Brink of Disaster: A History of Close Calls in Human Spaceflight

Introduction

The exploration of space stands as one of humanity’s most ambitious endeavors, a testament to our relentless drive to push beyond the known horizon. Yet, this ambition is matched only by the profound risks involved. Every launch, every orbit, every fiery return to Earth is a journey balanced on the knife’s edge of technological perfection and human fallibility. The history of human spaceflight is not just a story of triumphant achievements; it is also a somber chronicle of disaster and a dramatic saga of near-misses, where catastrophe was averted by skill, ingenuity, or sheer luck. These significant incidents and close calls, from the earliest days of the space race to the era of the International Space Station, form the bedrock upon which modern spaceflight safety is built.

Understanding these events requires looking beyond a simple list of accidents. By examining them thematically—grouping them by the phase of flight or the nature of the failure—a clearer picture emerges of the persistent challenges that have defined the quest for space. The dangers of the launchpad, the fragility of life-support systems in orbit, the counter-intuitive physics of rendezvous, the fallibility of the human-machine interface, and the unforgiving violence of re-entry are recurring motifs in this history. This article reviews these critical moments, exploring not just what went wrong, but why, and how the lessons learned from the brink of disaster have shaped the ongoing effort to make spaceflight a safer, more reliable enterprise. These are the stories that underscore the true cost and complexity of reaching for the stars.

The Perilous Ascent: Dangers on the Launchpad and Beyond

The launch is the most power-intensive and dynamic phase of any space mission. In minutes, a vehicle must accelerate to over 17,000 miles per hour, enduring immense structural loads, extreme vibrations, and searing temperatures. This controlled explosion is where the smallest flaw—a faulty seal, a software bug, an overlooked dust cap—can have immediate and catastrophic consequences. The history of crewed spaceflight is punctuated by harrowing incidents during ascent, from fires on the launchpad to in-flight breakups, each serving as a stark reminder that leaving Earth is the most dangerous part of the journey.

Fires and Aborts on the Pad

The moments just before and after ignition are among the most critical. With the vehicle fully fueled and all systems live, a failure on the pad can be devastating. Several missions have come within seconds of disaster before ever clearing the launch tower.

A dramatic example of a last-resort safety system working as intended occurred with the Soyuz T-10-1 mission on September 26, 1983. Shortly before liftoff, a propellant valve failed to close, spilling fuel that quickly ignited and engulfed the base of the rocket in a massive fire. The launch control team attempted to activate the capsule’s launch escape system, but the fire had already burned through the control cables. For twenty agonizing seconds, the two cosmonauts sat atop a burning rocket. Finally, ground controllers managed to activate the escape system by radio command. The escape tower’s powerful rocket motor fired, pulling the crew capsule away from the pad with an acceleration between 14 and 17 times the force of gravity. Seconds later, the booster exploded, completely destroying the launch complex. The crew landed safely about four kilometers away, their survival a testament to the robust, if brutally effective, escape system.

The Space Shuttle program had its own share of launchpad drama. The first on-the-pad abort occurred during the maiden flight attempt of the orbiter Discovery on mission STS-41D on June 26, 1984. The countdown proceeded normally until T-4 seconds, after two of the three Space Shuttle Main Engines (SSMEs) had already ignited. When the third engine failed to start, the onboard computers commanded an immediate shutdown of the other two. While the crew was safe inside the orbiter, an unseen danger was brewing outside. Leaking hydrogen from the engine shutdown sequence had ignited, creating a large, invisible fire at the shuttle’s aft end. The pad’s fire suppression system was activated, but had the crew attempted an immediate evacuation using the standard slidewire escape system, they would have run directly into the flames. This incident led to significant changes in pad abort procedures, including the routine use of the fire suppression system and more realistic crew training for pad escape scenarios.

Sometimes, the fate of a mission rested on a single, split-second decision by its commander. During the launch attempt of Gemini 6 on December 12, 1965, the Titan II rocket’s main engine ignited and then shut down just 1.5 seconds later. Complicating the situation, an electrical plug had fallen from the base of the rocket, which erroneously started a clock in the cockpit that normally only began at liftoff. The rocket’s malfunction detection system, sensing no upward motion while the clock was running, correctly triggered the engine stop. Inside the capsule, the crew faced a life-or-death choice. The instruments indicated a liftoff had occurred followed by an engine failure, a scenario that demanded an immediate ejection to escape the collapsing, fully fueled rocket. However, Commander Wally Schirra felt no sensation of movement. Trusting his own senses over his instruments, he chose not to pull the ejection ring, a decision that saved the mission. An investigation later revealed the cause of the shutdown: a simple plastic dust cover had been inadvertently left in an oxidizer port during ground preparations. This small oversight nearly led to the loss of the vehicle and highlighted the absolute necessity of meticulous ground procedures.

These were not isolated events. The complex SSME start sequence remained a source of trouble throughout the Shuttle program, with other on-pad aborts occurring on missions STS-51F, STS-55, STS-51, and STS-68. Each abort, triggered by issues like slow-acting valves or faulty sensor readings, underscored the razor-thin margin between a successful launch and a potentially hazardous shutdown on the pad.

Engine Failures and Performance Anomalies

Once a vehicle is in flight, the performance of its engines is paramount. Even a slight deviation from the planned thrust profile can lead to an abort, and a major failure can be catastrophic.

A persistent and dangerous problem during the Apollo program was a phenomenon known as pogo oscillation. This violent, longitudinal vibration, named for its resemblance to the motion of a pogo stick, is caused by a self-reinforcing feedback loop between the engine’s thrust and the fuel lines. As the rocket structure vibrates, it causes pressure fluctuations in the propellant lines, which in turn causes the engine thrust to fluctuate, amplifying the vibration. During the uncrewed Apollo 6 test flight, pogo was so severe that it caused structural damage to the spacecraft adapter. On the Apollo 13 launch, pogo oscillations in the second stage were so intense that they caused the center engine to shut down more than two minutes early. To reach orbit, the remaining four engines had to burn longer, a successful but unplanned demonstration of the Saturn V’s engine-out capability. Engineers eventually solved the pogo problem by installing helium-filled “shock absorbers” in the liquid oxygen lines of the first stage, a clever fix that “de-tuned” the system and broke the destructive feedback loop.

The Space Shuttle Main Engines were marvels of engineering, but their complexity made them susceptible to failure. On mission STS-51F in 1985, faulty temperature sensors triggered the premature shutdown of one main engine in flight. This forced the shuttle into an “Abort to Orbit,” a lower, less stable orbit than planned. A second engine’s sensors also showed high readings, but its auto-shutdown was inhibited by the crew to ensure the vehicle could reach a safe orbit. On STS-93 in 1999, a different problem occurred: a small metal pin, left over from the manufacturing process, broke loose inside the nozzle of one of the main engines. The pin struck and ruptured cooling tubes, causing a significant hydrogen leak. The engine’s controller compensated by increasing oxygen flow, which led to an early engine shutdown. These incidents reveal how the SSMEs were vulnerable to both minor component failures and foreign object debris.

Not all engine problems were so dramatic. On three consecutive missions—STS-108, STS-109, and STS-110—the main engines slightly underperformed. The cause was a subtle software error. A coefficient in the engine controller software, meant to compensate for a sensor bias, was adjusted in the wrong direction due to a communication error between engineering teams. The result was a small but measurable deviation in the engine’s mixture ratio. While the underperformance was not severe enough to affect the missions, it served as a powerful lesson: in the world of software, a misplaced minus sign or a simple miscommunication can have tangible, and potentially dangerous, physical consequences. A larger error could easily have led to a premature engine shutdown and a mission abort.

The criticality of proper stage separation was brutally demonstrated during the Soyuz 18-1 launch on April 5, 1975. An electrical fault caused two of the four explosive bolts connecting the first and second stages to fire prematurely. This severed the electrical connections for the remaining two bolts. When the first stage finished its burn, it could not separate. The second stage ignited, but it was now dragging the dead weight of the entire first stage. The booster veered violently off course, and at a deviation of 10 degrees, the automatic safety system activated, shutting down the engine and separating the crew capsule. The crew endured a punishing re-entry, with forces exceeding 20 Gs, and landed in the remote Altai Mountains. The incident highlighted the absolute necessity for the pyrotechnic systems that separate rocket stages to work with perfect timing and reliability.

Structural Failures and Debris

The immense forces of ascent can exploit any weakness in a spacecraft’s structure, and the vehicle itself can shed pieces that become dangerous projectiles. The most infamous example of this is the loss of Space Shuttle Challenger (STS-51L) on January 28, 1986. The cause was the failure of an O-ring seal in a joint of the right Solid Rocket Booster (SRB). Unusually cold temperatures at launch had made the rubbery O-rings stiff and unable to properly seal the joint. A plume of hot gas, at over 5,000 degrees Fahrenheit, burned through the side of the booster and acted like a blowtorch on the adjacent External Tank. The tank’s structure failed, leading to a massive explosion of liquid hydrogen and oxygen that destroyed the orbiter and killed all seven crew members.

Tragically, the Challenger disaster was a failure that had been foretold. The research material reveals that gas sealing anomalies in the SRB joints had been observed on nearly 20 previous shuttle flights. This pattern represents a classic case of what sociologists call the “normalization of deviance,” where a known flaw that does not cause immediate failure is gradually accepted as an acceptable risk. The repeated success of launches with flawed O-rings created a false sense of security that ended in disaster.

Even the very first Space Shuttle flight, STS-1, narrowly averted a structural catastrophe. As the SRBs ignited, they created a powerful ignition overpressure wave—a shock wave of sound—that reflected off the launch pad and slammed back into the vehicle. The wave was much stronger than pre-flight models had predicted. This shock wave traveled up the orbiter, causing it to vibrate violently and buckling a critical metal strut that supported one of the propellant tanks in the forward Reaction Control System module. Had the strut failed completely, it could have led to a catastrophic leak and explosion. This unexpected phenomenon led directly to the installation of the massive water sound suppression system on the launch pad, which was used for all subsequent launches to dampen the acoustic energy at liftoff.

In the later years of the Shuttle program, debris shedding during ascent became a primary safety concern. This included foam insulation breaking off the External Tank (the cause of the Columbia disaster, though that mission is not detailed in the source material), bird strikes, and pieces of ablative heat-shielding material liberating from the boosters. These debris strikes were a recurring problem on missions like STS-114, STS-116, and STS-125. The threat became so significant that extensive on-orbit inspections of the orbiter’s thermal protection system became standard procedure. On STS-117, a piece of debris tore a thermal blanket on the orbiter’s Orbital Maneuvering System (OMS) pod. The damage was severe enough that an unplanned, high-risk spacewalk was required to staple and pin the blanket back down to prevent the vehicle from burning up during re-entry.

The launch environment itself could also be a source of debris. During the launch of STS-124, the immense force of the SRBs tore approximately 3,500 fire-resistant bricks from the wall of the flame trench. The bricks were scattered hundreds of feet, posing a new and unexpected risk of debris striking the vehicle or launch infrastructure.

The ascent phase is an exercise in controlled violence, and the incidents from this period reveal that this control is often more tenuous than it appears. The line between a normal countdown and a mission-ending failure is measured in seconds and depends on the flawless performance of thousands of components. Events like the pogo oscillations show that even when systems are operating as designed, the complex interaction of forces can create destructive new phenomena that engineers failed to predict. The history of launch is a story of constantly discovering the limits of engineering prediction and control. Success often depended not just on robust design, but on the quick thinking of crews and, at times, a considerable measure of good fortune when these unknown forces emerged.

Life on the Edge: On-Orbit Crises

Once in orbit, the violent struggle of launch gives way to a different set of dangers. The spacecraft becomes a tiny, fragile outpost of life in the lethal vacuum of space. Here, survival depends on the flawless functioning of complex life support systems, the integrity of the hull protecting the crew from the void, and the ability to handle unexpected failures far from any help. On-orbit crises, from catastrophic explosions and uncontrollable tumbles to fires and toxic leaks, have repeatedly tested the resilience of both machines and their human operators. These events show that a spacecraft is not just a vehicle, but a delicate ecosystem where a single failure can threaten the entire mission.

Catastrophic System Failures

The most well-known on-orbit crisis is undoubtedly the Apollo 13 mission in April 1970. Fifty-six hours into its flight to the Moon, a routine stir of the cryogenic oxygen tanks triggered an explosion. The blast was the culmination of a chain of failures that began on the ground: a tank had been dropped during pre-flight handling, and an improper ground test procedure using incompatible equipment had severely damaged the wiring insulation inside. In flight, this damage led to an electrical short that ignited the Teflon insulation in the pure oxygen environment. The explosion blew off the side of the Service Module, venting the contents of both oxygen tanks into space. This knocked out the Command Module’s primary source of electrical power and breathable air. The lunar landing was aborted, and the crew’s survival depended on an incredible feat of improvisation: using their Lunar Module, “Aquarius,” as a lifeboat. For four days, the crew and Mission Control worked around the clock to solve one life-threatening problem after another, from conserving power and water to building a makeshift carbon dioxide scrubber. The safe return of the Apollo 13 crew became a legendary demonstration of ingenuity and the value of having a redundant, dissimilar spacecraft available in an emergency.

The first critical in-space emergency for the United States occurred four years earlier, during the Gemini 8mission in March 1966. After successfully performing the world’s first docking with an Agena target vehicle, a thruster on the Gemini capsule became stuck open due to an electrical short. The stuck thruster sent the docked spacecraft into a violent, accelerating spin. At its peak, the capsule was rotating nearly once per second, a rate that would soon have caused the astronauts to lose consciousness. Commander Neil Armstrong undocked from the Agena, but this only made the spin worse, as the lighter Gemini capsule now tumbled even faster. To save themselves, the crew had to shut down the main maneuvering thrusters and use the separate Re-entry Control System to stop the spin. While this action saved their lives, mission rules dictated that any use of the re-entry system automatically triggered an immediate abort. The mission was cut short, resulting in the first emergency de-orbit and landing for the U.S. space program. The incident was a stark lesson in how a single component failure could instantly create a life-threatening situation.

The long-duration missions on space stations have shown a vulnerability to cascading digital failures. During ISS Increment 2 in 2001, a near-simultaneous failure of the hard drives in two of the three primary U.S. Command and Control (C&C) computers left the American segment of the station essentially brain-dead. The crew and ground controllers had to painstakingly restore the systems, eventually replacing one computer and loading software directly into the memory of another. A similar crisis occurred during ISS Increment 15 in 2007, when all six of the Russian computers that provide primary attitude control for the station failed. The cause was traced to a short circuit caused by corrosion on a power monitoring unit, likely due to condensation from a nearby air separator. In both cases, the station’s survival depended on the redundancy provided by the other nation’s systems—the docked Space Shuttle provided attitude control during the Russian computer failure—and the crew’s ability to perform complex hardware bypasses and repairs.

The aging Mir space station was also no stranger to critical failures. In 1997, a cosmonaut preparing for a spacewalk accidentally unplugged a vital power cable to the station’s central computer. This immediately shut down the attitude control system, and the station began to drift uncontrollably. Without the ability to point its solar arrays at the sun, Mir lost all power. The crew had to use the thrusters on a docked Progress supply ship to reorient the station and slowly recharge its depleted batteries, a recovery that took several days. The incident highlighted the fragility of the station’s complex and often jury-rigged infrastructure.

The Hostile Environment: Fires, Leaks, and Contamination

The greatest danger to a crew in space can come from the very systems designed to keep them alive. The tragedy of Apollo 1 on January 27, 1967, was a brutal lesson in the dangers of a pure oxygen environment. During a launch rehearsal on the pad, an electrical short from damaged wiring ignited flammable materials inside the capsule, which was pressurized with 100% oxygen at greater than atmospheric pressure. The fire spread with explosive speed. The crew was unable to escape because the inward-opening hatch was held shut by the intense internal pressure. The three astronauts perished before ground crews could reach them. The disaster forced a complete redesign of the Apollo capsule, with flammable materials replaced, wiring protected, and a new quick-opening, outward-swinging hatch installed. It fundamentally changed NASA’s approach to safety.

A similar tragedy occurred in the Soviet program in March 1961. During a ground test in an altitude chamber, a cosmonaut tossed an alcohol-soaked cotton swab that landed on an electric hot plate. In the oxygen-rich atmosphere of the chamber, his training suit instantly caught fire. As with Apollo 1, the inward-swinging hatch was sealed by the internal pressure, and it took several minutes for rescuers to open it. The cosmonaut died from his burns. These parallel tragedies underscore that the extreme fire hazard of high-concentration oxygen environments was a known danger in both programs.

Fire broke out again in space on the Mir space station in February 1997. A Solid Fuel Oxygen Generator—an “oxygen candle” used to supplement the station’s atmosphere—malfunctioned upon activation. It ignited into a powerful, torch-like flame that spewed molten metal and blocked the crew’s emergency escape path to one of the docked Soyuz capsules. The six-person international crew donned oxygen masks and successfully extinguished the fire with foam extinguishers, but the incident filled the station with acrid smoke and was a terrifyingly close call. It raised serious questions about the safety of such oxygen-generating devices, which were also planned for use on the International Space Station.

Beyond the acute danger of fire, long-duration missions have been plagued by a constant, low-level battle against leaks and contamination. In August 2018, the crew of the ISS discovered a 2-millimeter hole in the orbital module of their docked Soyuz MS-09 spacecraft, which was causing a slow cabin pressure leak. The crew located the hole and sealed it with epoxy. The cause remains a subject of investigation. Throughout the history of Mir and the ISS, there have been numerous instances of coolant leaks, including Freon from air conditioning units and Triol from cooling loops. The air quality on these stations has also been a concern, with periodic spikes in contaminants like formaldehyde and methanol, and noxious odors from equipment like the U.S. segment’s metal oxide canister used for carbon dioxide removal. These events illustrate the immense challenge of maintaining a clean, safe, and habitable environment within a closed-loop system over many years.

Damage and Repair in the Void

Sometimes, the threat comes from damage to the spacecraft’s exterior, requiring crews to venture outside to perform risky and often improvised repairs.

During the ascent of Soyuz TM-9 in 1990, the crew on Mir noticed that three of the thermal blankets on the approaching capsule’s descent module had torn loose. These blankets were essential for protecting the capsule from the extreme temperatures of space and re-entry. There was a serious risk that the capsule could cool down too much, causing condensation and electrical shorts, or that critical re-entry sensors could be blocked. A contingency spacewalk was planned, and the two cosmonauts, who had not been trained for such a repair, had to learn the procedures in orbit. They successfully ventured outside and managed to fold and secure the damaged blankets, allowing for a safe return to Earth.

A similar crisis occurred on Space Shuttle Atlantis during mission STS-117 in 2007. A piece of debris during launch had torn a four-by-six-inch corner of a thermal blanket on one of the orbiter’s OMS pods. Engineers on the ground feared that during re-entry, the peeled-back blanket could allow superheated gas to penetrate the structure, which could lead to a catastrophic failure. An unplanned, high-risk spacewalk was added to the mission. Using the station’s robotic arm as a platform, an astronaut was maneuvered to the damaged area, where he used a medical stapler and pins to fasten the blanket back into place. The repair held, and the orbiter landed safely.

Perhaps the most dramatic orbital repair mission was the one that saved the entire Skylab program. America’s first space station was severely damaged during its unmanned launch in May 1973. Aerodynamic forces tore off the station’s large micrometeoroid shield, which also ripped away one of the two main solar arrays and jammed the other, leaving the station with minimal power and unprotected from the sun’s intense heat. The first crew, Skylab 2, launched on a rescue mission. They had to perform a series of daring and unprecedented spacewalks. First, they deployed a makeshift parasol-like sunshade through a scientific airlock to cool the overheating workshop. Then, in a later EVA, they used a pole with a cable cutter on the end to free the jammed solar array. The successful repairs by the crew saved the $2.5 billion program from being a total loss and demonstrated for the first time that humans could perform complex, unplanned construction and repair tasks in space.

These on-orbit crises reveal that a spacecraft is a fragile ecosystem, a delicate balance of crew, hardware, and environment. A single hardware failure, like on Apollo 13 or Gemini 8, can instantly threaten the entire system. The very life support systems that create a habitable environment, as seen in the recurring fires and leaks, are also a constant source of potential danger. The heroic repairs on Skylab and STS-117 show the crew acting as the ecosystem’s immune system, venturing out into the hostile external environment to repair damage and restore the system to health. On-orbit survival is a constant negotiation with entropy, and missions succeed not because failure is impossible, but because the systems and their crews possess enough resilience, redundancy, and ingenuity to withstand shocks and, when necessary, repair themselves.

The Human Element: When People and Procedures Falter

In the complex and unforgiving environment of spaceflight, the human operator is both the greatest asset and a potential source of critical failure. An astronaut’s ability to reason, adapt, and improvise has saved numerous missions from disaster. At the same time, a moment of distraction, a misinterpretation of an instrument, or a poorly designed procedure can lead directly to a crisis. The history of spaceflight is filled with incidents where “human error” was a contributing factor, but a deeper look often reveals that these errors are symptoms of a flawed interface between people and their incredibly complex machines. These events trace the evolution of understanding from blaming individuals to designing systems that are more resilient to inevitable human mistakes.

Errors of Commission: Incorrect Inputs and Actions

Some of the most harrowing close calls have been triggered by a simple, incorrect action—a switch flipped at the wrong time or a wrong number entered into a computer.

During the Apollo 10 mission in May 1969, the crew was performing a dress rehearsal for the lunar landing, flying the Lunar Module “Snoopy” to within nine miles of the Moon’s surface. While troubleshooting an unrelated electrical issue, the commander inadvertently flipped a switch for the Abort Guidance System to the “AUTO” position instead of “ATTITUDE HOLD.” The backup guidance system, now active, immediately tried to execute its pre-programmed function: find the Command Module. This sent the Lunar Module into a wild, uncontrolled tumble, flipping end over end. With the vehicle just miles from the lunar surface, the commander had to quickly take manual control to stop the gyration and save the vehicle.

A similarly critical error occurred at the very end of the Skylab 4 mission in February 1974. While preparing the Apollo Command Module for re-entry, the crew inadvertently opened the wrong set of circuit breakers. Instead of deactivating the service propulsion system, they disabled the primary stabilization and control system. As the commander attempted to orient the spacecraft for Service Module jettison, he found the controls unresponsive. The vehicle was adrift. The crew had to quickly diagnose the problem and switch to a direct manual control mode to get the spacecraft properly oriented with its heat shield facing forward. Failure to do so would have resulted in the loss of the vehicle and crew during re-entry. The incident was attributed to the close proximity and similar labeling of the critical circuit breakers, a design flaw that increased the potential for human error.

These errors were not limited to the crew in space. During the re-entry of Gemini 5 in August 1965, a ground controller made a mistake while programming the guidance computer, incorrectly entering the Earth’s rotation rate as 360 degrees per day instead of the correct 360.98. In orbit, the astronaut noticed that the computer’s guidance was commanding an incorrect flight path. Recognizing the error, he took manual control and flew the re-entry profile by hand. His intervention resulted in a landing that was 130 kilometers short of the target but was actually closer to the recovery ship than it would have been had he followed the flawed computer guidance.

A more dramatic ground error occurred during STS-32 in January 1990. While the crew was asleep, Mission Control uplinked an erroneous state vector—the data that tells the orbiter where it is and how it’s oriented—to the flight control system. The orbiter’s computers immediately began trying to “correct” to this false orientation, firing numerous thrusters and sending the vehicle into an uncontrolled, multi-axis rotation. The tumbling continued for about ten minutes until the orbiter came back into communications range. The crew had to be awakened by Mission Control and instructed to switch to a manual mode to arrest the unwanted motion before a correct state vector could be uploaded.

Errors of Omission and Flawed Procedures

Sometimes, the danger comes not from an incorrect action, but from a failure to perform a critical step, often because the procedure itself is flawed or lacks a necessary verification.

On STS-87 in November 1997, the crew deployed the SPARTAN satellite from the cargo bay. However, a critical command to activate the satellite was not successfully received by the spacecraft before release. Because the procedures lacked a clear verification step and there was no telemetry to confirm the satellite’s status, neither the crew nor Mission Control realized the satellite was inert. It failed to perform its expected maneuvers after release, and a planned spacewalk had to be re-tasked to allow astronauts to go out and manually recapture the dead satellite. The incident highlighted a procedural blind spot that relied on flawless human-machine communication without confirmation.

A complex chain of procedural and sensor failures nearly led to a major incident during a launch attempt for STS-61C in January 1986. A faulty sensor indication led a ground operator to deviate from the standard automatic launch sequence. In doing so, the operator did not manually command a critical liquid oxygen (LOX) fill-and-drain valve to close. This allowed approximately 14,000 to 18,000 pounds of LOX to drain out of the External Tank unnoticed. The launch was ultimately scrubbed for an unrelated issue, but had it proceeded, the shuttle would have run out of oxidizer far too early. This would have caused a premature main engine shutdown and forced a highly risky Trans-Atlantic Abort Landing (TAL).

The most famous example of a ground procedure failure setting the stage for an in-flight disaster is Apollo 13. The chain of events that led to the oxygen tank explosion began long before launch. The tank in question had been installed in a previous Apollo service module, then removed. During removal, a bolt was overlooked, and the shelf holding the tank was dropped two inches, potentially damaging an internal fill line. Later, during a ground test, the tank could not be emptied normally. To boil off the oxygen, ground crews decided to turn on the tank’s internal heaters. However, the ground support equipment supplied 65 volts to the heaters, which were designed to run on the spacecraft’s 28-volt system. This over-voltage welded the thermostatic protection switches shut, meaning the heaters could not turn off. During the test, the heaters ran for eight hours, cooking the wiring insulation inside the tank and turning it into a bomb waiting for a spark. This critical deviation from procedure went unnoticed and undocumented, setting the stage for the short circuit that occurred in space.

The tragic breakup of SpaceShipTwo during flight PF04 on October 31, 2014, was a stark lesson in human factors and procedural design. The vehicle’s design included a “feathering” system, where the tail booms rotate upward for a stable, high-drag re-entry. The system was held in place by locks. The procedure called for the copilot to unlock the feather at a speed of Mach 1.4. However, during the high-workload, high-vibration boost phase, the copilot unlocked the system prematurely, at only Mach 0.8. At this lower speed, the aerodynamic forces on the tail were too great for the feather’s actuators to handle alone. The feather deployed uncommanded, causing the vehicle to break apart catastrophically. The investigation determined that the system’s design, procedures, and training failed to adequately protect against a single, irreversible human error that had catastrophic consequences.

These incidents reveal that “human error” is often a symptom of a deeper issue: a system design that fails to account for the realities of human performance under stress. The same human cognition that leads to slips and mistakes is also the source of the flexible, adaptive problem-solving that has saved numerous missions. In cases like Apollo 10, Gemini 5, and Skylab 4, it was the crew’s quick manual intervention that averted disaster. The history of these failures shows a slow but steady progression in understanding, moving from a culture that might blame an individual to one that focuses on redesigning systems, procedures, and training to be more tolerant of, and resilient to, inevitable human fallibility.

The Delicate Dance: Rendezvous, Docking, and Collision

Bringing two spacecraft together in orbit is a fundamental capability for building space stations, conducting rescue missions, and traveling to the Moon. Yet, this delicate dance is governed by the unforgiving and often counter-intuitive laws of orbital mechanics. An attempt to “speed up” to catch a target by thrusting directly at it will, paradoxically, push a spacecraft into a higher, slower orbit, causing the target to pull away. Mastering this celestial ballet was a critical step in the space race, and the path to proficiency was marked by failed attempts, near-misses, and dangerous collisions that taught engineers and astronauts hard-won lessons.

Failures to Connect

The seemingly simple act of latching two vehicles together in the vacuum of space has proven to be a recurring challenge. On Apollo 14, the crew spent two hours making six unsuccessful attempts to dock the Command Module “Kitty Hawk” with the Lunar Module “Antares” after leaving Earth orbit. The docking probe would make contact, but the capture latches would not engage. With the lunar landing on the line, the crew and Mission Control developed a contingency plan on the fly. On the seventh try, the pilot fired the Command Module’s thrusters to physically push the two vehicles together and hold them in place while the probe retraction system was activated, finally achieving a hard dock. The cause was never definitively determined, but was suspected to be either foreign debris or ice in the docking mechanism from rain on the launch pad, or a mechanical binding within the probe itself.

The crew of Skylab 2 faced a similar crisis. After performing a fly-around to inspect the damaged Skylab station, they successfully docked. Later, they undocked to attempt a repair on the jammed solar array. When they tried to re-dock, the capture latches on their Apollo Command Module failed repeatedly. With the station’s rescue on the line, the crew had to don their pressure suits, depressurize the cabin, and perform an impromptu in-flight modification of the docking probe, bypassing the faulty automated system to achieve a manual docking. Failure to dock would have meant the loss of the entire Skylab station.

The Soviet space program experienced a persistent series of docking failures with their automated “Igla” (Needle) rendezvous system. Missions like Soyuz 15, Soyuz 23, Soyuz 33, Soyuz T-8, and Soyuz 56 all failed to dock with Salyut space stations due to various malfunctions in the Igla system. In some cases, the system caused the spacecraft to oscillate wildly or approach too quickly; in others, it simply failed to acquire the target. These failures often forced the missions to be aborted, as the crews did not have enough fuel remaining to attempt a manual docking after the automated system had failed. This highlighted a significant weakness in the automated systems of the era.

Collisions in Orbit

The consequences of getting the orbital dance wrong can be severe. The Mir space station was struck by unmanned Progress cargo ships on two separate occasions. In August 1994, Progress M-24 collided with the station multiple times during a docking attempt, though the damage was minor. A far more serious incident occurred on June 25, 1997, when the crew was testing a manual, tele-operated docking system called TORU. The commander, guiding Progress M-34 from a control station inside Mir, lost control as the ship came in too fast. The Progress vehicle struck the Spektr science module, punching a hole in its hull and damaging a solar panel. Air began rushing out of Spektr, and the station’s pressure began to drop. The crew had to act instantly, cutting a bundle of power and data cables that ran through the hatchway so they could seal off the leaking module and save the rest of the station. The collision was a devastating blow to Mir, leaving it with reduced power and without the use of a major science module.

It wasn’t just unmanned ships that posed a threat. In January 1994, after Soyuz TM-17 undocked from Mir, the crew began a planned photographic fly-around of the station. Due to a configuration error, the hand controller in the orbital module was switched on, which disabled the primary hand controller in the descent module where the crew was flying. They lost manual control, and the Soyuz drifted into the station, striking it multiple times before they could regain control.

Separation and Undocking Anomalies

Problems could also occur during separation. On Soyuz 21, as the crew was undocking from the Salyut 6 station, a faulty sensor gave a false “open” indication for the docking latches. This caused the separation thrusters to fire before the latches were fully disengaged, jamming them in a partially open position. The Soyuz remained loosely and precariously attached to the station until ground control was able to send a series of commands to force the latches fully open.

Even in the mature era of the Space Shuttle, docking two massive vehicles presented challenges. During the final docking phases of STS-130 and STS-133 with the International Space Station, the combined Shuttle-ISS stack experienced significant and unexpected oscillations. After the initial soft capture, the immense gravitational forces acting differently on the two joined vehicles (a phenomenon known as gravity gradient torque) caused them to slowly drift out of alignment. This misalignment prevented the final docking ring from engaging properly and delayed the completion of a hard mate, raising concerns about potential structural contact between the two vehicles.

The history of rendezvous and docking is a story of mastering a new kind of physics. The failed rendezvous attempt of Gemini 4, where the crew’s intuitive actions only pushed them further from their target, was a foundational lesson for the entire Apollo program. The repeated failures of automated systems and the dramatic collisions with Mir showed the immense difficulty of the task and the catastrophic consequences of miscalculation. Mastering this delicate dance was a pivotal achievement, enabling the construction of space stations and the missions to the Moon, but it was a mastery achieved through a series of failures and near-disasters that taught the hard lessons of orbital mechanics.

The Fiery Return: Dangers of Re-entry and Landing

The final phase of any space mission is the fiery return to Earth. The vehicle must transition from an orbital spacecraft traveling at over 17,000 miles per hour to an atmospheric vehicle, shedding immense kinetic energy as heat. This process subjects the craft and its crew to extreme temperatures and deceleration forces. Whether a capsule on a ballistic trajectory or a winged glider, the vehicle must maintain precise attitude control to ensure its heat shield bears the brunt of the inferno. The final moments of descent and landing leave no room for error, and history is filled with incidents where failures in control systems, parachutes, or landing gear turned a triumphant return into a final, perilous test of survival.

Control and System Failures During Descent

In the early days of the Mercury program, basic control during re-entry was not a given. During the flight of Mercury MA-7 in May 1962, the pilot’s accidental actuation of high-thrust units during orbital maneuvers depleted the reaction control system (RCS) fuel far earlier than planned. This left the capsule without any means of attitude control during the final phase of re-entry. As the capsule descended, it began to tumble uncontrollably. The pilot had to make the decision to manually deploy the drogue parachute earlier than normal, at an altitude of 25,000 feet, to stabilize the spacecraft. On the next and final Mercury flight, MA-9, a different problem arose. A failure in the electrical power supply knocked out the automatic control system entirely. This forced the pilot, Gordon Cooper, to perform a completely manual retrofire and re-entry, using visual cues and a watch for timing. It was an incredible feat of “flying by the seat of his pants” that resulted in one of the most accurate landings of the entire Mercury program, despite the critical system failure.

The Soviet Voskhod 2 mission, famous for the first spacewalk, also suffered a control system failure. The automatic descent system malfunctioned, forcing the crew to use a manual backup for re-entry. Difficulties with the manual system and a delayed retrofire caused the capsule to land over 1,000 kilometers off target in a remote, snow-covered forest in the Ural Mountains. The crew had to spend a cold night fending off wolves before a recovery team could reach them.

A far more dangerous re-entry scenario occurred on Soyuz 5 in 1969. After the de-orbit burn, the service module failed to separate from the crew’s descent module. This caused the conjoined spacecraft to begin re-entering the atmosphere nose-first, with the unprotected hatch and window facing the intense heat. The cosmonaut inside could feel the hatch seals begin to burn and smell smoke. Fortunately, as the aerodynamic forces and heat built up, they eventually tore the two modules apart. The now-freed descent module, weighted to be aerodynamically stable, naturally righted itself with its heat shield forward. However, the drama was not over. The parachute lines became tangled, and the soft-landing rockets failed to fire, resulting in a bone-jarring hard landing that fractured the cosmonaut’s teeth.

Landing and Post-Landing Anomalies

Even after a successful re-entry, the final moments of landing hold their own dangers. The Soyuz capsule relies on a burst from solid-fueled soft-landing rockets, fired just a meter or two above the ground, to cushion the impact. On Soyuz TM-25 in 1997, these critical rockets fired at the wrong time—at the moment of heat shield separation, high in the atmosphere, rather than just before touchdown. The likely cause was a short circuit created by high humidity and condensation that had built up inside the spacecraft while it was docked to the Mir space station. Without the cushioning rockets, the crew experienced a much harder landing than normal.

The Space Shuttle, as a 100-ton unpowered glider, faced a completely different set of landing challenges. During the landing of STS-3 in 1982, a combination of factors led to a pilot-induced oscillation (PIO). A late transition from the experimental autoland system to manual control did not give the pilot enough time to get a feel for the vehicle’s response. His control inputs, combined with the orbiter’s complex aerodynamics, resulted in an over-controlling situation. After touchdown, the orbiter pitched up onto its main wheels like a “wheelie” before the nose gear came down. The incident highlighted the extreme difficulty of manually flying the massive glider in the final moments of flight and led to procedural changes for future landings.

Sometimes, the danger doesn’t end until long after the vehicle has come to a stop. During the landing rollout of STS-9 in 1983, a hydrazine leak in the aft compartment caused two of the orbiter’s three Auxiliary Power Units (APUs) to catch fire. The APUs provide the hydraulic power for the shuttle’s flight controls and landing gear. The fires caused significant damage to the vehicle’s structure, but incredibly, neither the crew nor Mission Control was aware of the fire. The damage was only discovered during post-flight inspections on the ground. This incident, combined with on-orbit computer failures on the same mission, highlighted the complex, interconnected risks of the shuttle’s systems.

The final minutes of a mission represent a violent and unforgiving transition from the vacuum of space to the surface of the Earth. The early Mercury incidents show that basic control and power for re-entry were not guaranteed, and survival often depended on the pilot’s skill to manually fly a ballistic trajectory. The harrowing re-entry of Soyuz 5 demonstrates the absolute necessity of reliable stage separation. Whether in a capsule relying on parachutes and rockets or a glider that must be flown to a runway, the incidents from this phase show that the return home is a critical test of both the vehicle’s structural integrity and the crew’s ability to manage rapidly evolving, high-stakes situations where there is absolutely no margin for error.

Summary

The history of human spaceflight is a narrative of breathtaking successes interwoven with moments of profound crisis. The incidents and close calls detailed in this report are not mere footnotes to that history; they are the very foundation upon which the modern principles of spaceflight safety have been built. Examining these events reveals clear and recurring patterns of risk that transcend specific programs or eras. From the raw, explosive power of launch to the delicate, counter-intuitive physics of orbital rendezvous and the fiery ordeal of re-entry, each phase of a mission presents its own unique and persistent challenges.

The early days of Mercury and Gemini were defined by struggles with the fundamental reliability of hardware. Control systems failed, thrusters stuck, and capsules tumbled, with survival often depending on the skill and nerve of a single pilot. The Apollo program, with its far greater complexity, introduced new systemic risks. The Apollo 1 fire was a tragic lesson in the dangers of a flawed systems engineering approach, where the interaction between materials, atmosphere, and design created a death trap. The Apollo 13 crisis demonstrated how a chain of seemingly minor ground-level mistakes could cascade into a near-fatal failure in deep space, while also showcasing the incredible resilience that redundancy and human ingenuity could provide.

The long-duration missions aboard Skylab, Mir, and the ISS shifted the focus to the challenges of maintaining a fragile, artificial ecosystem in the hostile environment of space. Fires, toxic leaks, collisions, and cascading computer failures became the new specter of disaster, highlighting the immense difficulty of operating complex, aging systems far from home. The Space Shuttle era, with its promise of routine access to space, brought its own set of unique and complex failure modes. The disasters of Challenger and Columbia (the latter not detailed here but a known consequence of ascent debris) were rooted in the “normalization of deviance”—a cultural willingness to accept known flaws until they proved fatal. Pad aborts, pilot-induced oscillations, and debris strikes revealed the vulnerabilities of a reusable, winged vehicle that had to function as both a rocket and an aircraft.

Across all these programs, the human element remains the most complex variable. Astronauts and ground controllers have been the cause of critical failures through simple slips of a switch or incorrect data entry. Yet, in countless other instances, it was their ability to diagnose, improvise, and manually intervene that saved the mission. This double-edged sword underscores a central lesson: “human error” is often a symptom of a system that fails to account for human limitations. The safest systems are not those that demand perfection from their operators, but those that are designed to be tolerant of, and resilient to, inevitable human mistakes.

Ultimately, the chronicle of spaceflight’s close calls is not a record of failure. It is a powerful testament to a relentless process of learning. Each averted disaster, each harrowing recovery, and each tragic loss has yielded invaluable knowledge, leading to redesigned hardware, rewritten procedures, and a deeper, more humble understanding of the risks involved. This is the unforgiving, iterative process of exploration, where progress is measured not just by the destinations we reach, but by the lessons we learn on the brink of disaster.

Appendix: Chronology of Major Incidents and Close Calls in Human Spaceflight