HOW TO USE THIS TOOL
GUIDANCE, NAVIGATION & CONTROL
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
Related or Recurring event
Soyuz 15 8/28/1974
Mercury MA-7 5/24/1962
Voskhod 2 3/19/1965
Gemini 4 6/7/1965
Soyuz 33 4/12/1979
Soyuz T-11 10/2/1984
Soyuz 15 8/28/1974
Soyuz 10 4/23/1971
Skylab 2 5/26/1973
Soyuz T-8 4/22/1983
Soyuz 1 4/23/1967
ISS, Increment 2 4/24/2001
ISS, Increment 15 6/10-6/18/2007
Apollo 10 5/22/1969
Soyuz 15 | 8/28/1974 | Crew: 2
Descended through an electrical storm during night landing.
During the night of August 28, 1974 the capsule descended through an electrical storm.
STS-3 | 3/30/1982 | Crew: 2
Pilot induced oscillation during derotation. Stronger than predicted winds contributed.
On March 30, 1982 during orbiter derotation on rollout, the vehicle pitched up to approximately six degrees after having been down to -3 degrees pitch. This pitch up occurred because the pilot was preventing premature nose wheel contact. The planned late transition from autoland to manual control did not provide sufficient time for the pilot to feel the vehicle response, and attempts by the pilot to make minor trajectory adjustments resulted in a touchdown sooner than intended and at a higher than planned airspeed (225 Keas vs. 195 Keas). Subsequently, the derotation after main landing gear touchdown started at too high an airspeed and required the pilot to try and stop it at too low a pitch angle. The rapidly changing elevator trim requirements made it difficult to avoid over-controlling in this situation.
On all future missions, manual takeover from autoland was not planned to occur between the start of the preflare maneuver and touchdown. Flight procedures and crew training were also revised to be more explicit about keeping the nose up until the vehicle slows to 180 knots.
STS-9 | 12/8/1983 | Crew: 6
A. Two APUs caught fire during rollout.
B. GPC failed on touchdown.
C. Incorrect flight control rechannelization on rollout.
A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.
B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.
C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.
Mercury MA-7 | 5/24/1962 | Crew: 1
Pitch horizon scanner failed, resulting in manual entry and off-target landing. Delayed crew recovery.
On May 24, 1962 the failure of the spacecraft pitch horizon scanner required the pilot to assume manual control of the spacecraft for retrofire. As a result, the spacecraft attitude was outside of the recommended range for automatic initiation of the retrofire signal. Manual initiation of the retrofire signal occurred several seconds later than scheduled.
The delay in retrofire initiation and the less-than-ideal spacecraft attitude contributed to the spacecraft landing 250 nautical miles downrange of the intended landing point which delayed crew recovery.
Voskhod 2 | 3/19/1965 | Crew: 2
Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.
On March 19, 1965 a malfunction of the automatic descent system resulted in the use of a backup manual system for entry and landing. Difficulties encountered during manual operation and delayed retrofiring resulted in the spacecraft landing more than 1,000 km downrange from the intended landing point. The wooded, mountainous terrain caused a delay in crew recovery. (Actual distance of overshoot varies in the source documents, but most sources indicate a distance between 1,000 km and 2,500 km.)
Gemini 4 | 6/7/1965 | Crew: 2
Erroneous entry data uplinked; crew manually corrected entry flight profile.
On June 7, 1965 the computer could not be updated for entry, could not be turned off, and then stopped working entirely. The crew resorted to a rolling Mercury-type entry, rather than the lifting bank angle the computer was supposed to help them achieve.
Soyuz 33 | 4/12/1979 | Crew: 2
Backup engine burned 25 seconds too long on de-orbit. Ballistic entry.
On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)
Soyuz T-11 | 10/2/1984 | Crew: 3
Partial failure of atmospheric entry control system.
Partial failure of the atmospheric entry control system of Soyuz T-11 led to a moderately high (5-6 g) deceleration force.
Soyuz 15 | 8/28/1974 | Crew: 2 | Related or Recurring event | Loss of Mission
Failed to dock with Salyut 3 due to Igla system malfunction.
The Soyuz 15 mission launched on August 26, 1974. Its primary mission was to dock to the Saylut 3 military space station to conduct the second phase of crewed operations aboard the Salyut 3 space station. However, docking to the Salyut 3 space station was unsuccessful due to the failure of the Igla rendezvous system and the inability to complete docking in manual mode. Due to this inability to dock, as well as spacecraft battery power limitations, the Soyuz crew was forced to abandon the mission and return to Earth within two days of launch. Gyroscope problems nearly prevented orientation of the spacecraft for the de-orbit burn. After landing, the crew was recovered on August 28, 1974.
The state commission found that the Soyuz Igla docking system needed serious modifications which could not be completed before the Salyut 3 space station decayed beyond a useable orbit. Therefore, the planned Soyuz 16 spacecraft became unnecessary to the program. (It was later flown as Soyuz 20 to a civilian Salyut station, even though it exceeded its two-year rated storage life.)
Soyuz 10 | 4/23/1971 | Crew: 3 | Related or Recurring event | Loss of Mission
Automatic docking system failed. Manual docking with Salyut not achieved.
On April 23, 1971 during automatic approach to Salyut, the Soyuz began to oscillate. The crew went to manual control and was able to complete mechanical capture. During retraction of the probe, the engines began firing because the Soyuz control system was still active. This caused damage to the docking mechanism, which stopped the probe retraction and prevented the Soyuz from completing docking to the Salyut. The crew was instructed to reconfigure cables which allowed them to send a command to release the probe's capture latches. Soyuz was released, and landing occurred on April 25.
Skylab 2 | 5/26/1973 | Crew: 3 | Related or Recurring event
Multiple failed automatic docking attempts resulted in manual docking to Skylab.
On May 26, 1973 numerous failed docking attempts resulted in the use of contingency in-flight procedures to bypass the automated docking system. Successful docking to the Skylab station ultimately relied on manual control and crew piloting skills.
The contingency procedure required the Skylab 2 crew members to don pressure suits, depressurize the command module cabin, open the tunnel hatch, cut wires in the probe, and connect the emergency probe-retract cable using a utility power outlet. The crew members were able to fire the probe-retract pyrotechnic and complete docking manually.
The failure to dock would have resulted in the loss of Skylab due to the inability to perform critical repairs.
Soyuz T-8 | 4/22/1983 | Crew: 3 | Related or Recurring event | Loss of Mission
Loss of rendezvous antenna prevented docking.
On April 20, 1983 the loss of rendezvous antenna prevented docking.
The Soyuz rendezvous radar antenna failed to deploy properly before docking attempts with Salyut 7. Several attitude control maneuvers at high rates were attempted but failed to swing the boom out. A rendezvous using only an optical sight and ground radar inputs for guidance was attempted, but was aborted when it was thought the vehicles were closing too fast. No further attempts were made to dock with the station.
The post-flight inquiry later discovered that the antenna was torn off when the Soyuz payload shroud separated.
SR-71 | 7/30/1966 | Crew: 2 | Loss of Crew (1)
Loss of control at high speed and altitude.
On January 25, 1966 the SR-71 aircraft disintegrated during a high-speed, high-altitude test flight when the breakdown of super sonic airflow resulted in engine cutoff (also known as engine un-start). This occurred during a turn at speeds exceeding Mach 3.17 and a bank of 35 degrees. The bank immediately increased to 60 degrees. The nose pitched up and the aircraft broke apart. The pilot was thrown clear (his ejection seat never left the plane). He blacked out during the accident, but recovered and landed on the ground safely. His Reconnaissance System Officer did not survive the high-g bailout.
M21-D21 | 7/30/1966 | Crew: 2 | Loss of Crew (1)
D21 drone collided with M21 during launch, causing M21 breakup. Crew survived breakup but one was lost after water landing.
On July 30, 1966 as the M-21 mothership was performing a flight test for launching the D-21 drone, while traveling at high Mach speeds the drone was not able to penetrate the shock wave coming off the mothership. The D-21 had almost cleared the rudders of the M-21 when the drone bounced off the shockwave and pitched down, striking the M-21 and breaking it in half. The Pilot and Launch Control Officer (LCO) stayed with the tumbling wreckage of the plane a short time until a lower altitude was reached, then ejected over the Pacific Ocean.
Both crew members made safe ejections and landings, but after landing the LCO opened his helmet visor by mistake and his suit filled with water, causing him to drown. All subsequent flights of the D-21 were as D-21Bs, which were reconfigured to launch the drone from an under wing pylon of a B-52 (much like the X-15 had been), boosted to Mach 3 by a rocket motor that was jettisoned after the D-21Bs Marquardt ramjet was started.
Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission
Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.
After achieving orbital insertion on April 23, 1967 the left solar array of the Soyuz 1 spacecraft did not deploy, causing the spacecraft to receive only half of the planned solar power. Despite the solar array failure, the crew member attempted to maneuver the spacecraft. The attempt was unsuccessful because of interference between the reaction control system exhaust and the ion flow sensors.
The failure of the solar array to deploy also prevented the cover of the sun and star sensor from opening, preventing attitude control for crucial maneuvers such as spin stabilization and engine firings. The failures on Soyuz 1 prevented the launch of Soyuz 2, which had been scheduled to rendezvous and dock with Soyuz 1, causing the Soyuz 1 mission to be ended early.
Due to the failures with the control systems, the cosmonaut had to manually control the spacecraft for the critical de-orbit burn and entry while also managing the power supply of the crippled vehicle. (See also Soyuz 1 entry event)
STS-9 | 12/8/1983 | Crew: 3
Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.
On December 8, 1983 about five hours prior to the planned landing time, the orbiter's General Purpose Computer (GPC) 1 failed when the primary Reaction Control System jets were fired. About six minutes later GPC 2 also failed, leaving the orbiter in free drift for approximately five minutes before GPC 3 was brought online in OPS 3 entry mode (GPC 3 had been freeze dried for on-orbit operations). Attempts to bring GPC 1 back online were unsuccessful, and it was powered down.
Although problems had occurred, GPC 2 was reinitialized and placed back online, and GPCs 2, 3, 4, and 5 were configured for entry. This off-nominal configuration led to further problems, and delayed the landing time by about eight hours. Entry was set up without GPC 1, and upon landing GPC 2 failed again. Particle Impact Noise Detection testing was instituted to screen out any contamination of the GPC boards, and a spare GPC was flown for several flights after STS-9, but was later dropped as a requirement.
STS-44 | 11/24/1991 | Crew: 6 | Minimum Duration Flight
Failure of IMU 2 caused MDF to be declared. 10-day mission shortened to 7 days.
Failure of Inertial Measurement Unit (IMU) number 2 on November 24, 1991 caused minimum duration flight to be declared. The 10-day mission was shortened to seven days. In an attempt to recover normal operation of the IMU, it was placed in standby, operate, and then power cycled. These actions were not successful. Failure of this IMU invoked a flight rule requiring minimum duration flight for loss of one IMU.
Post-flight troubleshooting in the Inertial Systems Laboratory at Johnson Space Center isolated the problem to a failed computer interface card. This card converts analog acceleration signals into digital signals. The failed card was sent to the manufacturer for further analysis which revealed that a filter capacitor (C14), located within a chopper-stabilized amplifier hybrid component (U12) in the Z-accelerator channel, had shorted. This short circuit caused a bond wire from U12 pin 9 to the card case to fuse open.
Mir | 7/17/1997 | Crew: 3
Accidental unplugging of computer power cable led to loss of attitude control and loss of power.
On July 16, 1997 a cosmonaut inadvertently unplugged a central computer power cable while disconnecting cables for upcoming repairs of the Spektr module. The temporary loss of power caused the central computer to shut down, resulting in the loss of attitude control and Mir going into free drift. In free drift the Mir was unable to accurately point its solar arrays to provide sufficient power. Once in free drift, the ground and flight crew failed to turn off equipment to reduce power demand, which resulted in depletion of stored energy in the flight batteries and complete loss of power on Mir.
The Progress M-35 supply spacecraft was used to reorient the Mir to restore nominal solar array power generation, recharge flight batteries, and subsequently restore Mir attitude control functions.
ISS, Increment 2 | 4/24/2001 | Crew: 10
Failure of all U.S. command and control computers on ISS.
On April 24, 2001 the ISS Command and Control (C&C) Multiplexer/Demultiplexer (MDM)-1 suffered hard drive errors that resulted in C&C-1 going offline.C&C-2 automatically switched from backup to primary mode, but suffered hard drive errors. C&C-3 was brought online but also failed. This resulted in complete loss of command and control to the United States orbital segment. C&C-2 was restored and placed into operation in primary mode. Flight controllers were able to uplink critical C&C software into the dynamic random access memory of C&C-3. C&C-3 was declared operational except the hard drive. C&C-1 was replaced with an identical payload computer.
If the MDMs were unrecoverable, the failure could have resulted in the loss of the United States orbital segment.
ISS, Increment 15 | 6/10-6/18/2007 | Crew: 10
Power switch failures caused loss of ISS propulsive attitude control capability.
On June 10-18 2007 Russian computers that provide ISS propulsive attitude control [ТВМ], and Russian segment command and control capability [ЦВМ], experienced multiple automatic and manual restarts. ISS attitude control was maintained by the docked shuttle (Atlantis STS-117/13A) while Russian specialists and US teams worked to restore consistent power to the computers. The Russian cosmonauts were able to re-establish two of three computers on both systems ([ТВМ], [ЦВМ]) by June 18 after bypassing the secondary power circuitry to provide a continuous “ON” command.
Troubleshooting later identified the root cause to be an electrical short in the line resulting from corrosion of cabling within the Command Acquisition (Processing) Unit [БОК3] which monitors power. The short caused a power-off command to be passed to all six computers. The corrosion was presumed to be caused by increased humidity resulting from the close proximity of an air separator to the [БОК3]. The [БОК3] was subsequently relocated to a separate compartment.
If the Russian computers were unrecoverable, the failure could have resulted in the loss of ISS attitude control and loss of ISS.
SpaceShipOne 14P | 5/13/2004 | Crew: 1
Flight computer unresponsive. Recovered by rebooting.
On May 13, 2004 the flight computer on SpaceShipOne became unresponsive. During the boost following the vertical part of the trajectory, the avionics display flickered and went blank. The ground displays did not show an error. The avionics display on SpaceShipOne came back on as soon as the motor shut down.
Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.
SpaceShipOne 16P | 9/29/2004 | Crew: 1
Uncommanded vehicle roll. Control regained prior to apogee.
On September 29, 2004 SpaceShipOne performed a series of 60 rolls during last stage of engine burn. SpaceShipOne coasted to 103 km of altitude and successfully completed the first of two X-Prize flights. The motor was shut down when the pilot noted that his altitude predictor exceeded the required 100 km mark. During the motor burn the spacecraft began to roll uncontrollably, but the pilot continued despite advice from the ground to shut the motor down and abort the attempt.
The thin air at that altitude meant that the control surfaces didn't have enough air flowing over them, so they lost effectiveness to compensate for the roll as the spacecraft pointed nearly straight up. The pilot needed to correct the rolling that occurred because of asymmetric thrust coming from the engine.
To correct the issue for the 17P flight, the amount of allowable “down pitch trim” was limited, to avoid the negative-lift condition. The solution was to more gently turn the corner, such that a forward correction later would not be needed. Pointing straight up at burnout was determined to be acceptable, as long as negative lift was not created. This problem was corrected on SpaceShipTwo.
Apollo 10 | 5/22/1969 | Crew: 2
Switch misconfiguration resulted in lunar module control problems.
In May 22, 1969 a switch misconfiguration resulted in lunar lander control problems.
During the Lunar Module (LM) last pass, within eight miles of the moon and prior to the jettison of the LM Descent Stage, the Commander (while wearing a space suit) started to troubleshoot an electrical anomaly.
The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.
The attitude indicator was going to the red zone and in danger of tumbling the inertial platform. The Commander was able to grab the hand controller, switch to manual control, jettison the Descent Stage, control the LM Ascent Stage, and finally dock with the CSM.
LANDING & POSTLANDING