HOW TO USE THIS TOOL
TEST & VERIFICATION
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
SRB Seal Events (1981-96)
Other significant STS TPS anomalies:
STS-6, 41B, 51G, 27*, 28, 40, 42, 45
*Most severe tile damage to date.
STS-107 (Columbia) 2/1/2003
Apollo 15 8/7/1971
Gemini 5 8/29/1965
Soyuz 11 6/30/1971
ISS Increment 38 12/1/2013
Gemini 6 12/12/1965
Other On-pad Abort Events:
STS-51F, STS-55, STS-51, STS-68
Apollo 13 4/11/1970
Soyuz 18-1(18a) 4/5/1975
Other SRB gas seal anomalies:
STS-2, 6, 41B, 41C, 41D, 51C, 51D, 51B, 51G, 51F, 51I, 51J, 61A, 61B, 61C, 42, 70, 71, 78
STS-51L (Challenger) 1/28/1986
X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew
Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.
On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.
The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive. While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.
This was the first United States spaceflight fatality.
Related or Recurring event
Other Thermal Protection System Damage Events
In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:
STS-6 (April 1983)
STS-41B (February 1984)
STS-51G (June 1985)
STS-27 (December 1988)
STS-28 (August 1989)
STS-40 (June 1991)
STS-42 (January 1992)
STS-45 (March 1992)
Additional information can be found in the reports linked below.
STS-6 Mission Report STS-41B MER Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report
STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event
Right-hand main landing gear door warped due to entry heating.
On April 14, 1981 the right-hand main landing gear door warped due to entry heating. A forward facing step, a tile gap, a tile-to-filler bar gap and an inadequate flow restrictor resulted in excessive gap heating on the forward portion of the right main landing gear door. This excessive heating resulted in severe tile sidewall shrinkage (on four tiles), a charred filler bar, and a localized buckle in the door structure. The structure and Thermal Protection System on the door was refurbished, and the flow restrictor was modified to increase the effectiveness of the Thermal Protection System in the area of the main landing gear doors.
STS-107 (Columbia) | 2/1/2003 | Crew: 1 | Loss of Crew | Related or Recurring event
TPS damage from ascent debris strike resulted in loss of crew and vehicle on entry. Similar bipod ramp foam loss occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.
Damage to the Thermal Protection System from a debris strike on ascent resulted in the loss of crew and vehicle on entry on February 1, 2003.
At 81.7 seconds Mission Elapsed Time a piece of foam insulation from the External Tank (ET) left bipod ramp separated from the ET and struck the orbiter left wing leading edge in the vicinity of the lower half of reinforced carbon-carbon (RCC) panel #8, causing a breach in the RCC. During re-entry this breach allowed super-heated air to penetrate through the leading edge insulation and progressively melt the aluminum structure of the left wing, resulting in a weakening of the structure until increasing aerodynamic forces caused loss of control, failure of the wing, and break-up of the orbiter. This breakup occurred in a flight regime in which, given the design of the orbiter, there was no possibility for the crew to survive. (Similar bipod ramp foam releases prior to STS-107 occurred on STS-7, STS-32, STS-50, STS-52, STS-62, and STS-112.
Seven crew members were lost.
Apollo 15 | 8/7/1971 | Crew: 3
Landed with only 2 of 3 parachutes.
On August 7, 1971 the Apollo capsule, Endeavour, dropped into the Pacific Ocean about 320 miles (515 kilometers) north of Hawaii. During the Earth landing phase, after the main parachutes were deployed and shortly after Reaction Control System (RCS) propellant dumping, one of the main parachutes was observed to be deflated when exiting the clouds (3 of 6 fabric risers failed and two-thirds of the suspension lines were missing). One of the main parachutes was recovered after landing, but the failed parachute was not recovered.
The investigation was divided into three areas which were likely causes of the parachute failure.
The forward heat shield was suspected because of the close proximity to the spacecraft flight path during the period when the failure occurred.
A broken riser/suspension-line connector link was found on the recovered parachute, indicating the possibility of broken links in the failed chute.
The Command Module RCS propellant depletion firing had just been completed, and fuel (monomethyl hydrazine) expulsion was in progress at the time of the failure, indicating the possibility of damage from propellants.
Analysis and testing ruled out possible causes one and two, but a test of raw fuel expulsion after RCS firing produced burning outside of the engine. The flame front extended up to eight feet from the engine exit and unburned fuel was sprayed up to 10 feet from the engine and ignited by burning droplets. This was considered the most likely cause of the parachute failure.
Gemini 5 | 8/29/1965 | Crew: 2
Erroneous entry data uplinked; crew manually corrected entry flight profile.
During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.
Soyuz 11 | 6/30/1971 | Crew: 3 | Loss of Crew
Pyrotechnic system failure resulted in crew module rapid depress.
On June 30, 1971 during separation of the orbital and service modules from the descent module, the pyrotechnic system did not operate as intended. All of the pyrotechnics fired simultaneously rather than the designed sequential firing mode. This caused a pressure equalization seal to open in the descent module at a higher-than-designed altitude, resulting in the rapid depressurization of the crew module. The rapid depress led to loss of consciousness of the crew.
All three crew members were lost.
SpaceShipOne Flight 11P | 10/31/2014 | Crew: 1
Left main landing gear collapsed.
A nominal landing pattern was flown on December 17, 2003. However, touchdown caused the left main gear to collapse, and the vehicle rolled to a stop off the runway in the soft sand.
STS-51 | 9/12/1993 | Crew: 5 |
Both port-side primary and secondary SUPER*ZIP explosive cords fired, resulting in containment tube failure and damage in the payload bay.
On September 12, 1993 the STS-51 mission commands intended to initiate the primary SUPER*ZIP explosive cord resulted in the simultaneous firing of both the primary explosive cord and back-up explosive cord. This simultaneous explosive cord firing resulted in the rupture of a SUPER*ZIP containment tube and release of contaminants and high-energy debris into the orbiter cargo bay. The orbiter sustained damage to blankets, wire tray covers, the 1307 bulkhead, and Thermal Protection System tiles. If debris had hit critical items it could have resulted in a loss of the orbiter and crew.
STS-95 | 10/29/1998 | Crew: 7
Preflight sterilization process chemically altered the Low Iodine Residual System resulting in contaminated drinking water.
During STS-95 on October 29, 1998 the preflight sterilization process chemically altered the Low Iodine Residual System (LIRS) resulting in contaminated drinking water.
The crew reported the water from the galley with the LIRS installed had a bad taste. Samples of the water were taken post-flight for analysis. The LIRS was removed. A purge of the LIRS water from the galley plumbing was conducted. After the purge the Galley Iodine Removal Assembly was reinstalled and the crew reported that the water taste was normal after the change-out of hardware.
The bad tasting water could have led to possible crew dehydration due to the crew drinking less water.
ISS Increment 38 | 12/1/2013 | Crew: 6
ITCS configuration errors resulted in near freezing and potential rupture of water-to-ammonia heat exchanger.
On December 11, 2013 the failure of a flow control valve in the pump module of the External Thermal Control System (ETCS) and subsequent Internal Thermal Control System (ITCS) reconfiguration led to a drop in water temperature to nearly freezing in the Columbus module's Moderate Temperature Heat Exchanger (MTHX). If the water in the Interface Heat Exchanger (IFHX) had frozen, the expansion could have ruptured the barrier between the ITCS and the ETCS. A rupture of this barrier could allow ammonia to enter the interior crew portions of the ISS, causing a potential loss of crew/loss of vehicle.
Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission
Explosion due to electrical short. Loss of O2 and EPS.
Apollo 13 launched on April 11, 1970. On April 13, 1970 during trans-lunar flight at approximately 56 hours, one of the two Service Module oxygen tanks over-pressurized and exploded. This caused the loss of oxygen in that tank and a leak of oxygen out of the remaining tank. This resulted in the loss of all three fuel cells, loss of the primary oxygen source, and the loss of electrical power to the Command Module (except for the entry batteries). The mission was able to continue with the use of the Lunar Module, and the crew safely returned.
Prior to launch, the following conditions resulted in the oxygen tank failing during the mission: By design the cryogenic oxygen tank required both electrical heaters to maintain pressure, and fans to prevent stratification. The tank was a complex assembly with blind installation of the quantity probe, heater/fan assembly, and fill tube. This design leaves wiring insulation vulnerable to damage during assembly with no way to inspect after installation. The Teflon insulated wiring, which is a combustible material in the oxygen tank, was in close proximity to the heater elements and fan.
The Apollo 13 tanks were originally installed on Apollo 11, but a change required the tanks to be removed. During removal of the oxygen shelf, one bolt was left in place causing the fixture to break and resulting in a two-inch drop of the shelf and tanks. Although a loosely fitting (due to loose specification tolerances) fill tube could have been displaced by this, all testing was passed. No cryogenic tests were performed which would have revealed the problem. During the Count Down Demonstration Test the oxygen tank could not be emptied by the normal means of pressurized oxygen gas due to a leak at the fill tube. Instead, the tank heaters were turned on to boil off the oxygen in the tank. The thermostatic switches were rated for 30 volts direct current, but several years earlier the heater ground power supply voltage was raised to 65 volts to reduce the pressurization time. As the temperature increased the thermostatic switch opened and the higher voltage caused the contacts to weld closed. With the heaters continuously on, the temperature approached 1000 degrees and damaged the wire insulation, setting up the conditions for a short and ignition inside the tank. Ground personnel did not notice the continuous heater operation. During the prelaunch problem solving neither the Apollo Spacecraft Program Manager nor the Kennedy Director of Launch Operations knew the tank had previously been dropped or that the heaters had been on for eight hours.
STS-93 | 7/23/1999 | Crew: 5
At T+5 a short on AC1 Phase A resulted in loss of SSME1 Controller A and SSME3 Controller B.
SSME3 H2 leak: early LOX depletion and shutdown.
STS-93 encountered two close-call events.
STS-114 | 5/26/2006 | Crew: 7
Bird strike on External Tank.
Loss of foam from External Tank PAL ramp.
TPS gap filers protruding. Removed during third mission EVA.
Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward
separation bolt function and damaging secondary structure and a thermal blanket.
STS-114 encountered four close-call events.
Gemini 6 | 12/12/1965 | Crew: 2
Main engine shutdown. Booster left unsecured on pad. Crew elected not to eject. Launched 3 days later. After the failed launch attempt, review of engine data and an inspection of the number 2 engine revealed that a plastic dust cover had been inadvertently left on the oxidizer gas generator inlet port causing blockage of oxidizer to the gas generator. Ground procedures were modified to ensure removal of dust covers during engine assembly.
There was a main engine shutdown during the attempted launch on December 12,1965.
About 1.5 seconds after main engine ignition, an electrical plug fell from the vehicle and accidentally started a clock that normally starts during vehicle liftoff.
The rocket malfunction detection system sensed an anomaly since there was no upward motion associated with the start of the clock and triggered engine stop. The booster was left unsecured on the pad with the crew inside. The crew members elected to remain in the capsule until the gantry was returned.
A successful launch occurred three days later.
Other On Pad Aborts | Related or Recurring events
On pad aborts have also occurred on:
STS-51F: On July 12, 1985 the first launch attempt of STS-51F was aborted at T-4.2 seconds. The chamber coolant valve on Space Shuttle Main Engine 2 needed to move from the 100% open setting to the 70% open setting required for startup, but the valve responded slowly. The launch was aborted and the vehicle safely shut down.
STS-55: On March 22, 1993 the third launch attempt of STS-55 was aborted at T-3 seconds when the Space Shuttle Main Engine (SSME) 3 oxidizer preburner purge pressure exceeded the maximum pressure. The monitor detected that the combustion product pressure exceeded the 50 psi redline due to one of the five check valves in the purge system leaking. The launch was aborted and the vehicle safely shut down. All three SSMEs were replaced before the next launch attempt.
STS-51: On August 12, 1993 the first launch attempt of STS-51 was aborted at T-3 seconds because of a disagreement in the turbine fuel flow sensors of Space Shuttle Main Engine (SSME) 2. At 0.6 seconds after ignition SSME 2 experienced a failure of the fuel flow meter channel A2 speed pickup coil sensor (loss of redundancy) to respond to the start transient. The main engine controller used the A and B flow rate measurement data for closed-loop thrust/mixture ratio control, and the failure of either the A or B measurements resulted in lockup of the preset engine mixture ratio. As a result of the failure, the engines were safely shut down. All the main engines were replaced before the next launch attempt.
STS-68: On August 18, 1994 the first launch attempt of STS-68 was aborted at T-1.9 seconds. The abort was triggered after the discharge temperature of the high pressure oxidizer turbopump in Space Shuttle Main Engine (SSME) 3 exceeded the redline temperature, causing the main engine controller to issue a shutdown of SSME 3, followed shortly by the General Purpose Computers issuing a shutdown of the other two engines.
STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event
During the launch attempt on June 26, 1984 all aspects of launch countdown were nominal until T-4 seconds when an irregular operation of the Space Shuttle Main Engine (SSME) 3 main fuel valve resulted in an engine shutdown and pad abort condition.
The SSME 3 main fuel valve failed to open when commanded and leaked hydrogen for approximately 21 minutes following the shutdown. After the abort, fire was seen on the starboard side of the body flap for approximately 12 minutes. The aft base heat shield water deluge system was activated and was able to extinguish the fire. Damage to the orbiter was mostly confined to the body flap despite invisible flames of burning hydrogen reaching 190 feet.
The Mobile Launcher Platform sustained minor scorching damage to a few purge ducts and one burnt ground wire. The cause of the main fuel valve anomaly was attributed to contamination in the hydraulic actuator that was likely present at time of installation.
Additional inspection and ground tests were implemented to detect valve anomalies prior to installation into flight engines. Real-time monitoring of valve operation prior to engine start was also enhanced, and ultraviolet fire sensors were added.
STS-61C | 1/6/1986 | Crew: 7
System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.
On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.
Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).
Corrective action incorporated in response to this close call included modifications to automatic sequencer software to prevent the prerequisite control logic from blocking LOX inboard fill-and-drain valve close commands, updates to countdown procedures and launch constraints to verify closure of the inboard fill-and-drain valve after replenish valve closure and prior to tail service mast vent-and-drain valve opening, monitoring and initiation of holds if the fill-and-drain valve closed indication is lost, implementation of helium repressurization “pulse purge” if ET ullage pressure drops below 0.25 psi, and verification of minimum ET ullage pressure rise rate at T-120 seconds.
A subsequent launch attempt on January 7, 1986 was scrubbed at the T minus 9 minute hold due to weather constraint violations at TAL sites. However, during post launch scrub operations a broken Ground Support Equipment (GSE) LOX temperature probe was found lodged in SSME #2 pre-valve post-detanking. This temperature probe had failed (off-scale high reading) during LOX loading but due to the absence of any mechanical failure history, the failure was assumed to be electrical in nature and the temperature data from this probe was not mandatory for pre-launch loading operations. The broken temperature probe would have prevented closure of pre-valve during flight, at MECO, resulting in an uncontained SSME failure and possible loss of crew, loss of vehicle.
As a result of the broken GSE LOX temperature probe, all GSE LOX temperature probes were inspected and screened for improper welds, monitored during pre-launch operations for any anomalies, and eventually replaced with redesigned probes. A coarse debris screen was also added upstream of the LOX prevalve to prevent large debris from entering into the prevalve.
STS-112 | 10/7/2002 | Crew: 6
T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.
The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.
The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.
All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.
Apollo 13 | 4/11/1970 | Crew: 3
2nd stage center engine shutdown due to pogo oscillations.
During the April 11, 1970 launch of Apollo 13 severe pogo oscillations were experienced. Acceleration at the engine attachment reached an estimated 34 g (the accelerometer went out of recordable range) before the engine's combustion chamber low-level pressure sensor commanded an engine shutdown.
Soyuz 18-1(18a) | 4/5/1975 | Crew: 2 | Loss of Vehicle/Mission
Electrical fault caused premature firing of half of the 2nd stage separation bolts, resulting in the inability to fire the remaining ones. Staging failure resulted in abort sequence being used at T=295 seconds.
During ascent on April 5, 1975 an electrical malfunction in the Soyuz booster prematurely fired two of the four explosive latches holding the core of the first and second stage together. This severed the electrical connections necessary for firing the remaining two latches. When the core first stage burned out, it could not be cast off as designed.
Ignition of the second stage occurred normally, but the booster was rapidly dragged off course by the weight of the depleted core first stage. When the course deviation reached 10 degrees, the automatic safety system activated, shutting down the booster and separating the Soyuz capsule from the launch vehicle. At the time of separation, the Soyuz was 180 km high and traveling at 5.5 km per second.
The crew endured a 20+ g re-entry and landed in the Altai Mountains. The capsule rolled down a mountain side, and was caught in bushes just short of a precipice. After an hour of waiting in the cold next to the capsule, the crew was discovered by locals speaking Russian.
One crew member suffered internal injuries from the high-g re-entry and downhill fall and never flew again.
Other SRB Seal Events | Related or Recurring event
SRB gas sealing anomalies have also occurred on:
STS-2 November 12, 1981
STS-6 April 4, 1983
STS-11 (STS-41B) February 3,1984
STS-41C April 6,1984
STS-41D August 30, 1984
STS-51C January 24,1985
STS-51D April 12, 1985
STS-51B April 29, 1985
STS-51G June 17,1985
STS-51F July 29, 1985
STS-51I August 27, 1985
STS-51J October 3, 1985
STS-61A October 30, 1985
STS-61B November 26,1985
STS-61C January 12, 1986
STS-42 January 22, 1992
STS-71 June 27, 1995
STS-70 July 13, 1995
STS-78 June 20, 1996
STS-51L (Challenger) | 1/28/1986 | Crew: 7 | Loss of Crew | Related or Recurring event
SRB seal failure.
On January 28, 1986 a combustion gas leak developed in the right solid rocket motor aft field joint shortly after solid rocket booster ignition. The resulting hot gas plume exiting the joint impinged upon the SRB lower attachment strut and adjacent external tank structure weakening the structure to the point of failure.
Seventy-four seconds into flight, the Space Shuttle Challenger broke up.
All seven crew members were lost.
STS-91 | 6/2/1998 | Crew: 6
Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.
After the launch of STS-91 on June 2, 1998, a channel A main engine pressure chamber sensor froze. The sensor was disqualified by engine control software when the sensor exceeded allowable limits during the max Q engine throttle down sequence however the sensor remained qualified for engine redline monitoring since the reading was still within reasonableness limits / operational range for the sensor. The channel B sensor and the main engine performed nominally throughout ascent. If an engine problem had occurred, the channel B sensor would have displayed the correct information and indicated the proper corrective action. However, the channel B sensor would have been ignored due to the frozen channel A sensor.
The post-flight inspection revealed that contamination from a seal leak check caused the sensor to freeze. Marshall Space Flight Center (MSFC) project engineering suggested adding a V-seal leak check prior to the acceptance test, to ensure the newly added V-seal was installed properly. However, MSFC project engineering was unaware that performing the leak check would require the manufacturing personnel to plug the chamber pressure port with Viton. After the flight, the sensor was still plugged with a piece of Viton.
If the main engine pressure chamber sensor froze later in the flight, logic errors may have triggered a premature engine shutdown and a return to the launch site abort. Post-flight software changes were implemented to prevent this from occurring on subsequent flights. Additionally, a one-time flow check verified the reliability of the Lee-Jet for all engines in the fleet. A corrective action requires post-Lee-Jet installation flow check and borescope inspection for future engine builds. Lastly, the V-seal leak check was eliminated in future engine builds.
STS-110 | 4/8/2002 | Crew: 7
STS-109 | 3/1/2002 | Crew: 7
STS-108 | 12/5/2001 | Crew: 7
Incorrect adjustments to the controller software resulted in SSME underperformance.
Prior to STS-108 a change had been made to the controller software coefficient for the Space Shuttle Main Engine (SSME) to compensate for an observed measurement bias in the SSME main combustion chamber pressure sensor, which controls the SSME fuel/oxidizer mixture ratio. The pressure chamber sensor was biased high causing the flight software to lower the chamber pressure by decreasing the liquid oxygen flow rate. To correct the high bias a coefficient in the equation was adjusted to compensate. Because of communication errors between ground systems engineers and deficiencies in the flight software verification and validation processes, the software coefficient was adjusted in the wrong direction, resulting in even larger dispersions in the mixture ratio and SSME performance.
The error in the coefficient was discovered during post-flight reconstruction of the data from STS-108. The cause of the error remained unknown until after STS-110. The erroneous coefficient was flown on three consecutive flights (STS-108, STS-109, and STS-110) resulting in a slight SSME underperformance on each flight, and was fixed with the proper coefficient and independent verification prior to STS-111. The error in software and resulting mixture ratio wasn't severe enough to cause any significant impacts to SSME performance, and all three flights achieved proper orbits. However, if the software error had been larger, more severe impacts to the missions and crew safety could have occurred, including a premature engine shutdown/failure resulting in on-pad or ascent abort, loss of mission.
On-pad Abort Events (1984-93)
Related or Recurring event
TPS Entry Events (1981-2003)
LANDING & POSTLANDING