HOW TO USE THIS TOOL
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
Related or Recurring event
Other significant STS TPS anomalies:
STS-6, 41B, 51G, 27*, 28, 40, 42, 45
*Most severe tile damage to date.
STS-107 (Columbia) 2/1/2003
Soyuz TMA-10 (14S)
Soyuz TMA-11 (15S) 4/19/2008
Mercury MA-6 2/20/1962
Mercury MA-7 5/24/1962
Voskhod 2 3/19/1965
Gemini 4 6/7/1965
Gemini 5 8/29/1965
Soyuz 11 6/30/1971
Skylab 4 2/8/1974
Soyuz 33 4/12/1979
Soyuz T-11 10/2/1984
Soyuz TM-5 9/6/1988
Mercury MA-7 5/24/1962
Apollo ASTP 7/24/1975
Soyuz TM-25 8/17/1997
X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew
Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.
On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.
The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive. While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.
This was the first United States spaceflight fatality.
Related or Recurring event
Other Thermal Protection System Damage Events
In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:
STS-6 (April 1983)
STS-41B (February 1984)
STS-51G (June 1985)
STS-27 (December 1988)
STS-28 (August 1989)
STS-40 (June 1991)
STS-42 (January 1992)
STS-45 (March 1992)
Additional information can be found in the reports linked below.
STS-6 Mission Report STS-41B MER Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report
STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event
Right-hand main landing gear door warped due to entry heating.
On April 14, 1981 the right-hand main landing gear door warped due to entry heating. A forward facing step, a tile gap, a tile-to-filler bar gap and an inadequate flow restrictor resulted in excessive gap heating on the forward portion of the right main landing gear door. This excessive heating resulted in severe tile sidewall shrinkage (on four tiles), a charred filler bar, and a localized buckle in the door structure. The structure and Thermal Protection System on the door was refurbished, and the flow restrictor was modified to increase the effectiveness of the Thermal Protection System in the area of the main landing gear doors.
STS-51D | 4/19/1985 | Crew: 7 | Related or Recurring event
TPS burn-through on left outboard elevon.
The post-flight inspection of the Thermal Protection System (TPS) revealed that significant damage occurred during landing on April 19, 1985.
The outboard end of the left-hand lower outboard elevon had received significant heat damage, specifically the outboard forward corner of the elevon lower-honeycomb outer-face-sheet. This area was buckled and delaminated and had two small burn-through holes. The outboard elevon lower-leading-edge tile-carrier panel was completely melted under the outboard tile, and a hole was melted in the elevon-cove primary-seal support plate. Because of the damage the lower-outboard carrier-panel outermost tile fell onto the runway when the elevon was deflected upward after landing.
Evidence indicates that the entry plasma flow entered the inboard gap of the outboard tile, then progressed under the tile flowing outboard, where eventually the tile-attachment strain isolation pad was burned, allowing the tile to become loose. This allowed more plasma flow under the tile, resulting in the melting of the aluminum carrier panel, primary seal panel structure, and elevon honeycomb outer face sheet, as well as the melting of two tiles aft of the plasma entry point and two elevon sidewall tiles. The cause of the TPS and structural damage that occurred during descent has not been positively identified. The most probable cause is an out-of-spec step or gap in the lower wing surface forward of the elevon leading edge. It is believed that this flow path may have existed for the two previous flights, with progressive deterioration of the bond, but was not evident from outside inspection of this area during post-flight inspections.
A requirement was established to remove the outboard leading-edge carrier-panel on each side of all orbiters for detailed inspection after the next several flights. In addition, a more comprehensive detailed inspection of each outboard elevon/wing area was accomplished during the normal TPS post-flight inspections.
STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event
TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.
Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.
At 81.7 seconds Mission Elapsed Time a piece of foam insulation from the External Tank (ET) left bipod ramp separated from the ET and struck the orbiter left wing leading edge in the vicinity of the lower half of reinforced carbon-carbon (RCC) panel #8, causing a breach in the RCC. During re-entry this breach allowed super-heated air to penetrate through the leading edge insulation and progressively melt the aluminum structure of the left wing, resulting in a weakening of the structure until increasing aerodynamic forces caused loss of control, failure of the wing, and break-up of the orbiter. This breakup occurred in a flight regime in which, given the design of the orbiter, there was no possibility for the crew to survive. (Similar bipod ramp foam releases prior to STS-107 occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.
Seven crew members were lost.
Vostok 1 | 4/12/1961 | Crew: 1 | Related or Recurring event
On April 12, 1961 ten seconds after retrofire, commands were sent to separate the Vostok service module from the re-entry module. The Vostok equipment module unexpectedly remained attached to the re-entry module by a bundle of wires. The two halves of the spacecraft began entry and experienced strong gyrations as Vostok 1 crossed over Egypt. At this point in the entry profile the wires connecting the modules broke, causing the two modules to separate. After the separation of the two modules, the descent module settled into the proper entry attitude and landed as intended.
Vostok 2 | 8/7/1961 | Crew: 1 | Related or Recurring event
On August 7, 1961 during entry it was discovered that lights on the control console in the cabin, which were powered from the instrument module, remained on. Because the lights were on, it was thought that separation of the two modules had not happened. However, the separation between the capsule and the instrument compartment had taken place. A multi-cable umbilical line between two compartments apparently failed to cut off. This likely explains why the crew member heard the separation jolt, but did not see the control lights go out. The electric current was still flowing to the control panel via umbilical cables. The two modules eventually separated when the cable burned through during entry.
Vostok 5 | 6/19/1963 | Crew: 1 | Related or Recurring event
On June 19, 1963 the Vostok service module failed to separate cleanly from the re-entry sphere resulting in wild gyrations until the heat of re-entry burned through the non-separating retraining strap.
Voskhod 2 | 3/19/1965 | Crew: 1 | Related or Recurring event
On March 19, 1965 a communication cable connecting the landing module with the orbital module failed to separate at the appropriate time, causing the two modules' common center of gravity to shift, causing the two modules to begin spinning around it. The spinning eventually stopped at an altitude of about 100 kilometers, when the connecting cable burned through and the landing module slipped free.
Soyuz 5 | 1/18/1969 | Crew: 2 | Related or Recurring event
During entry procedures on January 18, 1969 the connecting latches between the Descent Module (DM) and the Service Module (SM) of the Soyuz spacecraft failed to separate at the intended time as designed. The failure to separate led the Soyuz to undergo a “nose first” entry. During the entry, layers of the descent module shell peeled away due to heating and internal pressure. As a result of the heating, the connections between the DM and SM were broken and allowed the DM to return to the normal orientation. The DM survived the unplanned heating in the unshielded areas of the capsule.
Soyuz TMA-10 (14S) | 10/21/2007 | Crew: 3 | Related or Recurring event
During Soyuz TMA-10 entry on October 21, 2007, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module.
Soyuz TMA-11 (15S) | 4/19/2008 | Crew: 3 | Crew Injury (1) | Related or Recurring event
Ballistic, high g entry and landing over 400 km short of intended target.
During Soyuz TMA-11 entry on April 19, 2008, the Soyuz instrumentation and propulsion module (IPM) failed to properly separate from the descent module (DM). This resulted in a ballistic entry, higher g loads during descent, and the spacecraft landing more than 400 km short of the intended target. The abnormal entry attitude(hatch-forward) during early descent caused excessive heating on the hatch and back shell of the descent module. The recovery team's arrival at the landing site was delayed by approximately 45 minutes due to the off-target landing. One crew member was later hospitalized because of injuries sustained during entry and landing.
A Russian investigation into the cause of the DM/IPM separation system failure concluded that one of the five pyrotechnically actuated locks, which attach the Soyuz instrumentation and propulsion module to the descent module, failed to release at the proper time.
Mercury MA-6 | 2/20/1962 | Crew: 1
False landing-bag indicator light led to entry with retropack in place as a precaution.
On February 20, 1962 a sensor indicated the heatshield was in an unlatched condition while still in orbit. If the sensor's reading were true, the heatshield could have been lost during entry, resulting in the loss of the vehicle and crew. Because the indictor said the heatshield had been dropped to the landing position, entry procedures were changed to eliminate the jettisoning of the retropack. The retropack was used as a redundant heatshield hold-down device to keep the heatshield in place. The straps holding the retropack burned through during entry, but it was thought that the aerodynamic pressure would hold the heatshield in place. After landing it was discovered that the indicator was incorrect and that the heatshield had not been dropped to the landing position.
Mercury MA-7 | 5/24/1962 | Crew: 1
Pitch horizon scanner failed, resulting in manual entry and off-target landing. Delayed crew recovery.
On May 24, 1962 the failure of the spacecraft pitch horizon scanner required the pilot to assume manual control of the spacecraft for retrofire. As a result, the spacecraft attitude was outside of the recommended range for automatic initiation of the retrofire signal. Manual initiation of the retrofire signal occurred several seconds later than scheduled.
The delay in retrofire initiation and the less-than-ideal spacecraft attitude contributed to the spacecraft landing 250 nautical miles downrange of the intended landing point which delayed crew recovery.
Voskhod 2 | 3/19/1965 | Crew: 2
Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.
On March 19, 1965 a malfunction of the automatic descent system resulted in the use of a backup manual system for entry and landing. Difficulties encountered during manual operation and delayed retrofiring resulted in the spacecraft landing more than 1,000 km downrange from the intended landing point. The wooded, mountainous terrain caused a delay in crew recovery. (Actual distance of overshoot varies in the source documents, but most sources indicate a distance between 1,000 km and 2,500 km.)
Gemini 4 | 6/7/1965 | Crew: 2
Erroneous entry data uplinked; crew manually corrected entry flight profile.
On June 7, 1965 the computer could not be updated for entry, could not be turned off, and then stopped working entirely. The crew resorted to a rolling Mercury-type entry, rather than the lifting bank angle the computer was supposed to help them achieve.
Gemini 5 | 8/29/1965 | Crew: 2
Erroneous entry data uplinked; crew manually corrected entry flight profile.
During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.
Soyuz 11 | 6/30/1971 | Crew: 3 | Loss of Crew
Pyrotechnic system failure resulted in crew module rapid depress.
On June 30, 1971 during separation of the orbital and service modules from the descent module, the pyrotechnic system did not operate as intended. All of the pyrotechnics fired simultaneously rather than the designed sequential firing mode. This caused a pressure equalization seal to open in the descent module at a higher-than-designed altitude, resulting in the rapid depressurization of the crew module. The rapid depress led to loss of consciousness of the crew.
All three crew members were lost.
Skylab 4 | 2/8/1974 | Crew: 3
Incorrect circuit breakers opened, resulting in the loss of the automatic control.
On February 8, 1974 while preparing foar entry, the crew inadvertently opened the stabilization and control system (SCS) pitch and yaw circuit breakers instead of the service propulsion system pitch and yaw circuit breakers. The vehicle was in an apex forward configuration for service module jettison. The commander attempted to orient the vehicle to the proper heat shield forward attitude for entry. The control commands produced no effect due to the SCS being inadvertently unpowered, and the vehicle failed to change attitude. The crew switched to “manual reaction control system direct” and oriented the vehicle to the proper attitude. The circuit breakers being in close proximity and similarly labeled, increased the potential for human error.
The failure to orient the heat shield forward would have caused loss of crew.
Soyuz 33 | 4/12/1979 | Crew: 2
Backup engine burned 25 seconds too long on de-orbit. Ballistic entry.
On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)
Soyuz T-11 | 10/2/1984 | Crew: 3
Partial failure of atmospheric entry control system.
Partial failure of the atmospheric entry control system of Soyuz T-11 led to a moderately high (5-6 g) deceleration force.
Soyuz TM-5 | 9/6/1988 | Crew: 2
Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.
Two de-orbit burn attempts failed and nearly led to the loss of the crew. The crew was confined to the descent module due to the orbital module being jettisoned prior to the first deorbit attempt. The first deorbit burn was prevented by a sensor glitch which disappeared after seven minutes, and then the burn started. However, the crew manually shut down the burn after three seconds.
A second burn two revolutions later occurred on time for six seconds, then stopped, and the crew manually restarted the burn. However, after an additional 60 seconds it was cut off by the autopilot. The crew manually interrupted the command sequence shortly before the descent/equipment module separation pyros were to have been fired, preventing an erroneous firing. The main cause of the crew's problems was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel.
Mercury MA-7 | 5/24/1962 | Crew: 1
RCS depletion at 80,000 ft.
This incident on May 24, 1962 involved the use of double authority control and the accidental actuation of the fly-by-wire high thrust units during certain maneuvers. The manual-system fuel was depleted near the end of the retrofire maneuver, and the automatic-system fuel was depleted at about 80,000 and 70,000 feet. Because of the early depletion of automatic-system fuel, attitude control during re-entry was not available for the required duration. Attitude rates built up after the Automatic Stabilization Control System became inoperative because of the lack of fuel, and these rates were not sufficiently damped by aerodynamic forces. The pilot chose to deploy the drogue parachute manually at an altitude of approximately 25,000 feet to stabilize the spacecraft.
To avoid the same situation on later flights, Mercury MA-8 and subsequent spacecraft contained a switch which allowed the pilot to disable and reactivate the high-thrust units at his discretion. An automatic override reactivated these thrusters just prior to retrofire. Additionally, a revision of fuel management and control training procedures was instituted for subsequent missions
Apollo ASTP | 7/24/1975 | Crew: 3 | Crew Injury
N2O4 in crew cabin. Crew hospitalized for 2 weeks.
On July 24, 1975 as the spacecraft descended, the commander, who was reading the checklist, failed to tell the command module pilot to move the Earth Landing System auto/manual switch to auto. The crew saw that the spacecraft was well below the deployment altitude and proceeded to manually deploy the chutes. Drogue chutes were deployed manually at 18,550 feet instead of 23,500 feet as the automatic system would have done. At 10,000 feet the commander realized that ELS was not in AUTO and quickly switched ELS Logic and AUTO, deploying the main parachutes at 7,150 feet and disabling the RCS instead of 10,500 feet.. The Reaction Control System (RCS) was not disabled manually (RCS command switch turned to “off”) at this time. It was disabled manually at 16,000 feet instead of when the checklist indicated at 24,000 feet. The cabin pressure relief valve opened automatically at 24,500 feet.
During a 30-second period of high thruster activity after drogue parachute deployment, a mixture of air and propellant combustion products followed by a mixture of air and nitrogen tetroxide oxidizer (N2O4) vapors were sucked into the cabin. One of the positive roll thrusters is located only two feet away from the steam vent that pulls in outside air when the cabin relief valve is open. This exposed the crew to a high level of N2O4 since emergency oxygen masks were not available until landing. The pilot passed out, but the commander quickly put the oxygen mask on him and he was revived. The exposure resulted in a two-week hospital stay for the crew after landing.
Soyuz TM-25 | 8/17/1997 | Crew: 3
Landing rockets fired at heat shield separation rather than at landing.
On August 17, 1997 the landing rockets on Soyuz TM-25 fired during heat shield separation rather than during landing. This failure resulted in a harder landing than normal.
The Mir with the docked Soyuz was experiencing high humidity levels in the atmosphere. Water condensing on the connectors in the Soyuz electrical box controlling the circuit probably caused a short circuit, which caused the rockets to fire when the system was armed at heat shield physical separation. Changes were made to either seal the connectors or separate the connectors to prevent a short from applying electrical power to the rockets when the system is armed.
The design has two primary types of inhibits. One inhibit consists of three mechanical switches that physically disconnect the firing circuit when the heat shield is attached. These switches are spring loaded and move approximately 20 mm as the heat shield is deployed to close the firing circuit. A minimum of two out of three switches must be closed for the initiating system to function. In addition to these mechanical inhibits, logic in the electronics prevents the ignition command from being sent until after the heat shield is deployed. Nominally the soft landing motors are ignited when the gamma ray altitude/velocity sensor detects proximity to the ground. The system automatically initiates either four or six motors depending on the velocity. Each motor has 1 kg of propellant and burns for approximately 0.1 to 0.14 seconds.
Service/Descent Module (1961-2008)
TPS Entry Events (1981-2003)
LANDING & POSTLANDING