring docking anomaly. Docking successful.
EVENT DESCRIPTION:
On January 31, 1971 six docking attempts were unsuccessful following translunar injection. On the seventh try the command module pilot was told to fire thrusters to hold the command module to the lunar module while the docking probe was retracted. The docking capture latches were triggered to fire the probe-retract pyrotechnic, and docking was successful. After docking, the drogue and probe were examined by the crew and appeared normal. No other issues arose with the docking mechanisms.
The most likely cause of the docking issue was a piece of debris or ice on the docking probe from rain water entering the boost shroud the day before launch. The mission would have been No-Go for lunar module separation and landing if a backup procedure for docking and retracting the docking probe in an emergency had not been developed.
SOURCES:
Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission
SUMMARY:
Explosion due to electrical short. Loss of O2 and EPS.
EVENT DESCRIPTION:
Apollo 13 launched on April 11, 1970. On April 13, 1970 during trans-lunar flight at approximately 56 hours, one of the two Service Module oxygen tanks over-pressurized and exploded. This caused the loss of oxygen in that tank and a leak of oxygen out of the remaining tank. This resulted in the loss of all three fuel cells, loss of the primary oxygen source, and the loss of electrical power to the Command Module (except for the entry batteries). The mission was able to continue with the use of the Lunar Module, and the crew safely returned.
Prior to launch, the following conditions resulted in the oxygen tank failing during the mission: By design the cryogenic oxygen tank required both electrical heaters to maintain pressure, and fans to prevent stratification. The tank was a complex assembly with blind installation of the quantity probe, heater/fan assembly, and fill tube. This design leaves wiring insulation vulnerable to damage during assembly with no way to inspect after installation. The Teflon insulated wiring, which is a combustible material in the oxygen tank, was in close proximity to the heater elements and fan.
The Apollo 13 tanks were originally installed on Apollo 11, but a change required the tanks to be removed. During removal of the oxygen shelf, one bolt was left in place causing the fixture to break and resulting in a two-inch drop of the shelf and tanks. Although a loosely fitting (due to loose specification tolerances) fill tube could have been displaced by this, all testing was passed. No cryogenic tests were performed which would have revealed the problem. During the Count Down Demonstration Test the oxygen tank could not be emptied by the normal means of pressurized oxygen gas due to a leak at the fill tube. Instead, the tank heaters were turned on to boil off the oxygen in the tank. The thermostatic switches were rated for 30 volts direct current, but several years earlier the heater ground power supply voltage was raised to 65 volts to reduce the pressurization time. As the temperature increased the thermostatic switch opened and the higher voltage caused the contacts to weld closed. With the heaters continuously on, the temperature approached 1000 degrees and damaged the wire insulation, setting up the conditions for a short and ignition inside the tank. Ground personnel did not notice the continuous heater operation. During the prelaunch problem solving neither the Apollo Spacecraft Program Manager nor the Kennedy Director of Launch Operations knew the tank had previously been dropped or that the heaters had been on for eight hours.
SOURCES:
Soyuz MS-09 | 8/30/2018 | Crew: 3
SUMMARY:
OM cabin leak due to hole in the pressure shell.
EVENT DESCRIPTION:
On August 30, 2018 an unexpected cabin pressure decrease on ISS occurred. The crew’s investigation found a hole in the orbital module (OM) of the Soyuz. An epoxy patch was applied to the hole to prevent further leaking. An EVA was conducted on December 11 to examine the area and gather samples from the outside of the OM for further analysis on the ground.
SOURCES:
ISS Increment 38 | 12/1/2013 | Crew: 6
SUMMARY:
ITCS configuration errors resulted in near freezing and potential rupture of water-to-ammonia heat exchanger.
EVENT DESCRIPTION:
On December 11, 2013 the failure of a flow control valve in the pump module of the External Thermal Control System (ETCS) and subsequent Internal Thermal Control System (ITCS) reconfiguration led to a drop in water temperature to nearly freezing in the Columbus module's Moderate Temperature Heat Exchanger (MTHX). If the water in the Interface Heat Exchanger (IFHX) had frozen, the expansion could have ruptured the barrier between the ITCS and the ETCS. A rupture of this barrier could allow ammonia to enter the interior crew portions of the ISS, causing a potential loss of crew/loss of vehicle.
SOURCES:
Station Crew Removes Ammonia Pump Anomaly Log
ITCS Heat Exchanger Close Call Case Study Close Call Outbrief
Soyuz TMA-18 (22S) | 9/23/2010 | Crew: Soyuz 3, ISS 3
SUMMARY:
First attempt to separate from ISS failed; ISS crew succeeded in bypassing faulty sensor.
EVENT DESCRIPTION:
The first attempt to separate the Soyuz from ISS on September 23, 2010 failed. A hatch sensor on the Poisk docking port of the Zvezda module prevented hooks on the Poisk side from opening.
SOURCES:
ISS, Increment 17 | 4/30/2008 | Crew: 3
SUMMARY:
Freon 218 leaked from SM AC.
EVENT DESCRIPTION:
On April 30, 2008 Freon 218 leaked from the Service Module air conditioner. The Russian [BMP] (Russian Microimpurities Removal System) was modified to allow for faster removal of the Freon 218.
SOURCES:
ISS, Increment 15 | 6/10-6/18/2007 | Crew: 10
SUMMARY:
Power switch failures caused loss of ISS propulsive attitude control capability.
EVENT DESCRIPTION:
On June 10-18 2007 Russian computers that provide ISS propulsive attitude control [ТВМ], and Russian segment command and control capability [ЦВМ], experienced multiple automatic and manual restarts. ISS attitude control was maintained by the docked shuttle (Atlantis STS-117/13A) while Russian specialists and US teams worked to restore consistent power to the computers. The Russian cosmonauts were able to re-establish two of three computers on both systems ([ТВМ], [ЦВМ]) by June 18 after bypassing the secondary power circuitry to provide a continuous “ON” command.
Troubleshooting later identified the root cause to be an electrical short in the line resulting from corrosion of cabling within the Command Acquisition (Processing) Unit [БОК3] which monitors power. The short caused a power-off command to be passed to all six computers. The corrosion was presumed to be caused by increased humidity resulting from the close proximity of an air separator to the [БОК3]. The [БОК3] was subsequently relocated to a separate compartment.
If the Russian computers were unrecoverable, the failure could have resulted in the loss of ISS attitude control and loss of ISS.
SOURCES:
RS Knowledge Base Event 2369 ISS Part Record 2511 ISS Status Report
STS-117MCC Status Report STS-117 NASA Facts
ISS, Increment 13 | 8/2006 | Crew: 3
SUMMARY:
Triol coolant leak in SM.
EVENT DESCRIPTION:
In August 2006 during ISS Increment 13, about 150 grams of Triol coolant leaked from the Docking Compartment-1 Hydraulic Cooling Loop Connector in the Service Module. The crew cleaned and monitored the area throughout the day. No additional leaking was reported.
SOURCES:
ISS, Increment 10 | 2/2005 | Crew: 2
SUMMARY:
Potential acid preservative aerosol escape from Russian urinal.
EVENT DESCRIPTION:
In February 2005 during ISS Increment 10 an acid preservative aerosol escaped from the Russian urinal.
SOURCES:
ISS, Increment 5&6 | mid 2002-2/03 | Crew: 3-10
SUMMARY:
Formaldehyde periodically exceeded long-term limits.
EVENT DESCRIPTION:
During ISS Increments 5 and 6, which spanned from mid-2002 until February 2003, formaldehyde levels onboard the station periodically exceeded the long-term limits.
SOURCES:
Portable Multigas Monitors for ISS
ISS, Increment 2-4 | 4/2001-3/2002 | Crew: 3
SUMMARY:
Freon 218 leaked from SM AC.
EVENT DESCRIPTION:
During ISS Increments 2-4, which spanned from April 2001 until March 2002, Freon 218 leaked from the Service Module air conditioner.
Freon 218, a coolant fluid used in the air conditioning system, was found in cabin air quality samples after Zvezda was activated. The concentration of the Freon increased slowly once detected, but then rapidly as time passed. Peak concentrations reached over 600 mg/m3.
SOURCES:
Portable Multigas Monitors for ISS
ISS, Increment 4 | 2/2002 | Crew: 3
SUMMARY:
MetOx regeneration caused noxious air.
EVENT DESCRIPTION:
During ISS Increment 4, February 2002, the United States Orbital Segment metal oxide canister regeneration caused the release of pollutants into the air.
SOURCES:
Portable Multigas Monitors for ISS
ISS Increment 2 | 8/2001 | Crew: 3
SUMMARY:
Extremely high methanol levels in FGB air sample.
EVENT DESCRIPTION:
During August 2001 Functional Cargo Block [FGB] air samples contained extremely high methanol levels. The source of the methanol was never identified.
SOURCES:
Portable Multigas Monitors for ISS
STS-104 | 7/2001 | Crew: 5
SUMMARY:
EMU battery leaked hazardous KOH. Discovered during EMU checkout.
EVENT DESCRIPTION:
During the first pre-extravehicular activity checkout of the July 2001 flight, an increased capacity extravehicular mobility unit (space suit) battery was discovered to have leaked hazardous potassium hydroxide. The leakage resulted in potassium hydroxide deposits on the contamination control cartridge, the water tank structure, and other locations on the primary life support system of the space suit.
SOURCES:
ISS, Increment 2 | 4/24/2001 | Crew: 10
SUMMARY:
Failure of all U.S. command and control computers on ISS.
EVENT DESCRIPTION:
On April 24, 2001 the ISS Command and Control (C&C) Multiplexer/Demultiplexer (MDM)-1 suffered hard drive errors that resulted in C&C-1 going offline.C&C-2 automatically switched from backup to primary mode, but suffered hard drive errors. C&C-3 was brought online but also failed. This resulted in complete loss of command and control to the United States orbital segment. C&C-2 was restored and placed into operation in primary mode. Flight controllers were able to uplink critical C&C software into the dynamic random access memory of C&C-3. C&C-3 was declared operational except the hard drive. C&C-1 was replaced with an identical payload computer.
If the MDMs were unrecoverable, the failure could have resulted in the loss of the United States orbital segment.
SOURCES:
Unlikely failures triggered computer shutdown STS-100 NASA Facts ISS PART MER Record 368
STS-99 | 2/2000 | Crew: 6
SUMMARY:
High bacterial count in postflight sample after GIRA installed to removed iodine.
EVENT DESCRIPTION:
During the February 2000 flight, a high bacterial count of 160 colony forming units (CFUs)per 100 ml was discovered in a post-flight sample after the Galley Iodine Removal Assembly was installed to remove iodine. The level should have been less than 100 CFUs/100 ml.
SOURCES:
ISS, Flight 2A.1 | 5/1999 | Crew: 7
SUMMARY:
Crew sickened in FGB; likely a result of high localized CO2 levels due to poor ventilation.
EVENT DESCRIPTION:
During ISS Flight 2A.1 in May 1999, the crew was sickened in the Functional Cargo Block [FGB], likely as result of high localized carbon dioxide levels due to poor ventilation. The evidence suggests that human metabolic products (carbon dioxide, water vapor, heat) were not being effectively removed from the crew member work area, and therefore caused the symptoms.
The number of crew members working in the [FGB] may also have contributed to the air quality issues.
Additionally, the flexible air duct running between the orbiter's Pressurized Mating Adapter 1 and the [FGB] may have contributed to poor air quality. The flexible air duct has a tendency to collapse with only minor incidental contact.
This duct was later redesigned to minimize the potential for collapse and restricted air flow.
SOURCES:
X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew
SUMMARY:
Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.
EVENT DESCRIPTION:
On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.
The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive. While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.
This was the first United States spaceflight fatality.
SOURCES:
SpaceShipOne 16P | 9/29/2004 | Crew: 1
SUMMARY:
Uncommanded vehicle roll. Control regained prior to apogee.
EVENT DESCRIPTION:
On September 29, 2004 SpaceShipOne performed a series of 60 rolls during last stage of engine burn. SpaceShipOne coasted to 103 km of altitude and successfully completed the first of two X-Prize flights. The motor was shut down when the pilot noted that his altitude predictor exceeded the required 100 km mark. During the motor burn the spacecraft began to roll uncontrollably, but the pilot continued despite advice from the ground to shut the motor down and abort the attempt.
The thin air at that altitude meant that the control surfaces didn't have enough air flowing over them, so they lost effectiveness to compensate for the roll as the spacecraft pointed nearly straight up. The pilot needed to correct the rolling that occurred because of asymmetric thrust coming from the engine.
To correct the issue for the 17P flight, the amount of allowable “down pitch trim” was limited, to avoid the negative-lift condition. The solution was to more gently turn the corner, such that a forward correction later would not be needed. Pointing straight up at burnout was determined to be acceptable, as long as negative lift was not created. This problem was corrected on SpaceShipTwo.
SOURCES:
SpaceShipOne 14P | 5/13/2004 | Crew: 1
SUMMARY:
Flight computer unresponsive. Recovered by rebooting.
EVENT DESCRIPTION:
On May 13, 2004 the flight computer on SpaceShipOne became unresponsive. During the boost following the vertical part of the trajectory, the avionics display flickered and went blank. The ground displays did not show an error. The avionics display on SpaceShipOne came back on as soon as the motor shut down.
Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.
SOURCES:
Altitude Chamber O2 Fire | 3/23/1961 | Crew: 1 | Loss of Crew
SUMMARY:
Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.
EVENT DESCRIPTION:
On March 23, 1961 a cosmonaut in an altitude chamber was removing the sensors that had been attached to him during an experiment. He cleaned the places where the sensors had been attached with cotton wool soaked in alcohol, and without looking threw away the cotton wool. The cotton wool landed on the ring of an electric hot plate in the oxygen-charged atmosphere of the chamber. In conditions of high oxygen concentration, normally non-flammable substances can burn vigorously. The cosmonaut's training suit caught fire. Unaccustomed to the vigor of high-oxygen fires, the cosmonaut would only have spread the flames further by attempting to smother them. The doctor on duty noticed the conflagration through a porthole and rushed to the hatch, which he could not open because the internal pressure kept the inward swinging hatch sealed. Releasing the pressure through bleed valves took several minutes and the cosmonaut later died in the hospital from the burns.
SOURCES:
Navy Chamber | 11/17/1962 | Crew: 4 | Crew Injury (4)
SUMMARY:
Fire started in a 100% oxygen environment at 5 psi. Four officers injured.
EVENT DESCRIPTION:
On November 17, 1962 four Navy officers were injured, two seriously, when a fire started in the altitude chamber they were occupying in a 20 day experiment at the U.S. Navy Air Crew Equipment Laboratory as part of a NASA atmosphere validation program.
The chamber contained 100% oxygen at 5 psi. The fire started when one officer changed a light bulb in an energized 24 volt DC light fixture. One wire in the fixture became disconnected resulting in arcing. A cotton towel was used in an attempt to smoother the fire. The towel caught fire, and the flames spread to the officers' clothes.
SOURCES:
Mercury MA-9 | 5/16/1963 | Crew: 1 | Manual Entry
SUMMARY:
Electrical faults caused loss of some systems and need to perform manual entry. Also experienced high PPCO2 levels in suit during entry operations.
EVENT DESCRIPTION:
During the May 16, 1963 flight electrical faults caused the loss of some systems and the need to perform manual entry. The alternating current power supply for the control system failed to operate, and it was determined that the pilot would have to make a manual retrofire and re-entry. He performed these maneuvers with close precision and landed a short distance from the prime recovery ship in the Pacific Ocean.
The malfunction during re-entry on MA-9 was traced to two connectors in an electrical amplifier.
SOURCES:
Gemini 8 3/16-17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission
SUMMARY:
Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.
EVENT DESCRIPTION:
During the Gemini 8 flight from March 16 – 17, 1966 a stuck thruster, number 8, which controls roll, caused a loss of control and rapid spin rate of the capsule that could have led to the crew losing consciousness. To counter the effects the stuck thruster was turned off and the re-entry control system had to be used to stabilize the capsule. Use of the re-entry control system led the Gemini safety group to declare an end to the mission, which led to the first United States emergency de-orbit. The thruster apparently short circuited while attached to the Agena target vehicle.
SOURCES:
Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission
SUMMARY:
Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.
EVENT DESCRIPTION:
After achieving orbital insertion on April 23, 1967 the left solar array of the Soyuz 1 spacecraft did not deploy, causing the spacecraft to receive only half of the planned solar power. Despite the solar array failure, the crew member attempted to maneuver the spacecraft. The attempt was unsuccessful because of interference between the reaction control system exhaust and the ion flow sensors.
The failure of the solar array to deploy also prevented the cover of the sun and star sensor from opening, preventing attitude control for crucial maneuvers such as spin stabilization and engine firings. The failures on Soyuz 1 prevented the launch of Soyuz 2, which had been scheduled to rendezvous and dock with Soyuz 1, causing the Soyuz 1 mission to be ended early.
Due to the failures with the control systems, the cosmonaut had to manually control the spacecraft for the critical de-orbit burn and entry while also managing the power supply of the crippled vehicle. (See also Soyuz 1 entry event)
SOURCES:
Soyuz 6 | 10/1969 | Crew: 2
SUMMARY:
Low-pressure compressed arc welding experiment nearly burned a hole through the inner compartment flooring and damaged the hull of the OM.
EVENT DESCRIPTION:
While testing the low-pressure compressed arc welder portion of the Vulkan Welding Unit in the depressurized orbital module, the welder nearly burned a hole through the inner compartment flooring and damaged the hull of the orbital module.
SOURCES:
Soyuz 21 | 8/24/1976 | Crew: 2
SUMMARY:
Separation from Salyut failed; ground command succeeded in opening latches.
EVENT DESCRIPTION:
On August 24, 1976 separation from Salyut failed. Prior to the latches being fully open, the latches gave a false 'open' indication, leading to the premature firing of the Soyuz separation thrusters and jamming the latches partially open. The Soyuz remained loosely attached to the station until ground control was able to send commands to the latches, forcing them open.
SOURCES:
Soyuz Landing Reliability Study
PRA on Soyuz Spacecraft as ACRV
Soyuz 23 | 10/16/1976 | Crew: 2 | Loss of Mission
SUMMARY:
Mission Abort due to docking failure.
EVENT DESCRIPTION:
The Soyuz 23 mission launched on October 14, 1976. Its primary mission was to dock to the Saylut 5 space station to conduct crewed operations aboard the station. However, docking to the Salyut 5 space station was unsuccessful due to the failure of the automated rendezvous system. Sensors used by the automatic system indicated an incorrect lateral velocity, causing unnecessary firing of the thrusters during rendezvous. The automatic system was turned off, but no fuel reserves remained for a manual docking attempt with the Salyut 5. The mission was aborted, and low spacecraft battery reserves forced the crew to return early. Upon re-entry/landing the capsule landed in a lake during a snow storm, delaying crew recovery (see Soyuz 23 landing event). The crew was recovered on October 16, 1976.
SOURCES:
Soyuz 33 | 4/12/1979 | Crew: 2 | Loss of Mission
SUMMARY:
Main engine anomaly caused final rendezvous abort.
EVENT DESCRIPTION:
On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)
SOURCES:
STS-2 | 11/21/1981 | Crew: 2 | Minimum Duration Flight | Crew Injury
SUMMARY:
Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.
EVENT DESCRIPTION:
During the flight of STS-2, which spanned from November 12 – 14, 1981, fuel cell failure led to the declaration of a minimum duration flight (MDF). In addition to the MDF, the failure of the fuel cell also led to high hydrogen levels in the drinking water. The fuel cells used produce drinking water as a by product. When the crew drank this water it provoked a need to belch. Belching in zero g leads to regurgitation. The crew avoiding drinking the water in order to avoid belching, which caused crew dehydration. Prior to entry, crew members fluid load to offset fluid shift when returning from orbit. The crew dehydration increased the effects of the fluid shift and could have posed a risk during high g entry procedures due to a higher chance for loss of consciousness.
SOURCES:
STS-9 | 12/8/1983 | Crew: 6
SUMMARY:
Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.
EVENT DESCRIPTION:
On December 8, 1983 about five hours prior to the planned landing time, the orbiter's General Purpose Computer (GPC) 1 failed when the primary Reaction Control System jets were fired. About six minutes later GPC 2 also failed, leaving the orbiter in free drift for approximately five minutes before GPC 3 was brought online in OPS 3 entry mode (GPC 3 had been freeze dried for on-orbit operations). Attempts to bring GPC 1 back online were unsuccessful, and it was powered down.
Although problems had occurred, GPC 2 was reinitialized and placed back online, and GPCs 2, 3, 4, and 5 were configured for entry. This off-nominal configuration led to further problems, and delayed the landing time by about eight hours. Entry was set up without GPC 1, and upon landing GPC 2 failed again. Particle Impact Noise Detection testing was instituted to screen out any contamination of the GPC boards, and a spare GPC was flown for several flights after STS-9, but was later dropped as a requirement.
SOURCES:
STS-32 | 1/9/1990 | Crew: 5 | Loss of Attitude Control
SUMMARY:
Erroneous state vector up-linked to flight control system, causing immediate and unpredictable attitude control problems.
EVENT DESCRIPTION:
An erroneous state vector up-linked to the flight control system on January 9, 1990 causing immediate and unpredictable attitude control problems.
At 17:23:46:51 Greenwich Mean Time, during a crew sleep period, a state vector update was commanded by the ground prior to the loss of signal. The uploaded state vector was erroneous, and the orbiter began to execute a multi-axis rotation at three degrees per second with a number of thruster firings. The rotation continued until the acquisition of signal period, about 10 minutes later, when the crew was awakened and instructed to switch to manual Digital Auto Pilot to arrest the unwanted rates. A good state vector was then uplinked.
SOURCES:
STS-44 | 11/24/1991 | Crew: 6 | Minimum Duration Flight
SUMMARY:
Failure of IMU 2 caused MDF to be declared. 10-day mission shortened to 7 days.
EVENT DESCRIPTION:
Failure of Inertial Measurement Unit (IMU) number 2 on November 24, 1991 caused minimum duration flight to be declared. The 10-day mission was shortened to seven days. In an attempt to recover normal operation of the IMU, it was placed in standby, operate, and then power cycled. These actions were not successful. Failure of this IMU invoked a flight rule requiring minimum duration flight for loss of one IMU.
Post-flight troubleshooting in the Inertial Systems Laboratory at Johnson Space Center isolated the problem to a failed computer interface card. This card converts analog acceleration signals into digital signals. The failed card was sent to the manufacturer for further analysis which revealed that a filter capacitor (C14), located within a chopper-stabilized amplifier hybrid component (U12) in the Z-accelerator channel, had shorted. This short circuit caused a bond wire from U12 pin 9 to the card case to fuse open.
SOURCES:
STS-51 | 9/12/1993 | Crew: 5
SUMMARY:
Both port-side primary and secondary SUPER*ZIP explosive cords fired, resulting in containment tube failure and damage in the payload bay.
EVENT DESCRIPTION:
On September 12, 1993 the STS-51 mission commands intended to initiate the primary SUPER*ZIP explosive cord resulted in the simultaneous firing of both the primary explosive cord and back-up explosive cord. This simultaneous explosive cord firing resulted in the rupture of a SUPER*ZIP containment tube and release of contaminants and high-energy debris into the orbiter cargo bay. The orbiter sustained damage to blankets, wire tray covers, the 1307 bulkhead, and Thermal Protection System tiles. If debris had hit critical items it could have resulted in a loss of the orbiter and crew.
SOURCES:
STS-83 | 4/6/1997 | Crew: 7 | Loss of Mission
SUMMARY:
Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.
EVENT DESCRIPTION:
A failure of fuel cell (FC) number two resulted in a minimum duration flight being declared on April 6,1997. The 16-day mission was reduced to four days due to FC problems encountered on flight day two. During prelaunch operations the differential voltage on FC 2, substack 3 remained above the 150mV limit (defined in the Operations and Maintenance Requirements Specification Document) for an unusually long period of time before dropping below 150 mV. The substack delta voltage began to trend upward shortly after on-orbit operations began at approximately two hours Mission Elapsed Time. FC purges were ineffective at stopping the trend. FC 2 was subsequently shut down and safed to prevent the possibility of a crossover condition, and multiple payloads had to be powered down. FCs 1 and 3 continued to carry the total orbiter load and performed nominally.
Post-flight failure analysis of FC 2 did not identify a root cause for the on-orbit anomaly experienced, but did identify degraded cells and verified the cell performance monitor (CPM) was functioning properly. No foreign material/contaminant was found and the most credible scenario implies an abnormal external event affected a group of cells prior to start–up. It has been hypothesized that this external event was the presence of oxygen in the oxygen side of substack 3 of the FC at a time when the FC was supposed to be inerted with helium. This event over time would cause oxidation of the nickel Electrolyte Reservoir Plate and dissolution of palladium and platinum in the anodes. Migration and plating of the palladium onto the cathode catalyst would cause high open circuit voltage once full reactants are applied to the FC.
As a result of this anomaly and failure analysis, the Launch Commit Criteria was revised to not allow launching with an FC showing similar prelaunch CPM readings. Kennedy Space Center FC purge procedures were also modified to preclude the potential for the presence of oxygen in inerted fuel cells. The program also designed and tested a fuel-cell monitoring system (FCMS) which finally provided individual cell-health monitoring capability (STS-87 first flight). If the FCMS had been available for STS-83, it may have precluded the shutdown of the FC and may have allowed the mission to complete its planned duration.
SOURCES:
Space Shuttle Missions Summary
Mir | 7/17/1997 | Crew: 3
SUMMARY:
Accidental unplugging of computer power cable led to loss of attitude control and loss of power.
EVENT DESCRIPTION:
On July 16, 1997 a cosmonaut inadvertently unplugged a central computer power cable while disconnecting cables for upcoming repairs of the Spektr module. The temporary loss of power caused the central computer to shut down, resulting in the loss of attitude control and Mir going into free drift. In free drift the Mir was unable to accurately point its solar arrays to provide sufficient power. Once in free drift, the ground and flight crew failed to turn off equipment to reduce power demand, which resulted in depletion of stored energy in the flight batteries and complete loss of power on Mir.
The Progress M-35 supply spacecraft was used to reorient the Mir to restore nominal solar array power generation, recharge flight batteries, and subsequently restore Mir attitude control functions.
SOURCES:
Crew Accidentally Pulls Plug on Mir
Mir Loses all power after accident
STS-87 | 11/27/1997 | Crew: 6
SUMMARY:
Spartan satellite deployed without proper activation.
Recapture with RMS unsuccessful. Later captured by EVA crew.
EVENT DESCRIPTION:
Deployment of the SPARTAN satellite on November 21, 1997 occurred without proper activation.
A crew input via the Payload and General Support Computer was not received by the spacecraft. Lack of telemetry and onboard verification procedures left this condition undetected by the Mission Control Center and flight crew. The SPARTAN was grappled with the Remote Manipulator System, removed from the Release/Engage Mechanism, and released per the flight plan.
The missed command step resulted in the failure of the SPARTAN to execute an expected preprogrammed maneuver ("pirouette") about 2.5 minutes after deploy. Attempts to re-grapple the SPARTAN after the deployment were unsuccessful. A previously scheduled extravehicular activity (space walk) had to be changed to manually recapture the satellite.
SOURCES:
Space Shuttle Missions Summary
STS-95 | 10/29/1998 | Crew: 7
SUMMARY:
Preflight sterilization process chemically altered the Low Iodine Residual System resulting in contaminated drinking water.
EVENT DESCRIPTION:
During STS-95 on October 29, 1998 the preflight sterilization process chemically altered the Low Iodine Residual System (LIRS) resulting in contaminated drinking water.
The crew reported the water from the galley with the LIRS installed had a bad taste. Samples of the water were taken post-flight for analysis. The LIRS was removed. A purge of the LIRS water from the galley plumbing was conducted. After the purge the Galley Iodine Removal Assembly was reinstalled and the crew reported that the water taste was normal after the change-out of hardware.
The bad tasting water could have led to possible crew dehydration due to the crew drinking less water.
SOURCES:
Space Shuttle Missions Summary
Apollo 11 | 7/21/1969 | Crew: 2
SUMMARY:
Engine arm circuit breaker knob broke off. Circuit breaker successfully reset allowing ascent.
EVENT DESCRIPTION:
On July 21, 1969 while preparing for extravehicular activities, the engine arm circuit breaker broke, probably due to an impact from the oxygen purge system. A felt tipped pen was used to successfully depress the circuit breaker when needed. Circuit breaker guards were installed on Apollo 12 and subsequent vehicles to prevent the oxygen purge system from impacting the circuit breakers.
SOURCES:
Apollo 10 | 5/22/1969 | Crew: 2
SUMMARY:
Switch misconfiguration resulted in lunar module control problems.
EVENT DESCRIPTION:
In May 22, 1969 a switch misconfiguration resulted in lunar lander control problems.
During the Lunar Module (LM) last pass, within eight miles of the moon and prior to the jettison of the LM Descent Stage, the Commander (while wearing a space suit) started to troubleshoot an electrical anomaly.
The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.
The attitude indicator was going to the red zone and in danger of tumbling the inertial platform. The Commander was able to grab the hand controller, switch to manual control, jettison the Descent Stage, control the LM Ascent Stage, and finally dock with the CSM.
SOURCES:
Salyut 7 | 1985 | Crew: 3 | Crew Illness
SUMMARY:
One returned with visiting crew due to medical condition.
EVENT DESCRIPTION:
Because a crew member became ill, the crew of Salyut 7 modified crew operations and ultimately departed the station on November 13, 1985, prior to full mission completion which would have occurred on November 21, 1985.
SOURCES:
Mir EO-2 | 7/24/1987 | Crew: 2 | Crew Illness
SUMMARY:
One crew member replaced early due to medical condition.
EVENT DESCRIPTION:
On July 24, 1987 during the Mir Principle Expedition 2 (EO-2) one crew member was diagnosed with a heart problem by ground-based doctors and returned to Earth early.
SOURCES:
Salyut 5 | 8/25/1976 | Crew: 2 | Crew Illness
SUMMARY:
Early return of crew due to health effects from suspected toxic gases in space station.
EVENT DESCRIPTION:
The Salyut 5 initial crew departed the station early, using Soyuz 21, on August 25, 1976. This was attributed to various causes including fire, environmental system failure, and crew health problems caused by fumes from chemicals used to develop film from the station's surveillance cameras. The subsequent mission crew (Soyuz 24) entered the station wearing protective breathing masks due to the potential contamination.
SOURCES:
STS-133 | 2/26/2011 | Crew: 6 | Related or Recurring event
SUMMARY:
Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.
EVENT DESCRIPTION:
On February 26, 2011 STS-133 experienced significant misalignment between the orbiter and the ISS during post-capture free drift due to gravity-gradient-induced motion.
There were significant oscillations between the orbiter and ISS on STS-133 during final ring retraction. The orbiter tipped approximately 10 degrees in pitch and four degrees in roll while ring retraction was paused. The time from contact to hardmate took 50 minutes.
Post-flight analysis of STS-133 docking operations raised several concerns, including vehicle-to-vehicle clearance, mechanism-to-mechanism contact, ISS free drift risks (longeron shadowing risk), timeline impacts, and the lack of a good integrated analysis tool.
At the Generic Joint Operations Panel on April, 6 2011 it was stated that the docking mechanism fixers will be used to maintain alignment during retraction. Engineering and safety agreed with the recommendation. The docking procedures were updated prior to STS-134/ULF6.
SOURCES:
STS-130 | 2/10/2010 | Crew: 6 | Related or Recurring event
SUMMARY:
Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.
EVENT DESCRIPTION:
On February 10, 2010 there were significant oscillations between the orbiter and ISS on STS-130 during final ring retraction, requiring an additional 34 minutes in free drift to complete docking. Similar oscillations were observed during STS-133 docking.
Post-flight analysis from the STS-130 event indicated that the oscillations were caused by gravity gradient effects on the integrated vehicle stack (ISS/Shuttle) resulting in misalignment of the final docking ring and loss of the “RING ALIGN” indication. When the “RING ALIGN” indication is lost, the fixers are released, resulting in large misalignments.
Concern for ISS longeron shadowing and lack of data resulted in the Missions Operations Directorate not accepting the recommendation to rely on the fixers to maintain the alignment even after loss of “RING ALIGN” until after STS-133.
SOURCES:
Soyuz T-8 | 4/22/1983 | Crew: 3 | Loss of Mission | Related or Recurring event
SUMMARY:
Loss of rendezvous antenna prevented docking.
EVENT DESCRIPTION:
On April 20, 1983 the loss of rendezvous antenna prevented docking.
The Soyuz rendezvous radar antenna failed to deploy properly before docking attempts with Salyut 7. Several attitude control maneuvers at high rates were attempted but failed to swing the boom out. A rendezvous using only an optical sight and ground radar inputs for guidance was attempted, but was aborted when it was thought the vehicles were closing too fast. No further attempts were made to dock with the station.
The post-flight inquiry later discovered that the antenna was torn off when the Soyuz payload shroud separated.
SOURCES:
Skylab 2 | 5/26/1973 | Crew: 3 | Related or Recurring event
SUMMARY:
Multiple failed automatic docking attempts resulted in manual docking to Skylab.
EVENT DESCRIPTION:
On May 26, 1973 numerous failed docking attempts resulted in the use of contingency in-flight procedures to bypass the automated docking system. Successful docking to the Skylab station ultimately relied on manual control and crew piloting skills.
The contingency procedure required the Skylab 2 crew members to don pressure suits, depressurize the command module cabin, open the tunnel hatch, cut wires in the probe, and connect the emergency probe-retract cable using a utility power outlet. The crew members were able to fire the probe-retract pyrotechnic and complete docking manually.
The failure to dock would have resulted in the loss of Skylab due to the inability to perform critical repairs.
SOURCES:
Living and Working in Space: A History of Skylab
Soyuz 10 | 4/23/1971 | Crew: 3 | Loss of Mission | Related or Recurring event
SUMMARY:
Automatic docking system failed. Manual docking with Salyut not achieved.
EVENT DESCRIPTION:
On April 23, 1971 during automatic approach to Salyut, the Soyuz began to oscillate. The crew went to manual control and was able to complete mechanical capture. During retraction of the probe, the engines began firing because the Soyuz control system was still active. This caused damage to the docking mechanism, which stopped the probe retraction and prevented the Soyuz from completing docking to the Salyut. The crew was instructed to reconfigure cables which allowed them to send a command to release the probe's capture latches. Soyuz was released, and landing occurred on April 25.
SOURCES:
Soyuz 15 | 8/28/1974 | Crew: 2 | Loss of Mission | Related or Recurring event
SUMMARY:
Failed to dock with Salyut 3 due to Igla system malfunction.
EVENT DESCRIPTION:
The Soyuz 15 mission launched on August 26, 1974. Its primary mission was to dock to the Saylut 3 military space station to conduct the second phase of crewed operations aboard the Salyut 3 space station. However, docking to the Salyut 3 space station was unsuccessful due to the failure of the Igla rendezvous system and the inability to complete docking in manual mode. Due to this inability to dock, as well as spacecraft battery power limitations, the Soyuz crew was forced to abandon the mission and return to Earth within two days of launch. Gyroscope problems nearly prevented orientation of the spacecraft for the de-orbit burn. After landing, the crew was recovered on August 28, 1974.
The state commission found that the Soyuz Igla docking system needed serious modifications which could not be completed before the Salyut 3 space station decayed beyond a useable orbit. Therefore, the planned Soyuz 16 spacecraft became unnecessary to the program. (It was later flown as Soyuz 20 to a civilian Salyut station, even though it exceeded its two-year rated storage life.)
SOURCES:
Mir | 6/25/1997 | Mir Crew: 3 | Loss of Mission | Related or Recurring event
SUMMARY:
Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.
Mir Crew: 3
Loss of Element
EVENT DESCRIPTION:
On June 25, 1997 Progress M-34 collided with the Mir Spektr module rupturing the module. The crew of Mir had to cut through cables in the hatchway in order to seal off the leaking module from the rest of the station.
SOURCES:
Progress Collision with Spektr
Mir-Progress Collision with Spektr
Mir | 8/30/1994 | Mir Crew: 2 | Related or Recurring event
SUMMARY:
Progress M-24 collided with Mir during second docking attempt.
Collision
EVENT DESCRIPTION:
On August 30, 1994 during the second attempt of the Progress M-24 to dock with Mir, the Progress collided with Mir's forward docking unit two to four times, and then drifted away from the station. The docking problems with Progress M-24 have been variously attributed to software or Kurs electronics failures on Progress M-24, or the failure of control equipment in the Moscow Mission Control Center.
SOURCES:
Mir | 8/30/1994 | Crew: Soyuz 2, Mir 3 | Related or Recurring event
SUMMARY:
Soyuz TM-17 collided twice with Mir during undocking.
Collision
EVENT DESCRIPTION:
On January 14, 1994 during the post-separation inspection fly-around of Mir, the crew lost manual translation control due to a configuration error. The loss of control led to the Soyuz colliding with Mir several times. The cause of the collision was traced to the hand controller in the orbital module which governed braking and acceleration being switched on, disabling the equivalent hand controller in the descent module.
SOURCES:
M21-D21 | 7/30/1966 | Crew: 2 | Loss of Crew
SUMMARY:
D21 drone collided with M21 during launch, causing M21 breakup. Crew survived breakup but one was lost after water landing.
EVENT DESCRIPTION:
On July 30, 1966 as the M-21 mothership was performing a flight test for launching the D-21 drone, while traveling at high Mach speeds the drone was not able to penetrate the shock wave coming off the mothership. The D-21 had almost cleared the rudders of the M-21 when the drone bounced off the shockwave and pitched down, striking the M-21 and breaking it in half. The Pilot and Launch Control Officer (LCO) stayed with the tumbling wreckage of the plane a short time until a lower altitude was reached, then ejected over the Pacific Ocean.
Both crew members made safe ejections and landings, but after landing the LCO opened his helmet visor by mistake and his suit filled with water, causing him to drown. All subsequent flights of the D-21 were as D-21Bs, which were reconfigured to launch the drone from an under wing pylon of a B-52 (much like the X-15 had been), boosted to Mach 3 by a rocket motor that was jettisoned after the D-21Bs Marquardt ramjet was started.
SOURCES:
SR-71 | 7/30/1966 | Crew: 2 | Loss of Crew (1)
SUMMARY:
Loss of control at high speed and altitude.
EVENT DESCRIPTION:
On January 25, 1966 the SR-71 aircraft disintegrated during a high-speed, high-altitude test flight when the breakdown of super sonic airflow resulted in engine cutoff (also known as engine un-start). This occurred during a turn at speeds exceeding Mach 3.17 and a bank of 35 degrees. The bank immediately increased to 60 degrees. The nose pitched up and the aircraft broke apart. The pilot was thrown clear (his ejection seat never left the plane). He blacked out during the accident, but recovered and landed on the ground safely. His Reconnaissance System Officer did not survive the high-g bailout.
SOURCES:
SpaceShipTwo PF04 | 10/31/2014 | Crew: 2 | Loss of Crew (1)
SUMMARY:
Vehicle breakup during powered flight.
EVENT DESCRIPTION:
On October 31, 2014 shortly after separating from the WhiteKnightTwo carrier aircraft, the SpaceShipTwo vehicle broke apart resulting in the loss of one crew member. A National Transportation Safety Board investigation into the accident is ongoing.
SOURCES:
NTSB Aerospace Accident Report
FAA Press Release - Statment on SpaceShipTwo Incident
SpaceShipOne Flight 11P | 10/31/2014 | Crew: 1
SUMMARY:
Left main landing gear collapsed.
EVENT DESCRIPTION:
A nominal landing pattern was flown on December 17, 2003. However, touchdown caused the left main gear to collapse, and the vehicle rolled to a stop off the runway in the soft sand.
SOURCES:
Mercury MA-7 | 5/24/1962 | Crew: 1
SUMMARY:
RCS depletion at 80,000 ft.
EVENT DESCRIPTION:
This incident on May 24, 1962 involved the use of double authority control and the accidental actuation of the fly-by-wire high thrust units during certain maneuvers. The manual-system fuel was depleted near the end of the retrofire maneuver, and the automatic-system fuel was depleted at about 80,000 and 70,000 feet. Because of the early depletion of automatic-system fuel, attitude control during re-entry was not available for the required duration. Attitude rates built up after the Automatic Stabilization Control System became inoperative because of the lack of fuel, and these rates were not sufficiently damped by aerodynamic forces. The pilot chose to deploy the drogue parachute manually at an altitude of approximately 25,000 feet to stabilize the spacecraft.
To avoid the same situation on later flights, Mercury MA-8 and subsequent spacecraft contained a switch which allowed the pilot to disable and reactivate the high-thrust units at his discretion. An automatic override reactivated these thrusters just prior to retrofire. Additionally, a revision of fuel management and control training procedures was instituted for subsequent missions
SOURCES:
Mercury 7 Description & Analysis
Apollo ASTP | 7/24/1975 | Crew: 3 | Crew Injury
SUMMARY:
N2O4 in crew cabin. Crew hospitalized for 2 weeks.
EVENT DESCRIPTION:
On July 24, 1975 as the spacecraft descended, the commander, who was reading the checklist, failed to tell the command module pilot to move the Earth Landing System auto/manual switch to auto. The crew saw that the spacecraft was well below the deployment altitude and proceeded to manually deploy the chutes. Drogue chutes were deployed manually at 18,550 feet instead of 23,500 feet as the automatic system would have done. At 10,000 feet the commander realized that ELS was not in AUTO and quickly switched ELS Logic and AUTO, deploying the main parachutes at 7,150 feet and disabling the RCS instead of 10,500 feet.. The Reaction Control System (RCS) was not disabled manually (RCS command switch turned to “off”) at this time. It was disabled manually at 16,000 feet instead of when the checklist indicated at 24,000 feet. The cabin pressure relief valve opened automatically at 24,500 feet.
During a 30-second period of high thruster activity after drogue parachute deployment, a mixture of air and propellant combustion products followed by a mixture of air and nitrogen tetroxide oxidizer (N2O4) vapors were sucked into the cabin. One of the positive roll thrusters is located only two feet away from the steam vent that pulls in outside air when the cabin relief valve is open. This exposed the crew to a high level of N2O4 since emergency oxygen masks were not available until landing. The pilot passed out, but the commander quickly put the oxygen mask on him and he was revived. The exposure resulted in a two-week hospital stay for the crew after landing.
SOURCES:
Apollo Soyuz Mission Anomaly Report
Soyuz TM-25 | 8/17/1997 | Crew: 3
SUMMARY:
Landing rockets fired at heat shield separation rather than at landing.
EVENT DESCRIPTION:
On August 17, 1997 the landing rockets on Soyuz TM-25 fired during heat shield separation rather than during landing. This failure resulted in a harder landing than normal.
The Mir with the docked Soyuz was experiencing high humidity levels in the atmosphere. Water condensing on the connectors in the Soyuz electrical box controlling the circuit probably caused a short circuit, which caused the rockets to fire when the system was armed at heat shield physical separation. Changes were made to either seal the connectors or separate the connectors to prevent a short from applying electrical power to the rockets when the system is armed.
The design has two primary types of inhibits. One inhibit consists of three mechanical switches that physically disconnect the firing circuit when the heat shield is attached. These switches are spring loaded and move approximately 20 mm as the heat shield is deployed to close the firing circuit. A minimum of two out of three switches must be closed for the initiating system to function. In addition to these mechanical inhibits, logic in the electronics prevents the ignition command from being sent until after the heat shield is deployed. Nominally the soft landing motors are ignited when the gamma ray altitude/velocity sensor detects proximity to the ground. The system automatically initiates either four or six motors depending on the velocity. Each motor has 1 kg of propellant and burns for approximately 0.1 to 0.14 seconds.
SOURCES:
Soyuz MS-02 | 4/10/2017 | Crew: 2
SUMMARY:
DM leak due to damage from parachute deployment.
EVENT DESCRIPTION:
On April 10, 2017 during parachute deployment, a buckle struck the descent module causing a partial depressurization 8 kilometers above the landing site.
SOURCES:
Related or Recurring event
In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:
Mir (October 1994) (A)
STS-40 (June 1991) (B)
STS-35 (December 1990) (C)
STS-28 (August 1989) (D)
STS-6 (April 1983) (E)
Salyut 7 (September 1982) (F)
Salyut 6 (1979) (G)
Salyut 1 (June 1971) (H)
SOURCES:
B-E) Portable Multigas Monitors for ISS
Related or Recurring event
On February 24, 1997 after replacing the Solid Fuel Oxygen Generator (SFOG) cartridge a fire ignited onboard the Mir space station. After becoming aware of the fire, the crew donned oxygen mask and gathered fire extinguishers. The flames blocked the emergency path to one of the docked Soyuz capsules preventing half of the 6 member crew from evacuating if the need arose. The foam fire extinguishers eventually doused the flames before an evacuation of the station was needed. The proximate cause of the fire is thought to be a piece of latex glove that contaminated the Lithium Perchlorate canister during ground operations.
SOURCES:
Portable Multigas Monitors for ISS
Related or Recurring event
On February 26, 1998 the Russian Micropurification Unit [BMP] onboard the Russian Mir space station overheated and caused the level of carbon dioxide to climb to health-threatening levels.
SOURCES:
Portable Multigas Monitors for ISS
Related or Recurring event
On October 10, 2008 the crew reported smoke and odor emitting from the Russian condensate water processor unit [SRV-K]. The equipment housing was hot. When the air quality was tested using the Compound Specific Analyzer-Combustible Products (CSA-CP), carbon dioxide was found at five parts per million and acid gases, hydrogen chloride and hydrogen cyanide, were zero. The [SRV-K] was powered off and replaced, which resolved the issue.
On September 18, 2006 the crew reported smoke and a solvent smell. The Elektron was found to have released toxic byproducts. The CSA-CP registered carbon dioxide at seven parts per million and hydrogen chloride and hydrogen cyanide above one part per million.
In March 2005 an electrical odor was traced to a lamp on the Service Module.
SOURCES:
Portable Multigas Monitors for ISS
Mercury MA-6 | 2/20/1962 | Crew: 1
SUMMARY:
False landing-bag indicator light led to entry with retropack in place as a precaution.
EVENT DESCRIPTION:
On February 20, 1962 a sensor indicated the heatshield was in an unlatched condition while still in orbit. If the sensor's reading were true, the heatshield could have been lost during entry, resulting in the loss of the vehicle and crew. Because the indictor said the heatshield had been dropped to the landing position, entry procedures were changed to eliminate the jettisoning of the retropack. The retropack was used as a redundant heatshield hold-down device to keep the heatshield in place. The straps holding the retropack burned through during entry, but it was thought that the aerodynamic pressure would hold the heatshield in place. After landing it was discovered that the indicator was incorrect and that the heatshield had not been dropped to the landing position.
SOURCES:
Mercury MA-7 | 5/24/1962 | Crew: 1
SUMMARY:
Pitch horizon scanner failed, resulting in manual entry and off-target landing. Delayed crew recovery.
EVENT DESCRIPTION:
On May 24, 1962 the failure of the spacecraft pitch horizon scanner required the pilot to assume manual control of the spacecraft for retrofire. As a result, the spacecraft attitude was outside of the recommended range for automatic initiation of the retrofire signal. Manual initiation of the retrofire signal occurred several seconds later than scheduled.
The delay in retrofire initiation and the less-than-ideal spacecraft attitude contributed to the spacecraft landing 250 nautical miles downrange of the intended landing point which delayed crew recovery.
SOURCES:
Mercury 7 Description and Analysis
Voskhod 2 | 3/19/1965 | Crew: 2
SUMMARY:
Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.
EVENT DESCRIPTION:
On March 19, 1965 a malfunction of the automatic descent system resulted in the use of a backup manual system for entry and landing. Difficulties encountered during manual operation and delayed retrofiring resulted in the spacecraft landing more than 1,000 km downrange from the intended landing point. The wooded, mountainous terrain caused a delay in crew recovery. (Actual distance of overshoot varies in the source documents, but most sources indicate a distance between 1,000 km and 2,500 km.)
SOURCES:
The Voskhod 2 mission revisited
Gemini 4 | 6/7/1965 | Crew: 2
SUMMARY:
Erroneous entry data uplinked; crew manually corrected entry flight profile.
EVENT DESCRIPTION:
On June 7, 1965 the computer could not be updated for entry, could not be turned off, and then stopped working entirely. The crew resorted to a rolling Mercury-type entry, rather than the lifting bank angle the computer was supposed to help them achieve.
SOURCES:
Gemini 5 | 8/29/1965 | Crew: 2
SUMMARY:
Erroneous entry data uplinked; crew manually corrected entry flight profile.
EVENT DESCRIPTION:
During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.
SOURCES:
Apollo AS-201 Test | 2/26/1966 | Crew: 0
SUMMARY:
Electrical short at separation resulted in RCS commands being sent to the Service Module, causing loss of RCS control
EVENT DESCRIPTION:
During the Apollo Saturn (AS-201) mission, after spacecraft (S/C-009) command and service module (CSM) separation, a short to power caused the Reaction Control System (RCS) commands to be transferred from the crew module (CM) to the service module (SM), resulting in the loss of RCS control. This transfer of command circuits to the shorted umbilical due to entry heating caused a large short and low voltage on main bus A & B till the circuit breakers opened. After loss of RCS, the CM went into a stable roll and did a ballistic entry instead of the planned lifting re-entry.
The cause of all this was a non-functional circuit that was routed through the CSM umbilical and was not deadfaced prior to separation. It shorted, tripping a circuit breaker and causing loss of the redundant Earth Landing System (ELS). The non-functional circuit had been dropped from the drawings, but the wiring was left in the spacecraft and was not disconnected from power. Since it was not on the drawing for the powered wiring going through the CSM umbilical, it was not deadfaced prior to guillotine of the umbilical. Redundant NASA Standard Initiators, one powered by System A and one by System B (this source failed), were used on all critical pyrotechnic functions, including the ELS, and this allowed for recovery of the CM.
SOURCES:
Apollo 11 | 7/24/1969 | Crew: 3 |
Apollo 10 | 5/18/1969 | Crew: 3 |
Apollo 8 | 12/21/1968 | Crew: 3 |
Related or Recurring event
SUMMARY:
Service Module did not follow the planned trajectory after separation and passed near the Command Module while tumbling. Also occurred on Apollo 8 and 10.
EVENT DESCRIPTION:
On July 24, 1969 during the return from the moon and about five minutes after the separation of the crew module (CM) from the service module (SM), the crew saw the SM fly by to the right and a little above them, straight ahead. It was visible from the CM windows and spinning. The CM should never have been so close to the SM after separation. During lunar return, if the SM contacted the CM in the entry corridor the result would be catastrophic, so this event triggered an anomaly investigation. Photographs obtained by aircraft showed the SM entering Earth’s atmosphere and disintegrating near the CM entry corridor. Radar tracking confirmed what the photographs had shown. The radar tracking data for the previous Apollo 8 and Apollo 10 lunar return missions were similar to Apollo 11, with the SM entering in the same corridor as the CM. In response to these events, the timing of the SM Reaction Control System jets was adjusted via the SM Jettison Controllers to prevent the chance of re-contact on future missions.
SOURCES:
Soyuz 11 | 6/30/1971 | Crew: 3 | Loss of Crew
SUMMARY:
Pyrotechnic system failure resulted in crew module rapid depress.
EVENT DESCRIPTION:
On June 30, 1971 during separation of the orbital and service modules from the descent module, the pyrotechnic system did not operate as intended. All of the pyrotechnics fired simultaneously rather than the designed sequential firing mode. This caused a pressure equalization seal to open in the descent module at a higher-than-designed altitude, resulting in the rapid depressurization of the crew module. The rapid depress led to loss of consciousness of the crew.
All three crew members were lost.
SOURCES:
Skylab 4 | 2/8/1974 | Crew: 3
SUMMARY:
Incorrect circuit breakers opened, resulting in the loss of the automatic control.
EVENT DESCRIPTION:
On February 8, 1974 while preparing foar entry, the crew inadvertently opened the stabilization and control system (SCS) pitch and yaw circuit breakers instead of the service propulsion system pitch and yaw circuit breakers. The vehicle was in an apex forward configuration for service module jettison. The commander attempted to orient the vehicle to the proper heat shield forward attitude for entry. The control commands produced no effect due to the SCS being inadvertently unpowered, and the vehicle failed to change attitude. The crew switched to “manual reaction control system direct” and oriented the vehicle to the proper attitude. The circuit breakers being in close proximity and similarly labeled, increased the potential for human error.
The failure to orient the heat shield forward would have caused loss of crew.
SOURCES:
Soyuz 33 | 4/12/1979 | Crew: 2
SUMMARY:
Backup engine burned 25 seconds too long on de-orbit. Ballistic entry.
EVENT DESCRIPTION:
On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)
SOURCES:
Soyuz T-11 | 10/2/1984 | Crew: 3
SUMMARY:
Partial failure of atmospheric entry control system.
EVENT DESCRIPTION:
Partial failure of the atmospheric entry control system of Soyuz T-11 led to a moderately high (5-6 g) deceleration force.
SOURCES:
Soyuz TM-5 | 9/6/1988 | Crew: 2
SUMMARY:
Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.
EVENT DESCRIPTION:
Two de-orbit burn attempts failed and nearly led to the loss of the crew. The crew was confined to the descent module due to the orbital module being jettisoned prior to the first deorbit attempt. The first deorbit burn was prevented by a sensor glitch which disappeared after seven minutes, and then the burn started. However, the crew manually shut down the burn after three seconds.
A second burn two revolutions later occurred on time for six seconds, then stopped, and the crew manually restarted the burn. However, after an additional 60 seconds it was cut off by the autopilot. The crew manually interrupted the command sequence shortly before the descent/equipment module separation pyros were to have been fired, preventing an erroneous firing. The main cause of the crew's problems was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel.
SOURCES:
Soyuz TMA-11 (15S) | 4/19/2008 | Crew: 3 | Crew Injury (1) | Related or Recurring event
SUMMARY:
Ballistic, high g entry and landing over 400 km short of intended target.
EVENT DESCRIPTION:
During Soyuz TMA-11 entry on April 19, 2008, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry, higher g loads during descent, and the spacecraft landing more than 400 km short of the intended target. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module. The recovery team's arrival at the landing site was delayed by approximately 45 minutes due to the off-target landing. One crew member was later hospitalized because of injuries sustained during entry and landing.
A Russian investigation into the cause of the DM/IPM separation system failure concluded that one of the five pyrotechnically actuated locks, which attach the Soyuz instrumentation and propulsion module to the descent module, failed to release at the proper time.
SOURCES:
Investigative findings backed by nominal Soyuz TMA-13 return
Soyuz TMA-10 (14S) | 10/21/2007 | Crew: 3 | Related or Recurring event
EVENT DESCRIPTION:
During Soyuz TMA-10 entry on October 21, 2007, the Soyuz instrumentation and propulsion module failed to properly separate from the descent module. This resulted in a ballistic entry. The abnormal entry attitude (hatch-forward) during early descent caused excessive heating on the hatch and backshell of the descent module.
SOURCES:
Investigative findings backed by nominal Soyuz TMA-13 return
RS KB Event 2649: 15S (No. 221) Ballistic Entry
STS-119 Delta FRR Soyuz Anomalies
Soyuz 5 | 1/18/1969 | Crew: 2 | Related or Recurring event
EVENT DESCRIPTION:
During entry procedures on January 18, 1969 the connecting latches between the descent module (DM) and the service module (SM) of the Soyuz spacecraft failed to separate at the intended time as designed. The failure to separate led the Soyuz to undergo a “nose first” entry. During the entry, layers of the descent module shell peeled away due to heating and internal pressure. As a result of the heating, the connections between the DM and SM were broken and allowed the DM to return to the normal orientation. The DM survived the unplanned heating in the unshielded areas of the capsule.
SOURCES:
Soyuz Landing Reliability Study
Voskhod 2 | 3/19/1965 | Crew: 1 | Related or Recurring event
EVENT DESCRIPTION:
On March 19, 1965 a communication cable connecting the landing module with the orbital module failed to separate at the appropriate time, causing the two modules' common center of gravity to shift, causing the two modules to begin spinning around it. The spinning eventually stopped at an altitude of about 100 kilometers, when the connecting cable burned through and the landing module slipped free.
SOURCES:
The Voskhod 2 mission revisited
Vostok 5 | 6/19/1963 | Crew: 1 | Related or Recurring event
EVENT DESCRIPTION:
On June 19, 1963 the Vostok service module failed to separate cleanly from the re-entry sphere resulting in wild gyrations until the heat of re-entry burned through the non-separating retraining strap.
SOURCES:
Vostok 2 | 8/7/1961 | Crew: 1 | Related or Recurring event
EVENT DESCRIPTION:
On August 7, 1961 during entry it was discovered that lights on the control console in the cabin, which were powered from the instrument module, remained on. Because the lights were on, it was thought that separation of the two modules had not happened. However, the separation between the capsule and the instrument compartment had taken place. A multi-cable umbilical line between two compartments apparently failed to cut off. This likely explains why the crew member heard the separation jolt, but did not see the control lights go out. The electric current was still flowing to the control panel via umbilical cables. The two modules eventually separated when the cable burned through during entry.
SOURCES:
Vostok 1 | 4/12/1961 | Crew: 1 | Related or Recurring event
EVENT DESCRIPTION:
On April 12, 1961 ten seconds after retrofire, commands were sent to separate the Vostok service module from the re-entry module. The Vostok equipment module unexpectedly remained attached to the re-entry module by a bundle of wires. The two halves of the spacecraft began entry and experienced strong gyrations as Vostok 1 crossed over Egypt. At this point in the entry profile the wires connecting the modules broke, causing the two modules to separate. After the separation of the two modules, the descent module settled into the proper entry attitude and landed as intended.
SOURCES:
STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event
SUMMARY:
TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.
EVENT DESCRIPTION:
Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.
At 81.7 seconds Mission Elapsed Time a piece of foam insulation from the External Tank (ET) left bipod ramp separated from the ET and struck the orbiter left wing leading edge in the vicinity of the lower half of reinforced carbon-carbon (RCC) panel #8, causing a breach in the RCC. During re-entry this breach allowed super-heated air to penetrate through the leading edge insulation and progressively melt the aluminum structure of the left wing, resulting in a weakening of the structure until increasing aerodynamic forces caused loss of control, failure of the wing, and break-up of the orbiter. This breakup occurred in a flight regime in which, given the design of the orbiter, there was no possibility for the crew to survive. (Similar bipod ramp foam releases prior to STS-107 occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.)
Seven crew members were lost.
SOURCES:
STS-51D | 4/19/1985 | Crew: 7 | Related or Recurring event
SUMMARY:
TPS burn-through on left outboard elevon.
EVENT DESCRIPTION:
The post-flight inspection of the Thermal Protection System (TPS) revealed that significant damage occurred during landing on April 19, 1985.
The outboard end of the left-hand lower outboard elevon had received significant heat damage, specifically the outboard forward corner of the elevon lower-honeycomb outer-face-sheet. This area was buckled and delaminated and had two small burn-through holes. The outboard elevon lower-leading-edge tile-carrier panel was completely melted under the outboard tile, and a hole was melted in the elevon-cove primary-seal support plate. Because of the damage the lower-outboard carrier-panel outermost tile fell onto the runway when the elevon was deflected upward after landing.
Evidence indicates that the entry plasma flow entered the inboard gap of the outboard tile, then progressed under the tile flowing outboard, where eventually the tile-attachment strain isolation pad was burned, allowing the tile to become loose. This allowed more plasma flow under the tile, resulting in the melting of the aluminum carrier panel, primary seal panel structure, and elevon honeycomb outer face sheet, as well as the melting of two tiles aft of the plasma entry point and two elevon sidewall tiles. The cause of the TPS and structural damage that occurred during descent has not been positively identified. The most probable cause is an out-of-spec step or gap in the lower wing surface forward of the elevon leading edge. It is believed that this flow path may have existed for the two previous flights, with progressive deterioration of the bond, but was not evident from outside inspection of this area during post-flight inspections.
A requirement was established to remove the outboard leading-edge carrier-panel on each side of all orbiters for detailed inspection after the next several flights. In addition, a more comprehensive detailed inspection of each outboard elevon/wing area was accomplished during the normal TPS post-flight inspections.
SOURCES:
Space Shuttle Missions Summary
STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event
SUMMARY:
Right-hand main landing gear door warped due to entry heating.
EVENT DESCRIPTION:
On April 14, 1981 the right-hand main landing gear door warped due to entry heating. A forward facing step, a tile gap, a tile-to-filler bar gap and an inadequate flow restrictor resulted in excessive gap heating on the forward portion of the right main landing gear door. This excessive heating resulted in severe tile sidewall shrinkage (on four tiles), a charred filler bar, and a localized buckle in the door structure. The structure and Thermal Protection System on the door was refurbished, and the flow restrictor was modified to increase the effectiveness of the Thermal Protection System in the area of the main landing gear doors.
SOURCES:
Related or Recurring event
Other Thermal Protection System Damage Events
In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:
STS-6 (April 1983)
STS-41B (February 1984)
STS-51G (June 1985)
STS-27 (December 1988)
STS-28 (August 1989)
STS-40 (June 1991)
STS-42 (January 1992)
STS-45 (March 1992)
Additional information can be found in the reports linked below.
SOURCES:
STS-6 Mission Report STS-41B MER Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report
STS-134 | 6/1/2011 | Crew: 7
SUMMARY:
Brief fire observed between the left main landing gear tires during runway rollout.
EVENT DESCRIPTION:
STS-134 landed on June 1, 2011. During analysis of the post-landing imagery, a fire was briefly observed during the rollout period, located between the left Main Landing Gear tires shortly after the drag chute was jettisoned. Detailed visual inspections, material analysis, and landing gear systems tests were performed in an effort to determine the root cause of the fire. However, no definitive root cause could be determined. The fire may have been operational, because the commander applied the brakes in excess of recommended deceleration rates, especially at the lower speeds, resulting in the shortest landing rollout on a concrete runway surface since the drag chute had been used. The excessive braking may have generated higher than normal temperatures within the brake.
SOURCES:
STS-108 | 12/7/2001 | Crew: 7
SUMMARY:
Violation of minimum landing weather requirements.
EVENT DESCRIPTION:
On December 17, 2001 the Shuttle Meteorology Group forecasted a “no go” for the de-orbit burn due to a weather forecast predicting the creation of a cloud ceiling at landing time. The Shuttle Training Aircraft reported a “go” based on observed conditions. Several positive factors provided the Flight Director with confidence to give a GO for landing on orbit 186, despite a weather forecast which could result in the crew being unable to see the Precision Approach Path Indicators (PAPIs) or runway environment until 3,000 feet or below. The GO was given with the belief that the cloud layer at 3,000 feet would break and that the PAPIs and runway environment would be visible by 6,500 feet. However, the cloud ceiling did not break and a flight rule was violated, but waived following the flight.
SOURCES:
STS-90 | 5/3/1998 | Crew: 7
SUMMARY:
Hard, fast landing due to human factors and rogue wind gust. Hardest shuttle landing.
EVENT DESCRIPTION:
Following the landing on May 3, 1998 the post-mission report indicated a harder than normal landing. The main gear touchdown speed was 196.2 Keas with a sink rate of -3.18 feet/second. Brake energies were all below 15 million ft-lbs. The rollout distance was 9769.3 feet. Imagery analysis indicated a main landing gear sink rate of -6.7 ft/sec and a "harder than normal" landing. The Mission Operations Directorate Space Shuttle Summary reported touchdown of the main landing gear at 218 Keas, a -6.0 ft/sec sink rate, and a rollout distance of 9998 feet.
SOURCES:
STS-37 | 4/11/1991 | Crew: 5
SUMMARY:
Several factors contributed to a low-energy landing 623 feet prior to the threshold of the runway at the backup landing location.
Low Energy Landing
EVENT DESCRIPTION:
On April 11, 1991 the first landing opportunity at Kennedy Space Center was waived due to fog, and a decision was made to land at the alternate landing site at Edwards Air Force Base. The entry wind profile included a large wind shear (from 90 kts at 13,000 feet to 10 kts at 8,000 feet). These conditions fell outside the Edwards Air Force Base 99 percent wind profile from 20,000 feet to 10,000 feet and significantly outside the shuttle experience base from 30,000 feet to 10,000 feet.
Around the Heading Alignment Circle (HAC), a significant amount of energy was lost due to a consistent negative pitch attitude error, and being outside of the HAC reference. The HAC is designed to provide an “energy pad” for use while making the approach. If guidance senses that the vehicle's energy state is getting very low (it uses altitude below a reference altitude and degrees of turn remaining to make the judgment), the HAC radius is decreased to help make up for the lower energy state. At approximately 23,000 feet the low-energy state triggered HAC shrink (when the range-to-go “distance from the vehicle to the runway” falls below the max lift/drag line). The HAC shrink was triggered due to the altitude being approximately 2-3,000 feet low, and increased the error from the HAC reference. A slow convergence back to the altitude reference was seen though the energy state remained low. At 13,500 feet the vehicle encountered a sharp wind shear reducing the vehicle's airspeed driving the energy state even lower. The vehicle again encountered wind shear at 8,600 feet in altitude. Touchdown occurred 623 feet prior to the threshold at 168 kts.
It is believed that the loss of energy on the HAC combined with the inadequate correction back to the altitude profile, both coming off the HAC and through the wind shear, resulted in the low-energy touchdown.
SOURCES:
STS-51D | 4/19/1985 | Crew: 7
SUMMARY:
Right brake failed (locked up) causing blowout of inboard tire and significant damage to outboard tire.
Crew: 7
EVENT DESCRIPTION:
On April 19, 1985 the right brake on the orbiter failed, causing the blowout of an inboard tire and significant damage to an outboard tire. A crosswind of about 8 knots, gusting up to 12, resulted in extra brake energy on the right brake while returning to and holding the runway centerline during rollout. The number 3 stator on both the inboard and outboard right main landing gear (MLG) brakes broke into several pieces, causing both brakes to lock during rollout. The inboard right brake locked at 20.6 knots and 113 feet, before the orbiter stopped and the outboard right brake locked for the last 5 feet of rollout. The right MLG inboard tire burst 33 feet after the inboard brake locked. Eleven of 16 cord layers were worn through before the tire burst. The right MLG brakes failed and locked due to thermal soak-back when the number 3 stators broke.
The corrective action included the following standard procedures to prevent heat soak-back:
1. Brake-on velocity between 140 and 120 knots.
2. Deceleration rate between 8 and 10 ft/sec2.
3. Deceleration rate reduced to 6 ft/sec2 at 40 knots. If brake-on velocity exceeds 140 knots, continue 8 to 10 ft/sec2 deceleration.
SOURCES:
STS-9 | 12/8/1983 | Crew: 6
SUMMARY:
A. Two APUs caught fire during rollout.
B. GPC failed on touchdown.
C. Incorrect flight control rechannelization on rollout.
EVENT DESCRIPTION:
A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.
B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.
C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.
SOURCES:
STS-3 | 3/30/1982 | Crew: 2
SUMMARY:
Pilot induced oscillation during derotation. Stronger than predicted winds contributed.
EVENT DESCRIPTION:
On March 30, 1982 during orbiter derotation on rollout, the vehicle pitched up to approximately six degrees after having been down to -3 degrees pitch. This pitch up occurred because the pilot was preventing premature nose wheel contact. The planned late transition from autoland to manual control did not provide sufficient time for the pilot to feel the vehicle response, and attempts by the pilot to make minor trajectory adjustments resulted in a touchdown sooner than intended and at a higher than planned airspeed (225 Keas vs. 195 Keas). Subsequently, the derotation after main landing gear touchdown started at too high an airspeed and required the pilot to try and stop it at too low a pitch angle. The rapidly changing elevator trim requirements made it difficult to avoid over-controlling in this situation.
On all future missions, manual takeover from autoland was not planned to occur between the start of the preflare maneuver and touchdown. Flight procedures and crew training were also revised to be more explicit about keeping the nose up until the vehicle slows to 180 knots.
SOURCES:
Soyuz 15 | 8/28/1974 | Crew: 2
SUMMARY:
Descended through an electrical storm during night landing.
EVENT DESCRIPTION:
During the night of August 28, 1974 the capsule descended through an electrical storm.
SOURCES:
Apollo 15 | 8/7/1971 | Crew: 3
SUMMARY:
Landed with only 2 of 3 parachutes.
EVENT DESCRIPTION:
On August 7, 1971 the Apollo capsule, Endeavour, dropped into the Pacific Ocean about 320 miles (515 kilometers) north of Hawaii. During the Earth landing phase, after the main parachutes were deployed and shortly after Reaction Control System (RCS) propellant dumping, one of the main parachutes was observed to be deflated when exiting the clouds (3 of 6 fabric risers failed and two-thirds of the suspension lines were missing). One of the main parachutes was recovered after landing, but the failed parachute was not recovered.
The investigation was divided into three areas which were likely causes of the parachute failure.
The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.
A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.
The Command Module RCS propellant depletion firing had just been completed, and fuel (monomethyl hydrazine) expulsion was in progress at the time of the failure, indicating the possibility of damage from propellants.
Analysis and testing ruled out possible causes one and two, but a test of raw fuel expulsion after RCS firing produced burning outside of the engine. The flame front extended up to eight feet from the engine exit and unburned fuel was sprayed up to 10 feet from the engine and ignited by burning droplets. This was considered the most likely cause of the parachute failure.
SOURCES:
LUNAR EXPLORATION CONCLUDED: to the Mountains of the Moon
Apollo 12 | 11/24/1969 | Crew: 3
SUMMARY:
Harder than normal splashdown knocked loose a camera. The camera knocked lunar module pilot unconscious.
EVENT DESCRIPTION:
Due to a harder than normal splashdown on November 24, 1969, a camera broke free from the window bracket and struck the lunar module pilot on the forehead. The crew member was unconscious for five seconds after the injury and required sutures following retrieval.
SOURCES:
Mercury MR-4 | 7/21/1969 | Crew: 1 | Loss of Capsule
SUMMARY:
Inadvertent hatch pyrotechnic firing. Capsule sunk. Astronaut nearly drowned.
EVENT DESCRIPTION:
After landing on July 21, 1961 the spacecraft hatch pyrotechnic charges prematurely fired. The crew member was able to escape from the emergency situation, but because of waves flooding the capsule, the capsule sunk. The crew member was nearly drowned when the flight suit took on water from an unsealed neckdam. The crew member was rescued after three to four minutes in the water.
SOURCES:
Results of the Second Manned Suborbital
Soyuz TM-15 | 2/1/1993 | Crew: 2 | Related or Recurring event
SUMMARY:
Rolled down hillside.
EVENT DESCRIPTION:
Upon landing on February 1, 1993 Soyuz TM-15 rolled down hill and stopped on its side 150 meters from the shore of a salt marsh.
SOURCES:
Soyuz Landing Reliability Study
Soyuz TM-14 | 8/10/1992 | Crew: 3 | Related or Recurring event
SUMMARY:
Hard landing impact. Hatch jammed, requiring cosmonauts to use tools to pry open.
EVENT DESCRIPTION:
On August 10, 1992 a hard landing impact led to the descent module turning over on its side and leaving the crew sideways. The spacecraft hatch also jammed and could not be opened from the outside, requiring the cosmonauts to use tools to pry it open. High winds in the landing area may have contributed to the severity of the impact.
SOURCES:
Soyuz Landing Reliability Study
Soyuz TM-12 | 10/10/1991 | Crew: 3 | Related or Recurring event
SUMMARY:
Hard impact. News team reported capsule as “very dented.”
EVENT DESCRIPTION:
On October 10, 1991 Soyuz TM-12 experienced a hard landing impact, and a television crew reported that the capsule was 'very dented' and lying on its side.
SOURCES:
Soyuz Landing Reliability Study
Soyuz TM-7 | 4/27/1989 | Crew: 2 | Crew Injury | Related or Recurring event
SUMMARY:
Double-impact “hard landing.”
EVENT DESCRIPTION:
On April 27, 1989 a double-impact, “hard landing” resulted in an injury to a crew member's leg. The injury required medical treatment at the landing site. The hard landing has been attributed to gusty winds at the landing site.
SOURCES:
Soyuz Landing Reliability Study
Soyuz T-7 | 12/10/1982 | Crew: 2 | Related or Recurring event
SUMMARY:
Landed on hillside and rolled downhill. One cosmonaut thrown from seat.
EVENT DESCRIPTION:
On December 10, 1982 Soyuz T-7 landed on a hillside and rolled down the hill. One of the cosmonauts was thrown from his seat as a result of the rolling.
SOURCES:
Soyuz Landing Reliability Study
Soyuz 36 | 7/31/1980 | Crew: 2 | Related or Recurring event
SUMMARY:
Landing rockets failed to fire resulting in ~30 g impact.
EVENT DESCRIPTION:
On July 31, 1980 the Soyuz 36 soft landing rockets failed to fire before touchdown, resulting in an impact at more than 30 g.
SOURCES:
Soyuz Landing Reliability Study
Soyuz 23 | 10/16/1976 | Crew: 2 | Related or Recurring event
SUMMARY:
Landed on frozen lake during blizzard. Delayed recovery.
EVENT DESCRIPTION:
On October 16, 1976 the Soyuz 23 descent module landed in Lake Tengiz, 2 km from shore. The water caused an electrical short which caused the reserve parachute to deploy. Parachute lines from the main and reserve parachute kept the capsule lying on its side in the water, preventing the hatch from opening and blocking the air vent. Transmission antennas became inoperable due to submersion in the water, and the inner walls of the capsule became covered with ice. The recovery team concluded the crew was dead and dragged the capsule to the shore to await the special team to remove the bodies. After eleven hours in the capsule the crew inside finally opened the hatch from the inside.
SOURCES:
Soyuz Landing Reliability Study
Soyuz 18-1 (18a) | 4/5/1975 | Crew: 2 | Crew Injury | Related or Recurring event
SUMMARY:
After ascent abort, capsule landed on snowy slope above cliff. Parachute snagged and prevented fall.
EVENT DESCRIPTION:
During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches. When the core first stage burned out it could not be cast off as designed.
Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.
The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice. After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.
One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.
SOURCES:
Soyuz 5 | 1/18/1969 | Crew: 1 | Crew Injury | Related or Recurring event
SUMMARY:
Landing rockets failed to fire, resulting in a hard landing.
EVENT DESCRIPTION:
On January 18, 1969 the Soyuz 5 soft landing rockets failed to fire, resulting in a harder than normal landing. Because of the force of the impact, one crew member onboard broke his teeth.
SOURCES:
Soyuz Landing Reliability Study
STS-97 | 11/30/2000 | Crew: 5
SUMMARY:
Left aft lower SRB strut system "A" NSI pressure cartridge failed to fire due to damaged cable.
EVENT DESCRIPTION:
Analysis of the flight data and assessment of the postflight condition of the recovered hardware indicated nominal performance of all SRB subsystems with the exception of the left aft lower strut System “A” NSI that failed to fire.
SOURCES:
Jones, Tom. Skywalking.
ISS, Increment 58 | 2/1/2019 | Crew: 6
SUMMARY:
Significant water leak while de-mating potable water quick disconnect.
EVENT DESCRIPTION:
On February 1, 20019 during the installation of the new Universal Waste Management System (UWMS), a water leak occurred while de-mating the quick disconnect (QD) for the potable water bus. Approximately 9.5 liters of water leaked before flight controllers in Mission Control isolated the bus. The crew re-mated the leaking QD, and an alternate QD was de-mated to continue with the installation of the UWMS. Leakage of greater than 3.8 liters of water in the ISS is deemed a catastrophic hazard due to the risk of suffocation and electrical shorts.
SOURCES:
Soyuz 64S | 10/15/2021 | Crew: 3
SUMMARY:
ISS Loss of attitude control due to Soyuz 64S thrusters not deactivating following thruster test.
EVENT DESCRIPTION:
At the end of the re-performance of the 64S thruster test, crew reported that the Soyuz thrusters were firing and they could not turn them off. 64S thrusters unexpectedly started firing just after РО-ДК mode (Soyuz Digital Attitude Control Mode) was deactivated. Thrusters stopped firing due to an error message for over consumption of prop. The prop limit was set to 10 kg and 10 kg of prop was used, causing the deactivation.
SOURCES:
Russian ASAT | 11/14/2021 | Crew: 0
SUMMARY:
Russian ASAT test results in increased orbital debris risk.
EVENT DESCRIPTION:
Russian satellite broke up in Low Earth Orbit in what was a deliberate test of Russian antisatellite (ASAT) device which created thousands of piece of space junk/debris. As reported by the US State department this test has generated more than 1,500 pieces of trackable orbital debris and thousands of pieces of smaller orbital debris. The test increased the risk to ISS, where the crew were directed to shelter in Crew Dragon and Soyuz vehicles due to the potential debris threat to ISS. The crews remained in their vehicles for a few hours before it was determined they could return to ISS.
SOURCES:
Nauka | 7/29/2021 | Crew: 0
SUMMARY:
ISS LOAC due to uncommanded firing of MLM thrusters.
EVENT DESCRIPTION:
The docking of Roscosmos "Nauka" Multipurpose Laboratory Module (MLM), on July 29, 2021 at the International Space Station. This incident involved the unplanned firing of MLM thrusters causing the station to move out of orientation. This incident resulted in NASA and Boeing standing the OFT-2 launch from July 31, 2021 to Aug 3, 2021 to allow ISS Teams time to continue to check out the "Nauka" MLM to ensure ISS operations could safely continue.
SOURCES:
SpaceX Crew-2 | 11/9/2021 | Crew: 4
SUMMARY:
WMS leak resulted in corrosion. (Also noted on Inspiration 4 flight C207.2).
EVENT DESCRIPTION:
Crew Dragon Endeavour waste management system leak was caused by tube delivering liquids from the bathroom rupturing in the spacecraft's cabin floor that then spilled into the waste management system fans.
SOURCES:
ISS Atmospheric Leak | 8/21-22/2021 | Crew: 3
SUMMARY:
Cracks in Russian pressure vessel shell resulted in ISS leak.
EVENT DESCRIPTION:
During this period ISS modules were isolated to gather data as the three-member ISS crew occupied the Russian Segment. The preliminary investigation eliminate the following as possible leak sources: airlock, Columbus, Node-1, Node-2, Node-3, lab, Permanent Multipurpose Module, Japanese Experiment Module, and Docking Compartment-1. The leak could be from the FGB or the Service Module and the Mini-Research Module (MRM)-1 may be a contributing factor.
SOURCES:
Boeing OFT-1 | 12/20/2019 | Crew: 4
SUMMARY:
OFT software issue – LOM and potential LOV during entry.
EVENT DESCRIPTION:
An issue with the spacecraft's mission elapsed time (MET) clock occurred 31 minutes into flight. Due to intermittent space-to-ground communication issues flight controllers could not correct the issue. This anomaly caused the spacecraft's Orbital Maneuvering Thrusters (OMT) to burn into an incorrect orbit causing too much propellant to be burned. This precluded a rendezvous and docking with the ISS. After the mission, it was revealed that another critical software bug was found in flight, which could have resulted in the service module bumping back into Starliner after separation.
SOURCES:
STS-112 | 10/7/2002 | Crew: 6
SUMMARY:
T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.
EVENT DESCRIPTION:
The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.
The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.
All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.
SOURCES:
Boeing OFT-2 | 7/31/2021 | Crew: 0
SUMMARY:
Russian MLM firing and Prop valves “Stuck” Caused the delays in the launch of OFT-2.
EVENT DESCRIPTION:
The initial delay of OFT-2 from Jul 31, 2021 to Aug 3, 2021 was due to Russian MLM. However Boeing later discovered prior to the launch on August 3, 2021 several of the propulsion valves "Stuck" would not open and close properly.....the analysis and troubleshooting of this incident has resulted I this event now being scheduled for late May 2022. The analysis indicated the "most probably cause" for the valves not to function properly may have been due to "oxidizer and moisture interactions". Testing and analysis of the valves continues at White Sands Testing Facility and Marshall Space Flight Center.
SOURCES:
Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event
SUMMARY:
Main and reserve parachutes failed.
Crew: 1
EVENT DESCRIPTION:
On April 24, 1967 on the maiden flight of the Russian Soyuz spacecraft, the cosmonaut encountered an anomaly with the parachute system during descent. During the descent the drag chutes successfully deployed, but the main chutes failed to deploy from their container. Detecting increasing speeds, the computer deployed a backup parachute. Because the drag chute was still attached and failed to release, the backup chute became tangled with the drag chute, preventing the deployment of the backup chute and resulting in a high-speed impact with the ground.
One cosmonaut was lost.
SOURCES:
PRA on Soyuz Spacecraft as ACRV
Soyuz Landing Reliability Study
LAUNCH/GROUND
SUBORBITAL FLIGHTS
RESEARCH FACILITY
ATMOSPHERIC FLIGHTS
LANDING & POSTLANDING
Site last updated: September 30, 2019
NASA Official: Nigel Packham Technical Questions/Infographic Editor: Faisal Ali