HOW TO USE THIS TOOL
TRAINING & HUMAN FACTORS
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Voskhod 2 3/19/1965
Gemini 5 8/29/1965
Skylab 4 2/8/1974
Soyuz TM-5 9/6/1988
Mercury MA-7 5/24/1962
Apollo ASTP 7/24/1975
SpaceShipTwo, PF04 10/31/2014
Soyuz 10 4/23/1971
Skylab 2 5/26/1973
Mercury MA-9 5/16/1963
Gemini 8 3/16-3/17/1966
Soyuz 33 4/12/1979
O2 Fire - Soviet
ISS Increment 38 12/1/2013
Apollo 10 5/22/1969
X-15 3-65-97 | 11/15/1967 | Crew: 1 | Loss of Crew
Electrical short and crew error led to loss of control at 230,000 feet. First U.S. spaceflight fatality.
On November 15, 1967 an electrical short and crew error led to loss of control of the X-15 at 230,000 feet. During re-entry of the vehicle, the aircraft deviated off course due to a combination of the pilot's distraction, misinterpretation of instrumentation display, and possible vertigo. An electrical disturbance that occurred early in the flight had degraded the overall effectiveness of the aircraft's control system and further added to pilot workload. The aircraft entered into a high Mach spin.
The pilot was able to break free from the spin, but the aircraft was in a high-speed inverted dive. While the aircraft was still at sufficient altitude to recover from the dive, the hand controller began forcing the horizontal stabilizers to oscillate. Because of the buffeting in the spin and dive, the pilot likely lost consciousness and the aircraft broke apart.
This was the first United States spaceflight fatality.
Mercury MR-4 | 7/21/1969 | Crew: 1 | Loss of Capsule
Inadvertent hatch pyrotechnic firing. Capsule sunk. Astronaut nearly drowned.
After landing on July 21, 1961 the spacecraft hatch pyrotechnic charges prematurely fired. The crew member was able to escape from the emergency situation, but because of waves flooding the capsule, the capsule sunk. The crew member was nearly drowned when the flight suit took on water from an unsealed neckdam. The crew member was rescued after three to four minutes in the water.
STS-3 | 3/30/1982 | Crew: 2
Pilot induced oscillation during derotation. Stronger than predicted winds contributed.
On March 30, 1982 during orbiter derotation on rollout, the vehicle pitched up to approximately six degrees after having been down to -3 degrees pitch. This pitch up occurred because the pilot was preventing premature nose wheel contact. The planned late transition from autoland to manual control did not provide sufficient time for the pilot to feel the vehicle response, and attempts by the pilot to make minor trajectory adjustments resulted in a touchdown sooner than intended and at a higher than planned airspeed (225 Keas vs. 195 Keas). Subsequently, the derotation after main landing gear touchdown started at too high an airspeed and required the pilot to try and stop it at too low a pitch angle. The rapidly changing elevator trim requirements made it difficult to avoid over-controlling in this situation.
On all future missions, manual takeover from autoland was not planned to occur between the start of the preflare maneuver and touchdown. Flight procedures and crew training were also revised to be more explicit about keeping the nose up until the vehicle slows to 180 knots.
STS-9 | 12/8/1983 | Crew: 6
A. Two APUs caught fire during rollout.
B. GPC failed on touchdown.
C. Incorrect flight control rechannelization on rollout.
A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.
B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.
C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.
STS-37 | 4/11/1991 | Crew: 5
Several factors contributed to a low-energy landing 623 feet prior to the threshold of the runway at the backup landing location.
Low Energy Landing
On April 11, 1991 the first landing opportunity at Kennedy Space Center was waived due to fog, and a decision was made to land at the alternate landing site at Edwards Air Force Base. The entry wind profile included a large wind shear (from 90 kts at 13,000 feet to 10 kts at 8,000 feet). These conditions fell outside the Edwards Air Force Base 99 percent wind profile from 20,000 feet to 10,000 feet and significantly outside the shuttle experience base from 30,000 feet to 10,000 feet.
Around the Heading Alignment Circle (HAC), a significant amount of energy was lost due to a consistent negative pitch attitude error, and being outside of the HAC reference. The HAC is designed to provide an “energy pad” for use while making the approach. If guidance senses that the vehicle's energy state is getting very low (it uses altitude below a reference altitude and degrees of turn remaining to make the judgment), the HAC radius is decreased to help make up for the lower energy state. At approximately 23,000 feet the low-energy state triggered HAC shrink (when the range-to-go “distance from the vehicle to the runway” falls below the max lift/drag line). The HAC shrink was triggered due to the altitude being approximately 2-3,000 feet low, and increased the error from the HAC reference. A slow convergence back to the altitude reference was seen though the energy state remained low. At 13,500 feet the vehicle encountered a sharp wind shear reducing the vehicle's airspeed driving the energy state even lower. The vehicle again encountered wind shear at 8,600 feet in altitude. Touchdown occurred 623 feet prior to the threshold at 168 kts.
It is believed that the loss of energy on the HAC combined with the inadequate correction back to the altitude profile, both coming off the HAC and through the wind shear, resulted in the low-energy touchdown.
STS-90 | 5/3/1998 | Crew: 7
Hard, fast landing due to human factors and rogue wind gust. Hardest shuttle landing.
Following the landing on May 3, 1998 the post-mission report indicated a harder than normal landing. The main gear touchdown speed was 196.2 Keas with a sink rate of -3.18 feet/second. Brake energies were all below 15 million ft-lbs. The rollout distance was 9769.3 feet. Imagery analysis indicated a main landing gear sink rate of -6.7 ft/sec and a "harder than normal" landing. The Mission Operations Directorate Space Shuttle Summary reported touchdown of the main landing gear at 218 Keas, a -6.0 ft/sec sink rate, and a rollout distance of 9998 feet.
STS-108 | 12/7/2001 | Crew: 7
Violation of minimum landing weather requirements.
On December 17, 2001 the Shuttle Meteorology Group forecasted a “no go” for the de-orbit burn due to a weather forecast predicting the creation of a cloud ceiling at landing time. The Shuttle Training Aircraft reported a “go” based on observed conditions. Several positive factors provided the Flight Director with confidence to give a GO for landing on orbit 186, despite a weather forecast which could result in the crew being unable to see the Precision Approach Path Indicators (PAPIs) or runway environment until 3,000 feet or below. The GO was given with the belief that the cloud layer at 3,000 feet would break and that the PAPIs and runway environment would be visible by 6,500 feet. However, the cloud ceiling did not break and a flight rule was violated, but waived following the flight.
STS-137 | 6/1/2011 | Crew: 7
Brief fire observed between the left main landing gear tires during runway rollout.
STS-134 landed on June 1, 2011. During analysis of the post-landing imagery, a fire was briefly observed during the rollout period, located between the left Main Landing Gear tires shortly after the drag chute was jettisoned. Detailed visual inspections, material analysis, and landing gear systems tests were performed in an effort to determine the root cause of the fire. However, no definitive root cause could be determined. The fire may have been operational, because the commander applied the brakes in excess of recommended deceleration rates, especially at the lower speeds, resulting in the shortest landing rollout on a concrete runway surface since the drag chute had been used. The excessive braking may have generated higher than normal temperatures within the brake.
Voskhod 2 | 3/19/1965 | Crew: 2
Automatic descent system malfunctioned. Issues with manual entry resulted in off-target, rough terrain landing. Delayed crew recovery.
On March 19, 1965 a malfunction of the automatic descent system resulted in the use of a backup manual system for entry and landing. Difficulties encountered during manual operation and delayed retrofiring resulted in the spacecraft landing more than 1,000 km downrange from the intended landing point. The wooded, mountainous terrain caused a delay in crew recovery. (Actual distance of overshoot varies in the source documents, but most sources indicate a distance between 1,000 km and 2,500 km.)
Gemini 5 | 8/29/1965 | Crew: 2
Erroneous entry data uplinked; crew manually corrected entry flight profile.
During entry on August 29, 1965 a crew member used attitude controls to correct the entry flight profile of the vehicle. The computer guiding the capsule was functioning as intended. However, the rotation rate of the Earth was incorrectly entered as 360 degrees per day, instead of the correct 360.98 degrees per day. The crew member recognized the error in the readings and was able to counter the effects. The landing fell 130 kilometers short of the target, but this short landing was closer to the U.S. Navy recovery ship than it would have been if the crew member had not taken action.
Skylab 4 | 2/8/1974 | Crew: 3
Incorrect circuit breakers opened, resulting in the loss of the automatic control.
On February 8, 1974 while preparing foar entry, the crew inadvertently opened the stabilization and control system (SCS) pitch and yaw circuit breakers instead of the service propulsion system pitch and yaw circuit breakers. The vehicle was in an apex forward configuration for service module jettison. The commander attempted to orient the vehicle to the proper heat shield forward attitude for entry. The control commands produced no effect due to the SCS being inadvertently unpowered, and the vehicle failed to change attitude. The crew switched to “manual reaction control system direct” and oriented the vehicle to the proper attitude. The circuit breakers being in close proximity and similarly labeled, increased the potential for human error.
The failure to orient the heat shield forward would have caused loss of crew.
Soyuz TM-5 | 9/6/1988 | Crew: 2
Two de-orbit attempts failed. Crew confined to DM due to OM being jettisoned prior to 1st de-orbit attempt. Crew prevented erroneous firing of SM separation pyrotechnics.
Two de-orbit burn attempts failed and nearly led to the loss of the crew. The crew was confined to the descent module due to the orbital module being jettisoned prior to the first deorbit attempt. The first deorbit burn was prevented by a sensor glitch which disappeared after seven minutes, and then the burn started. However, the crew manually shut down the burn after three seconds.
A second burn two revolutions later occurred on time for six seconds, then stopped, and the crew manually restarted the burn. However, after an additional 60 seconds it was cut off by the autopilot. The crew manually interrupted the command sequence shortly before the descent/equipment module separation pyros were to have been fired, preventing an erroneous firing. The main cause of the crew's problems was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel.
Mercury MA-7 | 5/24/1962 | Crew: 1
RCS depletion at 80,000 ft.
This incident on May 24, 1962 involved the use of double authority control and the accidental actuation of the fly-by-wire high thrust units during certain maneuvers. The manual-system fuel was depleted near the end of the retrofire maneuver, and the automatic-system fuel was depleted at about 80,000 and 70,000 feet. Because of the early depletion of automatic-system fuel, attitude control during re-entry was not available for the required duration. Attitude rates built up after the Automatic Stabilization Control System became inoperative because of the lack of fuel, and these rates were not sufficiently damped by aerodynamic forces. The pilot chose to deploy the drogue parachute manually at an altitude of approximately 25,000 feet to stabilize the spacecraft.
To avoid the same situation on later flights, Mercury MA-8 and subsequent spacecraft contained a switch which allowed the pilot to disable and reactivate the high-thrust units at his discretion. An automatic override reactivated these thrusters just prior to retrofire. Additionally, a revision of fuel management and control training procedures was instituted for subsequent missions
Apollo ASTP | 7/24/1975 | Crew: 3 | Crew Injury
N2O4 in crew cabin. Crew hospitalized for 2 weeks.
On July 24, 1975 as the spacecraft descended, the commander, who was reading the checklist, failed to tell the command module pilot to move the Earth Landing System auto/manual switch to auto. The crew saw that the spacecraft was well below the deployment altitude and proceeded to manually deploy the chutes. Drogue chutes were deployed manually at 18,550 feet instead of 23,500 feet as the automatic system would have done. At 10,000 feet the commander realized that ELS was not in AUTO and quickly switched ELS Logic and AUTO, deploying the main parachutes at 7,150 feet and disabling the RCS instead of 10,500 feet.. The Reaction Control System (RCS) was not disabled manually (RCS command switch turned to “off”) at this time. It was disabled manually at 16,000 feet instead of when the checklist indicated at 24,000 feet. The cabin pressure relief valve opened automatically at 24,500 feet.
During a 30-second period of high thruster activity after drogue parachute deployment, a mixture of air and propellant combustion products followed by a mixture of air and nitrogen tetroxide oxidizer (N2O4) vapors were sucked into the cabin. One of the positive roll thrusters is located only two feet away from the steam vent that pulls in outside air when the cabin relief valve is open. This exposed the crew to a high level of N2O4 since emergency oxygen masks were not available until landing. The pilot passed out, but the commander quickly put the oxygen mask on him and he was revived. The exposure resulted in a two-week hospital stay for the crew after landing.
SpaceShipTwo PF04 | 10/31/2014 | Crew: 2 | Loss of Crew (1)
Vehicle breakup during powered flight.
On October 31, 2014 shortly after separating from the WhiteKnightTwo carrier aircraft, the SpaceShipTwo vehicle broke apart resulting in the loss of one crew member. A National Transportation Safety Board investigation into the accident is ongoing.
Soyuz 10 | 4/23/1971 | Crew: 3 | Related or Recurring event | Loss of Mission
Automatic docking system failed. Manual docking with Salyut not achieved.
On April 23, 1971 during automatic approach to Salyut, the Soyuz began to oscillate. The crew went to manual control and was able to complete mechanical capture. During retraction of the probe, the engines began firing because the Soyuz control system was still active. This caused damage to the docking mechanism, which stopped the probe retraction and prevented the Soyuz from completing docking to the Salyut. The crew was instructed to reconfigure cables which allowed them to send a command to release the probe's capture latches. Soyuz was released, and landing occurred on April 25.
Skylab 2 | 5/26/1973 | Crew: 3 | Related or Recurring event
Multiple failed automatic docking attempts resulted in manual docking to Skylab.
On May 26, 1973 numerous failed docking attempts resulted in the use of contingency in-flight procedures to bypass the automated docking system. Successful docking to the Skylab station ultimately relied on manual control and crew piloting skills.
The contingency procedure required the Skylab 2 crew members to don pressure suits, depressurize the command module cabin, open the tunnel hatch, cut wires in the probe, and connect the emergency probe-retract cable using a utility power outlet. The crew members were able to fire the probe-retract pyrotechnic and complete docking manually.
The failure to dock would have resulted in the loss of Skylab due to the inability to perform critical repairs.
M21-D21 | 7/30/1966 | Crew: 2 | Loss of Crew (1)
D21 drone collided with M21 during launch, causing M21 breakup. Crew survived breakup but one was lost after water landing.
On July 30, 1966 as the M-21 mothership was performing a flight test for launching the D-21 drone, while traveling at high Mach speeds the drone was not able to penetrate the shock wave coming off the mothership. The D-21 had almost cleared the rudders of the M-21 when the drone bounced off the shockwave and pitched down, striking the M-21 and breaking it in half. The Pilot and Launch Control Officer (LCO) stayed with the tumbling wreckage of the plane a short time until a lower altitude was reached, then ejected over the Pacific Ocean.
Both crew members made safe ejections and landings, but after landing the LCO opened his helmet visor by mistake and his suit filled with water, causing him to drown. All subsequent flights of the D-21 were as D-21Bs, which were reconfigured to launch the drone from an under wing pylon of a B-52 (much like the X-15 had been), boosted to Mach 3 by a rocket motor that was jettisoned after the D-21Bs Marquardt ramjet was started.
Mir | 8/30/1994 | Crew: Soyuz 2, Mir 3 | Related or Recurring event
Soyuz TM-17 collided twice with Mir during undocking.
On January 14, 1994 during the post-separation inspection fly-around of Mir, the crew lost manual translation control due to a configuration error. The loss of control led to the Soyuz colliding with Mir several times. The cause of the collision was traced to the hand controller in the orbital module which governed braking and acceleration being switched on, disabling the equivalent hand controller in the descent module.
Mir | 8/30/1994 | Mir Crew: 2 | Related or Recurring event
Progress M-24 collided with Mir during second docking attempt.
On August 30, 1994 during the second attempt of the Progress M-24 to dock with Mir, the Progress collided with Mir's forward docking unit two to four times, and then drifted away from the station. The docking problems with Progress M-24 have been variously attributed to software or Kurs electronics failures on Progress M-24, or the failure of control equipment in the Moscow Mission Control Center.
Mir | 6/25/1997 | Mir Crew: 3 | Loss of Mission | Related or Recurring event
Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.
Mir Crew: 3
Loss of Element
On June 25, 1997 Progress M-34 collided with the Mir Spektr module rupturing the module. The crew of Mir had to cut through cables in the hatchway in order to seal off the leaking module from the rest of the station.
Mercury MA-9 | 5/16/1963 | Crew: 1 | Manual Entry
Electrical faults caused loss of some systems and need to perform manual entry. Also experienced high PPCO2 levels in suit during entry operations.
During the May 16, 1963 flight electrical faults caused the loss of some systems and the need to perform manual entry. The alternating current power supply for the control system failed to operate, and it was determined that the pilot would have to make a manual retrofire and re-entry. He performed these maneuvers with close precision and landed a short distance from the prime recovery ship in the Pacific Ocean.
The malfunction during re-entry on MA-9 was traced to two connectors in an electrical amplifier.
Gemini 8 | 3/16-3/17/1966 | Crew: 2 | Emergency De-orbit | Loss of Mission
Stuck thruster caused loss of control and led to 1st U.S. emergency
During the Gemini 8 flight from March 16 – 17, 1966 a stuck thruster, number 8, which controls roll, caused a loss of control and rapid spin rate of the capsule that could have led to the crew losing consciousness. To counter the effects the stuck thruster was turned off and the re-entry control system had to be used to stabilize the capsule. Use of the re-entry control system led the Gemini safety group to declare an end to the mission, which led to the first United States emergency de-orbit. The thruster apparently short circuited while attached to the Agena target vehicle.
Soyuz 33 | 4/12/1979 | Crew: 2 | Loss of Mission
Main engine anomaly caused final rendezvous abort.
On April 12, 1979 during docking attempts the crew aboard Salyut 6 reported flames shooting sideways from the main engine, toward the backup engine, at the time of the shutdown. The docking was canceled and the Soyuz crew prepared to return to Earth. (See Soyuz 33 entry event)
STS-32 | 1/9/1990 | Crew: 3 | Loss of Attitude Control
Erroneous state vector up-linked to flight control system, causing immediate and unpredictable attitude control problems.
An erroneous state vector up-linked to the flight control system on January 9, 1990 causing immediate and unpredictable attitude control problems.
At 17:23:46:51 Greenwich Mean Time, during a crew sleep period, a state vector update was commanded by the ground prior to the loss of signal. The uploaded state vector was erroneous, and the orbiter began to execute a multi-axis rotation at three degrees per second with a number of thruster firings. The rotation continued until the acquisition of signal period, about 10 minutes later, when the crew was awakened and instructed to switch to manual Digital Auto Pilot to arrest the unwanted rates. A good state vector was then uplinked.
Mir | 7/17/1997 | Crew: 3
Accidental unplugging of computer power cable led to loss of attitude control and loss of power.
On July 16, 1997 a cosmonaut inadvertently unplugged a central computer power cable while disconnecting cables for upcoming repairs of the Spektr module. The temporary loss of power caused the central computer to shut down, resulting in the loss of attitude control and Mir going into free drift. In free drift the Mir was unable to accurately point its solar arrays to provide sufficient power. Once in free drift, the ground and flight crew failed to turn off equipment to reduce power demand, which resulted in depletion of stored energy in the flight batteries and complete loss of power on Mir.
The Progress M-35 supply spacecraft was used to reorient the Mir to restore nominal solar array power generation, recharge flight batteries, and subsequently restore Mir attitude control functions.
STS-87 | 11/27/1997 | Crew: 6
Spartan satellite deployed without proper activation.
Recapture with RMS unsuccessful. Later captured by EVA crew.
Deployment of the SPARTAN satellite on November 21, 1997 occurred without proper activation.
A crew input via the Payload and General Support Computer was not received by the spacecraft. Lack of telemetry and onboard verification procedures left this condition undetected by the Mission Control Center and flight crew. The SPARTAN was grappled with the Remote Manipulator System, removed from the Release/Engage Mechanism, and released per the flight plan.
The missed command step resulted in the failure of the SPARTAN to execute an expected preprogrammed maneuver ("pirouette") about 2.5 minutes after deploy. Attempts to re-grapple the SPARTAN after the deployment were unsuccessful. A previously scheduled extravehicular activity (space walk) had to be changed to manually recapture the satellite.
Altitude Chamber O2 Fire | 3/23/1961 | Crew: 1 | Loss of Crew
Alcohol wipe hit hot plate and started fire in oxygen-rich test chamber.
On March 23, 1961 a cosmonaut in an altitude chamber was removing the sensors that had been attached to him during an experiment. He cleaned the places where the sensors had been attached with cotton wool soaked in alcohol, and without looking threw away the cotton wool. The cotton wool landed on the ring of an electric hot plate in the oxygen-charged atmosphere of the chamber. In conditions of high oxygen concentration, normally non-flammable substances can burn vigorously. The cosmonaut's training suit caught fire. Unaccustomed to the vigor of high-oxygen fires, the cosmonaut would only have spread the flames further by attempting to smother them. The doctor on duty noticed the conflagration through a porthole and rushed to the hatch, which he could not open because the internal pressure kept the inward swinging hatch sealed. Releasing the pressure through bleed valves took several minutes and the cosmonaut later died in the hospital from the burns.
ISS Increment 38 | 12/1/2013 | Crew: 6
ITCS configuration errors resulted in near freezing and potential rupture of water-to-ammonia heat exchanger.
On December 11, 2013 the failure of a flow control valve in the pump module of the External Thermal Control System (ETCS) and subsequent Internal Thermal Control System (ITCS) reconfiguration led to a drop in water temperature to nearly freezing in the Columbus module's Moderate Temperature Heat Exchanger (MTHX). If the water in the Interface Heat Exchanger (IFHX) had frozen, the expansion could have ruptured the barrier between the ITCS and the ETCS. A rupture of this barrier could allow ammonia to enter the interior crew portions of the ISS, causing a potential loss of crew/loss of vehicle.
SpaceShipOne 14P | 5/13/2004 | Crew: 1
Flight computer unresponsive. Recovered by rebooting.
On May 13, 2004 the flight computer on SpaceShipOne became unresponsive. During the boost following the vertical part of the trajectory, the avionics display flickered and went blank. The ground displays did not show an error. The avionics display on SpaceShipOne came back on as soon as the motor shut down.
Due to the loss of avionics during the boost, the trajectory was not precise. The avionics malfunction was traced to a dimmer, a small electrical component.
SpaceShipOne 16P | 9/29/2004 | Crew: 1
Uncommanded vehicle roll. Control regained prior to apogee.
On September 29, 2004 SpaceShipOne performed a series of 60 rolls during last stage of engine burn. SpaceShipOne coasted to 103 km of altitude and successfully completed the first of two X-Prize flights. The motor was shut down when the pilot noted that his altitude predictor exceeded the required 100 km mark. During the motor burn the spacecraft began to roll uncontrollably, but the pilot continued despite advice from the ground to shut the motor down and abort the attempt.
The thin air at that altitude meant that the control surfaces didn't have enough air flowing over them, so they lost effectiveness to compensate for the roll as the spacecraft pointed nearly straight up. The pilot needed to correct the rolling that occurred because of asymmetric thrust coming from the engine.
To correct the issue for the 17P flight, the amount of allowable “down pitch trim” was limited, to avoid the negative-lift condition. The solution was to more gently turn the corner, such that a forward correction later would not be needed. Pointing straight up at burnout was determined to be acceptable, as long as negative lift was not created. This problem was corrected on SpaceShipTwo.
Apollo 10 | 5/22/1969 | Crew: 2
Switch misconfiguration resulted in lunar module control problems.
In May 22, 1969 a switch misconfiguration resulted in lunar lander control problems.
During the Lunar Module (LM) last pass, within eight miles of the moon and prior to the jettison of the LM Descent Stage, the Commander (while wearing a space suit) started to troubleshoot an electrical anomaly.
The Abort Guidance System (AGS) was inadvertently switched from HOLD ATTITUDE to AUTO, which caused the LM to look for the Command/Service Module (CSM) and flip end over end.
The attitude indicator was going to the red zone and in danger of tumbling the inertial platform. The Commander was able to grab the hand controller, switch to manual control, jettison the Descent Stage, control the LM Ascent Stage, and finally dock with the CSM.
STS-61C | 1/6/1986 | Crew: 7
System configuration errors resulted in inadvertent drain back of 14,000 lbs of LOX prelaunch, which would have resulted in a Trans-Atlantic Abort Landing.
On January 6, 1986 during the second launch attempt of STS-61C, the MPS liquid-oxygen inboard fill-and-drain valve was not commanded closed because the liquid-oxygen (LOX) loading automatic sequencer (terminal countdown sequencer / control software) did not receive the closed-switch indication from the replenish valve as required by the prerequisite control logic. This resulted in the automatic sequencer initiating a hold at launch minus 4 minutes 20 seconds. The ground operator verified replenish-valve closure using flowrate and other parameters, but did not close the inboard fill-and-drain valve prior to issuing the resume command to the automatic sequencer at launch minus 2 minutes 55 seconds. This allowed LOX to drain back out of the external tank through the tail service mast vent-and-drain valves until the ground operators noticed the inboard fill-and-drain valve was still open and manually closed the valve. Although unknown at the time, approximately 14,000 to 18,000 lbm of LOX had been inadvertently drained out of the external tank.
Another hold was initiated by ground personnel at launch minus 31 seconds to review the previous out-of-sequence loading termination and obtain a 5-minute liquid-oxygen drain through the main engines. During the hold, the liquid-oxygen main engine temperature dropped below the engine start requirement of 168.3 degrees Rankine by approximately 3 degrees. The engine limit was exceeded because the amount of LOX lost overboard through the fill-and-drain valve caused the colder, more-dense LOX to be drawn in from the external tank. The countdown was recycled to launch minus 20 minutes and oxygen replenish flow was reestablished. The launch was scrubbed when it was determined that the vehicle could not be recycled within the allowable launch window. If the launch had occurred, the reduced LOX quantity in the external tank would have caused early SSME shutdown due to LOX depletion resulting in a Trans-Atlantic Abort Landing (TAL).
Corrective action incorporated in response to this close call included modifications to automatic sequencer software to prevent the prerequisite control logic from blocking LOX inboard fill-and-drain valve close commands, updates to countdown procedures and launch constraints to verify closure of the inboard fill-and-drain valve after replenish valve closure and prior to tail service mast vent-and-drain valve opening, monitoring and initiation of holds if the fill-and-drain valve closed indication is lost, implementation of helium repressurization “pulse purge” if ET ullage pressure drops below 0.25 psi, and verification of minimum ET ullage pressure rise rate at T-120 seconds.
A subsequent launch attempt on January 7, 1986 was scrubbed at the T minus 9 minute hold due to weather constraint violations at TAL sites. However, during post launch scrub operations a broken Ground Support Equipment (GSE) LOX temperature probe was found lodged in SSME #2 pre-valve post-detanking. This temperature probe had failed (off-scale high reading) during LOX loading but due to the absence of any mechanical failure history, the failure was assumed to be electrical in nature and the temperature data from this probe was not mandatory for pre-launch loading operations. The broken temperature probe would have prevented closure of pre-valve during flight, at MECO, resulting in an uncontained SSME failure and possible loss of crew, loss of vehicle.
As a result of the broken GSE LOX temperature probe, all GSE LOX temperature probes were inspected and screened for improper welds, monitored during pre-launch operations for any anomalies, and eventually replaced with redesigned probes. A coarse debris screen was also added upstream of the LOX prevalve to prevent large debris from entering into the prevalve.
Crew Injury/Illness and/or Loss of Vehicle or Mission
Related or Recurring event
Mir Collision Events (1994-1997)
LANDING & POSTLANDING