Space Accidents : Lessons Learnt
by
Gp Capt Pankaj Tyagi
Senior Adviser (Av Med)
IAM, IAF

Like in aviation, every incidence is a potential major accident and every major accident points towards material failure or human failure or design failure, which makes us learn and take steps towards a safer “Next Mission”. Although our experience in this field is negligible, we should look back at the setbacks which others had to face and learn from them to update ourselves in this area. Meanwhile the debate on, whether human flights into space are worthwhile or not can carry on.

SPACE ACCIDENTS & LESSONS LEARNT
The time span of space flights with human on board is 40 yrs since 12 April 1961 till date. Some landmarks amongst the accidents involving humans in space are listed in Table - 1 and some important fatal accidents are listed in Table - 2.

24 Oct 1960 R 16 Rocket (Nedelin Disaster)
The "R-16," a new Soviet two-stage rocket, underwent a test in Tyuratam, Russia in October. Under pressure to demonstrate that the Soviets possessed operational intercontinental ballistic missiles, Soviet Field Marshal Mitrofan Nedelin arrived to personally oversee the rocket's launch. Problems developed before the test, but Nedelin ordered it to continue, refusing to drain the rocket of its propellant and make repairs, as workers suggested. Because of a bad wiring connection, a command signal was sent to the second stage that ignited the engine. The engine then burned through the first stage upper tank, causing it to explode. Much of the acid formed a toxic cloud that seared the lungs of nearby workers and onlookers. At least 91 people were killed, including Field Marshal Nedelin.

Marshall of Artillery Mitrofan Nedelin died in the explosion of a ballistic missile in Tyuratam along with numerous other nameless victims. LD1-3T rocket was installed on the "left" launch pad at Site 41. The initial checks at the launch pad were apparently uneventful and were completed successfully on October 23. On the same day, the missile was fueled for launch. By the time of the fueling, all unessential personnel was suppose to leave the area, however, according to several accounts, Marshall Nedelin and Chief-Designer Mikhail Yangel ignored the safety rules and stayed at the pad. Around 150 people, military and civilian, of all ranks also remained.

Soon after or around the time the fueling was completed, the launch personnel discovered a fuel leak onboard the rocket estimated at 142-145 drops per minute. Yet, the technical management characterized the leak as acceptable, as long as it was kept contained. The launch managers assigned personnel from a chemical unit to keep the leak under control.

Table - 1

Human Space Flight Accidents: Some Landmarks

Table – 2
Important Fatal Space Accidents

On loading the rocket with its poisonous propellant, the R-16 launch team reached the point of no return. At the time, there was no procedure allowing to drain the propellant from the rocket. In addition, LD1-3T could not be used for another launch attempt if highly corrosive propellants were drained.

As preparations for the launch continued, the technicians on the ground sent a command to activate pyrotechnically operated membranes on the oxidizer line of the second stage of the rocket. However, due to design and production flaws in the electrical circuit of the control panel, the membranes on the fuel line of the first stage were blown up instead. The pyromembranes prevent propellant loaded in the tanks from entering the fuel lines leading toward the engines. With membranes blown up, the vehicle can not remain fueled on the launch pad for more than two days. As a result, the launch team was now facing a short launch deadline.

To make matters worse, several minutes after the membranes blew up, pyrotechnic devices on the valves of one of three engines in the first stage fired spontaneously. And to complete the picture, the electrical current distributor A-120 supplying the power to the rocket failed. General Gerchik claimed that at some point his team had made a proposal to drain the fuel and remove the rocket from the launch pad, however, it was denied. The engineers decided to use autonomous electrical sources for further operations with the membranes.

Moreover, the membranes on the fuel and oxidizer lines of the second stage had been activated, as well, so, the components of the self-igniting propellant were only one valve away from the combustion chamber of the engine. The PTR switch was activated an electrically driven pneumatic valve EPK VO-8, controlling the ignition of the engine on the second stage of the rocket. This command was intended as a back up to the primary system, which normally would ignite the engine of the second stage in flight.

The second stage engine came to life. Instantly, the roaring flame of the engine burst through the fuel tank of the first stage directly below, initiating an enormous explosion of the fully fueled rocket. In seconds, a giant fireball, up to 120 meters in diameter engulfed the launch pad 41. The direct cause of the accident,” — the commission’s final report said — “was the shortcomings in the design of the control system, which allowed unscheduled operation of the of the EPK V-08 valve controlling the ignition of the main engine of the second stage during pre-launch processing. This problem was not discovered during all previous tests. The fire on the vehicle LD1-3T could have been avoided if the reconfiguration of the current distributor into a zero position was conducted before the activation of the onboard power supply.” They also recommended to re-evaluate the sequence of the pre-launch processing, to improve safety measures.

1966 : Gemini 8
Determined to effect a successful rendezvous in orbit, NASA sent astronauts Neil Armstrong and David Scott in Gemini 8 to dock with the orbiting spacecraft Agena. The astronauts docked successfully but immediately lost control of the combined spacecraft, which began to spin uncontrollably. Scott separated the two vessels, but Gemini 8 only increased its rotation velocity, to a full rotation per second. Armstrong and Scott were veteran pilots and kept their cool. Careful to hold their heads still to prevent paralyzing dizziness, they eventually isolated the problem, a stuck attitude adjuster. By cutting out the adjuster, they stabilized the spacecraft and safely returned home.

27 January 1967 : Apollo 1
A fire claimed the lives of three U.S. astronauts during a preflight test at Cape Canaveral for what was to be the first manned Apollo mission. After the disaster, the mission was officially designated Apollo 1. The three American astronauts, Virgil “Gus” Grissom, Ed White, and Roger Chaffee underwent a training exercise in the Apollo 1 command module. The command module was mounted on the Saturn 5 on the launch pad just as it would be for the actual launch, but the Saturn 5 was not fueled. The plan was to go through an entire countdown sequence. During the procedure, a spark ignited some nylon netting, and a fire quickly spread. At 6:31 one of the astronauts (probably Chaffee) reported, “Fire, I smell fire.” Two seconds later White was heard to say, “Fire in the cockpit.” The Apollo hatch could only open inward and was held closed by a number of latches, which had to be operated by ratchets. It took at least 90 seconds to get the hatch open under ideal conditions. Because the cabin had been filled with a pure oxygen atmosphere at normal pressure for the test and there had been many hours for the oxygen to permeate all the material in the cabin, the fire spread rapidly and the astronauts had no chance to get the hatch open. Near by technicians tried to get to the hatch but were repeatedly driven back by the heat and smoke. By the time they succeeded in getting the hatch open, the astronauts had already perished due to smoke inhalation (Poisonous carbon monoxide).

Unfortunately, NASA had chosen to use the spacecraft’s pure-oxygen system during the test. In the weightless environment of space, such a system would not have posed a fire hazard, as any flame would have been quickly smothered by its own combustion gases. But at ground level the pure oxygen only fanned the flames. After the tragedy, NASA made two simple modifications to its spacecraft: an emergency escape hatch and a two-gas system to dilute the oxygen and nitrogen during ground tests.

The accident was investigated in detail. It was concluded that the most likely cause was a spark from a short circuit in a bundle of wires that ran to the left and just in front of Grissom’s seat. The large amount of flammable material in the cabin in the oxygen environment allowed the fire to start and spread quickly. A number of changes were instigated in the program over the next year and a half. These included the redesigning of a new hatch which opened outward and could be operated quickly, removing much of the flammable material and replacing it with self-extinguishing components, using a nitrogen-oxygen mixture at launch, and recording all changes and overseeing all modifications to the spacecraft design more rigorously.

Mistake number one :
Apollo was planned to fly in space with a pure oxygen atmosphere at 5 psi (pounds per square inch), about one-third the pressure of the air we breathe. But on the launching pad, Apollo used pure oxygen at 16 psi, slightly above the pressure of the outside air. In the oxygen atmosphere at 5 psi things will generally burn in the same manner as they do in air at normal pressures. At 16 psi oxygen pressure most nonmetallic materials will burn explosively; even steel can be set on fire. Incredible as it may sound in hindsight, but all had been blind to this problem. In spite of all the care, all the checks and balances, all the “what happens if’s”, everyone had overlooked the hazard on the launching pad. Strapped down, as though waiting for launch, the astronauts had also began purging their space suits and the cabin atmosphere of all gases except oxygen - a standing operating procedure. Mistake number two :
The cabin was full of Velcro cloth, a sort of space-age baling wire, to help astronauts store and attach their gear and checklists. There were paper books and checklists, a special kind of plastic netting to provide more storage space, and the spacesuits themselves, made of rubber and fabric and plastic. Behind the panels there were wires with nonmetallic insulation, and switches and circuit breakers in plastic cases. Far too much nonmetallic material had been incorporated in the construction of the spacecraft.

Mistake number three :
In the rush to prepare Apollo for flight, the control of changes had not been as rigorous as it should have been. The investigation board was unable to determine the precise detailed configuration of the spacecraft as to how it was made, and what was in it at the time of the accident. Three mistakes, and perhaps more, added up to a spark, fuel for a fire, and an environment to make the fire explosive in its nature. And three fine men died.

Mistake number four :
Unlike the outward-opening hatches of the McDonnell-built spacecraft for Mercury and Gemini flights, the Apollo hatches opened inward. They required a minimum of ninety seconds for opening under routine conditions.

Findings :

• There was a momentary power failure at 23:30:55 GMT.
• Evidence of several arcs was found in the post-fire investigation.
• No single ignition source of the fire was conclusively identified.
• No procedures for this type of emergency had been established either for the crew or for the spacecraft pad work team.
• The emergency equipment located in the White Room and on the spacecraft work levels was not designed for the smoke condition resulting from a fire of this nature.
• Emergency fire, rescue and medical teams were not in attendance.
• Both the spacecraft work levels and the umbilical tower access arm contain features such as steps, sliding doors and sharp turns in the egress paths which hinder emergency operations.

The following are the possible conditions, which led to the disaster:

• A sealed cabin, pressurized with an oxygen atmosphere.
• An extensive distribution of combustible materials in the cabin.
• Vulnerable wiring carrying spacecraft power.
• Vulnerable plumbing carrying a combustible and corrosive coolant.
• Inadequate provisions for the crew to escape.
• Inadequate provisions for rescue or medical assistance

23 April 1967 Soyuz 1
The announcement of the launch was made after one revolution around the Earth. Cosmonaut Vladimir Komarov flew into orbit aboard the Soyuz 1. His mission was to dock with another Soyuz spacecraft, but one of the two solar panels that supplied energy for the maneuver refused to deploy. Soviet ground controllers canceled the launch of the second craft and ordered Komarov to abandon his mission. He promptly complied, but on his return through the atmosphere, his main parachute failed to open, and his reserve parachute became tangled. The spacecraft struck the ground at high speed, killing Komarov, the first man to die in space flight. Komarov experienced severe problems with the attitude control system of his craft. Upon entry into orbit the ships’s sun sensor was inoperable - possibly due to contamination from thruster exhausts.

The landing phase normally comprises descent module separation at 723 seconds after the start of the retroburn (T0). Reentry occurred 27 minutes after T0. This is consistent with a purely ballistic re-entry and no parachute deployment. A few minutes after entering the radio blackout Komarov’s voice reappeared. He was experiencing up to 8-g overload caused by the purely ballistic descent. Drogue parachute was unable to pull the main parachute out of its container. Then the reserve parachute was released but prevented from filling with air by the still-attached drogue chute. Soyuz-1 then hit the ground at 40 meters/second at 0322:52 UT The descent module caught fire and the landing spot was engulfed in smoke. The capsule was in such a state that rescue crews could not find Komarov when they landed and approached the burning wreckage. After an hour of excavations Komarov’s remains were found.

15 January 1969: Soyuz 5
As part of the re-entry procedure at the end of his flight aboard Soyuz 5, cosmonaut Boris Volynov had to jettison his spacecraft’s extra modules. But when he fired the explosive separation bolts, the Equipment Module failed to fully separate and blocked the ship’s heat shield. Volynov lost control, and the Soyuz 5 began to tumble in space. It finally stabilized with the most aerodynamically stable position that is its nose, the thinnest part of the vehicle, facing forward. As the vehicle entered the atmosphere, it began to burn up and its structure to fail. The spacecraft continued on a 9 G ballistic trajectory. Miraculously, stresses on the ship finally dislodged the Equipment Module, and the ship righted itself.

Volynov’s troubles were not over, however. Damaged during re-entry, the spacecraft’s parachutes only partially deployed, making for a near-fatal landing. When ground searchers finally found the wrecked spacecraft, Volynov was not there. He had staggered to a nearby peasant hut, where he had kept warm until the rescue team discovered him. Volynov lost teeth. The capsule was recovered 2 km SW of Kustani, far short of its aim point, on January 18, 1969 at 07:58 GMT.

13 April 1970: Apollo 13
Enroute to the moon, Apollo 13 suffered an explosion and lost its main power supply. Abandoning the mission, ground controllers in Houston then had to figure out a way to get the three astronauts, Jim Lovell, John Swigert, and Fred Haise, back home. On 13th April 1970 the Apollo 13’s command module’s oxygen tank exploded. The oxygen tank No. 2 had exploded from a frayed wire inside the oxygen tank 210,000 km away from the earth. The oxygen tank explosion could have occurred at any time from the launch pad to lunar landing or on the return journey. The explosion occurred shortly after checkout of the life saving lunar module. Alarms at ground control showed no fuel cells meaning that the command module or the mother ship would soon die. When emergency resuscitation failed, the lunar module’s presence became as critical as any of Titanic’s lifeboats. The crew hearing the explosion’s thump-like sound, wrongly thought that the lunar Module might have collided with space debris. Suspecting damage to the lunar module and in order to preserve air, they inadvertently attempted to close their route to safety by trying to close the lunar module’s hatch. Fortunately , the NASA designed mechanism failed in the simplest of functions i.e. closing of the hatch.

The crew later abandoned the mothership for the relative safety of the lunar module, as too much of electrical power was consumed, draining the command vehicle of power for re-entry through Earth’s atmosphere. This meant certain death for the crew. The Lunar module’s large batteries were used to charge smaller cells of re-entry capsule.

Mistake number one :
Since the power was limited, the gyros which control accuracy of re-entry could not be warmed-up for the required 24 hours. Despite considerable odds against Apollo 13, the re-entry and splashdown were among the most precise of the entire Apollo program. The ground crew devised a celestial steering program using the Earth, the Sun, and the Moon as the three points in space.

Cause :
The series of events that led to Apollo 13’s life-and-death drama began five years earlier with a simple design change to the Apollo spacecraft. During flight, the systems aboard the command and service modules were designed to operate at 28 volts. In 1965, however, it became clear that during preflight tests at the Kennedy Space Center, 65 volts would be used. That year, engineers at North American directed that the craft’s electrical components be redesigned to accept both levels of voltage. But one crucial participant never got word of the change. Within the service module were two tanks of liquid oxygen. Oxygen from these tanks was used not only for the astronauts to breathe, but to help run three fuel cells that provided electrical power to run the systems of command module. Each oxygen tank had a thermostat, which was used to regulate the temperature inside the tank. The manufacturer of this thermostat never learned of the need to accept 65 volts of electricity.

In October 1968, the Number 2 tank eventually used on Apollo 13 was at the North American Aviation plant in Downey, California. There, technicians who were handling the tank accidentally dropped it about two inches. After testing the tank, they concluded the incident hadn’t caused any detectable damage. The dropped tank was eventually cleared for flight and installed in Apollo 13. The tank passed all of its routine prelaunch tests. In March 1970, after a practice session called the Countdown Demonstration Test, ground crews could not empty the tank.

The small tube used to fill and empty the tank of its supercold contents had been damaged by the mishandling almost two years earlier. To get around the problem, workers turned on heaters inside the tank to warm up the remaining liquid oxygen, turning it into gas that could then be vented to the outside. The inside the tank was supposed to prevent the temperature exceeding 80 degrees Fahrenheit (25 degrees Centigrade). But as the temperature inside the tank rose, the thermostat was activated, and the oversight from 1965 came into play. The resulting surge of electricity at 65 volts caused the 28-volt thermostat to weld shut. Technicians failed to notice the situation, and during the procedure to empty the tank temperatures inside rose to 1,000 degrees Fahrenheit (500 degrees Centigrade). The intense heat damaged some insulation on wiring inside the tank. No one knew it, but when Apollo 13 lifted off, it carried the makings of a small bomb inside its service module.

The “bomb” was triggered on the evening of April 13 when ground controllers asked Jack Swigert to turn on the fans inside the service module’s two liquid-oxygen tanks, as a way of stirring the contents, to allow more accurate quantity readings. When the fan inside the Number 2 tank was turned on, the damaged wiring caused a spark, starting a fire inside the oxygen tank. With pure oxygen feeding the fire, the pressure inside quickly grew to the point where the tank burst open, at the same time damaging much of the other plumbing inside the densely packed service module and crippling the spacecraft. Guenter Wendt explains, “That thing just cooked and burned up and that’s what caused the thing to blow.”

Lesson Learnt :
In the wake of Apollo 13, engineers redesigned the oxygen tanks to prevent similar accidents. Also, a third oxygen tank was added to the service module, as an additional backup. Eight more Apollo spacecraft flew and none of them experienced the same trouble again.

29 June 1971: Soyuz 11
Crew : Cosmonauts Viktor Patsayev, Georgi Dobrovolsky, and Vladislav Volkov Soyuz 11 was the second mission to Salyut 1, the first civilian space station launched on 6th June 9171 . This record-breaking 24-day space mission was heralded as the beginning a new era in space exploration. Everything went as planned, until the craft began to enter the Earth’s atmosphere. A failure in the firing of the pyrotechnic devices that separate the Soyuz orbital module from the return module caused a pressure equalization valve to remain open and thus allowed the atmosphere in the return module to leak out. The cabin began to lose pressure, and oxygen. Viktor, one of the cosmonauts, knew that in order to restore pressure, he had to close the pressure equalization valve. He began turning the handle connected to the valve as fast as he could, but unfortunately, it was not fast enough. One hundred miles above the Earth, the capsule was suddenly exposed to the surrounding low pressure of space. Patsayev tried to close the valve by hand but failed. Air inside the spacecraft quickly leaked away, causing an abrupt loss of pressure and the death of all three cosmonauts, killing them 30 minutes before landing. The cosmonauts were found dead in the Soyuz 11 capsule when it was opened after landing. The design of the Soyuz reentry module at the time did not allow enough room for three cosmonauts to wear spacesuits.

The spacecraft landed successfully, but the recovery teams found all three cosmonauts dead. As a result of this accident, all subsequent Soyuz crews have worn pressure suits during launch, re-entry, and docking activities.

If the design had done a better job on the valve, the cosmonaut would have been able to close it in time. However, when designing the valve, the conditions under which it would be needed to be closed were not considered. It was intended to be used for such an emergency, however when the emergency came, it was not possible to close the valve in time to save the crew’s lives, hence defeating its purpose. In a case like this, the design team should have done more testing.

18 March 1980 Vostok :
The Plesetsk launch center accident was the second biggest on-ground accident since October 24, 1960 (Nedelin’s disaster). On March 18th, 1980 during filling of the booster with liquid oxygen – 2 hours before the scheduled launch time – soldiers discovered an oxygen leak in a pipeline close to the booster. As it used to be in Russia – despite its alleged superiority – they decided to fix the problem with improvised means – this time it was a wet rag.The day was very cool and the wet rag was supposed to stop the leak instantly. Unfortunately the rag was taken from a nearby truck – and was dirty (with traces of oil and gas). It took only a few seconds for the rag to catch on fire – and another minute to put the entire launch pad and then the booster itself ablaze. The truth about the wet rag was only understood after several months work on the part of the accident commission– after extensive chemical tests and eyewitness interviews – there were slightly less than 100 people on the pad during the accident.

CONCLUSION
From small inputs on modification of pre launch operations, cabin atmosphere selection, space suit layers, procedural modifications, to major design changes in the space vehicles itself have come from the investigations carried out into the causes of space accidents. This is the price which has been paid, in the early part of the space progrramme as time, rather than validation of the technology in the laboratories was at premium.

REFERENCES :

1. AE Nicogossian Sam LP, John JU. Historical Perspective In: Space Physiology and Medicine Page
2. Anand BK. Some aspects of space ecology and physiology. IJAM. October 1971. 14 : 24-9
3. Ginsburg AP, Vanderploeg JM. Vision In Space: Near Vision Acuity And Contrast Sensitivity. In : Results Of Life Sciences Detailed Supplementary Objectives (DSOs) conducted aboard the space shuttle from 1981 to 1986 (NASA TM-58280) edited by Bungo MW, Bagian TM, Bowman MA and Levitan BM. Washington, D.C., US Government Printing Office, 1987
4. Ursula T Slager. Man’s Entry Into Space In: Space Medicine Page 13
5. Verghese CA. Biomedical Problems in Orbital And Sub Orbital Manned Space Flight. IJAM. October 1961 6:9-17
6. Internet searches.