HOW TO USE THIS TOOL
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
SRB Seal Events (1981-96)
Soyuz 1 4/24/67
Apollo 15 8/7/1971
Mercury MA-6 2/20/1962
STS-6, 4/83, Crew: 4*
*toxic byproducts released
Gemini 8 3/16-3/17/1966
Soyuz 1 4/23/1967
Soyuz 33 4/12/1979
ISS, Increment 2 4/24/2001
ISS, Increment 15 6/10-6/18/2007
Apollo 12 11/14/1969
Soyuz 18-1(18a) 4/5/1975
STS-51L (Challenger) 1/28/1986
Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event
Main and reserve parachutes failed.
On April 24, 1967 on the maiden flight of the Russian Soyuz spacecraft, the cosmonaut encountered an anomaly with the parachute system during descent. During the descent the drag chutes successfully deployed, but the main chutes failed to deploy from their container. Detecting increasing speeds, the computer deployed a backup parachute. Because the drag chute was still attached and failed to release, the backup chute became tangled with the drag chute, preventing the deployment of the backup chute and resulting in a high-speed impact with the ground.
One cosmonaut was lost.
Apollo 15 | 8/7/1971 | Crew: 3
Landed with only 2 of 3 parachutes.
On August 7, 1971 the Apollo capsule, Endeavour, dropped into the Pacific Ocean about 320 miles (515 kilometers) north of Hawaii. During the Earth landing phase, after the main parachutes were deployed and shortly after Reaction Control System (RCS) propellant dumping, one of the main parachutes was observed to be deflated when exiting the clouds (3 of 6 fabric risers failed and two-thirds of the suspension lines were missing). One of the main parachutes was recovered after landing, but the failed parachute was not recovered.
The investigation was divided into three areas which were likely causes of the parachute failure.
The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.
A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.
The Command Module RCS propellant depletion firing had just been completed, and fuel (monomethyl hydrazine) expulsion was in progress at the time of the failure, indicating the possibility of damage from propellants.
Analysis and testing ruled out possible causes one and two, but a test of raw fuel expulsion after RCS firing produced burning outside of the engine. The flame front extended up to eight feet from the engine exit and unburned fuel was sprayed up to 10 feet from the engine and ignited by burning droplets. This was considered the most likely cause of the parachute failure.
STS-9 | 12/8/1983 | Crew: 6
A. Two APUs caught fire during rollout.
B. GPC failed on touchdown.
C. Incorrect flight control rechannelization on rollout.
A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.
B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.
C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.
Mercury MA-6 | 2/20/1962 | Crew: 1
False landing-bag indicator light led to entry with retropack in place as a precaution.
On February 20, 1962 a sensor indicated the heatshield was in an unlatched condition while still in orbit. If the sensor's reading were true, the heatshield could have been lost during entry, resulting in the loss of the vehicle and crew. Because the indictor said the heatshield had been dropped to the landing position, entry procedures were changed to eliminate the jettisoning of the retropack. The retropack was used as a redundant heatshield hold-down device to keep the heatshield in place. The straps holding the retropack burned through during entry, but it was thought that the aerodynamic pressure would hold the heatshield in place. After landing it was discovered that the indicator was incorrect and that the heatshield had not been dropped to the landing position.
Related or Recurring event
In addition to the three overheating/fire events on the ISS and the two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:
Mir (October 1994) (A)
STS-40 (June 1991) (B)
STS-35 (December 1990) (C)
STS-28 (August 1989) (D)
STS-6 (April 1983) (E)
Salyut 7 (September 1982) (F)
Salyut 6 (1979) (G)
Salyut 1 (June 1971) (H)
Information on these events is contained in the reports below.
Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission
Stuck thruster caused loss of control and led to 1st U.S. emergency
During the Gemini 8 flight from March 16 – 17, 1966 a stuck thruster, number 8, which controls roll, caused a loss of control and rapid spin rate of the capsule that could have led to the crew losing consciousness. To counter the effects the stuck thruster was turned off and the re-entry control system had to be used to stabilize the capsule. Use of the re-entry control system led the Gemini safety group to declare an end to the mission, which led to the first United States emergency de-orbit. The thruster apparently short circuited while attached to the Agena target vehicle.
Soyuz 1 | 4/23/1967 | Crew: 1 | Loss of Mission
Failures in attitude control and electrical power systems resulted in a loss of mission. The launch of the intended docking target, Soyuz 2, was scrubbed.
After achieving orbital insertion on April 23, 1967 the left solar array of the Soyuz 1 spacecraft did not deploy, causing the spacecraft to receive only half of the planned solar power. Despite the solar array failure, the crew member attempted to maneuver the spacecraft. The attempt was unsuccessful because of interference between the reaction control system exhaust and the ion flow sensors.
The failure of the solar array to deploy also prevented the cover of the sun and star sensor from opening, preventing attitude control for crucial maneuvers such as spin stabilization and engine firings. The failures on Soyuz 1 prevented the launch of Soyuz 2, which had been scheduled to rendezvous and dock with Soyuz 1, causing the Soyuz 1 mission to be ended early.
Due to the failures with the control systems, the cosmonaut had to manually control the spacecraft for the critical de-orbit burn and entry while also managing the power supply of the crippled vehicle. (See also Soyuz 1 entry event)
Soyuz 33 | 4/12/1979 | Crew: 2 | Loss of Mission
Main engine anomaly caused final rendezvous abort.
On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)
STS-2 | 11/21/1981 | Crew: 2 | Minimum Duration Flight | Crew Injury
Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.
During the flight of STS-2, which spanned from November 12 – 14, 1981, fuel cell failure led to the declaration of a minimum duration flight (MDF). In addition to the MDF, the failure of the fuel cell also led to high hydrogen levels in the drinking water. The fuel cells used produce drinking water as a by product. When the crew drank this water it provoked a need to belch. Belching in zero g leads to regurgitation. The crew avoiding drinking the water in order to avoid belching, which caused crew dehydration. Prior to entry, crew members fluid load to offset fluid shift when returning from orbit. The crew dehydration increased the effects of the fluid shift and could have posed a risk during high g entry procedures due to a higher chance for loss of consciousness.
STS-9 | 12/8/1983 | Crew: 3
Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.
On December 8, 1983 about five hours prior to the planned landing time, the orbiter's General Purpose Computer (GPC) 1 failed when the primary Reaction Control System jets were fired. About six minutes later GPC 2 also failed, leaving the orbiter in free drift for approximately five minutes before GPC 3 was brought online in OPS 3 entry mode (GPC 3 had been freeze dried for on-orbit operations). Attempts to bring GPC 1 back online were unsuccessful, and it was powered down.
Although problems had occurred, GPC 2 was reinitialized and placed back online, and GPCs 2, 3, 4, and 5 were configured for entry. This off-nominal configuration led to further problems, and delayed the landing time by about eight hours. Entry was set up without GPC 1, and upon landing GPC 2 failed again. Particle Impact Noise Detection testing was instituted to screen out any contamination of the GPC boards, and a spare GPC was flown for several flights after STS-9, but was later dropped as a requirement.
STS-44 | 11/24/1991 | Crew: 6 | Minimum Duration Flight
Failure of IMU 2 caused MDF to be declared. 10-day mission shortened to 7 days.
Failure of Inertial Measurement Unit (IMU) number 2 on November 24, 1991 caused minimum duration flight to be declared. The 10-day mission was shortened to seven days. In an attempt to recover normal operation of the IMU, it was placed in standby, operate, and then power cycled. These actions were not successful. Failure of this IMU invoked a flight rule requiring minimum duration flight for loss of one IMU.
Post-flight troubleshooting in the Inertial Systems Laboratory at Johnson Space Center isolated the problem to a failed computer interface card. This card converts analog acceleration signals into digital signals. The failed card was sent to the manufacturer for further analysis which revealed that a filter capacitor (C14), located within a chopper-stabilized amplifier hybrid component (U12) in the Z-accelerator channel, had shorted. This short circuit caused a bond wire from U12 pin 9 to the card case to fuse open.
STS-83 | 4/6/1997 | Crew: 7 | Loss of Mission
Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.
A failure of fuel cell (FC) number two resulted in a minimum duration flight being declared on April 6,1997. The 16-day mission was reduced to four days due to FC problems encountered on flight day two. During prelaunch operations the differential voltage on FC 2, substack 3 remained above the 150mV limit (defined in the Operations and Maintenance Requirements Specification Document) for an unusually long period of time before dropping below 150 mV. The substack delta voltage began to trend upward shortly after on-orbit operations began at approximately two hours Mission Elapsed Time. FC purges were ineffective at stopping the trend. FC 2 was subsequently shut down and safed to prevent the possibility of a crossover condition, and multiple payloads had to be powered down. FCs 1 and 3 continued to carry the total orbiter load and performed nominally.
Post-flight failure analysis of FC 2 did not identify a root cause for the on-orbit anomaly experienced, but did identify degraded cells and verified the cell performance monitor (CPM) was functioning properly. No foreign material/contaminant was found and the most credible scenario implies an abnormal external event affected a group of cells prior to start–up. It has been hypothesized that this external event was the presence of oxygen in the oxygen side of substack 3 of the FC at a time when the FC was supposed to be inerted with helium. This event over time would cause oxidation of the nickel Electrolyte Reservoir Plate and dissolution of palladium and platinum in the anodes. Migration and plating of the palladium onto the cathode catalyst would cause high open circuit voltage once full reactants are applied to the FC.
As a result of this anomaly and failure analysis, the Launch Commit Criteria was revised to not allow launching with an FC showing similar prelaunch CPM readings. Kennedy Space Center FC purge procedures were also modified to preclude the potential for the presence of oxygen in inerted fuel cells. The program also designed and tested a fuel-cell monitoring system (FCMS) which finally provided individual cell-health monitoring capability (STS-87 first flight). If the FCMS had been available for STS-83, it may have precluded the shutdown of the FC and may have allowed the mission to complete its planned duration.
ISS, Increment 2 | 4/24/2001 | Crew: 10
Failure of all U.S. command and control computers on ISS.
On April 24, 2001 the ISS Command and Control (C&C) Multiplexer/Demultiplexer (MDM)-1 suffered hard drive errors that resulted in C&C-1 going offline.C&C-2 automatically switched from backup to primary mode, but suffered hard drive errors. C&C-3 was brought online but also failed. This resulted in complete loss of command and control to the United States orbital segment. C&C-2 was restored and placed into operation in primary mode. Flight controllers were able to uplink critical C&C software into the dynamic random access memory of C&C-3. C&C-3 was declared operational except the hard drive. C&C-1 was replaced with an identical payload computer.
If the MDMs were unrecoverable, the failure could have resulted in the loss of the United States orbital segment.
ISS, Increment 15 | 6/10-6/18/2007 | Crew: 10
Power switch failures caused loss of ISS propulsive attitude control capability.
On June 10-18 2007 Russian computers that provide ISS propulsive attitude control [ТВМ], and Russian segment command and control capability [ЦВМ], experienced multiple automatic and manual restarts. ISS attitude control was maintained by the docked shuttle (Atlantis STS-117/13A) while Russian specialists and US teams worked to restore consistent power to the computers. The Russian cosmonauts were able to re-establish two of three computers on both systems ([ТВМ], [ЦВМ]) by June 18 after bypassing the secondary power circuitry to provide a continuous “ON” command.
Troubleshooting later identified the root cause to be an electrical short in the line resulting from corrosion of cabling within the Command Acquisition (Processing) Unit [БОК3] which monitors power. The short caused a power-off command to be passed to all six computers. The corrosion was presumed to be caused by increased humidity resulting from the close proximity of an air separator to the [БОК3]. The [БОК3] was subsequently relocated to a separate compartment.
If the Russian computers were unrecoverable, the failure could have resulted in the loss of ISS attitude control and loss of ISS.
SpaceShipOne 14P | 5/13/2004 | Crew: 1
Flight computer unresponsive. Recovered by rebooting.
On May 13, 2004 the flight computer on SpaceShipOne became unresponsive. During the boost following the vertical part of the trajectory, the avionics display flickered and went blank. The ground displays did not show an error. The avionics display on SpaceShipOne came back on as soon as the motor shut down.
Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.
STS-93 | 7/23/1999 | Crew: 5
At T+5 a short on AC1 Phase A resulted in loss of SSME1 Controller A and SSME3 Controller B.
SSME3 H2 leak: early LOX depletion and shutdown.
STS-93 encountered two close-call events.
STS-114 | 5/26/2006 | Crew: 7
Bird strike on External Tank.
Loss of foam from External Tank PAL ramp.
TPS gap filers protruding. Removed during third mission EVA.
Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward
separation bolt function and damaging secondary structure and a thermal blanket.
STS-114 encountered four close-call events.
STS-117 | 6/8/2007 | Crew: 7
Thermal blanket damage. EVA performed to repair damage.
On June 8, 2007 during ascent, a thermal blanket covering the port orbital maneuvering system (OMS) pod was damaged.
An unplanned extravehicular activity, a high risk operation, was performed to repair the damaged blanket, so the blanket could effectively prevent potential damage to the vehicle from heating during entry. Failure of the thermal protection during entry could have resulted in overheating of the OMS and catastrophic structural failure of the vehicle and loss of crew.
The blanket was repaired by inserting pins between the thermal blanket and the surrounding shuttle tiles. A surgical stapler was also used in fastening the two thermal blankets together.
STS-112 | 10/7/2002 | Crew: 6
T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.
The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.
The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.
All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.
Apollo 12 | 11/14/1969 | Crew: 3
Lightning strike on ascent.
During the Apollo 12 launch on November 14, 1969 lightning struck the spacecraft.
Light rain was falling, but weather conditions did not indicate any thunderstorm activity. There were seven miles of visibility with cloud break estimated at 800 feet and overcast conditions at 10,000 feet.
At 11:22am, T+36 seconds, the crew saw a bright light.
At T+36.5 seconds many errors occurred: Fuel Cells 1, 2, and 3 disconnected; Main Buses A and B were under-voltage; Alternating Current (AC) Buses 1 and 2 overloaded. The warning lights and alarm came on in the cabin, indicating failure of the Inertial Stabilization System.
At T+52 seconds (13,000 feet) lightning struck the vehicle and the Inertial Measurement Unit platform tumbled.
The potential effect on the vehicle was induction into wiring, depending on the location and rate of change of potential and direct current flow in grounding. The high negative voltage spike (delta voltage/delta time) caused the Silicon Controlled Rectifiers to trip on the Fuel Cell and AC Inverter overload sensors. Failures occurred in four Service Module Reaction Control System helium tank quantity measurements, five thermocouples, and four pressure/temperature transducers.
Using power from the Battery Relay Bus, the crew reconnected the Fuel Cells to Main Bus A and B, and reconnected the inverters to AC Bus 1 and 2. The mission continued.
Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission
Electrical fault caused premature firing of half of the 2nd stage separation bolts, resulting in the inability to fire the remaining ones. Staging failure resulted in abort sequence being used at T=295 seconds.
During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches. When the core first stage burned out, it could not be cast off as designed.
Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.
The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice. After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.
One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.
STS-51F | 7/29/1985 | Crew: 7 | Abort to Orbit
Temperature sensor problems resulted in SSME1 shutdown at T+5:45.
On July 29, 1985 at T+5:43, both temperature sensors for the Space Shuttle Main Engine (SSME) 1 high pressure fuel turbopump showed readings exceeding the redline limit. This resulted in a premature shutdown of SSME 1 and declaration of an Abort to Orbit condition, the first in program history. At T+8:13, one of the two temperature sensors on SSME 3 indicted a high reading, but auto-shutdown was inhibited to assure STS-51F achieved an acceptable orbit.
These events were a result of confirmed instrumentation failures. The temperature sensors were removed for engineering analysis following the flight, and a new configuration sensor was used on subsequent engines.
STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event
SRB seal failure.
On January 28, 1986 a combustion gas leak developed in the right solid rocket motor aft field joint shortly after solid rocket booster ignition. The resulting hot gas plume exiting the joint impinged upon the SRB lower attachment strut and adjacent external tank structure weakening the structure to the point of failure.
Seventy-four seconds into flight, the Space Shuttle Challenger broke up.
All seven crew members were lost.
STS-91 | 6/2/1998 | Crew: 6
Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.
After the launch of STS-91 on June 2, 1998, a channel A main engine pressure chamber sensor froze. The sensor was disqualified by engine control software when the sensor exceeded allowable limits during the max Q engine throttle down sequence however the sensor remained qualified for engine redline monitoring since the reading was still within reasonableness limits / operational range for the sensor. The channel B sensor and the main engine performed nominally throughout ascent. If an engine problem had occurred, the channel B sensor would have displayed the correct information and indicated the proper corrective action. However, the channel B sensor would have been ignored due to the frozen channel A sensor.
The post-flight inspection revealed that contamination from a seal leak check caused the sensor to freeze. Marshall Space Flight Center (MSFC) project engineering suggested adding a V-seal leak check prior to the acceptance test, to ensure the newly added V-seal was installed properly. However, MSFC project engineering was unaware that performing the leak check would require the manufacturing personnel to plug the chamber pressure port with Viton. After the flight, the sensor was still plugged with a piece of Viton.
If the main engine pressure chamber sensor froze later in the flight, logic errors may have triggered a premature engine shutdown and a return to the launch site abort. Post-flight software changes were implemented to prevent this from occurring on subsequent flights. Additionally, a one-time flow check verified the reliability of the Lee-Jet for all engines in the fleet. A corrective action requires post-Lee-Jet installation flow check and borescope inspection for future engine builds. Lastly, the V-seal leak check was eliminated in future engine builds.
Related or Recurring event
Soyuz Landing Events
LANDING & POSTLANDING