HOW TO USE THIS TOOL
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
Other significant ascent debris events have occurred on:
Late Release Orbiter Tyvek Covers
Other significant STS TPS anomalies:
STS-6, 41B, 51G, 27*, 28, 40, 42, 45
*Most severe tile damage to date.
Soyuz TM-25 8/17/1997
Gemini 6 12/12/1965
Apollo 1 (AS-204) 1/27/1967
Other On-pad Abort Events:
STS-51F, STS-55, STS-51, STS-68
Soyuz T-10-1(T-10a) 9/26/1983
Apollo 12 11/14/1969
Apollo 13 4/11/1970
X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew
Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.
On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.
The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive. While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.
This was the first United States spaceflight fatality.
Related or Recurring event
Other Thermal Protection System Damage Events
In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:
STS-6 (April 1983)
STS-41B (February 1984)
STS-51G (June 1985)
STS-27 (December 1988)
STS-28 (August 1989)
STS-40 (June 1991)
STS-42 (January 1992)
STS-45 (March 1992)
Additional information can be found in the reports linked below.
STS-6 Mission Report STS-41B MER Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report
Soyuz TM-25 | 8/17/1997 | Crew: 3
Landing rockets fired at heat shield separation rather than at landing.
On August 17, 1997 the landing rockets on Soyuz TM-25 fired during heat shield separation rather than during landing. This failure resulted in a harder landing than normal.
The Mir with the docked Soyuz was experiencing high humidity levels in the atmosphere. Water condensing on the connectors in the Soyuz electrical box controlling the circuit probably caused a short circuit, which caused the rockets to fire when the system was armed at heat shield physical separation. Changes were made to either seal the connectors or separate the connectors to prevent a short from applying electrical power to the rockets when the system is armed.
The design has two primary types of inhibits. One inhibit consists of three mechanical switches that physically disconnect the firing circuit when the heat shield is attached. These switches are spring loaded and move approximately 20 mm as the heat shield is deployed to close the firing circuit. A minimum of two out of three switches must be closed for the initiating system to function. In addition to these mechanical inhibits, logic in the electronics prevents the ignition command from being sent until after the heat shield is deployed. Nominally the soft landing motors are ignited when the gamma ray altitude/velocity sensor detects proximity to the ground. The system automatically initiates either four or six motors depending on the velocity. Each motor has 1 kg of propellant and burns for approximately 0.1 to 0.14 seconds.
STS-130 | 2/10/2010 | Crew: 6 | Related or Recurring event
Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.
On February 10, 2010 there were significant oscillations between the orbiter and ISS on STS-130 during final ring retraction, requiring an additional 34 minutes in free drift to complete docking. Similar oscillations were observed during STS-133 docking.
Post-flight analysis from the STS-130 event indicated that the oscillations were caused by gravity gradient effects on the integrated vehicle stack (ISS/Shuttle) resulting in misalignment of the final docking ring and loss of the “RING ALIGN” indication. When the “RING ALIGN” indication is lost, the fixers are released, resulting in large misalignments.
Concern for ISS longeron shadowing and lack of data resulted in the Missions Operations Directorate not accepting the recommendation to rely on the fixers to maintain the alignment even after loss of “RING ALIGN” until after STS-133.
STS-133 | 2/26/2011 | Crew: 6 | Related or Recurring event
Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.
On February 26, 2011 STS-133 experienced significant misalignment between the orbiter and the ISS during post-capture free drift due to gravity-gradient-induced motion.
There were significant oscillations between the orbiter and ISS on STS-133 during final ring retraction. The orbiter tipped approximately 10 degrees in pitch and four degrees in roll while ring retraction was paused. The time from contact to hardmate took 50 minutes.
Post-flight analysis of STS-133 docking operations raised several concerns, including vehicle-to-vehicle clearance, mechanism-to-mechanism contact, ISS free drift risks (longeron shadowing risk), timeline impacts, and the lack of a good integrated analysis tool.
At the Generic Joint Operations Panel on April, 6 2011 it was stated that the docking mechanism fixers will be used to maintain alignment during retraction. Engineering and safety agreed with the recommendation. The docking procedures were updated prior to STS-134/ULF6.
STS-95 | 10/29/1998 | Crew: 7 | Related or Recurring event
Drag chute door separated during launch and impacted main engine bell.
On October 29, 1998 during the main engine ignition sequence, the drag chute panel fell away from the vehicle. Video of the launch confirmed the drag chute door detached three seconds prior to liftoff and hit the engine nozzle of Space Shuttle Main Engine (SSME) 1.
The remains of the door were found during a post-launch pad inspection, revealing that at least one aluminum shear pin used to attach the door sheared. The root cause of the shearing was a combination of the high pressure environment caused by SSME ignition and a low margin hinge pin. The drag chute door struck the nozzle of the center main engine but did not do any appreciable damage to the engine or vehicle. Concerns about the status and condition of the chute contained in the drag chute compartment resulted in the decision not to deploy the chute during landing.
As a precautionary measure, two subsequent missions used a solid closeout panel bolted over the drag chute compartment and did not utilize the drag chute. All flights following these missions used Inconel instead of aluminum as shear pin material.
STS-114 | 5/26/2006 | Crew: 7
Bird strike on External Tank.
Loss of foam from External Tank PAL ramp.
TPS gap filers protruding. Removed during third mission EVA.
Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward
separation bolt function and damaging secondary structure and a thermal blanket.
STS-114 encountered four close-call events.
Gemini 6 | 12/12/1965 | Crew: 2
Main engine shutdown. Booster left unsecured on pad. Crew elected not to eject. Launched 3 days later. After the failed launch attempt, review of engine data and an inspection of the number 2 engine revealed that a plastic dust cover had been inadvertently left on the oxidizer gas generator inlet port causing blockage of oxidizer to the gas generator. Ground procedures were modified to ensure removal of dust covers during engine assembly.
There was a main engine shutdown during the attempted launch on December 12,1965.
About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.
The rocket malfunction detection system sensed an anomaly since there was no upward motion associated with the start of the clock and triggered engine stop. The booster was left unsecured on the pad with the crew inside. The crew members elected to remain in the capsule until the gantry was returned.
A successful launch occurred three days later.
Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew
Crew cabin fire (electrical short + high pressure O2 atmosphere).
On January 27, 1967 the crew cabin of Apollo 1 caught fire during a test with three crew members inside. The cabin was filled with a pure oxygen atmosphere and pressurized greater than ambient pressure (16.7 psi). Over the course of several hours, the oxygen permeated all materials in the cabin, which had been tested to the normal flight pressure of pure oxygen (5 psi). When the fire began it spread rapidly. Due to the pressure in the cabin, the crew members could not open the hatch to escape. Technicians in the room outside the capsule attempted to open the hatch but were driven back by the heat and smoke. Some technicians donned the available gas masks, but the masks were designed to protect against hypergolic propellant fumes, not smoke. Consequently, these technicians lost consciousness after a short time in the smoke-filled room.
All three crew members were lost.
The fire was caused by an electrical short from an unprotected wire. A subsequent review of all wiring dioded to both Main Bus A and B identified a problem with an environmental control system instrumentation wire powered from Main Bus A and B. The wire was routed over plumbing lines on the crew compartment floor, located below the left-hand crew seat, going into the left-hand equipment bay, between the environmental control unit and the oxygen panel. This Teflon-insulated wire should have had a protective Teflon overwrap, but closeout photos showed that the overwrap had slipped down, no longer providing protection. The commander likely contacted this wire with his foot when he turned to change his communications cable. The most probable initiator of the fire is an electrical arc from this wire, which was unprotected from external damage.
Factors contributing to this accident include:
STS-1 | 4/12/1981 | Crew: 2
SRB ignition pressure wave caused TPS and structural damage.
During the April 12, 1981 launch of STS-1, a higher than expected solid rocket booster ignition pressure wave caused damage to both the thermal protection system and structure.
Other On Pad Aborts | Related or Recurring events
On pad aborts have also occurred on:
STS-51F: On July 12, 1985 the first launch attempt of STS-51F was aborted at T-4.2 seconds. The chamber coolant valve on Space Shuttle Main Engine 2 needed to move from the 100% open setting to the 70% open setting required for startup, but the valve responded slowly. The launch was aborted and the vehicle safely shut down.
STS-55: On March 22, 1993 the third launch attempt of STS-55 was aborted at T-3 seconds when the Space Shuttle Main Engine (SSME) 3 oxidizer preburner purge pressure exceeded the maximum pressure. The monitor detected that the combustion product pressure exceeded the 50 psi redline due to one of the five check valves in the purge system leaking. The launch was aborted and the vehicle safely shut down. All three SSMEs were replaced before the next launch attempt.
STS-51: On August 12, 1993 the first launch attempt of STS-51 was aborted at T-3 seconds because of a disagreement in the turbine fuel flow sensors of Space Shuttle Main Engine (SSME) 2. At 0.6 seconds after ignition SSME 2 experienced a failure of the fuel flow meter channel A2 speed pickup coil sensor (loss of redundancy) to respond to the start transient. The main engine controller used the A and B flow rate measurement data for closed-loop thrust/mixture ratio control, and the failure of either the A or B measurements resulted in lockup of the preset engine mixture ratio. As a result of the failure, the engines were safely shut down. All the main engines were replaced before the next launch attempt.
STS-68: On August 18, 1994 the first launch attempt of STS-68 was aborted at T-1.9 seconds. The abort was triggered after the discharge temperature of the high pressure oxidizer turbopump in Space Shuttle Main Engine (SSME) 3 exceeded the redline temperature, causing the main engine controller to issue a shutdown of SSME 3, followed shortly by the General Purpose Computers issuing a shutdown of the other two engines.
Soyuz T-10-1 (T-10a) | 9/26/1983 | Crew: 2 | Loss of Vehicle/Mission | Related or Recurring event
Pad booster fire/explosion. Capsule Escape System used.
Shortly before liftoff on September 26, 1983 fuel spilled around the base of the Soyuz launch vehicle and ignited the vehicle. Launch control activated the escape system, but the control cables were burnt.
Twenty seconds later ground control activated the escape system by radio command. By this time the booster was engulfed in flames.
Explosive bolts fired to separate the descent module from the service module. Explosive bolts also fired to separate of the upper shroud from the lower shroud. The escape system motor pulled the orbit module and descent module, still encased within the upper shroud, away from the booster at 14 to 17g of acceleration.
Seconds after the escape system activated, the booster exploded, destroying the launch complex.
The descent module separated from the orbital module and dropped free from the shroud. The descent module heat shield was discarded to expose the solid-fueled landing rockets. A fast-opening emergency parachute was deployed and landing occurred about four km from the launch pad.
STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event
During the launch attempt on June 26, 1984 all aspects of launch countdown were nominal until T-4 seconds when an irregular operation of the Space Shuttle Main Engine (SSME) 3 main fuel valve resulted in an engine shutdown and pad abort condition.
The SSME 3 main fuel valve failed to open when commanded and leaked hydrogen for approximately 21 minutes following the shutdown. After the abort, fire was seen on the starboard side of the body flap for approximately 12 minutes. The aft base heat shield water deluge system was activated and was able to extinguish the fire. Damage to the orbiter was mostly confined to the body flap despite invisible flames of burning hydrogen reaching 190 feet.
The Mobile Launcher Platform sustained minor scorching damage to a few purge ducts and one burnt ground wire. The cause of the main fuel valve anomaly was attributed to contamination in the hydraulic actuator that was likely present at time of installation.
Additional inspection and ground tests were implemented to detect valve anomalies prior to installation into flight engines. Real-time monitoring of valve operation prior to engine start was also enhanced, and ultraviolet fire sensors were added.
STS-61C | 1/6/1986 | Crew: 7
System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.
On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.
Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).
Corrective action incorporated in response to this close call included modifications to automatic sequencer software to prevent the prerequisite control logic from blocking LOX inboard fill-and-drain valve close commands, updates to countdown procedures and launch constraints to verify closure of the inboard fill-and-drain valve after replenish valve closure and prior to tail service mast vent-and-drain valve opening, monitoring and initiation of holds if the fill-and-drain valve closed indication is lost, implementation of helium repressurization “pulse purge” if ET ullage pressure drops below 0.25 psi, and verification of minimum ET ullage pressure rise rate at T-120 seconds.
A subsequent launch attempt on January 7, 1986 was scrubbed at the T minus 9 minute hold due to weather constraint violations at TAL sites. However, during post launch scrub operations a broken Ground Support Equipment (GSE) LOX temperature probe was found lodged in SSME #2 pre-valve post-detanking. This temperature probe had failed (off-scale high reading) during LOX loading but due to the absence of any mechanical failure history, the failure was assumed to be electrical in nature and the temperature data from this probe was not mandatory for pre-launch loading operations. The broken temperature probe would have prevented closure of pre-valve during flight, at MECO, resulting in an uncontained SSME failure and possible loss of crew, loss of vehicle.
As a result of the broken GSE LOX temperature probe, all GSE LOX temperature probes were inspected and screened for improper welds, monitored during pre-launch operations for any anomalies, and eventually replaced with redesigned probes. A coarse debris screen was also added upstream of the LOX prevalve to prevent large debris from entering into the prevalve.
STS-112 | 10/7/2002 | Crew: 6
T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.
The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.
The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.
All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.
Apollo 12 | 11/14/1969 | Crew: 3
Lightning strike on ascent.
During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.
Light rain was falling, but weather conditions did not indicate any thunderstorm activity. There were seven miles of visibility with cloud break estimated at 800 feet and overcast conditions at 10,000 feet.
At 11:22am, T+36 seconds, the crew saw a bright light.
At T+36.5 seconds many errors occurred: Fuel Cells 1, 2, and 3 disconnected; Main Buses A and B were under-voltage; Alternating Current (AC) Buses 1 and 2 overloaded. The warning lights and alarm came on in the cabin, indicating failure of the Inertial Stabilization System.
At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.
The potential effect on the vehicle was induction into wiring, depending on the location and rate of change of potential and direct current flow in grounding. The high negative voltage spike (delta voltage/delta time) caused the Silicon Controlled Rectifiers to trip on the Fuel Cell and AC Inverter overload sensors. Failures occurred in four Service Module Reaction Control System helium tank quantity measurements, five thermocouples, and four pressure/temperature transducers.
Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.
Apollo 13 | 4/11/1970 | Crew: 3
2nd stage center engine shutdown due to pogo oscillations.
During the April 11, 1970 launch of Apollo 13 severe pogo oscillations were experienced. Acceleration at the engine attachment reached an estimated 34 g (the accelerometer went out of recordable range) before the engine's combustion chamber low-level pressure sensor commanded an engine shutdown.
STS-51F | 7/29/1985 | Crew: 7 | Abort to Orbit
Temperature sensor problems resulted in SSME1 shutdown at T+5:45.
On July 29, 1985 at T+5:43, both temperature sensors for the Space Shuttle Main Engine (SSME) 1 high pressure fuel turbopump showed readings exceeding the redline limit. This resulted in a premature shutdown of SSME 1 and declaration of an Abort to Orbit condition, the first in program history. At T+8:13, one of the two temperature sensors on SSME 3 indicted a high reading, but auto-shutdown was inhibited to assure STS-51F achieved an acceptable orbit.
These events were a result of confirmed instrumentation failures. The temperature sensors were removed for engineering analysis following the flight, and a new configuration sensor was used on subsequent engines.
On-pad Abort Events (1984-93)
Related or Recurring event
TPS Entry Events (1981-2003)
LANDING & POSTLANDING