Significant Incidents & Close Calls in Human Spaceflight: EVA Operations

Interactive Launch Vehicle History

Significant Incidents in Uncrewed Missions

The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox.

https://www.mozilla.org/en-US/firefox/new/

GENERAL USAGE - Click or tap an event for a pop-up with additional information. Click or tap the event again to close the pop-up.

DESKTOP TIPS - For best results, please use your browser's full screen mode:

Windows: Press F11.

Mac: Click the green Full Screen button in the upper-left corner of the browser window.

To zoom in/out:

Windows: Control-plus/minus to zoom in/out*

Mac: Command-plus/minus to zoom in/out*

TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.

SOURCES INFORMATION

Source documents require Adobe Acrobat to view.

https://get.adobe.com/reader/

Most of the source files contain bookmarks to help locate the relevant information.

Source documents labeled with a padlock are controlled and require NASA authentication to view.

*May cause formatting inconsistencies.

STS-110     |     4/8/2002     |     Crew: 7     |     Related or Recurring event

SUMMARY:

Incorrect adjustments to the controller software resulted in SSME underperformance.Also occurred on STS-108 and STS-109.

EVENT DESCRIPTION:

Prior to STS-108 a change had been made to the controller software coefficient for the Space Shuttle Main Engine (SSME) to compensate for an observed measurement bias in the SSME main combustion chamber pressure sensor, which controls the SSME fuel/oxidizer mixture ratio. The pressure chamber sensor was biased high causing the flight software to lower the chamber pressure by decreasing the liquid oxygen flow rate. To correct the high bias a coefficient in the equation was adjusted to compensate.  Because of communication errors between ground systems engineers and deficiencies in the flight software verification and validation processes, the software coefficient was adjusted in the wrong direction, resulting in even larger dispersions in the mixture ratio and SSME performance.

The error in the coefficient was discovered during post-flight reconstruction of the data from STS-108. The cause of the error remained unknown until after STS-110. The erroneous coefficient was flown on three consecutive flights (STS-108, STS-109, and STS-110) resulting in a slight SSME underperformance on each flight, and was fixed with the proper coefficient and independent verification prior to STS-111. The error in software and resulting mixture ratio wasn't severe enough to cause any significant impacts to SSME performance, and all three flights achieved proper orbits. However, if the software error had been larger, more severe impacts to the missions and crew safety could have occurred, including a premature engine shutdown/failure resulting in on-pad or ascent abort, loss of mission.

SOURCES:

STS-111 SSME FRR

STS-111 FRR

Close Call Presentation

Close Call Awareness Paper

STS-91     |     6/2/1998     |     Crew: 6

SUMMARY:

Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.

EVENT DESCRIPTION:

After the launch of STS-91 on June 2, 1998, a channel A main engine pressure chamber sensor froze.  The sensor was disqualified by engine control software when the sensor exceeded allowable limits during the max Q engine throttle down sequence however the sensor remained qualified for engine redline monitoring since the reading was still within reasonableness limits / operational range for the sensor. The channel B sensor and the main engine performed nominally throughout ascent.  If an engine problem had occurred, the channel B sensor would have displayed the correct information and indicated the proper corrective action. However, the channel B sensor would have been ignored due to the frozen channel A sensor.

The post-flight inspection revealed that contamination from a seal leak check caused the sensor to freeze.  Marshall Space Flight Center (MSFC) project engineering suggested adding a V-seal leak check prior to the acceptance test, to ensure the newly added V-seal was installed properly.  However, MSFC project engineering was unaware that performing the leak check would require the manufacturing personnel to plug the chamber pressure port with Viton.  After the flight, the sensor was still plugged with a piece of Viton.

If the main engine pressure chamber sensor froze later in the flight, logic errors may have triggered a premature engine shutdown and a return to the launch site abort.  Post-flight software changes were implemented to prevent this from occurring on subsequent flights.  Additionally, a one-time flow check verified the reliability of the Lee-Jet for all engines in the fleet. A corrective action requires post-Lee-Jet installation flow check and borescope inspection for future engine builds.  Lastly, the V-seal leak check was eliminated in future engine builds.

SOURCES:

Space Shuttle Mission Summary

Mission Report

Close Call

Soyuz TM-9     |     2/11/1990     |     Crew: 2

SUMMARY:

DM insulation torn loose on ascent; contingency EVA repair.

EVENT DESCRIPTION:

During the docking of Soyuz TM-9 on February 11, 1990, the TM-8 crew aboard Mir noticed three of the eight descent module's thermal blankets had partially detached near the heat shield during ascent. This raised five concerns:

1. If the capsule cooled down, it would allow condensation to form inside the capsule and cause electrical systems to fail.
2. The partially detached blankets could interfere with the infrared vertical sensor which is required to orient the module for re-entry.
3. Exposure to space could cause a failure of the explosive bolts that bind the service module to the descent module.
4. The heat shield could be compromised by direct space exposure.
5. An Extravehicular Activity (EVA) to repair the blankets could inflict further damage.

A rescue mission with a cosmonaut aboard Soyuz-TM 10 was considered, but not executed.  The temperature of TM-9 was stabilized by the Mir directing it into alignment with the sun.

Four months later, the Kristall module (90-048A) arrived with the special tools needed to repair the decent module. Cosmonauts were able to secure the blankets out of the sensor's line of sight after an EVA longer than seven hours.  The success of the EVA led to a nominal entry upon mission completion.

SOURCES:

Mir Hardware Heritage 

STS-51L (Challenger)     |     1/28/1986     |     Crew: 7     |     Loss of Crew     |     Related or Recurring event

SUMMARY:

SRB seal failure.

EVENT DESCRIPTION:

On January 28, 1986 a combustion gas leak developed in the right solid rocket motor aft field joint shortly after solid rocket booster ignition. The resulting hot gas plume exiting the joint impinged upon the SRB lower attachment strut and adjacent external tank structure weakening the structure to the point of failure.

Seventy-four seconds into flight, the Space Shuttle Challenger broke up.

All seven crew members were lost.

SOURCES:

The Accident

Other SRB Seal Events     |     Related or Recurring event

SRB gas sealing anomalies have also occurred on:

STS-2  November 12, 1981

STS-6  April 4, 1983

STS-11 (STS-41B) February 3,1984

STS-41C  April 6,1984

STS-41D  August 30, 1984

STS-51C  January 24,1985

STS-51D  April 12, 1985

STS-51B  April 29, 1985

STS-51G  June 17,1985

STS-51F  July 29, 1985

STS-51I  August 27, 1985

STS-51J  October 3, 1985

STS-61A  October 30, 1985

STS-61B  November 26,1985

STS-61C  January 12, 1986

STS-42  January 22, 1992

STS-71  June 27, 1995

STS-70  July 13, 1995

STS-78  June 20, 1996

SOURCES:

SRB Seal Events

Space Shuttle Missions Summary

Rogers Commission Report

STS-51F     |     7/29/1985     |     Crew: 7     |     Abort to Orbit

SUMMARY:

Temperature sensor problems resulted in SSME1 shutdown at T+5:45.

EVENT DESCRIPTION:

On July 29, 1985 at T+5:43, both temperature sensors for the Space Shuttle Main Engine (SSME) 1 high pressure fuel turbopump showed readings exceeding the redline limit.  This resulted in a premature shutdown of SSME 1 and declaration of an Abort to Orbit condition, the first in program history.  At T+8:13, one of the two temperature sensors on SSME 3 indicted a high reading, but auto-shutdown was inhibited to assure STS-51F achieved an acceptable orbit.

These events were a result of confirmed instrumentation failures. The temperature sensors were removed for engineering analysis following the flight, and a new configuration sensor was used on subsequent engines.

SOURCES:

Mission Report

Space Shuttle Missions Summary

Soyuz 18-1(18a)     |     4/5/1975     |     Crew: 2     |      Loss of Vehicle/Mission

SUMMARY:

Electrical fault caused premature firing of half of the 2nd stage separation bolts, resulting in the inability to fire the remaining ones. Staging failure resulted in abort sequence being used at T=295 seconds.

EVENT DESCRIPTION:

During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches.  When the core first stage burned out, it could not be cast off as designed.

Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.

The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice.  After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

Mir Hardware Heritage

Soyuz 18-1

Soyuz LOC-LOM Study

Apollo 13     |     4/11/1970     |     Crew: 3

SUMMARY:

2nd stage center engine shutdown due to pogo oscillations.

EVENT DESCRIPTION:

During the April 11, 1970 launch of Apollo 13 severe pogo oscillations were experienced.  Acceleration at the engine attachment reached an estimated 34 g (the accelerometer went out of recordable range) before the engine's combustion chamber low-level pressure sensor commanded an engine shutdown.

SOURCES:

Apollo 13

Mission Report

Prevention of Coupled Structure Propulsion Integrity Case File

Apollo 6     |     4/4/1968     |     Crew: 0     |     Related or Recurring event

EVENT DESCRIPTION:

On April 4, 1968 at two minutes after launch, two engines on the Saturn V first stage experienced severe pogo oscillations. After the flight it was discovered that the F1 engines on the first stage had a natural vibration frequency of 5.5 hertz, and the vehicle vibrated at a frequency that peaked at 5.25 hertz, causing the whole vehicle to vibrate. To solve this problem helium gas was used to partially fill a valve cavity in the liquid oxygen lines on the first stage to act as a shock absorber and dampen engine vibration in the lines. Pogo was previously encountered on Apollo 4 and early in the Gemini program.

SOURCES:

Final Flight Evaluation Report: Apollo 6

Apollo 12     |     11/14/1969     |     Crew: 3

SUMMARY:

Lightning strike on ascent.

EVENT DESCRIPTION:

During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.

Light rain was falling, but weather conditions did not indicate any thunderstorm activity.  There were seven miles of visibility with cloud break estimated at 800 feet and overcast conditions at 10,000 feet.

At 11:22am, T+36 seconds, the crew saw a bright light.

At T+36.5 seconds many errors occurred:  Fuel Cells 1, 2, and 3 disconnected; Main Buses A and B were under-voltage; Alternating Current (AC) Buses 1 and 2 overloaded. The warning lights and alarm came on in the cabin, indicating failure of the Inertial Stabilization System.

At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.

The potential effect on the vehicle was induction into wiring, depending on the location and rate of change of potential and direct current flow in grounding.  The high negative voltage spike (delta voltage/delta time) caused the Silicon Controlled Rectifiers to trip on the Fuel Cell and AC Inverter overload sensors.  Failures occurred in four Service Module Reaction Control System helium tank quantity measurements, five thermocouples, and four pressure/temperature transducers.

Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2.  The mission continued.

SOURCES:

Apollo 12 Lightning Analysis

Gemini 10     |     7/18/1966     |     Crew: 2

SUMMARY:

1st stage oxidizer tank exploded at staging. No discernible effects. Nominal ascent.

EVENT DESCRIPTION:

On July 18, 1966, 1.2 seconds after booster engine cutoff, tracking cameras displayed an amber cloud and an unusual amount of debris. The evidence indicated the first stage oxidizer tank ruptured after the normal staging sequence.

This event had no detectable effect on the operation of the second stage.

SOURCES:

Mission Report

STS-61C     |     1/6/1986     |     Crew: 7

SUMMARY:

System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.

EVENT DESCRIPTION:

On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic  sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.

Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).

Corrective action incorporated in response to this close call included modifications to automatic sequencer  software to prevent the  prerequisite control logic from blocking LOX inboard fill-and-drain valve close commands, updates to countdown procedures and launch constraints to verify closure of the inboard fill-and-drain valve after replenish valve closure and prior to tail service mast vent-and-drain valve opening, monitoring and initiation of holds if the fill-and-drain valve closed indication is lost, implementation of helium repressurization “pulse purge” if ET ullage pressure drops below 0.25 psi, and verification of minimum ET ullage pressure rise rate at T-120 seconds.

A subsequent launch attempt on January 7, 1986 was scrubbed at the T minus 9 minute hold due to weather constraint violations at TAL sites. However, during post launch scrub operations a broken Ground Support Equipment (GSE) LOX temperature probe was found lodged in SSME #2 pre-valve post-detanking.  This temperature probe had failed (off-scale high reading) during LOX loading but due to the absence of any mechanical failure history, the failure was assumed to be electrical in nature and the temperature data from this probe was not mandatory for pre-launch loading operations. The broken temperature probe would have prevented closure of pre-valve during flight, at MECO, resulting in an uncontained SSME failure and possible loss of crew, loss of vehicle.

As a result of the broken GSE LOX temperature probe, all  GSE LOX temperature probes were inspected and screened for improper welds, monitored during pre-launch operations for any anomalies, and eventually replaced with redesigned probes.  A coarse debris screen was also added upstream of the LOX prevalve to prevent large debris from entering into the prevalve.

SOURCES:

MER Report      |     Anomaly PR      |     LO2 Temerature Probe Incident      |     Mission Report      |     Close Call

STS-41D     |     6/26/1984     |     Crew: 6     |     Related or Recurring event

SUMMARY:

During the launch attempt on June 26, 1984 all aspects of launch countdown were nominal until T-4 seconds when an irregular operation of the Space Shuttle Main Engine (SSME) 3 main fuel valve resulted in an engine shutdown and pad abort condition.

EVENT DESCRIPTION:

The SSME 3 main fuel valve failed to open when commanded and leaked hydrogen for approximately 21 minutes following the shutdown. After the abort, fire was seen on the starboard side of the body flap for approximately 12 minutes. The aft base heat shield water deluge system was activated and was able to extinguish the fire. Damage to the orbiter was mostly confined to the body flap despite invisible flames of burning hydrogen reaching 190 feet.

The Mobile Launcher Platform sustained minor scorching damage to a few purge ducts and one burnt ground wire. The cause of the main fuel valve anomaly was attributed to contamination in the hydraulic actuator that was likely present at time of installation.

Additional inspection and ground tests were implemented to detect valve anomalies prior to installation into flight engines. Real-time monitoring of valve operation prior to engine start was also enhanced, and ultraviolet fire sensors were added.

SOURCES:

Close Call

Mission Report

Space Shuttle Missions Summary

Soyuz T-10-1 (T-10a)     |     9/26/1983     |     Crew: 2     |      Loss of Vehicle/Mission     |     Related or Recurring event

SUMMARY:

Pad booster fire/explosion. Capsule Escape System used.

Crew: 2

EVENT DESCRIPTION:

Shortly before liftoff on September 26, 1983 fuel spilled around the base of the Soyuz launch vehicle and ignited the vehicle. Launch control activated the escape system, but the control cables were burnt.

Twenty seconds later ground control activated the escape system by radio command. By this time the booster was engulfed in flames.

Explosive bolts fired to separate the descent module from the service module. Explosive bolts also fired to separate of the upper shroud  from the lower shroud. The escape system motor pulled the orbit module and descent module, still encased within the upper shroud, away from  the booster at 14 to 17g of acceleration.

Seconds after the escape system activated, the booster exploded, destroying the launch complex.

The descent module separated from the orbital module and dropped free from the shroud. The descent module heat shield was discarded to expose the solid-fueled landing rockets. A fast-opening emergency parachute was deployed and landing occurred about  four km from the launch pad.

SOURCES:

Cosmonaut Biography

MIR Hardware Heritage

NASA Astonauts on Soyuz

Soyuz LOC-LOM Study

Other On Pad Aborts     |     Related or Recurring events

On pad aborts have also occurred on:

STS-51F: On July 12, 1985 the first launch attempt of STS-51F was aborted at T-4.2 seconds. The chamber coolant valve on Space Shuttle Main Engine 2 needed to move from the 100% open setting to the 70% open setting required for startup, but the valve responded slowly. The launch was aborted and the vehicle safely shut down.

STS-55: On March 22, 1993 the third launch attempt of STS-55 was aborted at T-3 seconds when the Space Shuttle Main Engine (SSME) 3 oxidizer preburner purge pressure exceeded the maximum pressure. The monitor detected that the combustion product pressure exceeded the 50 psi redline due to one of the five check valves in the purge system leaking. The launch was aborted and the vehicle safely shut down. All three SSMEs were replaced before the next launch attempt.

STS-51: On August 12, 1993 the first launch attempt of STS-51 was aborted at T-3 seconds because of a disagreement in the turbine fuel flow sensors of Space Shuttle Main Engine (SSME) 2. At 0.6 seconds after ignition SSME 2 experienced a failure of the fuel flow meter channel A2 speed pickup coil sensor (loss of redundancy) to respond to the start transient. The main engine controller used the A and B flow rate measurement data for closed-loop thrust/mixture ratio control, and the failure of either the A or B measurements resulted in lockup of the preset engine mixture ratio. As a result of the failure, the engines were safely shut down. All the main engines were replaced before the next launch attempt.

 STS-68: On August 18, 1994 the first launch attempt of STS-68 was aborted at T-1.9 seconds. The abort was triggered after the discharge temperature of the high pressure oxidizer turbopump in Space Shuttle Main Engine (SSME) 3 exceeded the redline temperature, causing the main engine controller to issue a shutdown of SSME 3, followed shortly by the General Purpose Computers issuing a shutdown of the other two engines.

SOURCES:

STS-51F Mission Report

STS-51 Mission Report

STS-55 Mission Report

STS-68 Mission Report

STS-1     |     4/12/1981     |     Crew: 2

SUMMARY:

SRB ignition pressure wave caused TPS and structural damage.

EVENT DESCRIPTION:

During the April 12, 1981 launch of STS-1, a higher than expected solid rocket booster ignition pressure wave caused damage to both the thermal protection system and structure.

SOURCES:

Mission Report

Space Shuttle Mission Summary

Skylab 2     |     5/25/1973     |     Crew: 3

SUMMARY:

Instrument unit erroneously sent a command to switch the launch vehicle from internal to external power.

EVENT DESCRIPTION:

On May 25, 1972 at launch commit (T-0 in the launch countdown, at which point the hold-downs are released), an erroneous momentary cutoff signal was sent by the Saturn 1B electrical support equipment and confirmed by the recording of a thrust failure indication and cutoff start indication. The erroneous signal’s duration was not sufficient to trigger the cutoff relay. Had the cutoff relay been energized, an improper automatic cutoff sequence would have occurred, resulting in the vehicle switching to external power without cutting off the engines. This configuration would have caused the vehicle to launch without electrical power and resulted in loss of mission or vehicle.

Analysis revealed the indications to be a momentary re-energization of the launch bus due to remake of the launch bus contactors. To prevent a recurrence, two normally closed commit relay contacts were added to inhibit the thrust failure cutoff circuit after launch commit. Additional changes were made to the automated power transfer circuitry to prevent a “power transfer to external” for the time period after launch commit until a command to cut off the S-1B stage engines was given.

SOURCES:

Skylab 2 Flight Evaluation Report

Apollo I (AS-204)     |     1/27/1967     |     Crew: 3     |    Loss of Crew

SUMMARY:

Crew cabin fire (electrical short + high pressure O2 atmosphere).

EVENT DESCRIPTION:

On January 27, 1967 the crew cabin of Apollo 1 caught fire during a test with three crew members inside.  The cabin was filled with a pure oxygen atmosphere and pressurized greater than ambient pressure (16.7 psi).  Over the course of several hours, the oxygen permeated all materials in the cabin, which had  been tested to the normal flight pressure of pure oxygen (5 psi).  When the fire began it spread rapidly.  Due to the pressure in the cabin, the crew members could not open the hatch to escape. Technicians in the room outside the capsule attempted to open the hatch but were driven back by the heat and smoke.  Some technicians donned the available gas masks, but the masks were designed to protect against hypergolic propellant fumes, not smoke.  Consequently, these technicians lost consciousness after a short time in the smoke-filled room.

All three crew members were lost.

The fire was caused by an electrical short from an unprotected wire.  A subsequent review of all wiring dioded to both Main Bus A and B identified a problem with an environmental control system instrumentation wire powered from Main Bus A and B.  The wire was routed over plumbing lines on the crew compartment floor, located below the left-hand crew seat, going into the left-hand equipment bay, between the environmental control unit and the oxygen panel.  This Teflon-insulated wire should have had a protective Teflon overwrap, but closeout photos showed that the overwrap had slipped down, no longer providing protection.  The commander likely contacted this wire with his foot when he turned to change his communications cable.  The most probable initiator of the fire is an electrical arc from this wire, which was unprotected from external damage.

Factors contributing to this accident include:

- Failure to identify the test as hazardous

- Inward-opening hatch which could not be opened during periods of increased cabin pressure

- Inadequate ground safety procedures and emergency equipment

- Last-minute changes to operational test procedures

- Unsatisfactory communications overall

- Lack of control of combustible materials

- Deficiencies in engineering, workmanship, and quality control

SOURCES:

System Failure Case Study

Accident Report

Gemini 6     |     12/12/1965     |     Crew: 2

SUMMARY:

Main engine shutdown. Booster left unsecured on pad. Crew elected not to eject. Launched 3 days later. After the failed launch attempt, review of engine data and an inspection of the number 2 engine revealed that a plastic dust cover had been inadvertently left on the oxidizer gas generator inlet port causing blockage of oxidizer to the gas generator. Ground procedures were modified to ensure removal of dust covers during engine assembly.

EVENT DESCRIPTION:

There was a main engine shutdown during the attempted launch on December 12,1965.

About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.

The rocket malfunction detection system sensed an anomaly since there was no upward motion associated with the start of the clock and triggered engine stop. The booster was left unsecured on the pad with the crew inside.  The crew members elected to remain in the capsule until the gantry was returned.

A successful launch occurred three days later.

SOURCES:

Go Back to Go

Mission Report

Progress M-12M     |     8/24/2011     |     Crew: 0     |     Loss of Mission

SUMMARY:

Anomaly in fuel pressurization system led to shutdown of 3rd stage engine. Vehicle failed to reach orbit.

EVENT DESCRIPTION:

On the August 24, 2011 flight of Progress M-12M (44P) an anomaly in the fuel pressurization system led to the shutdown of the third stage engine.  The engine shutdown resulted in the vehicle failing to reach orbit and crashing in the Altai Mountains.

A root cause has yet to be conclusively determined. A blockage of the third stage fuel lines is believed to be the leading cause due to manufacturing and processing.

Progress is an uncrewed vehicle which uses the same third stage rocket segment as the crewed Soyuz capsule.

SOURCES:

News Report

Other ISS cargo mission failures     |      Loss of Mission

Cargo Misson Failures also occurred on:

Cygnus CRS Orb-3: On October 28, 2014 an explosion in the first stage engine LO2 turbopump during ascent resulted in loss of launch vehicle and spacecraft

Progress M-27M (59P): On April, 28 2015 a failure in upper stage just prior to spacecraft separation resulted in catastrophic damage to the spacecraft and loss of mission.

SpaceX Dragon CRS SpX-7: On June 28, 2015 overpressurization and structural failure of the second stage LO2 tank during ascent resulted in loss of launch vehicle and spacecraft.

Progress MS-04 (65P): On December 1, 2016 a catastrophic failure of the third stage engine oxidizer pump during powered flight resulted in destruction of the upper stage and spacecraft

SOURCES:

Cygnus CRS Orb-3

- Orb-3 Accident Investigation Report

- Space News article on Antares Failure

Progress M-27M (59P)

- M-27 Roscosmos Press Service

- Progress M-27M Mission Updates - Spaceflight 101

- Progress failure probe narrows in on separation from rocket – Spaceflight Now

- Roscosmos determines cause of Progress M-27M cargo craft failure - SpaceFlight Insider

SpaceX Dragon CRS SpX-7

- SpaceX CRS-7 Investigation Update

- SpaceX failure adds another kink in station supply chain - Spaceflight Now

- SpaceX Falcon 9 failure investigation focuses on COPV struts - NASA Spaceflight

Progress MS-04 (65P)

- Progress MS-04 fails to reach orbit

STS-117     |     6/8/2007     |     Crew: 7

SUMMARY:

Thermal blanket damage. EVA performed to repair damage.

EVENT DESCRIPTION:

On June 8, 2007 during ascent, a thermal blanket covering the port orbital maneuvering system (OMS) pod was damaged.

 An unplanned extravehicular activity, a high risk operation, was performed to repair the damaged blanket, so the blanket could effectively prevent potential damage to the vehicle from heating during entry. Failure of the thermal protection during entry could have resulted in overheating of the OMS and catastrophic structural failure of the vehicle and loss of crew.

The blanket was repaired by inserting pins between the thermal blanket and the surrounding shuttle tiles. A surgical stapler was also used in fastening the two thermal blankets together.

SOURCES:

STS-117 MCC Status Report

STS-117 NASA Facts

STS-117 EVA

STS-114     |     5/26/2006     |     Crew: 7

SUMMARY:

Bird strike on External Tank.

Loss of foam from External Tank PAL ramp.

TPS gap filers protruding. Removed during third mission EVA.

Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward separation bolt function and damaging secondary structure and a thermal blanket.

EVENT DESCRIPTION:

STS-114 encountered four close-call events.

1. Bird-strike on external tank (ET).
   During the July 26, 2005 launch of Discovery on flight STS-114, a vulture soaring around the launch pad impacted the shuttle's ET after liftoff.  A bird-strike at a critical point on the shuttle could cause catastrophic damage to the vehicle since the average weight of a vulture is three to five pounds.  As a preventative measure, a bird abatement program was implemented to limit the possibility of a future bird-strike on liftoff. One aspect of the program was to remove "roadkill" around the Kennedy Space Center, eliminating an easy food source for vultures. Noise deterrents were tried but had little effect on the vultures. The radar tracking of birds was also implemented.
   
   
2. Loss of foam from External Tank Protuberance Air Load (PAL) ramp.
   At T+127.1 seconds foam debris from the ET PAL ramp was seen coming off the ET. The PAL ramps on the liquid hydrogen and liquid oxygen tanks were eliminated on STS-121 and subsequent flights.
   
   
3. Thermal Protection System (TPS) gap fillers protruding.  Removed during third extravehicular activity (EVA). 
   Protruding gap fillers were discovered on the lower forward fuselage during the rendezvous pitch maneuver with the photography of the bottom of the vehicle. Concerns associated with potential early boundary layer tripping and excessive aerodynamic heating during re-entry prompted the decision to remove both gap fillers via EVA.  During EVA 3, both gap fillers were successfully removed. Post-flight inspections identified nine additional protruding gap fillers. The gap filler installation process was reviewed and modified.
   
   
4. During post-flight inspection it was discovered that a NASA Standard Initiator (NSI) in one of the two orbiter external tank forward attach shear bolt pressure cartridges had been ejected.  Black soot from pyrotechnic combustion residue covered the local surrounding area and a small crack in the secondary structure was observed. The ejected NSI damaged the secondary structure panel (approximately 1 inch long crack) and burned the thermal blankets in the vicinity. The most probable cause of the NSI ejection was a missing O-ring (vendor process escape) between the NSI and pressure cartridge which allowed hot combustion gasses to leak past, erode, and subsequently eject the NSI. The missing O-ring and subsequent combustion gas leakage reduced the probability of successful orbiter external tank forward attachment bolt shear (fracturing was successful).  The NSI relies on combustion gas pressure to fracture the forward attach bolt and separate the orbiter from the external tank once on-orbit. Failure to safely separate the orbiter from the external tank would result in loss of crew and vehicle. The ejected NSI could have also damaged the crew cabin pressure shell, located near the forward attach shear bolt,  possibly resulting in a cabin air leak requiring an emergency crew return and loss of mission. Mandatory inspection of NSI O-rings during installation / assembly of forward attach shear bolt pressure cartridges was implemented after STS-114.

SOURCES:

A) News Article     |     B) C) D) Space Shuttle Missions Summary     |     D) NSI Anomaly      |     B) C) D) Mission Report      |     C) D) MER Report

D) MER-33 Forward Attach Shear Bolt NSI

STS-93     |     7/23/1999     |     Crew: 5

SUMMARY:

At T+5 a short on AC1 Phase A

resulted in loss of SSME1 Controller A and SSME3 Controller B.

SSME3 H2 leak: early LOX depletion and shutdown.

EVENT DESCRIPTION:

STS-93 encountered two close-call events.

1. At T+5 seconds a short on AC1 Phase A resulted in the loss of Space Shuttle Main Engine (SSME) 1 Controller A and SSME 3 Controller B.
   Approximately five seconds into the launch of STS-93 on July 23, 1999 a momentary short occurred on AC1 phase A. A current spike in excess of 20 amps combined with a voltage drop from 114 to 21 volts alternating current was observed on AC1 phase, phase A. Coincident with the short, the SSME 1 (center) controller A and SSME 3 (right) controller B failed. The short was isolated to a damaged wire in the port wire tray at the mid-body bay. Analysis of the damaged wire indicated the damage resulted from a single mechanical event. It was initially suspected the damage was caused by vibration-induced chaffing against the head of a torque-set screw. At the short location, the screw head showed obvious signs of arcing, and wire damage at a second screw head (about 2 inches away) was observed, but there was no evidence of arcing.
   
   
2. Main Engine 3 hydrogen leak: early liquid oxygen depletion and shutdown.
   An early SSME shutdown resulted in a 16 feet per second under speed condition. The early shutdown was traced to a hydrogen leak in the number three main engine nozzle. Post-flight inspection revealed ruptures in the engine nozzle tubes caused by an impact of a loose liquid oxygen post deactivation pin. The liquid hydrogen leak resulted in the controller compensating for fuel loss with additional liquid oxygen flow, at 16 feet per second under speed. The deactivation pin was expelled during the engine start as pressure built in the liquid oxygen cavity (five seconds after engine start). Design changes were implemented to eliminate the need for deactivation pins.

SOURCES:

A) MER Report

B) Close Call

Both) Mission Report

STS-124     |     5/31/2008     |     Crew: 7     |     Related or Recurring event

SUMMARY:

Pad 39-A flame trench suffered significant damage causing about 3,500 refractory bricks to be blown away from the flame trench wall.

EVENT DESCRIPTION:

On May 31, 2008 during the launch of STS-124, the Pad 39-A flame trench suffered significant damage causing about 3,500 refractory bricks to be blown away from the flame trench wall. The bricks scattered away from the flame trench beyond the pad perimeter fence. This debris could have damaged the vehicle or the launch complex.

Pad generated debris is a concern for any spaceflight, due to the potential for debris to travel in a manner that can damage the vehicle or the launch complex.

SOURCES:

Kennedy Space Center Annual Report FY2008

Spray-on Layer to Protect Flame Trench

Debris Assessment Report

STS-95     |     10/29/1998     |     Crew: 7     |    Related or Recurring event

SUMMARY:

Drag chute door separated during launch and impacted main engine bell.

EVENT DESCRIPTION:

On October 29, 1998 during the main engine ignition sequence, the drag chute panel fell away from the vehicle.  Video of the launch confirmed the drag chute door detached three seconds prior to liftoff and hit the engine nozzle of Space Shuttle Main Engine (SSME) 1.

The remains of the door were found during a post-launch pad inspection, revealing that at least one aluminum shear pin used to attach the door sheared.  The root cause of the shearing was a combination of the high pressure environment caused by SSME ignition and a low margin hinge pin.  The drag chute  door struck the nozzle of the center main engine but did not do any appreciable damage to the engine or vehicle. Concerns about the status and condition of the chute contained in the drag chute compartment resulted in the decision not to deploy the chute during landing.

As a precautionary measure, two subsequent missions used a solid closeout panel bolted over the drag chute compartment and did not utilize the drag chute.  All flights following these missions used Inconel instead of aluminum as shear pin material.

SOURCES:

STS-95 Mission Archives

Space Shuttle Missions Summary

Mission Report

STS-116     |     12/10/2006     |     Related or Recurring event

STS-125     |     15/11/2009     |     Related or Recurring event

Debris from the flight vehicle or the launch facility poses a risk to all crewed space launches.

Other significant ascent debris events have occurred on:

STS-116:

On December 10, 2006, during ascent, booster trowelable ablative (BTA) around the solid rocket booster (SRB) left hand aft booster separation motor (BSM) nozzle liberated and was seen striking the bottom of the orbiter shortly after SRB separation began. The root cause of the observed debris liberation was determined to be stress buildup in the thermal protection system (TPS) and BTA closeout configuration at the aft BSM exit cone. The failure mechanism that produced the forward transport of the BTA was a hinging effect on the liberated BTA coupled with plume expansion at altitude, which projected the debris forward to where it struck the orbiter.

The BTA closeouts around the aft BSM nozzles were modified to eliminate the failure mechanism that caused the forward debris transport as well as limit the size and release angle of BTA liberated at SRB separation.

STS-125:

On May 11, 2009 during ascent the Wing Leading Edge Impact Detection System (WLEIDS) recorded two impacts on the starboard chine, which was confirmed by video imagery analysis.

Damage detected during on-orbit inspection was below the damage tolerance threshold.

SOURCES:

STS-116 Debris Report      |     STS-116 IDBR-01      |     STS-125 Debris Report      |     STS-125 MER Report      |     STS-125 Mission Report

Late Release Orbiter Tyvek Covers

During the ascent phase of:

STS-114      |      7/26/2005

STS-115      |        9/9/2006

STS-118      |        8/8/2007

STS-119      |      3/15/2009

STS-124      |      7/31/2008

STS-126      |    11/14/2008

The Tyvek covers for the reaction control system jets released later than intended. The late release resulted in the Tyvek reaching a higher velocity than designed, thus posing a higher risk of damage to the orbiter.

Tyvek covers were used to keep rain water and other debris out of the reaction control system jets while the shuttle was on the launch pad.

SOURCES:

STS-114 MER Report      |     STS-115 MER Report      |     STS-118 Debris Report

STS-119 MER Report      |     STS-124 MER Report      |     STS-124 Debris Report

STS-126 MER Report

Apollo 14     |     1/31/1971     |     Crew: 3

SUMMARY:

Multiple failed docking attempts. Contingency procedures developed to mitigate risk of recurring docking anomaly. Docking successful.

EVENT DESCRIPTION:

On January 31, 1971 six docking attempts were unsuccessful following translunar injection. On the seventh try the command module pilot was told to fire thrusters to hold the command module to the lunar module while the docking probe was retracted. The docking capture latches were triggered to fire the probe-retract pyrotechnic, and docking was successful. After docking, the drogue and probe were examined by the crew and appeared normal. No other issues arose with the docking mechanisms.

The most likely cause of the docking issue was a piece of debris or ice on the docking probe from rain water entering the boost shroud the day before launch. The mission would have been No-Go for lunar module separation and landing if a backup procedure for docking and retracting the docking probe in an emergency had not been developed.

SOURCES:

Mission Anomaly Report

Apollo 13     |     4/13/1970     |     Crew: 3     |     Loss of Mission

SUMMARY:

Explosion due to electrical short. Loss of O2 and EPS.

EVENT DESCRIPTION:

Apollo 13 launched on April 11, 1970.  On April 13, 1970 during trans-lunar flight at approximately 56 hours, one of the two Service Module oxygen tanks over-pressurized and exploded.  This caused the loss of oxygen in that tank and a leak of oxygen out of the remaining tank. This resulted in the loss of all three fuel cells, loss of the primary oxygen source, and the loss of electrical power to the Command Module (except for the entry batteries).  The mission was able to continue with the use of the Lunar Module, and the crew safely returned.

Prior to launch, the following conditions resulted in the oxygen tank failing during the mission: By design the cryogenic oxygen tank required both electrical heaters to maintain pressure, and fans to prevent stratification. The tank was a complex assembly with blind installation of the quantity probe, heater/fan assembly, and fill tube. This design leaves wiring insulation vulnerable to damage during assembly with no way to inspect after installation.  The Teflon insulated wiring, which is a combustible material in the oxygen tank, was in close proximity to the heater elements and fan.

The Apollo 13 tanks were originally installed on Apollo 11, but a change required the tanks to be removed. During removal of the oxygen shelf, one bolt was left in place causing the fixture to break and resulting in a two-inch drop of the shelf and tanks. Although a loosely fitting (due to loose specification tolerances) fill tube could have been displaced by this, all testing was passed. No cryogenic tests were performed which would have revealed the problem. During the Count Down Demonstration Test the oxygen tank could not be emptied by the normal means of pressurized oxygen gas due to a leak at the fill tube.  Instead, the tank heaters were turned on to boil off the oxygen in the tank. The thermostatic switches were rated for 30 volts direct current, but several years earlier the heater ground power supply voltage was raised to 65 volts to reduce the pressurization time. As the temperature increased the thermostatic switch opened and the higher voltage caused the contacts to weld closed. With the heaters continuously on, the temperature approached 1000 degrees and damaged the wire insulation, setting up the conditions for a short and ignition inside the tank. Ground personnel did not notice the continuous heater operation. During the prelaunch problem solving neither the Apollo Spacecraft Program Manager nor the Kennedy Director of Launch Operations knew the tank had previously been dropped or that the heaters had been on for eight hours.

SOURCES:

Apollo 13

Mission Report

Soyuz MS-09    |     8/30/2018     |     Crew: 3

SUMMARY:

OM cabin leak due to hole in the pressure shell.

EVENT DESCRIPTION:

On August 30, 2018 an unexpected cabin pressure decrease on ISS occurred. The crew’s investigation found a hole in the orbital module (OM) of the Soyuz. An epoxy patch was applied to the hole to prevent further leaking. An EVA was conducted on December 11 to examine the area and gather samples from the outside of the OM for further analysis on the ground.

SOURCES:

NASASpaceFlight Soyuz MS-09 article

ISS Increment 38     |     12/1/2013     |     Crew: 6

SUMMARY:

ITCS configuration errors resulted in near freezing and potential rupture of water-to-ammonia heat exchanger.

EVENT DESCRIPTION:

On December 11, 2013 the failure of a flow control valve in the pump module of the External Thermal Control System (ETCS) and subsequent Internal Thermal Control System (ITCS) reconfiguration led to a drop in water temperature to nearly freezing in the Columbus module's Moderate Temperature Heat Exchanger (MTHX).  If the water in the Interface Heat Exchanger (IFHX) had frozen, the expansion could have ruptured the barrier between the ITCS and the ETCS.  A rupture of this barrier could allow ammonia to enter the interior crew portions of the ISS, causing a potential loss of crew/loss of vehicle.

SOURCES:

Station Crew Removes Ammonia Pump     Anomaly Log

ITCS Heat Exchanger Close Call Case Study      Close Call Outbrief

Soyuz TMA-18 (22S)     |     9/23/2010     |     Crew: Soyuz 3, ISS 3

SUMMARY:

First attempt to separate from ISS failed; ISS crew succeeded in bypassing faulty sensor.

EVENT DESCRIPTION:

The first attempt to separate the Soyuz from ISS on September 23, 2010 failed. A hatch sensor on the Poisk docking port of the Zvezda module prevented hooks on the Poisk side from opening.

SOURCES:

News Report

ISS, Increment 17     |     4/30/2008     |     Crew: 3

SUMMARY:

Freon 218 leaked from SM AC.

EVENT DESCRIPTION:

On April 30, 2008 Freon 218 leaked from the Service Module air conditioner. The Russian [BMP] (Russian Microimpurities Removal System) was modified to allow for faster removal of the Freon 218.

SOURCES:

ISS Status Report

ISS, Increment 15     |     6/10-6/18/2007     |     Crew: 10

SUMMARY:

Power switch failures caused loss of ISS propulsive attitude control capability.

EVENT DESCRIPTION:

On June 10-18 2007 Russian computers that provide ISS propulsive attitude control [ТВМ], and Russian segment command and control capability [ЦВМ], experienced multiple automatic and manual restarts.  ISS attitude control was maintained by the docked shuttle (Atlantis STS-117/13A) while Russian specialists and US teams worked to restore consistent power to the computers.  The Russian cosmonauts were able to re-establish two of three computers on both systems ([ТВМ], [ЦВМ]) by June 18 after bypassing the secondary power circuitry to provide a continuous “ON” command.

Troubleshooting later identified the root cause to be an electrical short in the line resulting from corrosion of cabling within the Command Acquisition (Processing) Unit [БОК3] which monitors power.  The short caused a power-off command to be passed to all six computers.  The corrosion was presumed to be caused by increased humidity resulting from the close proximity of an air separator to the [БОК3]. The [БОК3] was subsequently relocated to a separate compartment.

If the Russian computers were unrecoverable, the failure could have resulted in the loss of ISS attitude control and loss of ISS.

SOURCES:

RS Knowledge Base Event 2369     ISS Part Record 2511      ISS Status Report

STS-117MCC Status Report     STS-117 NASA Facts

ISS, Increment 13     |     8/2006     |     Crew: 3

SUMMARY:

Triol coolant leak in SM.

EVENT DESCRIPTION:

In August 2006 during ISS Increment 13, about 150 grams of Triol coolant leaked from the Docking Compartment-1 Hydraulic Cooling Loop Connector in the Service Module. The crew cleaned and monitored the area throughout the day. No additional leaking was reported.

SOURCES:

ISS Daily Status Report

ISS, Increment 10     |     2/2005     |     Crew: 2

SUMMARY:

Potential acid preservative aerosol escape from Russian urinal.

EVENT DESCRIPTION:

In February 2005 during ISS Increment 10 an acid preservative aerosol escaped from the Russian urinal.

SOURCES:

ISS Daily Status Report

ISS, Increment 5&6     |     mid 2002-2/03     |     Crew: 3-10

SUMMARY:

Formaldehyde periodically exceeded long-term limits.

EVENT DESCRIPTION:

During ISS Increments 5 and 6, which spanned from mid-2002 until February 2003, formaldehyde levels onboard the station periodically exceeded the long-term limits.

SOURCES:

Portable Multigas Monitors for ISS

ISS, Increment 2-4     |     4/2001-3/2002     |     Crew: 3

SUMMARY:

Freon 218 leaked from SM AC.

EVENT DESCRIPTION:

During ISS Increments 2-4, which spanned from April 2001 until March 2002, Freon 218 leaked from the Service Module air conditioner.

Freon 218, a coolant fluid used in the air conditioning system, was found in cabin air quality samples after Zvezda was activated. The concentration of the Freon increased slowly once detected, but then rapidly as time passed. Peak concentrations reached over 600 mg/m3.

SOURCES:

Cabin Air Quality

Portable Multigas Monitors for ISS

ISS, Increment 4     |     2/2002     |     Crew: 3

SUMMARY:

MetOx regeneration caused noxious air.

EVENT DESCRIPTION:

During ISS Increment 4, February 2002, the United States Orbital Segment metal oxide canister regeneration caused the release of pollutants into the air.

SOURCES:

Portable Multigas Monitors for ISS

ISS Increment 2   |     8/2001     |     Crew: 3

SUMMARY:

Extremely high methanol levels in FGB air sample.

EVENT DESCRIPTION:

During August 2001 Functional Cargo Block [FGB] air samples contained extremely high methanol levels. The source of the methanol was never identified.

SOURCES:

Air Quality Assessment

Portable Multigas Monitors for ISS

STS-104    |     7/2001     |     Crew: 5

SUMMARY:

EMU battery leaked hazardous KOH. Discovered during EMU checkout.

EVENT DESCRIPTION:

During the first pre-extravehicular activity checkout of the July 2001 flight, an increased capacity extravehicular mobility unit (space suit) battery was discovered to have leaked hazardous potassium hydroxide. The leakage resulted in potassium hydroxide deposits on the contamination control cartridge, the water tank structure, and other locations on the primary life support system of the space suit.

SOURCES:

MER Report

Mission Report

ISS, Increment 2    |     4/24/2001     |     Crew: 10

SUMMARY:

Failure of all U.S. command and control computers on ISS.

EVENT DESCRIPTION:

On April 24, 2001 the ISS Command and Control (C&C) Multiplexer/Demultiplexer (MDM)-1 suffered hard drive errors that resulted in C&C-1 going offline.C&C-2 automatically switched from backup to primary mode, but suffered hard drive errors. C&C-3 was brought online but also failed. This resulted in complete loss of command and control to the United States orbital segment. C&C-2 was restored and placed into operation in primary mode. Flight controllers were able to uplink critical C&C software into the dynamic random access memory of C&C-3. C&C-3 was declared operational except the hard drive. C&C-1 was replaced with an identical payload computer.

If the MDMs were unrecoverable, the failure could have resulted in the loss of the United States orbital segment.

SOURCES:

Unlikely failures triggered computer shutdown     STS-100 NASA Facts     ISS PART MER Record 368

FMEA-CIL 18249      FMEA-CIL 7882

STS-99    |     2/2000     |     Crew: 6

SUMMARY:

High bacterial count in postflight sample after GIRA installed to removed iodine.

EVENT DESCRIPTION:

During the February 2000 flight, a high bacterial count of 160 colony forming units (CFUs)per 100 ml was discovered in a post-flight sample after the Galley Iodine Removal Assembly was installed to remove iodine. The level should have been less than 100 CFUs/100 ml.

SOURCES:

Mission Report

ISS, Flight 2A.1    |     5/1999     |     Crew: 7

SUMMARY:

Crew sickened in FGB; likely a result of high localized CO2 levels due to poor ventilation.

EVENT DESCRIPTION:

During ISS Flight 2A.1 in May 1999, the crew was sickened in the Functional Cargo Block [FGB], likely as result of high localized carbon dioxide levels due to poor ventilation. The evidence suggests that human metabolic products (carbon dioxide, water vapor, heat) were not being effectively removed from the crew member work area, and therefore caused the symptoms.

The number of crew members working in the [FGB] may also have contributed to the air quality issues.

Additionally, the flexible air duct running between the orbiter's Pressurized Mating Adapter 1 and the [FGB] may have contributed to poor air quality. The flexible air duct has a tendency to collapse with only minor incidental contact.

This duct was later redesigned to minimize the potential for collapse and restricted air flow.

SOURCES:

Toxicology Assessment     NASA Quest Space Team Online

Anomaly Report

X-15 3-65-97    |     11/15/1967     |     Crew: 1     |     Loss of Crew

SUMMARY:

Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.

EVENT DESCRIPTION:

On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.

The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive.  While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.

This was the first United States spaceflight fatality.

SOURCES:

Hypersonic Before the Shuttle

X-15 Inflight Breakup

Micheal J. Adams

SpaceShipOne 16P    |     9/29/2004    |     Crew: 1

SUMMARY:

Uncommanded vehicle roll. Control regained prior to apogee.

EVENT DESCRIPTION:

On September 29, 2004 SpaceShipOne performed a series of 60 rolls during last stage of engine burn.  SpaceShipOne coasted to 103 km of altitude and successfully completed the first of two X-Prize flights. The motor was shut down when the pilot noted that his altitude predictor exceeded the required 100 km mark.  During the motor burn the spacecraft began to roll uncontrollably, but the pilot continued despite advice from the ground to shut the motor down and abort the attempt.

The thin air at that altitude meant that the control surfaces didn't have enough air flowing over them, so they lost effectiveness to compensate for the roll as the spacecraft pointed nearly straight up.  The pilot needed to correct the rolling that occurred because of asymmetric thrust coming from the engine.

To correct the issue for the 17P flight, the amount of allowable “down pitch trim” was limited, to avoid the negative-lift condition. The solution was to more gently turn the corner, such that a forward correction later would not be needed. Pointing straight up at burnout was determined to be acceptable, as long as negative lift was not created. This problem was corrected on SpaceShipTwo.

SOURCES:

SpaceShipOne Flight Tests

SpaceShipOne Flight 16P

SpaceShipOne 14P    |     5/13/2004    |     Crew: 1

SUMMARY:

Flight computer unresponsive. Recovered by rebooting.

EVENT DESCRIPTION:

On May 13, 2004 the flight computer on SpaceShipOne became unresponsive.  During the boost following the vertical part of the trajectory, the avionics display flickered and went blank. The ground displays did not show an error.  The avionics display on SpaceShipOne came back on as soon as the motor shut down.

Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.

SOURCES:

SpaceShipOne Flight Tests

Altitude Chamber O2 Fire   |     3/23/1961    |     Crew: 1     |     Loss of Crew

SUMMARY:

Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.

EVENT DESCRIPTION:

On March 23, 1961 a cosmonaut in an altitude chamber was removing the sensors that had been attached to him during an experiment.  He cleaned the places where the sensors had been attached with cotton wool soaked in alcohol, and without looking threw away the cotton wool. The cotton wool landed on the ring of an electric hot plate in the oxygen-charged atmosphere of the chamber. In conditions of high oxygen concentration, normally non-flammable substances can burn vigorously. The cosmonaut's training suit caught fire. Unaccustomed to the vigor of high-oxygen fires, the cosmonaut would only have spread the flames further by attempting to smother them. The doctor on duty noticed the conflagration through a porthole and rushed to the hatch, which he could not open because the internal pressure kept the inward swinging hatch sealed. Releasing the pressure through bleed valves took several minutes and the cosmonaut later died in the hospital from the burns.

SOURCES:

Chapter 10 - Dead Cosmonauts

Navy Chamber   |     11/17/1962    |     Crew: 4     |     Crew Injury (4)

SUMMARY:

Fire started in a 100% oxygen environment at 5 psi. Four officers injured.

EVENT DESCRIPTION:

On November 17, 1962 four Navy officers were injured, two seriously, when a fire started in the altitude chamber they were occupying in a 20 day experiment at the U.S. Navy Air Crew Equipment Laboratory as part of a NASA atmosphere validation program.

The chamber contained 100% oxygen at 5 psi. The fire started when one officer changed a light bulb in an energized 24 volt DC light fixture. One wire in the fixture became disconnected resulting in arcing.  A cotton towel was used in an attempt to smoother the fire. The towel caught fire, and the flames spread to the officers' clothes.

SOURCES:

Apollo 1 Hearing

Mercury MA-9     |     5/16/1963     |     Crew: 1     |     Manual Entry

SUMMARY:

Electrical faults caused loss of some systems and need to perform manual entry. Also experienced high PPCO2  levels in suit during entry operations.

EVENT DESCRIPTION:

During the May 16, 1963 flight electrical faults caused the loss of some systems and the need to perform manual entry.  The alternating current power supply for the control system failed to operate, and it was determined that the pilot would have to make a manual retrofire and re-entry. He performed these maneuvers with close precision and landed a short distance from the prime recovery ship in the Pacific Ocean.

The malfunction during re-entry on MA-9 was traced to two connectors in an electrical amplifier.

SOURCES:

Mission Report

News Article

Faith 7

Project Review

Gemini 8       3/16-17/1966   |   Crew: 2   |   Emergency De-orbit     |     Loss of Mission

SUMMARY:

Stuck thruster caused loss of control and led to 1st U.S. emergency
de-orbit.

EVENT DESCRIPTION:

During the Gemini 8 flight from March 16 – 17, 1966  a stuck thruster, number 8, which controls roll, caused a loss of control and rapid spin rate of the capsule that could have led to the crew losing consciousness. To counter the effects the stuck thruster was turned off and the re-entry control system had to be used to stabilize the capsule. Use of the re-entry control system led the Gemini safety group to declare an end to the mission, which led to the first United States emergency de-orbit. The thruster apparently short circuited while attached to the Agena target vehicle.

SOURCES:

NSSDC Spacecraft Details

The Whirligig

Soyuz 1     |     4/23/1967     |     Crew: 1     |     Loss of Mission

SUMMARY:

Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.

EVENT DESCRIPTION:

After achieving orbital insertion on April 23, 1967 the left solar array of the Soyuz 1 spacecraft did not deploy, causing the spacecraft to receive only half of the planned solar power. Despite the solar array failure, the crew member attempted to maneuver the spacecraft. The attempt was unsuccessful because of interference between the reaction control system exhaust and the ion flow sensors.

The failure of the solar array to deploy also prevented the cover of the sun and star sensor from opening, preventing attitude control for crucial maneuvers such as spin stabilization and engine firings. The failures on Soyuz 1 prevented the launch of Soyuz 2, which had been scheduled to rendezvous and dock with Soyuz 1, causing the Soyuz 1 mission to be ended early.

Due to the failures with the control systems, the cosmonaut had to manually control the spacecraft for the critical de-orbit burn and entry while also managing the power supply of the crippled vehicle. (See also Soyuz 1 entry event)

SOURCES:

Soyuz 1

Tragic Tangle

The Mission of Soyuz 1

Soyuz 6     |     10/1969     |     Crew: 2

SUMMARY:

Low-pressure compressed arc welding experiment nearly burned a hole through the inner compartment flooring and damaged the hull of the OM.

EVENT DESCRIPTION:

While testing the low-pressure compressed arc welder portion of the Vulkan Welding Unit in the depressurized orbital module, the welder nearly burned a hole through the inner compartment flooring and damaged the hull of the orbital module.

SOURCES:

NASA Astronauts on Soyuz

Soyuz 21     |     8/24/1976     |     Crew: 2

SUMMARY:

Separation from Salyut failed; ground command succeeded in opening latches.

EVENT DESCRIPTION:

On August 24, 1976 separation from Salyut failed.  Prior to the latches being fully open, the latches gave a false 'open' indication, leading to the premature firing of the Soyuz separation thrusters and jamming the latches partially open. The Soyuz remained loosely attached to the station until ground control was able to send commands to the latches, forcing them open.

SOURCES:

NASA Astronauts on Soyuz

Soyuz Landing Reliability Study

PRA on Soyuz Spacecraft as ACRV

Soyuz 23     |     10/16/1976     |     Crew: 2     |     Loss of Mission

SUMMARY:

Mission Abort due to docking failure.

EVENT DESCRIPTION:

The Soyuz 23 mission launched on October 14, 1976.  Its primary mission was to dock to the Saylut 5 space station to conduct crewed operations aboard the station.  However, docking to the Salyut 5 space station was unsuccessful due to the failure of the automated rendezvous system.  Sensors used by the automatic system indicated an incorrect lateral velocity, causing unnecessary firing of the thrusters during rendezvous.  The automatic system was turned off, but no fuel reserves remained for a manual docking attempt with the Salyut 5.  The mission was aborted, and low spacecraft battery reserves forced the crew to return early.  Upon re-entry/landing the capsule landed in a lake during a snow storm, delaying crew recovery (see Soyuz 23 landing event).  The crew was recovered on October 16, 1976.

SOURCES:

Mir Hardware Heritage

Soyuz 23

Soyuz 33     |     4/12/1979     |     Crew: 2     |     Loss of Mission

SUMMARY:

Main engine anomaly caused final rendezvous abort.

EVENT DESCRIPTION:

On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)

SOURCES:

Mir Hardware Heritage

Soyuz 33

STS-2     |     11/21/1981     |     Crew: 2     |     Minimum Duration Flight     |     Crew Injury

SUMMARY:

Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.

EVENT DESCRIPTION:

During the flight of STS-2, which spanned from November 12 – 14, 1981, fuel cell failure led to the declaration of a minimum duration flight (MDF). In addition to the MDF, the failure of the fuel cell also led to high hydrogen levels in the drinking water. The fuel cells used produce drinking water as a by product. When the crew drank this water it provoked a need to belch.  Belching in zero g leads to regurgitation. The crew avoiding drinking the water in order to avoid belching, which caused crew dehydration. Prior to entry, crew members fluid load to offset fluid shift when returning from orbit. The crew dehydration increased the effects of the fluid shift and could have posed a risk during high g entry procedures due to a higher chance for loss of consciousness.

SOURCES:

Oral History Report

Space Shuttle Missions Summary

MER Report

Mission Report

STS-9     |     12/8/1983     |     Crew: 6

SUMMARY:

Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.

EVENT DESCRIPTION:

On December 8, 1983 about five hours prior to the planned landing time, the orbiter's General Purpose Computer (GPC) 1 failed when the primary Reaction Control System jets were fired. About six minutes later GPC 2 also failed, leaving the orbiter in free drift for approximately five minutes before GPC 3 was brought online in OPS 3 entry mode (GPC 3 had been freeze dried for on-orbit operations). Attempts to bring GPC 1 back online were unsuccessful, and it was powered down.

Although problems had occurred, GPC 2 was reinitialized and placed back online, and GPCs 2, 3, 4, and 5 were configured for entry. This off-nominal configuration led to further problems, and delayed the landing time by about eight hours. Entry was set up without GPC 1, and upon landing GPC 2 failed again. Particle Impact Noise Detection testing was instituted to screen out any contamination of the GPC boards, and a spare GPC was flown for several flights after STS-9, but was later dropped as a requirement.

SOURCES:

Space Shuttle Mission Summary

Mission Report

MER Report

Close Call

STS-32     |     1/9/1990     |     Crew: 5     |     Loss of Attitude Control

SUMMARY:

Erroneous state vector up-linked to flight control system, causing immediate and unpredictable attitude control problems.

EVENT DESCRIPTION:

An erroneous state vector up-linked to the flight control system on January 9, 1990 causing immediate and unpredictable attitude control problems.

At 17:23:46:51 Greenwich Mean Time, during a crew sleep period, a state vector update was commanded by the ground prior to the loss of signal. The uploaded state vector was erroneous, and the orbiter began to execute a multi-axis rotation at three degrees per second with a number of thruster firings. The rotation continued until the acquisition of signal period, about 10 minutes later, when the crew was awakened and instructed to switch to manual Digital Auto Pilot to arrest the unwanted rates. A good state vector was then uplinked.

SOURCES:

Close Call

Mission Report

STS-44     |     11/24/1991     |     Crew: 6     |     Minimum Duration Flight

SUMMARY:

Failure of IMU 2 caused MDF to be declared. 10-day mission shortened to 7 days.

EVENT DESCRIPTION:

Failure of Inertial Measurement Unit (IMU) number 2 on November 24, 1991 caused minimum duration flight to be declared.  The 10-day mission was shortened to seven days. In an attempt to recover normal operation of the IMU, it was placed in standby, operate, and then power cycled. These actions were not successful. Failure of this IMU invoked a flight rule requiring minimum duration flight for loss of one IMU.

Post-flight troubleshooting in the Inertial Systems Laboratory at Johnson Space Center isolated the problem to a failed computer interface card. This card converts analog acceleration signals into digital signals. The failed card was sent to the manufacturer for further analysis which revealed that a filter capacitor (C14), located within a chopper-stabilized amplifier hybrid component (U12) in the Z-accelerator channel, had shorted. This short circuit caused a bond wire from U12 pin 9 to the card case to fuse open.

SOURCES:

Space Shuttle Missions Summary

Mission Report

MER Report

STS-51     |     9/12/1993     |     Crew: 5

SUMMARY:

Both port-side primary and secondary SUPER*ZIP explosive cords fired, resulting in containment tube failure and damage in the payload bay.

EVENT DESCRIPTION:

On September 12, 1993 the STS-51 mission commands intended to initiate the primary SUPER*ZIP explosive cord resulted in the simultaneous firing of both the primary explosive cord and back-up explosive cord. This simultaneous explosive cord firing resulted in the rupture of a SUPER*ZIP containment tube and release of contaminants and high-energy debris into the orbiter cargo bay. The orbiter sustained damage to blankets, wire tray covers, the 1307 bulkhead, and Thermal Protection System tiles. If debris had hit critical items it could have resulted in a loss of the orbiter and crew.

SOURCES:

Lessons Learned

Mission Report

STS-83     |     4/6/1997     |     Crew: 7     |     Loss of Mission

SUMMARY:

Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.

EVENT DESCRIPTION:

A failure of fuel cell (FC) number two resulted in a minimum duration flight being declared on April 6,1997. The 16-day mission was reduced to four days due to FC problems encountered on flight day two. During prelaunch operations the differential voltage on FC 2, substack 3 remained above the 150mV limit (defined in the Operations and Maintenance Requirements Specification Document) for an unusually long period of time before dropping below 150 mV. The substack delta voltage began to trend upward shortly after on-orbit operations began at approximately two hours Mission Elapsed Time. FC purges were ineffective at stopping the trend.  FC 2 was subsequently shut down and safed to prevent the possibility of a crossover condition, and multiple payloads had to be powered down. FCs 1 and 3 continued to carry the total orbiter load and performed nominally.

Post-flight failure analysis of FC 2 did not identify a root cause for the on-orbit anomaly experienced, but did identify degraded cells and verified the cell performance monitor (CPM) was functioning properly. No foreign material/contaminant was found and the most credible scenario implies an abnormal external event affected a group of cells prior to start–up. It has been hypothesized that this external event was the presence of oxygen in the oxygen side of substack 3 of the FC at a time when the FC was supposed to be inerted with helium. This event over time would cause oxidation of the nickel Electrolyte Reservoir Plate and dissolution of palladium and platinum in the anodes. Migration and plating of the palladium onto the cathode catalyst would cause high open circuit voltage once full reactants are applied to the FC.

As a result of this anomaly and failure analysis, the Launch Commit Criteria was revised to not allow launching with an FC showing similar prelaunch CPM readings. Kennedy Space Center FC purge procedures were also modified to preclude the potential for the presence of oxygen in inerted fuel cells. The program also designed and tested a fuel-cell monitoring system (FCMS) which finally provided individual cell-health monitoring capability (STS-87 first flight). If the FCMS had been available for STS-83, it may have precluded the shutdown of the FC and may have allowed the mission to complete its planned duration.

SOURCES:

Space Shuttle Missions Summary

Mission Report

MER Report

Corrective Action Record

Mir     |     7/17/1997     |     Crew: 3

SUMMARY:

Accidental unplugging of computer power cable led to loss of attitude control and loss of power.

EVENT DESCRIPTION:

On July 16, 1997 a cosmonaut inadvertently unplugged a central computer power cable while disconnecting cables for upcoming repairs of the Spektr module. The temporary loss of power caused the central computer to shut down, resulting in the loss of attitude control and Mir going into free drift. In free drift the Mir was unable to accurately point its solar arrays to provide sufficient power. Once in free drift, the ground and flight crew failed to turn off equipment to reduce power demand, which resulted in depletion of stored energy in the flight batteries and complete loss of power on Mir.

The Progress M-35 supply spacecraft was used to reorient the Mir to restore nominal solar array power generation, recharge flight batteries, and subsequently restore Mir attitude control functions.

SOURCES:

Crew Accidentally Pulls Plug on Mir

Mir Loses all power after accident

STS-87     |     11/27/1997     |     Crew: 6

SUMMARY:

Spartan satellite deployed without proper activation.

Recapture with RMS unsuccessful. Later captured by EVA crew.

EVENT DESCRIPTION:

Deployment of the SPARTAN satellite on November 21, 1997 occurred without proper activation.

A crew input via the Payload and General Support Computer was not received by the spacecraft. Lack of telemetry and onboard verification procedures left this condition undetected by the Mission Control Center and flight crew. The SPARTAN was grappled with the Remote Manipulator System, removed from the Release/Engage Mechanism, and released per the flight plan.

The missed command step resulted in the failure of the SPARTAN to execute an expected preprogrammed maneuver ("pirouette") about 2.5 minutes after deploy. Attempts to re-grapple the SPARTAN after the deployment were unsuccessful. A previously scheduled extravehicular activity (space walk) had to be changed to manually recapture the satellite.

SOURCES:

Space Shuttle Missions Summary

Mission Report

Investigation Report

STS-95     |     10/29/1998     |     Crew: 7

SUMMARY:

Preflight sterilization process chemically altered the Low Iodine Residual System resulting in contaminated drinking water.

EVENT DESCRIPTION:

During STS-95 on October 29, 1998 the preflight sterilization process chemically altered the Low Iodine Residual System (LIRS) resulting in contaminated drinking water.

The crew reported the water from the galley with the LIRS installed had a bad taste. Samples of the water were taken post-flight for analysis. The LIRS was removed. A purge of the LIRS water from the galley plumbing was conducted. After the purge the Galley Iodine Removal Assembly was reinstalled and the crew reported that the water taste was normal after the change-out of hardware.

The bad tasting water could have led to possible crew dehydration due to the crew drinking less water.

SOURCES:

Space Shuttle Missions Summary

Mission Report

Apollo 11     |     7/21/1969     |     Crew: 2

SUMMARY:

Engine arm circuit breaker knob broke off. Circuit breaker successfully reset allowing ascent.

EVENT DESCRIPTION:

On July 21, 1969 while preparing for extravehicular activities, the engine arm circuit breaker broke, probably due to an impact from the oxygen purge system. A felt tipped pen was used to successfully depress the circuit breaker when needed. Circuit breaker guards were installed on Apollo 12 and subsequent vehicles to prevent the oxygen purge system from impacting the circuit breakers.

SOURCES:

Mission Report

Apollo 10     |     5/22/1969     |     Crew: 2

SUMMARY:

Switch misconfiguration resulted in lunar module control problems.

EVENT DESCRIPTION:

In May 22, 1969  a switch misconfiguration resulted in lunar lander control problems.

During the Lunar Module (LM) last pass, within eight miles of the moon and prior to the jettison of the LM Descent Stage, the Commander (while wearing a space suit) started to troubleshoot an electrical anomaly.

The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.

The attitude indicator was going to the red zone and in danger of tumbling the inertial platform.  The Commander was able to grab the hand controller, switch to manual control, jettison the Descent Stage, control the LM Ascent Stage, and finally dock with the CSM.

SOURCES:

Apollo 10

Flight Evaluation Report

Mission Report

Salyut 7     |     1985     |     Crew: 3     |     Crew Illness

SUMMARY:

One returned with visiting crew due to medical condition.

EVENT DESCRIPTION:

Because a crew member became ill, the crew of Salyut 7 modified crew operations and ultimately departed the station on November 13, 1985, prior to full mission completion which would have occurred on November 21, 1985.

SOURCES:

Mir Hardware Heritage

Mir EO-2     |     7/24/1987     |     Crew: 2     |     Crew Illness

SUMMARY:

One crew member replaced early due to medical condition.

EVENT DESCRIPTION:

On July 24, 1987 during the Mir Principle Expedition 2 (EO-2) one crew member was diagnosed with a heart problem by ground-based doctors and returned to Earth early.

SOURCES:

Mir Hardware Heritage

Salyut 5     |     8/25/1976     |     Crew: 2     |     Crew Illness

SUMMARY:

Early return of crew due to health effects from suspected toxic gases in space station.

EVENT DESCRIPTION:

The Salyut 5 initial crew departed the station early, using Soyuz 21, on August 25, 1976. This was attributed to various causes including fire, environmental system failure, and crew health problems caused by fumes from chemicals used to develop film from the station's surveillance cameras. The subsequent mission crew (Soyuz 24) entered the station wearing protective breathing masks due to the potential contamination.

SOURCES:

Mir Hardware Heritage

STS-133     |     2/26/2011     |     Crew: 6     |     Related or Recurring event

SUMMARY:

Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.

EVENT DESCRIPTION:

On February 26, 2011 STS-133 experienced significant misalignment between the orbiter and the ISS during post-capture free drift due to gravity-gradient-induced motion.

There were significant oscillations between the orbiter and ISS on STS-133 during final ring retraction.  The orbiter tipped approximately 10 degrees in pitch and four degrees in roll while ring retraction was paused. The time from contact to hardmate took 50 minutes.

Post-flight analysis of STS-133 docking operations raised several concerns, including vehicle-to-vehicle clearance, mechanism-to-mechanism contact, ISS free drift risks (longeron shadowing risk), timeline impacts, and the lack of a good integrated analysis tool.

At the Generic Joint Operations Panel on April, 6 2011 it was stated that the docking mechanism fixers will be used to maintain alignment during retraction.  Engineering and safety agreed with the recommendation. The docking procedures were updated prior to STS-134/ULF6.

SOURCES:

Mission Report

JOP Minutes

STS-130     |     2/10/2010     |     Crew: 6     |     Related or Recurring event

SUMMARY:

Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.

EVENT DESCRIPTION:

On February 10, 2010 there were significant oscillations between the orbiter and ISS on STS-130 during final ring retraction, requiring an additional 34 minutes in free drift to complete docking.  Similar oscillations were observed during STS-133 docking.

Post-flight analysis from the STS-130 event indicated that the oscillations were caused by gravity gradient effects on the integrated vehicle stack (ISS/Shuttle) resulting in misalignment of the final docking ring and loss of the “RING ALIGN” indication. When the “RING ALIGN” indication is lost, the fixers are released, resulting in large misalignments.

Concern for ISS longeron shadowing and lack of data resulted in the Missions Operations Directorate not accepting the recommendation to rely on the fixers to maintain the alignment even after loss of “RING ALIGN” until after STS-133.

SOURCES:

Mission Report

JOP Minutes

Soyuz T-8     |     4/22/1983     |     Crew: 3     |      Loss of Mission     |     Related or Recurring event

SUMMARY:

Loss of rendezvous antenna prevented docking.

EVENT DESCRIPTION:

On April 20, 1983 the loss of rendezvous antenna prevented docking.

The Soyuz rendezvous radar antenna failed to deploy properly before docking attempts with Salyut 7. Several attitude control maneuvers at high rates were attempted but failed to swing the boom out. A rendezvous using only an optical sight and ground radar inputs for guidance was attempted, but was aborted when it was thought the vehicles were closing too fast. No further attempts were made to dock with the station.

The post-flight inquiry later discovered that the antenna was torn off when the Soyuz payload shroud separated.

SOURCES:

Cosmonaut Biography

Mir Hardware Heritage

Skylab 2     |     5/26/1973     |     Crew: 3     |     Related or Recurring event

SUMMARY:

Multiple failed automatic docking attempts resulted in manual docking to Skylab.

EVENT DESCRIPTION:

On May 26, 1973 numerous failed docking attempts resulted in the use of contingency in-flight procedures to bypass the automated docking system. Successful docking to the Skylab station ultimately relied on manual control and crew piloting skills.

The contingency procedure required the Skylab 2 crew members to don pressure suits, depressurize the command module cabin, open the tunnel hatch, cut wires in the probe, and connect the emergency probe-retract cable using a utility power outlet. The crew members were able to fire the probe-retract pyrotechnic and complete docking manually.

The failure to dock would have resulted in the loss of Skylab due to the inability to perform critical repairs.

SOURCES:

Skylab 2

Skylab 1-2 Technical Debrief

Living and Working in Space: A History of Skylab

Soyuz 10     |     4/23/1971     |     Crew: 3     |      Loss of Mission     |     Related or Recurring event

SUMMARY:

Automatic docking system failed. Manual docking with Salyut not achieved.

EVENT DESCRIPTION:

On April 23, 1971 during automatic approach to Salyut, the Soyuz began to oscillate. The crew went to manual control and was able to complete mechanical capture. During retraction of the probe, the engines began firing because the Soyuz control system was still active. This caused damage to the docking mechanism, which stopped the probe retraction and prevented the Soyuz from completing docking to the Salyut. The crew was instructed to reconfigure cables which allowed them to send a command to release the probe's capture latches. Soyuz was released, and landing occurred on April 25.

SOURCES:

Soyuz 10

Soyuz 15     |     8/28/1974     |     Crew: 2     |      Loss of Mission     |     Related or Recurring event

SUMMARY:

Failed to dock with Salyut 3 due to Igla system malfunction.

EVENT DESCRIPTION:

The Soyuz 15 mission launched on August 26, 1974. Its primary mission was to dock to the Saylut 3 military space station to conduct the second phase of crewed operations aboard the Salyut 3 space station.  However, docking to the Salyut 3 space station was unsuccessful due to the failure of the Igla rendezvous system and the inability to complete docking in manual mode.  Due to this inability to dock, as well as spacecraft battery power limitations, the Soyuz crew was forced to abandon the mission and return to Earth within two days of launch.  Gyroscope problems nearly prevented orientation of the spacecraft for the de-orbit burn.  After landing, the crew was recovered on August 28, 1974.

The state commission found that the Soyuz Igla docking system needed serious modifications which could not be completed before the Salyut 3 space station decayed beyond a useable orbit. Therefore, the planned Soyuz 16 spacecraft became unnecessary to the program. (It was later flown as Soyuz 20 to a civilian Salyut station, even though it exceeded its two-year rated storage life.)

SOURCES:

Mir Hardware Heritage

Soyuz 15

Mir     |     6/25/1997     |     Mir Crew: 3     |      Loss of Mission     |     Related or Recurring event

SUMMARY:

Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.

Mir Crew: 3

Loss of Element

EVENT DESCRIPTION:

On June 25, 1997 Progress M-34 collided with the Mir Spektr module rupturing the module. The crew of Mir had to cut through cables in the hatchway in order to seal off the leaking module from the rest of the station.

SOURCES:

Michael Foale

Progress Collision with Spektr

Mir-Progress Collision with Spektr

Mir     |     8/30/1994     |     Mir Crew: 2     |     Related or Recurring event

SUMMARY:

Progress M-24 collided with Mir during second docking attempt.

Collision

EVENT DESCRIPTION:

On August 30, 1994 during the second attempt of the Progress M-24 to dock with Mir, the Progress collided with Mir's forward docking unit two to four times, and then drifted away from the station. The docking problems with Progress M-24 have been variously attributed to software or Kurs electronics failures on Progress M-24, or the failure of control equipment in the Moscow Mission Control Center.

SOURCES:

Mir Hardware Heritage

Mir     |     8/30/1994     |     Crew: Soyuz 2, Mir 3     |     Related or Recurring event

SUMMARY:

Soyuz TM-17 collided twice with Mir during undocking.

Collision

EVENT DESCRIPTION:

On January 14, 1994 during the post-separation inspection fly-around of Mir, the crew lost manual translation control due to a configuration error. The loss of control led to the Soyuz colliding with Mir several times. The cause of the collision was traced to the hand controller in the orbital module which governed braking and acceleration being switched on, disabling the equivalent hand controller in the descent module.

SOURCES:

Mir Hardware Heritage

M21-D21     |     7/30/1966     |     Crew: 2     |     Loss of Crew

SUMMARY:

D21 drone collided with M21 during launch, causing M21 breakup. Crew survived breakup but one was lost after water landing.

EVENT DESCRIPTION:

On July 30, 1966 as the M-21 mothership was performing a flight test for launching the D-21 drone, while traveling at high Mach speeds the drone was not able to penetrate the shock wave coming off the mothership. The D-21 had almost cleared the rudders of the M-21 when the drone bounced off the shockwave and pitched down, striking the M-21 and breaking it in half. The Pilot and Launch Control Officer (LCO) stayed with the tumbling wreckage of the plane a short time until a lower altitude was reached, then ejected over the Pacific Ocean.

Both crew members made safe ejections and landings, but after landing the LCO opened his helmet visor by mistake and his suit filled with water, causing him to drown. All subsequent flights of the D-21 were as D-21Bs, which were reconfigured to launch the drone from an under wing pylon of a B-52 (much like the X-15 had been), boosted to Mach 3 by a rocket motor that was jettisoned after the D-21Bs Marquardt ramjet was started.

SOURCES:

Loss of M-21 and D-21

SR-71     |     7/30/1966     |     Crew: 2     |     Loss of Crew (1)

SUMMARY:

Loss of control at high speed and altitude.

EVENT DESCRIPTION:

On January 25, 1966 the SR-71 aircraft disintegrated during a high-speed, high-altitude test flight when the breakdown of super sonic airflow resulted in engine cutoff (also known as engine un-start). This occurred during a turn at speeds exceeding Mach 3.17 and a bank of 35 degrees. The bank immediately increased to 60 degrees. The nose pitched up and the aircraft broke apart. The pilot was thrown clear (his ejection seat never left the plane). He blacked out during the accident, but recovered and landed on the ground safely. His Reconnaissance System Officer did not survive the high-g bailout.

SOURCES:

Blackbird Losses

SpaceShipTwo PF04     |     10/31/2014     |     Crew: 2     |     Loss of Crew (1)

SUMMARY:

Vehicle breakup during powered flight.

EVENT DESCRIPTION:

On October 31, 2014 shortly after separating from the WhiteKnightTwo carrier aircraft, the SpaceShipTwo vehicle broke apart resulting in the loss of one crew member. A National Transportation Safety Board investigation into the accident is ongoing.

SOURCES:

NTSB Aerospace Accident Report

FAA Press Release - Statment on SpaceShipTwo Incident

SpaceShipOne Flight 11P     |     10/31/2014     |     Crew: 1

SUMMARY:

Left main landing gear collapsed.

EVENT DESCRIPTION:

A nominal landing pattern was flown on December 17, 2003. However, touchdown caused the left main gear to collapse, and the vehicle rolled to a stop off the runway in the soft sand.

SOURCES:

SpaceShipOne Flight Tests

Mercury MA-7     |     5/24/1962     |     Crew: 1

SUMMARY:

RCS depletion at 80,000 ft.

EVENT DESCRIPTION:

This incident on May 24, 1962 involved the use of double authority control and the accidental actuation of the fly-by-wire high thrust units during certain maneuvers. The manual-system fuel was depleted near the end of the retrofire maneuver, and the automatic-system fuel was depleted at about 80,000 and 70,000 feet. Because of the early depletion of automatic-system fuel, attitude control during re-entry was not available for the required duration. Attitude rates built up after the Automatic Stabilization Control System became inoperative because of the lack of fuel, and these rates were not sufficiently damped by aerodynamic forces. The pilot chose to deploy the drogue parachute manually at an altitude of approximately 25,000 feet to stabilize the spacecraft.

To avoid the same situation on later flights, Mercury MA-8 and subsequent spacecraft contained a switch which allowed the pilot to disable and reactivate the high-thrust units at his discretion. An automatic override reactivated these thrusters just prior to retrofire. Additionally, a revision of fuel management and control training procedures was instituted for subsequent missions

SOURCES:

Mercury 7 Description & Analysis

Spacecraft Performance

Flight of Aurora 7

Apollo ASTP     |     7/24/1975     |     Crew: 3     |     Crew Injury

SUMMARY:

N2O4 in crew cabin. Crew hospitalized for 2 weeks.

EVENT DESCRIPTION:

On July 24, 1975 as the spacecraft descended, the commander, who was reading the checklist, failed to tell the command module pilot to move the Earth Landing System auto/manual switch to auto. The crew saw that the spacecraft was well below the deployment altitude and proceeded to manually deploy the chutes. Drogue chutes were deployed manually at 18,550 feet instead of 23,500 feet as the automatic system would have done. At 10,000 feet the commander realized that ELS was not in AUTO and quickly switched ELS Logic and AUTO, deploying the main parachutes at 7,150 feet and disabling the RCS instead of 10,500 feet.. The Reaction Control System (RCS) was not disabled manually (RCS command switch turned to “off”) at this time.  It was disabled manually at 16,000 feet instead of when the checklist indicated at 24,000 feet. The cabin pressure relief valve opened automatically at 24,500 feet.

During a 30-second period of high thruster activity after drogue parachute deployment, a mixture of air and propellant combustion products followed by a mixture of air and nitrogen tetroxide oxidizer (N2O4) vapors were sucked into the cabin. One of the positive roll thrusters is located only two feet away from the steam vent that pulls in outside air when the cabin relief valve is open. This exposed the crew to a high level of N2O4 since emergency oxygen masks were not available until landing. The pilot passed out, but the commander quickly put the oxygen mask on him and he was revived.  The exposure resulted in a two-week hospital stay for the crew after landing.

SOURCES:

Asynchronicity

Apollo Soyuz Mission Anomaly Report

July 24th - Last Splash

Soyuz TM-25     |     8/17/1997     |     Crew: 3

SUMMARY:

Landing rockets fired at heat shield separation rather than at landing.

EVENT DESCRIPTION:

On August 17, 1997 the landing rockets on Soyuz TM-25 fired during heat shield separation rather than during landing. This failure resulted in a harder landing than normal.

The Mir with the docked Soyuz was experiencing high humidity levels in the atmosphere. Water condensing on the connectors in the Soyuz electrical box controlling the circuit probably caused a short circuit, which caused the rockets to fire when the system was armed at heat shield physical separation. Changes were made to either seal the connectors or separate the connectors to prevent a short from applying electrical power to the rockets when the system is armed.

The design has two primary types of inhibits. One inhibit consists of three mechanical switches that physically disconnect the firing circuit when the heat shield is attached. These switches are spring loaded and move approximately 20 mm as the heat shield is deployed to close the firing circuit. A minimum of two out of three switches must be closed for the initiating system to function. In addition to these mechanical inhibits, logic in the electronics prevents the ignition command from being sent until after the heat shield is deployed. Nominally the soft landing motors are ignited when the gamma ray altitude/velocity sensor detects proximity to the ground. The system automatically initiates either four or six motors depending on the velocity. Each motor has 1 kg of propellant and burns for approximately 0.1 to 0.14 seconds.

SOURCES:

Soyuz TM-25

Soyuz MS-02     |     4/10/2017     |     Crew: 2

SUMMARY:

DM leak due to damage from parachute deployment.

EVENT DESCRIPTION:

On April 10, 2017 during parachute deployment, a buckle struck the descent module causing a partial depressurization 8 kilometers above the landing site.

SOURCES:

SPACENEWS Soyuz MS-02 Article

​Related or Recurring event

In addition to three overheating/fire events on the ISS and two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:

Mir (October 1994) (A)

STS-40 (June 1991) (B)

STS-35 (December 1990) (C)

STS-28 (August 1989) (D)

STS-6 (April 1983) (E)

Salyut 7 (September 1982) (F)

Salyut 6 (1979) (G)

Salyut 1 (June 1971) (H)

SOURCES:

B-E) Portable Multigas Monitors for ISS

A, F-H) Russian Space Fires

H) Descent into the Void

H) Rockets and People IV "The Moon Race"

​Related or Recurring event

On February 24, 1997 after replacing the Solid Fuel Oxygen Generator (SFOG) cartridge a fire ignited onboard the Mir space station. After becoming aware of the fire, the crew donned oxygen mask and gathered fire extinguishers. The flames blocked the emergency path to one of the docked Soyuz capsules preventing half of the 6 member crew from evacuating if the need arose. The foam fire extinguishers eventually doused the flames before an evacuation of the station was needed. The proximate cause of the fire is thought to be a piece of latex glove that contaminated the Lithium Perchlorate canister during ground operations.

SOURCES:

The Fire - News Release

Russian Space Fires

Portable Multigas Monitors for ISS

​Related or Recurring event

On February 26, 1998 the Russian Micropurification Unit [BMP] onboard the Russian Mir space station overheated and caused the level of carbon dioxide to climb to health-threatening levels.

SOURCES:

Portable Multigas Monitors for ISS

​Related or Recurring event

On October 10, 2008 the crew reported smoke and odor emitting from the Russian condensate water processor unit [SRV-K].  The equipment housing was hot.  When the air quality was tested using the Compound Specific Analyzer-Combustible Products (CSA-CP), carbon dioxide was found at five parts per million and acid gases, hydrogen chloride and hydrogen cyanide, were zero.  The [SRV-K] was powered off and replaced, which resolved the issue.

On September 18, 2006 the crew reported smoke and a solvent smell.  The Elektron was found to have released toxic byproducts. The CSA-CP registered carbon dioxide at seven parts per million and hydrogen chloride and hydrogen cyanide above one part per million.

In March 2005 an electrical odor was traced to a lamp on the Service Module.

SOURCES:

Portable Multigas Monitors for ISS

Mercury MA-6     |     2/20/1962     |     Crew: 1

SUMMARY:

False landing-bag indicator light led to entry with retropack in place as a precaution.

EVENT DESCRIPTION:

On February 20, 1962 a sensor indicated the heatshield was in an unlatched condition while still in orbit. If the sensor's reading were true, the heatshield could have been lost during entry, resulting in the loss of the vehicle and crew. Because the indictor said the heatshield had been dropped to the landing position, entry procedures were changed to eliminate the jettisoning of the retropack. The retropack was used as a redundant heatshield hold-down device to keep the heatshield in place. The straps holding the retropack burned through during entry, but it was thought that the aerodynamic pressure would hold the heatshield in place. After landing it was discovered that the indicator was incorrect and that the heatshield had not been dropped to the landing position.

SOURCES:

Project Review

An American in Orbit

Mission Report

Mercury MA-7     |     5/24/1962     |     Crew: 1

SUMMARY:

Pitch horizon scanner failed, resulting in manual entry and off-target landing. Delayed crew recovery.

EVENT DESCRIPTION:

On May 24, 1962 the failure of the spacecraft pitch horizon scanner required the pilot to assume manual control of the spacecraft for retrofire. As a result, the spacecraft attitude was outside of the recommended range for automatic initiation of the retrofire signal. Manual initiation of the retrofire signal occurred several seconds later than scheduled.

The delay in retrofire initiation and the less-than-ideal spacecraft attitude contributed to the spacecraft landing 250 nautical miles downrange of the intended landing point which delayed crew recovery.

SOURCES:

Mercury 7 Description and Analysis

Spacecraft Performance

Flight of Aurora 7

Voskhod 2     |     3/19/1965     |     Crew: 2

SUMMARY:

Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.

EVENT DESCRIPTION:

On March 19, 1965 a malfunction of the automatic descent system resulted in the use of a backup manual system for entry and landing. Difficulties encountered during manual operation and delayed retrofiring resulted in the spacecraft landing more than 1,000 km downrange from the intended landing point. The wooded, mountainous terrain caused a delay in crew recovery. (Actual distance of overshoot varies in the source documents, but most sources indicate a distance between 1,000 km and 2,500 km.)

SOURCES:

Voskhod 2 Report

The Voskhod 2 mission revisited

The Nighmare of Voskhod 2

Gemini 4     |     6/7/1965     |     Crew: 2

SUMMARY:

Erroneous entry data uplinked; crew manually corrected entry flight profile.

EVENT DESCRIPTION:

On June 7, 1965 the computer could not be updated for entry, could not be turned off, and then stopped working entirely. The crew resorted to a rolling Mercury-type entry, rather than the lifting bank angle the computer was supposed to help them achieve.

SOURCES:

Four Days and a "Walk"

Gemini 4 Computer Report

Gemini 5     |     8/29/1965     |     Crew: 2

SUMMARY:

Erroneous entry data uplinked; crew manually corrected entry flight profile.

EVENT DESCRIPTION:

During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.

SOURCES:

The Covered Wagon

Mission Report

Apollo AS-201 Test     |     2/26/1966     |     Crew: 0

SUMMARY:

Electrical short at separation resulted in RCS commands being sent to the Service Module, causing loss of RCS control

EVENT DESCRIPTION:

During the Apollo Saturn (AS-201) mission, after spacecraft (S/C-009) command and service module (CSM) separation, a short to power caused the Reaction Control System (RCS) commands to be transferred from the crew module (CM) to the service module (SM), resulting in the loss of RCS control. This transfer of command circuits to the shorted umbilical due to entry heating caused a large short and low voltage on main bus A & B till the circuit breakers opened. After loss of RCS, the CM went into a stable roll and did a ballistic entry instead of the planned lifting re-entry.

The cause of all this was a non-functional circuit that was routed through the CSM umbilical and was not deadfaced prior to separation. It shorted, tripping a circuit breaker and causing loss of the redundant Earth Landing System (ELS). The non-functional circuit had been dropped from the drawings, but the wiring was left in the spacecraft and was not disconnected from power. Since it was not on the drawing for the powered wiring going through the CSM umbilical, it was not deadfaced prior to guillotine of the umbilical. Redundant NASA Standard Initiators, one powered by System A and one by System B (this source failed), were used on all critical pyrotechnic functions, including the ELS, and this allowed for recovery of the CM.

SOURCES:

NASA Apollo Mission AS-201

Apollo 11     |     7/24/1969     |     Crew: 3     |

Apollo 10     |     5/18/1969     |     Crew: 3     |

Apollo 8       |     12/21/1968   |     Crew: 3     |

​Related or Recurring event

SUMMARY:

Service Module did not follow the planned trajectory after separation and passed near the Command Module while tumbling. Also occurred on Apollo 8 and 10.

EVENT DESCRIPTION:

On July 24, 1969 during the return from the moon and about five minutes after the separation of the crew module (CM) from the service module (SM), the crew saw the SM fly by to the right and a little above them, straight ahead. It was visible from the CM windows and spinning. The CM should never have been so close to the SM after separation. During lunar return, if the SM contacted the CM in the entry corridor the result would be catastrophic, so this event triggered an anomaly investigation. Photographs obtained by aircraft showed the SM entering Earth’s atmosphere and disintegrating near the CM entry corridor. Radar tracking confirmed what the photographs had shown. The radar tracking data for the previous Apollo 8 and Apollo 10 lunar return missions were similar to Apollo 11, with the SM entering in the same corridor as the CM. In response to these events, the timing of the SM Reaction Control System jets was adjusted via the SM Jettison Controllers to prevent the chance of re-contact on future missions.

SOURCES:

Apollo 11 Mission Report

Apollo 11 Tecknical Crew Debriefing

Apollo 11 Mission Anomaly Report No. 3 Service Module Entry

Soyuz 11     |     6/30/1971     |     Crew: 3     |     Loss of Crew

SUMMARY:

Pyrotechnic system failure resulted in crew module rapid depress.

EVENT DESCRIPTION:

On June 30, 1971 during separation of the orbital and service modules from the descent module, the pyrotechnic system did not operate as intended. All of the pyrotechnics fired simultaneously rather than the designed sequential firing mode. This caused a pressure equalization seal to open in the descent module at a higher-than-designed altitude, resulting in the rapid depressurization of the crew module. The rapid depress led to loss of consciousness of the crew.

All three crew members were lost.

SOURCES:

Mir Hardware Heritage

Descent into the Void

Skylab 4     |     2/8/1974     |     Crew: 3

SUMMARY:

Incorrect circuit breakers opened, resulting in the loss of the automatic control.

EVENT DESCRIPTION:

On February 8, 1974 while preparing foar entry, the crew inadvertently opened the stabilization and control system (SCS) pitch and yaw circuit breakers instead of the service propulsion system pitch and yaw circuit breakers. The vehicle was in an apex forward configuration for service module jettison. The commander attempted to orient the vehicle to the proper heat shield forward attitude for entry. The control commands produced no effect due to the SCS being inadvertently unpowered, and the vehicle failed to change attitude. The crew switched to “manual reaction control system direct” and oriented the vehicle to the proper attitude. The circuit breakers being in close proximity and similarly labeled, increased the potential for human error.

The failure to orient the heat shield forward would have caused loss of crew.

SOURCES:

Skylab 4 Technical Debrief (see page 9-26)

Soyuz 33     |     4/12/1979     |     Crew: 2

SUMMARY:

Backup engine burned 25 seconds too long on de-orbit. Ballistic entry.

EVENT DESCRIPTION:

On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)

SOURCES:

Mir Hardware Heritage

Soyuz 33

Soyuz T-11     |     10/2/1984     |     Crew: 3

SUMMARY:

Partial failure of atmospheric entry control system.

EVENT DESCRIPTION:

Partial failure of the atmospheric entry control system of Soyuz T-11 led to a moderately high (5-6 g) deceleration force.

SOURCES:

NASA Astronauts on Soyuz

Soyuz TM-5     |     9/6/1988     |     Crew: 2

SUMMARY:

Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.

EVENT DESCRIPTION:

Two de-orbit burn attempts failed and nearly led to the loss of the crew. The crew was confined to the descent module due to the orbital module being jettisoned prior to the first deorbit attempt. The first deorbit burn was prevented by a sensor glitch which disappeared after seven minutes, and then the burn started. However, the crew manually shut down the burn after three seconds.

A second burn two revolutions later occurred on time for six seconds, then stopped, and the crew manually restarted the burn. However, after an additional 60 seconds it was cut off by the autopilot. The crew manually interrupted the command sequence shortly before the descent/equipment module separation pyros were to have been fired, preventing an erroneous firing. The main cause of the crew's problems was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel.

SOURCES:

NASA Astronauts on Soyuz

Mir Hardware Heritage

Soyuz TMA-11 (15S)     |     4/19/2008     |     Crew: 3     |     Crew Injury (1)     |     Related or Recurring event

SUMMARY:

Ballistic, high g entry and landing over 400 km short of intended target.

EVENT DESCRIPTION:

During Soyuz TMA-11 entry on April 19, 2008, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry, higher g loads during descent, and the spacecraft landing more than 400 km short of the intended target. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module. The recovery team's arrival at the landing site was delayed by approximately 45 minutes due to the off-target landing.  One crew member was later hospitalized because of injuries sustained during entry and landing.

A Russian investigation into the cause of the DM/IPM separation system failure concluded that one of the five pyrotechnically actuated locks, which attach the Soyuz instrumentation and propulsion module to the descent module, failed to release at the proper time.

SOURCES:

Investigative findings backed by nominal Soyuz TMA-13 return

RS KB Event 2649: 15S (No. 221) Ballistic Entry

STS-119 Delta FRR Soyuz Anomalies

Soyuz TMA-10 (14S)     |     10/21/2007     |     Crew: 3     |     Related or Recurring event

EVENT DESCRIPTION:

During Soyuz TMA-10 entry on October 21, 2007, the Soyuz instrumentation and propulsion module failed to properly separate from the descent module. This resulted in a ballistic entry. The abnormal entry attitude (hatch-forward) during early descent caused excessive heating on the hatch and backshell of the descent module.

SOURCES:

Investigative findings backed by nominal Soyuz TMA-13 return

RS KB Event 2649: 15S (No. 221) Ballistic Entry

STS-119 Delta FRR Soyuz Anomalies

Soyuz 5     |     1/18/1969     |     Crew: 2     |     Related or Recurring event

EVENT DESCRIPTION:

During entry procedures on January 18, 1969 the connecting latches between the descent module (DM) and the service module (SM) of the Soyuz spacecraft failed to separate at the intended time as designed. The failure to separate led the Soyuz to undergo a “nose first” entry. During the entry, layers of the descent module shell peeled away due to heating and internal pressure. As a result of the heating, the connections between the DM and SM were broken and allowed the DM to return to the normal orientation. The DM survived the unplanned heating in the unshielded areas of the capsule.

SOURCES:

Soyuz 5's Flaming Return

Soyuz Landing Reliability Study

Voskhod 2     |     3/19/1965     |     Crew: 1     |     Related or Recurring event

EVENT DESCRIPTION:

On March 19, 1965 a communication cable connecting the landing module with the orbital module failed to separate at the appropriate time, causing the two modules' common center of gravity to shift, causing the two modules to begin spinning around it. The spinning eventually stopped at an altitude of about 100 kilometers, when the connecting cable burned through and the landing module slipped free.

SOURCES:

Voskhod 2 Report

The Voskhod 2 mission revisited

The Nightmare of Voskhod 2

Vostok 5     |     6/19/1963     |     Crew: 1     |     Related or Recurring event

EVENT DESCRIPTION:

On June 19, 1963 the Vostok service module failed to separate cleanly from the re-entry sphere resulting in wild gyrations until the heat of re-entry burned through the non-separating retraining strap.

SOURCES:

Vostok 5

Vostok 2     |     8/7/1961     |     Crew: 1     |     Related or Recurring event

EVENT DESCRIPTION:

On August 7, 1961 during entry it was discovered that lights on the control console in the cabin, which were powered from the instrument module, remained on. Because the lights were on, it was thought that separation of the two modules had not happened. However, the separation between the capsule and the instrument compartment had taken place. A multi-cable umbilical line between two compartments apparently failed to cut off. This likely explains why the crew member heard the separation jolt, but did not see the control lights go out. The electric current was still flowing to the control panel via umbilical cables. The two modules eventually separated when the cable burned through during entry.

SOURCES:

Vostok 2

Vostok 1     |     4/12/1961     |     Crew: 1     |     Related or Recurring event

EVENT DESCRIPTION:

On April 12, 1961 ten seconds after retrofire, commands were sent to separate the Vostok service module from the re-entry module. The Vostok equipment module unexpectedly remained attached to the re-entry module by a bundle of wires. The two halves of the spacecraft began entry and experienced strong gyrations as Vostok 1 crossed over Egypt. At this point in the entry profile the wires connecting the modules broke, causing the two modules to separate. After the separation of the two modules, the descent module settled into the proper entry attitude and landed as intended.

SOURCES:

The Flight of Vostok 1

STS-107 (Columbia)     |     2/1/2003     |     Crew: 1     |     Loss of Crew     |     Related or Recurring event

SUMMARY:

TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.

EVENT DESCRIPTION:

Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.

At 81.7 seconds Mission Elapsed Time a piece of foam insulation from the External Tank (ET) left bipod ramp separated from the ET and struck the orbiter left wing leading edge in the vicinity of the lower half of reinforced carbon-carbon (RCC) panel #8, causing a breach in the RCC. During re-entry this breach allowed super-heated air to penetrate through the leading edge insulation and progressively melt the aluminum structure of the left wing, resulting in a weakening of the structure until increasing aerodynamic forces caused loss of control, failure of the wing, and break-up of the orbiter. This breakup occurred in a flight regime in which, given the design of the orbiter, there was no possibility for the crew to survive. (Similar bipod ramp foam releases prior to STS-107 occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.)

Seven crew members were lost.

SOURCES:

CAIB Vol1

CAIB Chapter 6

Space Shuttle Mission Summary

STS-51D     |     4/19/1985     |     Crew: 7     |     Related or Recurring event

SUMMARY:

TPS burn-through on left outboard elevon.

EVENT DESCRIPTION:

The post-flight inspection of the Thermal Protection System (TPS) revealed that significant damage occurred during landing on April 19, 1985.

The outboard end of the left-hand lower outboard elevon had received significant heat damage, specifically the outboard forward corner of the elevon lower-honeycomb outer-face-sheet. This area was buckled and delaminated and had two small burn-through holes. The outboard elevon lower-leading-edge tile-carrier panel was completely melted under the outboard tile, and a hole was melted in the elevon-cove primary-seal support plate. Because of the damage the lower-outboard carrier-panel outermost tile fell onto the runway when the elevon was deflected upward after landing.

Evidence indicates that the entry plasma flow entered the inboard gap of the outboard tile, then progressed under the tile flowing outboard, where eventually the tile-attachment strain isolation pad was burned, allowing the tile to become loose. This allowed more plasma flow under the tile, resulting in the melting of the aluminum carrier panel, primary seal panel structure, and elevon honeycomb outer face sheet, as well as the melting of two tiles aft of the plasma entry point and two elevon sidewall tiles. The cause of the TPS and structural damage that occurred during descent has not been positively identified. The most probable cause is an out-of-spec step or gap in the lower wing surface forward of the elevon leading edge. It is believed that this flow path may have existed for the two previous flights, with progressive deterioration of the bond, but was not evident from outside inspection of this area during post-flight inspections.

A requirement was established to remove the outboard leading-edge carrier-panel on each side of all orbiters for detailed inspection after the next several flights. In addition, a more comprehensive detailed inspection of each outboard elevon/wing area was accomplished during the normal TPS post-flight inspections.

SOURCES:

Mission Report

MER Report

Space Shuttle Missions Summary

STS-1     |    4/14/1981     |     Crew: 2     |     Related or Recurring event

SUMMARY:

Right-hand main landing gear door warped due to entry heating.

EVENT DESCRIPTION:

On April 14, 1981 the right-hand main landing gear door warped due to entry heating. A forward facing step, a tile gap, a tile-to-filler bar gap and an inadequate flow restrictor resulted in excessive gap heating on the forward portion of the right main landing gear door. This excessive heating resulted in severe tile sidewall shrinkage (on four tiles), a charred filler bar, and a localized buckle in the door structure. The structure and Thermal Protection System on the door was refurbished, and the flow restrictor was modified to increase the effectiveness of the Thermal Protection System in the area of the main landing gear doors.

SOURCES:

Mission Report

MER Report

​Related or Recurring event

Other Thermal Protection System Damage Events

In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:

STS-6 (April 1983)

STS-41B (February 1984)

STS-51G (June 1985)

STS-27 (December 1988)

STS-28 (August 1989)

STS-40 (June 1991)

STS-42 (January 1992)

STS-45 (March 1992)

Additional information can be found in the reports linked below.

SOURCES:

​STS-6 Mission Report STS-41B MER  Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call     STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report

STS-134     |     6/1/2011     |     Crew: 7

SUMMARY:

Brief fire observed between the left main landing gear tires during runway rollout.

EVENT DESCRIPTION:

STS-134 landed on June 1, 2011. During analysis of the post-landing imagery, a fire was briefly observed during the rollout period, located between the left Main Landing Gear tires shortly after the drag chute was jettisoned. Detailed visual inspections, material analysis, and landing gear systems tests were performed in an effort to determine the root cause of the fire. However, no definitive root cause could be determined. The fire may have been operational, because the commander applied the brakes in excess of recommended deceleration rates, especially at the lower speeds, resulting in the shortest landing rollout on a concrete runway surface since the drag chute had been used. The excessive braking may have generated higher than normal temperatures within the brake.

SOURCES:

Mission Report

MER Report

STS-108     |     12/7/2001     |     Crew: 7

SUMMARY:

Violation of minimum landing weather requirements.

EVENT DESCRIPTION:

On December 17, 2001 the Shuttle Meteorology Group forecasted a “no go” for the de-orbit burn due to a weather forecast predicting the creation of a cloud ceiling at landing time. The Shuttle Training Aircraft reported a “go” based on observed conditions. Several positive factors provided the Flight Director with confidence to give a GO for landing on orbit 186, despite a weather forecast which could result in the crew being unable to see the Precision Approach Path Indicators (PAPIs) or runway environment until 3,000 feet or below. The GO was given with the belief that the cloud layer at 3,000 feet would break and that the PAPIs and runway environment would be visible by 6,500 feet.  However, the cloud ceiling did not break and a flight rule was violated, but waived following the flight.

SOURCES:

Meteorology Report

Entry FDO Post Flight

STS-90     |     5/3/1998     |     Crew: 7

SUMMARY:

Hard, fast landing due to human factors and rogue wind gust. Hardest shuttle landing.

EVENT DESCRIPTION:

Following the landing on May 3, 1998 the post-mission report indicated a harder than normal landing.  The main gear touchdown speed was 196.2 Keas with a sink rate of -3.18 feet/second. Brake energies were all below 15 million ft-lbs. The rollout distance was 9769.3 feet. Imagery analysis indicated a main landing gear sink rate of -6.7 ft/sec and a "harder than normal" landing.  The Mission Operations Directorate Space Shuttle Summary reported touchdown of the main landing gear at 218 Keas, a -6.0 ft/sec sink rate, and a rollout distance of 9998 feet.

SOURCES:

Mission Report

STS-37     |     4/11/1991     |     Crew: 5

SUMMARY:

Several factors contributed to a low-energy landing 623 feet prior to the threshold of the runway at the backup landing location.

Low Energy Landing

EVENT DESCRIPTION:

On April 11, 1991 the first landing opportunity at Kennedy Space Center was waived due to fog, and a decision was made to land at the alternate landing site at Edwards Air Force Base. The entry wind profile included a large wind shear (from 90 kts at 13,000 feet to 10 kts at 8,000 feet). These conditions fell outside the Edwards Air Force Base 99 percent wind profile from 20,000 feet to 10,000 feet and significantly outside the shuttle experience base from 30,000 feet to 10,000 feet.

Around the Heading Alignment Circle (HAC), a significant amount of energy was lost due to a consistent negative pitch attitude error, and being outside of the HAC reference. The HAC is designed to provide an “energy pad” for use while making the approach.  If guidance senses that the vehicle's energy state is getting very low (it uses altitude below a reference altitude and degrees of turn remaining to make the judgment), the HAC radius is decreased to help make up for the lower energy state. At approximately 23,000 feet the low-energy state triggered HAC shrink (when the range-to-go “distance from the vehicle to the runway” falls below the max lift/drag line). The HAC shrink was triggered due to the altitude being approximately 2-3,000 feet low, and increased the error from the HAC reference. A slow convergence back to the altitude reference was seen though the energy state remained low. At 13,500 feet the vehicle encountered a sharp wind shear reducing the vehicle's airspeed driving the energy state even lower. The vehicle again encountered wind shear at 8,600 feet in altitude. Touchdown occurred 623 feet prior to the threshold at 168 kts.

It is believed that the loss of energy on the HAC combined with the inadequate correction back to the altitude profile, both coming off the HAC and through the wind shear, resulted in the low-energy touchdown.

SOURCES:

Mission Report

Post-Flight Report

STS-37 Weather Group Report

STS-51D     |     4/19/1985     |     Crew: 7

SUMMARY:

Right brake failed (locked up) causing blowout of inboard tire and significant damage to outboard tire.

Crew: 7

EVENT DESCRIPTION:

On April 19, 1985 the right brake on the orbiter failed, causing the blowout of an inboard tire and significant damage to an outboard tire. A crosswind of about 8 knots, gusting up to 12, resulted in extra brake energy on the right brake while returning to and holding the runway centerline during rollout.  The number 3 stator on both the inboard and outboard right main landing gear (MLG) brakes broke into several pieces, causing both brakes to lock during rollout. The inboard right brake locked at 20.6 knots and 113 feet, before the orbiter stopped and the outboard right brake locked for the last 5 feet of rollout. The right MLG inboard tire burst 33 feet after the inboard brake locked. Eleven of 16 cord layers were worn through before the tire burst.  The right MLG brakes failed and locked due to thermal soak-back when the number 3 stators broke.

The corrective action included the following standard procedures to prevent heat soak-back:

1. Brake-on velocity between 140 and 120 knots.

2. Deceleration rate between 8 and 10 ft/sec2.

3. Deceleration rate reduced to 6 ft/sec2 at 40 knots. If brake-on velocity exceeds 140 knots, continue 8 to 10 ft/sec2 deceleration.

SOURCES:

Space Shuttle Mission Summary

MER Report

Mission Report

Close Call

STS-9     |     12/8/1983     |     Crew: 6

SUMMARY:

A.     Two APUs caught fire during rollout.

B.     GPC failed on touchdown.

C.     Incorrect flight control rechannelization on rollout.

EVENT DESCRIPTION:

A)  During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire.  Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.

B)  Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.

C)  The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.

SOURCES:

Space Shuttle Mission Summary

MER Report

Mission Report

Close Call

STS-3     |     3/30/1982     |     Crew: 2

SUMMARY:

Pilot induced oscillation during derotation. Stronger than predicted winds contributed.

EVENT DESCRIPTION:

On March 30, 1982 during orbiter derotation on rollout, the vehicle pitched up to approximately six degrees after having been down to -3 degrees pitch. This pitch up occurred because the pilot was preventing premature nose wheel contact. The planned late transition from autoland to manual control did not provide sufficient time for the pilot to feel the vehicle response, and attempts by the pilot to make minor trajectory adjustments resulted in a touchdown sooner than intended and at a higher than planned airspeed (225 Keas vs. 195 Keas). Subsequently, the derotation after main landing gear touchdown started at too high an airspeed and required the pilot to try and stop it at too low a pitch angle. The rapidly changing elevator trim requirements made it difficult to avoid over-controlling in this situation.

On all future missions, manual takeover from autoland was not planned to occur between the start of the preflare maneuver and touchdown. Flight procedures and crew training were also revised to be more explicit about keeping the nose up until the vehicle slows to 180 knots.

SOURCES:

MER Report

Mission Report

Soyuz 15     |     8/28/1974     |     Crew: 2

SUMMARY:

Descended through an electrical storm during night landing.

EVENT DESCRIPTION:

During the night of August 28, 1974 the capsule descended through an electrical storm.

SOURCES:

Mir Hardware Heritage

Apollo 15     |     8/7/1971     |     Crew: 3

SUMMARY:

Landed with only 2 of 3 parachutes.

EVENT DESCRIPTION:

On August 7, 1971 the Apollo capsule, Endeavour, dropped into the Pacific Ocean about 320 miles (515 kilometers) north of Hawaii. During the Earth landing phase, after the main parachutes were deployed and shortly after Reaction Control System (RCS) propellant dumping, one of the main parachutes was observed to be deflated when exiting the clouds (3 of 6 fabric risers failed and two-thirds of the suspension lines were missing). One of the main parachutes was recovered after landing, but the failed parachute was not recovered.

The investigation was divided into three areas which were likely causes of the parachute failure.

The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.

A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.

The Command Module RCS propellant depletion firing had just been completed, and fuel (monomethyl hydrazine) expulsion was in progress at the time of the failure, indicating the possibility of damage from propellants.

Analysis and testing ruled out possible causes one and two, but a test of raw fuel expulsion after RCS firing produced burning outside of the engine. The flame front extended up to eight feet from the engine exit and unburned fuel was sprayed up to 10 feet from the engine and ignited by burning droplets. This was considered the most likely cause of the parachute failure.

SOURCES:

Mission Report

Main Parachute Failure

LUNAR EXPLORATION CONCLUDED: to the Mountains of the Moon

Crew Debrief

Apollo 15 Anomaly Report

Apollo 12     |     11/24/1969     |     Crew: 3

SUMMARY:

Harder than normal splashdown knocked loose a camera. The camera knocked lunar module pilot unconscious.

EVENT DESCRIPTION:

Due to a harder than normal splashdown on November 24, 1969, a camera broke free from the window bracket and struck the lunar module pilot on the forehead. The crew member was unconscious for five seconds after the injury and required sutures following retrieval.

SOURCES:

Mission Report

Technical Debrief

Mercury MR-4     |     7/21/1969     |     Crew: 1     |      Loss of Capsule

SUMMARY:

Inadvertent hatch pyrotechnic firing. Capsule sunk. Astronaut nearly drowned.

EVENT DESCRIPTION:

After landing on July 21, 1961 the spacecraft hatch pyrotechnic charges prematurely fired. The crew member was able to escape from the emergency situation, but because of waves flooding the capsule, the capsule sunk. The crew member was nearly drowned when the flight suit took on water from an unsealed neckdam. The crew member was rescued after three to four minutes in the water.

SOURCES:

Project Review

Results of the Second Manned Suborbital

Soyuz TM-15     |     2/1/1993     |     Crew: 2     |     Related or Recurring event

SUMMARY:

Rolled down hillside.

EVENT DESCRIPTION:

Upon landing on February 1, 1993 Soyuz TM-15 rolled down hill and stopped on its side 150 meters from the shore of a salt marsh.

SOURCES:

Soyuz Landing Reliability Study

Soyuz TM-14     |     8/10/1992     |     Crew: 3     |     Related or Recurring event

SUMMARY:

Hard landing impact. Hatch jammed, requiring cosmonauts to use tools to pry open.

EVENT DESCRIPTION:

On August 10, 1992 a hard landing impact led to the descent module turning over on its side and leaving the crew sideways.  The spacecraft hatch also jammed and could not be opened from the outside, requiring the cosmonauts to use tools to pry it open. High winds in the landing area may have contributed to the severity of the impact.

SOURCES:

Soyuz Landing Reliability Study

Soyuz TM-12     |     10/10/1991     |     Crew: 3     |     Related or Recurring event

SUMMARY:

Hard impact. News team reported capsule as “very dented.”

EVENT DESCRIPTION:

On October 10, 1991 Soyuz TM-12 experienced a hard landing impact, and a television crew reported that the capsule was 'very dented' and lying on its side.

SOURCES:

Soyuz Landing Reliability Study

Soyuz TM-7     |     4/27/1989     |     Crew: 2     |     Crew Injury     |    Related or Recurring event

SUMMARY:

Double-impact “hard landing.”

EVENT DESCRIPTION:

On April 27, 1989 a double-impact, “hard landing” resulted in an injury to a crew member's leg. The injury required medical treatment at the landing site. The hard landing has been attributed to gusty winds at the landing site.

SOURCES:

Soyuz Landing Reliability Study

Soyuz T-7     |     12/10/1982     |     Crew: 2     |     Related or Recurring event

SUMMARY:

Landed on hillside and rolled downhill. One cosmonaut thrown from seat.

EVENT DESCRIPTION:

On December 10, 1982 Soyuz T-7 landed on a hillside and rolled down the hill.  One of the cosmonauts was thrown from his seat as a result of the rolling.

SOURCES:

Soyuz Landing Reliability Study

Soyuz 36     |     7/31/1980     |     Crew: 2     |     Related or Recurring event

SUMMARY:

Landing rockets failed to fire resulting in ~30 g impact.

EVENT DESCRIPTION:

On July 31, 1980 the Soyuz 36 soft landing rockets failed to fire before touchdown, resulting in an impact at more than 30 g.

SOURCES:

Soyuz Landing Reliability Study

Soyuz 23     |     10/16/1976     |     Crew: 2     |     Related or Recurring event

SUMMARY:

Landed on frozen lake during blizzard. Delayed recovery.

EVENT DESCRIPTION:

On October 16, 1976 the Soyuz 23 descent module landed in Lake Tengiz, 2 km from shore. The water caused an electrical short which caused the reserve parachute to deploy. Parachute lines from the main and reserve parachute kept the capsule lying on its side in the water, preventing the hatch from opening and blocking the air vent. Transmission antennas became inoperable due to submersion in the water, and the inner walls of the capsule became covered with ice. The recovery team concluded the crew was dead and dragged the capsule to the shore to await the special team to remove the bodies. After eleven hours in the capsule the crew inside finally opened the hatch from the inside.

SOURCES:

Soyuz Landing Reliability Study

Soyuz 18-1 (18a)     |     4/5/1975     |     Crew: 2     |     Crew Injury     |     Related or Recurring event

SUMMARY:

After ascent abort, capsule landed on snowy slope above cliff. Parachute snagged and prevented fall.

EVENT DESCRIPTION:

During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches.  When the core first stage burned out it could not be cast off as designed.

Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.

The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice.  After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.

One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.

SOURCES:

Soyuz 18-1

Soyuz 5     |     1/18/1969     |     Crew: 1     |     Crew Injury     |     Related or Recurring event

SUMMARY:

Landing rockets failed to fire, resulting in a hard landing.

EVENT DESCRIPTION:

On January 18, 1969 the Soyuz 5 soft landing rockets failed to fire, resulting in a harder than normal landing. Because of the force of the impact, one crew member onboard broke his teeth.

SOURCES:

Soyuz Landing Reliability Study

STS-97     |     11/30/2000     |     Crew: 5

SUMMARY:

Left aft lower SRB strut system "A" NSI pressure cartridge failed to fire due to damaged cable.

EVENT DESCRIPTION:

Analysis of the flight data and assessment of the postflight condition of the recovered hardware indicated nominal performance of all SRB subsystems with the exception of the left aft lower strut System “A” NSI that failed to fire.

SOURCES:

Jones, Tom. Skywalking.

STS-97 FER

ISS, Increment 58    |     2/1/2019     |     Crew: 6

SUMMARY:

Significant water leak while de-mating potable water quick disconnect.

EVENT DESCRIPTION:

On February 1, 20019 during the installation of the new Universal Waste Management System (UWMS), a water leak occurred while de-mating the quick disconnect (QD) for the potable water bus. Approximately 9.5 liters of water leaked before flight controllers in Mission Control isolated the bus. The crew re-mated the leaking QD, and an alternate QD was de-mated to continue with the installation of the UWMS. Leakage of greater than 3.8 liters of water in the ISS is deemed a catastrophic hazard due to the risk of suffocation and electrical shorts.

SOURCES:

ISS Daily Summary Report

Soyuz 64S    |     10/15/2021     |     Crew: 3

SUMMARY:

ISS Loss of attitude control due to Soyuz 64S thrusters not deactivating following thruster test.

EVENT DESCRIPTION:

At the end of the re-performance of the 64S thruster test, crew reported that the Soyuz thrusters were firing and they could not turn them off. 64S thrusters unexpectedly started firing just after РО-ДК mode (Soyuz Digital Attitude Control Mode) was deactivated. Thrusters stopped firing due to an error message for over consumption of prop.  The prop limit was set to 10 kg and 10 kg of prop was used, causing the deactivation.

SOURCES:

AR 010364

Space.com article

Russian ASAT    |     11/14/2021     |     Crew: 0

SUMMARY:

Russian ASAT test results in increased orbital debris risk.

EVENT DESCRIPTION:

Russian satellite broke up in Low Earth Orbit in what was a deliberate test of Russian antisatellite (ASAT) device which created thousands of piece of space junk/debris. As reported by the US State department this test has generated more than 1,500 pieces of trackable orbital debris and thousands of pieces of smaller orbital debris. The test increased the risk to ISS, where the crew were directed to shelter in Crew Dragon and Soyuz vehicles due to the potential debris threat to ISS. The crews remained in their vehicles for a few hours before it was determined they could return to ISS.

SOURCES:

NASA Administrator Statement

Arms Control Association Article

Space News Article

Nauka    |     7/29/2021     |     Crew: 0

SUMMARY:

ISS LOAC due to uncommanded firing of MLM thrusters.

EVENT DESCRIPTION:

The docking of Roscosmos "Nauka" Multipurpose Laboratory Module (MLM), on July 29, 2021 at the International Space Station. This incident involved the unplanned firing of MLM thrusters causing the station to move out of orientation. This incident resulted in NASA and Boeing standing the OFT-2 launch from July 31, 2021 to Aug 3, 2021 to allow ISS Teams time to continue to check out the "Nauka" MLM to ensure ISS operations could safely continue.

SOURCES:

AR 010253 

ISS Top Risks, 12/14/21

SpaceX Crew-2    |     11/9/2021     |     Crew: 4

SUMMARY:

WMS leak resulted in corrosion. (Also noted on Inspiration 4 flight C207.2).

EVENT DESCRIPTION:

Crew Dragon Endeavour waste management system leak was caused by tube delivering liquids from the bathroom rupturing in the spacecraft's cabin floor that then spilled into the waste management system fans.

SOURCES:

Science Times Article

Space.com article

ISS Atmospheric Leak     |     8/21-22/2021     |     Crew: 3

SUMMARY:

Cracks in Russian pressure vessel shell resulted in ISS leak.

EVENT DESCRIPTION:

During this period ISS modules were isolated to gather data as the three-member ISS crew occupied the Russian Segment.  The preliminary investigation eliminate the following as possible leak sources: airlock, Columbus, Node-1, Node-2, Node-3, lab, Permanent Multipurpose Module, Japanese Experiment Module, and Docking Compartment-1. The leak could be from the FGB or the Service Module and the Mini-Research Module (MRM)-1 may be a contributing factor.

1. On September 4, 20220, a leak increase to 3.0-3.5 lbm/ per day was detected. A second ISS Module isolation was conducted from September 25-28, 2020 and again the three-member ISS Crew was isolated with the Russian segment. However data on September 28, 2020 indicated the SM, MRM-2 Soyuz (62S), Progress (75P), and Russian system hardware were possible sources for the leak. These results were discussed with the International partners on September 30, 2020.
2. Although the ultrasonic leak detector was unsuccessful in locating the leakage, the SM Transfer Tunnel (PrK) volume was isolated and determined to be a leak source.  The Prk hatch was closed while the pressure gauges and leak indicators were monitored, and after 10 hours of isolation it was determined the leaks source was the PrK interior hull crack. The Russian Segment crew applied Kapton Tape to the crack, and the leak rate dropped to 2/lbm/day.
3. Structural TIMs and analysis have been on-going for several months to resolve this problem.  The Russians have indicated there are no load or docking restrictions at this time due this activity. There are currently no concerns with structural failures, and the current ISS atmospheric leak is not classified as an immediate threat to ISS or crew.

SOURCES:

ISS Top Risks 12/14/21  ​

Boeing OFT-1     |     12/20/2019     |     Crew: 4

SUMMARY:

OFT software issue – LOM and potential LOV during entry.

EVENT DESCRIPTION:

An issue with the spacecraft's mission elapsed time (MET) clock occurred 31 minutes into flight. Due to intermittent space-to-ground communication issues flight controllers could not correct the issue. This anomaly caused the spacecraft's Orbital Maneuvering Thrusters (OMT) to burn into an incorrect orbit causing too much propellant to be burned. This precluded a rendezvous and docking with the ISS. After the mission, it was revealed that another critical software bug was found in flight, which could have resulted in the service module bumping back into Starliner after separation.

SOURCES:

NASA Spaceflight article

Space.com Article

STS-112     |     10/7/2002     |     Crew: 6

SUMMARY:

T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.

EVENT DESCRIPTION:

The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.

The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.

All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.

SOURCES:

MER Report

Space Shuttle PRACA

Mission Report

Boeing OFT-2     |     7/31/2021     |     Crew: 0

SUMMARY:

Russian MLM firing and Prop valves “Stuck” Caused the delays in the launch of OFT-2.

EVENT DESCRIPTION:

 The initial delay of OFT-2 from Jul 31, 2021 to Aug 3, 2021 was due to Russian MLM. However Boeing later discovered prior to the launch on August 3, 2021 several of the propulsion valves "Stuck" would not open and close properly.....the analysis and troubleshooting of this incident has resulted I this event now being scheduled for late May 2022. The analysis indicated the "most probably cause" for the valves not to function properly may have been due to "oxidizer and moisture interactions". Testing and analysis of the valves continues at White Sands Testing Facility and Marshall Space Flight Center. 

SOURCES:

Starliner Update

ISS Top Risks 12/14/21

Soyuz 1     |     4/24/1967     |     Crew: 1     |     Loss of Crew     |     Related or Recurring event

SUMMARY:

Main and reserve parachutes failed.

Crew: 1

EVENT DESCRIPTION:

On April 24, 1967 on the maiden flight of the Russian Soyuz spacecraft, the cosmonaut encountered an anomaly with the parachute system during descent. During the descent the drag chutes successfully deployed, but the main chutes failed to deploy from their container. Detecting increasing speeds, the computer deployed a backup parachute. Because the drag chute was still attached and failed to release, the backup chute became tangled with the drag chute, preventing the deployment of the backup chute and resulting in a high-speed impact with the ground.

One cosmonaut was lost.

SOURCES:

Tragic Tangle

PRA on Soyuz Spacecraft as ACRV ​

Soyuz 1

Mir Hardware Heritage

Soyuz Landing Reliability Study