HOW TO USE THIS TOOL
WORKMANSHIP & PROCESS CONTROL
The Significant Incidents & Close Calls in Human Spaceflight interactive tool is optimized for use with Firefox. To download Firefox, please visit:
GENERAL USAGE - Click or tap on any event for a pop-up with additional information. Click or tap the pop-up again to hide it.
DESKTOP TIPS - For best results, please use your browser's full screen mode:
Windows: Press F11.
Mac: Click the green Full Screen button in the upper-left corner of the browser window.
To zoom in/out:
Windows: Control-plus/minus to zoom in/out*
Mac: Command-plus/minus to zoom in/out*
TABLET/MOBILE TIPS - This site is optimized for desktops, but also functions on a tablet or phone. For best results on mobile devices, close pop-ups before repositioning the page or zooming in/out.
Source documents require Adobe Acrobat to view. Get Adobe Acrobat here:
Most of the source files contain bookmarks to help locate the relevant information.
Source documents labeled with a padlock are controlled and require NASA authentication to view.
*May cause formatting inconsistencies.
Abort Guidance System
Auxiliary Power Unit
Abort to Orbit
Russian Micropurification Unit (Russian)
Carbon Dioxide Removal System
Colony Forming Unit
Control Moment Gyroscope
Cell Performance Monitor
Compound Specific Analyzer-Combustible Products
Extravehicular Mobility Unit
Electrical Power System
Fuel Cell Monitoring System
Functional Cargo Block (Russian)
Flight Safety Office
Galley Iodine Removal Assembly
Guidance, Navigation, and Control
General Purpose Computer
Global Positioning System
Inertial Measurement Unit
International Space Station
Internal Thermal Control System
Launch Control Officer
Low Iodine Residual System
Loss of Crew
Loss of Vehicle
Minimum Duration Flight
Master Events Controller
Main Landing Gear
Micro-Meteoroid Orbital Debris
Marshall Space Flight Center
NASA Standard Initiator
Office of Safety & Mission Assurance (NASA HQ)
Protuberance Air Load
Precision Approach Path Indicator
Primary Avionics Software System
Pyrotechnic Initiator Controller
Partial Pressure of CO2
Reaction Control System/Subsystem
Remote Manipulator System
Russia or Russian
Return to Launch Site
Safety & Mission Assurance
Solid Fuel Oxygen Generator
Solid Rocket Booster
Condensate Water Processor Unit (Russian)
Space Shuttle Main Engine
Space Shuttle Program
Thermal Protection System
Loss of Crew
Crew Injury/Illness and/or Loss of Vehicle or Mission
Soyuz 1 4/24/67
Other significant STS TPS anomalies:
STS-6, 41B, 51G, 27*, 28, 40, 42, 45
*Most severe tile damage to date.
STS-6, 4/83, Crew: 4*
*toxic byproducts released
Soyuz 15 8/28/1974
Progress M-12M 8/24/2011
Apollo 1 (AS-204) 1/27/1967
Soyuz TM-9 2/11/1990
Soyuz 1 | 4/24/1967 | Crew: 1 | Loss of Crew | Related or Recurring event
Main and reserve parachutes failed.
On April 24, 1967 on the maiden flight of the Russian Soyuz spacecraft, the cosmonaut encountered an anomaly with the parachute system during descent. During the descent the drag chutes successfully deployed, but the main chutes failed to deploy from their container. Detecting increasing speeds, the computer deployed a backup parachute. Because the drag chute was still attached and failed to release, the backup chute became tangled with the drag chute, preventing the deployment of the backup chute and resulting in a high-speed impact with the ground.
One cosmonaut was lost.
Related or Recurring event
Other Thermal Protection System Damage Events
In addition to the Thermal Protection System (TPS) damage on STS-1, STS-51D, and STS-107, the following Space Shuttle flights experienced TPS damage:
STS-6 (April 1983)
STS-41B (February 1984)
STS-51G (June 1985)
STS-27 (December 1988)
STS-28 (August 1989)
STS-40 (June 1991)
STS-42 (January 1992)
STS-45 (March 1992)
Additional information can be found in the reports linked below.
STS-6 Mission Report STS-41B MER Report STS-41B Mission Report STS-51G MER Report STS-51G Mission Report STS-27 MER Report STS-27 Mission Report STS-27 Close Call STS-28 Mission Safety Eval Record STS-28 MER Report STS-28 Mission Report STS-40 Debris, Ice, TPS Assessment STS-40 Mission Safety Evaluation STS-40 Mission Report STS-42 Debris, Ice, TPS Assessment STS-42 Mission Report
STS-1 | 4/14/1981 | Crew: 2 | Related or Recurring event
Right-hand main landing gear door warped due to entry heating.
On April 14, 1981 the right-hand main landing gear door warped due to entry heating. A forward facing step, a tile gap, a tile-to-filler bar gap and an inadequate flow restrictor resulted in excessive gap heating on the forward portion of the right main landing gear door. This excessive heating resulted in severe tile sidewall shrinkage (on four tiles), a charred filler bar, and a localized buckle in the door structure. The structure and Thermal Protection System on the door was refurbished, and the flow restrictor was modified to increase the effectiveness of the Thermal Protection System in the area of the main landing gear doors.
STS-51D | 4/19/1985 | Crew: 7 | Related or Recurring event
TPS burn-through on left outboard elevon.
The post-flight inspection of the Thermal Protection System (TPS) revealed that significant damage occurred during landing on April 19, 1985.
The outboard end of the left-hand lower outboard elevon had received significant heat damage, specifically the outboard forward corner of the elevon lower-honeycomb outer-face-sheet. This area was buckled and delaminated and had two small burn-through holes. The outboard elevon lower-leading-edge tile-carrier panel was completely melted under the outboard tile, and a hole was melted in the elevon-cove primary-seal support plate. Because of the damage the lower-outboard carrier-panel outermost tile fell onto the runway when the elevon was deflected upward after landing.
Evidence indicates that the entry plasma flow entered the inboard gap of the outboard tile, then progressed under the tile flowing outboard, where eventually the tile-attachment strain isolation pad was burned, allowing the tile to become loose. This allowed more plasma flow under the tile, resulting in the melting of the aluminum carrier panel, primary seal panel structure, and elevon honeycomb outer face sheet, as well as the melting of two tiles aft of the plasma entry point and two elevon sidewall tiles. The cause of the TPS and structural damage that occurred during descent has not been positively identified. The most probable cause is an out-of-spec step or gap in the lower wing surface forward of the elevon leading edge. It is believed that this flow path may have existed for the two previous flights, with progressive deterioration of the bond, but was not evident from outside inspection of this area during post-flight inspections.
A requirement was established to remove the outboard leading-edge carrier-panel on each side of all orbiters for detailed inspection after the next several flights. In addition, a more comprehensive detailed inspection of each outboard elevon/wing area was accomplished during the normal TPS post-flight inspections.
STS-9 | 12/8/1983 | Crew: 6
A. Two APUs caught fire during rollout.
B. GPC failed on touchdown.
C. Incorrect flight control rechannelization on rollout.
A) During rollout on December 8, 1983 two Auxiliary Power Units (APUs) caught fire. Six minutes and fifty seconds after the orbiter landed, APU-1 shut down automatically due to a turbine-underspeed condition. Four minutes and twenty-four seconds later, a detonation occurred in APU-1, along with simultaneous automatic shutdown of APU-2, also the result of a turbine-underspeed condition. Fourteen minutes and forty-two seconds after APU-2 shutdown, a detonation occurred on APU-2. Post-flight examination of the orbiter aft compartment revealed fire damage to both APUs and minor shrapnel damage. Post-flight analysis indicated that both APU failures were the result of stress-corrosion cracking in the injector stems of both APUs, which resulted in leakage of hydrazine and subsequent fire/explosion events. The injector stems were subsequently redesigned to reduce susceptibility to corrosion by chromizing the stem, and to reduce material stresses by making changes in the installation processes.
B) Also during landing on December 8, a General Purpose Computer (GPC) failed on touchdown and an incorrect flight control rechannelization occurred on rollout. Due to a failure on orbit, GPC 1 was powered down prior to entry (creating an off-nominal configuration), and the remaining GPCs (2, 3, 4, and 5) were configured for entry landing. During landing rollout, GPC 2, which had previously failed on orbit but was recovered prior to entry, failed again at nose-wheel slap down.
C) The crew reacted with procedures for computer loss in a nominal configuration with GPC 1 active and nominal Flight Control System channel assignments. The crew's execution of GPC 2 malfunction procedures in this off-nominal GPC string configuration resulted in the loss of the remaining two redundant flight control strings. This was not a problem on the runway, but could have resulted in loss of control in flight.
Related or Recurring event
In addition to the three overheating/fire events on the ISS and the two significant events on Mir in 1997 and 1998, other overheating/fire events also occurred on:
Mir (October 1994) (A)
STS-40 (June 1991) (B)
STS-35 (December 1990) (C)
STS-28 (August 1989) (D)
STS-6 (April 1983) (E)
Salyut 7 (September 1982) (F)
Salyut 6 (1979) (G)
Salyut 1 (June 1971) (H)
Information on these events is contained in the reports below.
Soyuz 15 | 8/28/1974 | Crew: 2 | Related or Recurring event | Loss of Mission
Failed to dock with Salyut 3 due to Igla system malfunction.
The Soyuz 15 mission launched on August 26, 1974. Its primary mission was to dock to the Saylut 3 military space station to conduct the second phase of crewed operations aboard the Salyut 3 space station. However, docking to the Salyut 3 space station was unsuccessful due to the failure of the Igla rendezvous system and the inability to complete docking in manual mode. Due to this inability to dock, as well as spacecraft battery power limitations, the Soyuz crew was forced to abandon the mission and return to Earth within two days of launch. Gyroscope problems nearly prevented orientation of the spacecraft for the de-orbit burn. After landing, the crew was recovered on August 28, 1974.
The state commission found that the Soyuz Igla docking system needed serious modifications which could not be completed before the Salyut 3 space station decayed beyond a useable orbit. Therefore, the planned Soyuz 16 spacecraft became unnecessary to the program. (It was later flown as Soyuz 20 to a civilian Salyut station, even though it exceeded its two-year rated storage life.)
Mir | 8/30/1994 | Crew: Soyuz 2, Mir 3 | Related or Recurring event
Soyuz TM-17 collided twice with Mir during undocking.
On January 14, 1994 during the post-separation inspection fly-around of Mir, the crew lost manual translation control due to a configuration error. The loss of control led to the Soyuz colliding with Mir several times. The cause of the collision was traced to the hand controller in the orbital module which governed braking and acceleration being switched on, disabling the equivalent hand controller in the descent module.
Mir | 8/30/1994 | Mir Crew: 2 | Related or Recurring event
Progress M-24 collided with Mir during second docking attempt.
On August 30, 1994 during the second attempt of the Progress M-24 to dock with Mir, the Progress collided with Mir's forward docking unit two to four times, and then drifted away from the station. The docking problems with Progress M-24 have been variously attributed to software or Kurs electronics failures on Progress M-24, or the failure of control equipment in the Moscow Mission Control Center.
Mir | 6/25/1997 | Mir Crew: 3 | Loss of Mission | Related or Recurring event
Progress M-34 collided with Mir. Spektr pressure shell ruptured. Spektr module isolated. Cables through hatchway impeded hatch closing.
Mir Crew: 3
Loss of Element
On June 25, 1997 Progress M-34 collided with the Mir Spektr module rupturing the module. The crew of Mir had to cut through cables in the hatchway in order to seal off the leaking module from the rest of the station.
STS-2 | 11/21/1981 | Crew: 2 | Minimum Duration Flight | Crew Injury
Failure of fuel cell resulted in a MDF being declared. The fuel cell failure also resulted in hydrogen in the drinking water leading to crew dehydration.
During the flight of STS-2, which spanned from November 12 – 14, 1981, fuel cell failure led to the declaration of a minimum duration flight (MDF). In addition to the MDF, the failure of the fuel cell also led to high hydrogen levels in the drinking water. The fuel cells used produce drinking water as a by product. When the crew drank this water it provoked a need to belch. Belching in zero g leads to regurgitation. The crew avoiding drinking the water in order to avoid belching, which caused crew dehydration. Prior to entry, crew members fluid load to offset fluid shift when returning from orbit. The crew dehydration increased the effects of the fluid shift and could have posed a risk during high g entry procedures due to a higher chance for loss of consciousness.
STS-9 | 12/8/1983 | Crew: 3
Two GPCs failed during reconfiguration for entry. One GPC could not be recovered.
On December 8, 1983 about five hours prior to the planned landing time, the orbiter's General Purpose Computer (GPC) 1 failed when the primary Reaction Control System jets were fired. About six minutes later GPC 2 also failed, leaving the orbiter in free drift for approximately five minutes before GPC 3 was brought online in OPS 3 entry mode (GPC 3 had been freeze dried for on-orbit operations). Attempts to bring GPC 1 back online were unsuccessful, and it was powered down.
Although problems had occurred, GPC 2 was reinitialized and placed back online, and GPCs 2, 3, 4, and 5 were configured for entry. This off-nominal configuration led to further problems, and delayed the landing time by about eight hours. Entry was set up without GPC 1, and upon landing GPC 2 failed again. Particle Impact Noise Detection testing was instituted to screen out any contamination of the GPC boards, and a spare GPC was flown for several flights after STS-9, but was later dropped as a requirement.
STS-83 | 4/6/1997 | Crew: 7 | Loss of Mission
Failure of fuel cell number 2 resulted in MDF being declared. The 15-day mission was shortened to 3 days.
A failure of fuel cell (FC) number two resulted in a minimum duration flight being declared on April 6,1997. The 16-day mission was reduced to four days due to FC problems encountered on flight day two. During prelaunch operations the differential voltage on FC 2, substack 3 remained above the 150mV limit (defined in the Operations and Maintenance Requirements Specification Document) for an unusually long period of time before dropping below 150 mV. The substack delta voltage began to trend upward shortly after on-orbit operations began at approximately two hours Mission Elapsed Time. FC purges were ineffective at stopping the trend. FC 2 was subsequently shut down and safed to prevent the possibility of a crossover condition, and multiple payloads had to be powered down. FCs 1 and 3 continued to carry the total orbiter load and performed nominally.
Post-flight failure analysis of FC 2 did not identify a root cause for the on-orbit anomaly experienced, but did identify degraded cells and verified the cell performance monitor (CPM) was functioning properly. No foreign material/contaminant was found and the most credible scenario implies an abnormal external event affected a group of cells prior to start–up. It has been hypothesized that this external event was the presence of oxygen in the oxygen side of substack 3 of the FC at a time when the FC was supposed to be inerted with helium. This event over time would cause oxidation of the nickel Electrolyte Reservoir Plate and dissolution of palladium and platinum in the anodes. Migration and plating of the palladium onto the cathode catalyst would cause high open circuit voltage once full reactants are applied to the FC.
As a result of this anomaly and failure analysis, the Launch Commit Criteria was revised to not allow launching with an FC showing similar prelaunch CPM readings. Kennedy Space Center FC purge procedures were also modified to preclude the potential for the presence of oxygen in inerted fuel cells. The program also designed and tested a fuel-cell monitoring system (FCMS) which finally provided individual cell-health monitoring capability (STS-87 first flight). If the FCMS had been available for STS-83, it may have precluded the shutdown of the FC and may have allowed the mission to complete its planned duration.
STS-104 | 7/2001 | Crew: 5
EMU battery leaked hazardous KOH. Discovered during EMU checkout.
During the first pre-extravehicular activity checkout of the July 2001 flight, an increased capacity extravehicular mobility unit (space suit) battery was discovered to have leaked hazardous potassium hydroxide. The leakage resulted in potassium hydroxide deposits on the contamination control cartridge, the water tank structure, and other locations on the primary life support system of the space suit.
Apollo 13 | 4/13/1970 | Crew: 3 | Loss of Mission
Explosion due to electrical short. Loss of O2 and EPS.
Apollo 13 launched on April 11, 1970. On April 13, 1970 during trans-lunar flight at approximately 56 hours, one of the two Service Module oxygen tanks over-pressurized and exploded. This caused the loss of oxygen in that tank and a leak of oxygen out of the remaining tank. This resulted in the loss of all three fuel cells, loss of the primary oxygen source, and the loss of electrical power to the Command Module (except for the entry batteries). The mission was able to continue with the use of the Lunar Module, and the crew safely returned.
Prior to launch, the following conditions resulted in the oxygen tank failing during the mission: By design the cryogenic oxygen tank required both electrical heaters to maintain pressure, and fans to prevent stratification. The tank was a complex assembly with blind installation of the quantity probe, heater/fan assembly, and fill tube. This design leaves wiring insulation vulnerable to damage during assembly with no way to inspect after installation. The Teflon insulated wiring, which is a combustible material in the oxygen tank, was in close proximity to the heater elements and fan.
The Apollo 13 tanks were originally installed on Apollo 11, but a change required the tanks to be removed. During removal of the oxygen shelf, one bolt was left in place causing the fixture to break and resulting in a two-inch drop of the shelf and tanks. Although a loosely fitting (due to loose specification tolerances) fill tube could have been displaced by this, all testing was passed. No cryogenic tests were performed which would have revealed the problem. During the Count Down Demonstration Test the oxygen tank could not be emptied by the normal means of pressurized oxygen gas due to a leak at the fill tube. Instead, the tank heaters were turned on to boil off the oxygen in the tank. The thermostatic switches were rated for 30 volts direct current, but several years earlier the heater ground power supply voltage was raised to 65 volts to reduce the pressurization time. As the temperature increased the thermostatic switch opened and the higher voltage caused the contacts to weld closed. With the heaters continuously on, the temperature approached 1000 degrees and damaged the wire insulation, setting up the conditions for a short and ignition inside the tank. Ground personnel did not notice the continuous heater operation. During the prelaunch problem solving neither the Apollo Spacecraft Program Manager nor the Kennedy Director of Launch Operations knew the tank had previously been dropped or that the heaters had been on for eight hours.
STS-114 | 5/26/2006 | Crew: 7
Bird strike on External Tank.
Loss of foam from External Tank PAL ramp.
TPS gap filers protruding. Removed during third mission EVA.
Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward
separation bolt function and damaging secondary structure and a thermal blanket.
STS-114 encountered four close-call events.
Progress M-12M | 8/24/2011 | Crew: 0 | Loss of Mission
Anomaly in fuel pressurization system led to shutdown of 3rd stage engine. Vehicle failed to reach orbit.
On the August 24, 2011 flight of Progress M-12M (44P) an anomaly in the fuel pressurization system led to the shutdown of the third stage engine. The engine shutdown resulted in the vehicle failing to reach orbit and crashing in the Altai Mountains.
A root cause has yet to be conclusively determined. A blockage of the third stage fuel lines is believed to be the leading cause due to manufacturing and processing.
Progress is an uncrewed vehicle which uses the same third stage rocket segment as the crewed Soyuz capsule.
Apollo I (AS-204) | 1/27/1967 | Crew: 3 | Loss of Crew
Crew cabin fire (electrical short + high pressure O2 atmosphere).
On January 27, 1967 the crew cabin of Apollo 1 caught fire during a test with three crew members inside. The cabin was filled with a pure oxygen atmosphere and pressurized greater than ambient pressure (16.7 psi). Over the course of several hours, the oxygen permeated all materials in the cabin, which had been tested to the normal flight pressure of pure oxygen (5 psi). When the fire began it spread rapidly. Due to the pressure in the cabin, the crew members could not open the hatch to escape. Technicians in the room outside the capsule attempted to open the hatch but were driven back by the heat and smoke. Some technicians donned the available gas masks, but the masks were designed to protect against hypergolic propellant fumes, not smoke. Consequently, these technicians lost consciousness after a short time in the smoke-filled room.
All three crew members were lost.
The fire was caused by an electrical short from an unprotected wire. A subsequent review of all wiring dioded to both Main Bus A and B identified a problem with an environmental control system instrumentation wire powered from Main Bus A and B. The wire was routed over plumbing lines on the crew compartment floor, located below the left-hand crew seat, going into the left-hand equipment bay, between the environmental control unit and the oxygen panel. This Teflon-insulated wire should have had a protective Teflon overwrap, but closeout photos showed that the overwrap had slipped down, no longer providing protection. The commander likely contacted this wire with his foot when he turned to change his communications cable. The most probable initiator of the fire is an electrical arc from this wire, which was unprotected from external damage.
Factors contributing to this accident include:
STS-41D | 6/26/1984 | Crew: 6 | Related or Recurring event
During the launch attempt on June 26, 1984 all aspects of launch countdown were nominal until T-4 seconds when an irregular operation of the Space Shuttle Main Engine (SSME) 3 main fuel valve resulted in an engine shutdown and pad abort condition.
The SSME 3 main fuel valve failed to open when commanded and leaked hydrogen for approximately 21 minutes following the shutdown. After the abort, fire was seen on the starboard side of the body flap for approximately 12 minutes. The aft base heat shield water deluge system was activated and was able to extinguish the fire. Damage to the orbiter was mostly confined to the body flap despite invisible flames of burning hydrogen reaching 190 feet.
The Mobile Launcher Platform sustained minor scorching damage to a few purge ducts and one burnt ground wire. The cause of the main fuel valve anomaly was attributed to contamination in the hydraulic actuator that was likely present at time of installation.
Additional inspection and ground tests were implemented to detect valve anomalies prior to installation into flight engines. Real-time monitoring of valve operation prior to engine start was also enhanced, and ultraviolet fire sensors were added.
STS-112 | 10/7/2002 | Crew: 6
T-0 umbilical issues resulted in none of the system A pyrotechnic charges firing.
The post-launch data review of the October 7, 2002 launch determined that none of the system A pyrotechnics (NASA Standard Initiators) for the Solid Rocket Booster hold-down posts nor the External Tank Vent Arm System discharged.
The Master Events Controller (MEC) provided the signal to the Pyrotechnic Initiator Controller (PIC) to discharge the pyrotechnics. Therefore the MEC common wiring, as well as the wiring between the MEC in the orbiter and the PIC rack on the ground, were suspected of not working properly.
All connectors and electrical circuits were inspected and tested, but no root cause was identified to explain the anomaly.
Soyuz TM-9 | 2/11/1990 | Crew: 2
DM insulation torn loose on ascent; contingency EVA repair.
During the docking of Soyuz TM-9 on February 11, 1990, the TM-8 crew aboard Mir noticed three of the eight descent module's thermal blankets had partially detached near the heat shield during ascent. This raised five concerns:
A rescue mission with a cosmonaut aboard Soyuz-TM 10 was considered, but not executed. The temperature of TM-9 was stabilized by the Mir directing it into alignment with the sun.
Four months later, the Kristall module (90-048A) arrived with the special tools needed to repair the decent module. Cosmonauts were able to secure the blankets out of the sensor's line of sight after an EVA longer than seven hours. The success of the EVA led to a nominal entry upon mission completion.
STS-91 | 6/2/1998 | Crew: 6
Main engine pressure chamber sensor failed. If it occurred later, logic error may have triggered at RTLS.
After the launch of STS-91 on June 2, 1998, a channel A main engine pressure chamber sensor froze. The sensor was disqualified by engine control software when the sensor exceeded allowable limits during the max Q engine throttle down sequence however the sensor remained qualified for engine redline monitoring since the reading was still within reasonableness limits / operational range for the sensor. The channel B sensor and the main engine performed nominally throughout ascent. If an engine problem had occurred, the channel B sensor would have displayed the correct information and indicated the proper corrective action. However, the channel B sensor would have been ignored due to the frozen channel A sensor.
The post-flight inspection revealed that contamination from a seal leak check caused the sensor to freeze. Marshall Space Flight Center (MSFC) project engineering suggested adding a V-seal leak check prior to the acceptance test, to ensure the newly added V-seal was installed properly. However, MSFC project engineering was unaware that performing the leak check would require the manufacturing personnel to plug the chamber pressure port with Viton. After the flight, the sensor was still plugged with a piece of Viton.
If the main engine pressure chamber sensor froze later in the flight, logic errors may have triggered a premature engine shutdown and a return to the launch site abort. Post-flight software changes were implemented to prevent this from occurring on subsequent flights. Additionally, a one-time flow check verified the reliability of the Lee-Jet for all engines in the fleet. A corrective action requires post-Lee-Jet installation flow check and borescope inspection for future engine builds. Lastly, the V-seal leak check was eliminated in future engine builds.
On-pad Abort Events (1984-93)
Related or Recurring event
Mir Collision Events (1994-1997)
TPS Entry Events (1981-2003)
Soyuz Landing Events
LANDING & POSTLANDING