7 May 2008—What should have been a routine return from the International Space Station (ISS) on 19 April 2008 quickly turned into a heart-stopping drama for ground controllers and the three astronauts aboard a Soyuz TMA-11. The craft had disappeared during the descent and was then found on a scorched steppe some 400 kilometers from where it was supposed to land. Now the incident is a technological puzzle to space engineers and a potential political challenge to the international partnership behind the ISS.
Although the technical investigation will take weeks to resolve, NASA and Russian engineers have come to several credible preliminary conclusions. And internal NASA documents, such as ”15S Ballistic Entry Outbrief” by George Kafka, chief of the Safety & Mission Assurance Directorate for the ISS program, reveal a plausible idea of what probably happened.
During the landing, space officials at mission control in Moscow and at the recovery site seriously worried for at least half an hour—and some even believed, briefly, that the crew had been killed. The landing seemed to be a replay of a near disaster from almost 40 years ago, and it threatened to have the first Russian in-flight fatalities since 1971.
Although the officials’ worries soon turned out to be ill-founded, an examination of the craft’s flight path indicates that catastrophe had not been far off. Total disaster was avoided not by any real-time actions of the crew or ground teams but instead by the ingenious design and robust construction of the spacecraft.
The Russian Soyuz vehicle has made about 100 manned orbital flights since 1967. Like the U.S. Apollo spacecraft and the future Orion capsule, it consists of a crew cabin and a rear-mounted equipment module containing its propulsion system. But unlike those craft, it also includes a forward-mounted habitation cabin. When returning to Earth, all these spacecraft perform a de-orbit rocket burn, cutting about 125 meters per second off their 8000 m/s orbital velocity. They then jettison their attached modules and turn their heat shields into the wind. The atmosphere slows the vehicle—it loses most of its speed in a matter of minutes as it decelerates to three to four times the normal acceleration due to gravity (which is 9.8 m/s2). When the craft is low and moving slowly enough, it deploys parachutes for a soft surface touchdown that is cushioned by a brief braking rocket burst.
But this time, something seems to have gone wrong with the mechanical separation of the Soyuz from its aft equipment module. Separation is supposed to occur 32 minutes after the de-orbit burn, as the craft is descending toward the sensible atmosphere, a point 100 km up where aerodynamic effects start to matter. Something in the pyrobolts or cable cutters malfunctioned, and the crew felt the cabin shuddering as it was jerked around by a partly loose massive equipment module.
The details of a Soyuz.
The still-linked modules entered the sensible atmosphere but at the wrong orientation. Air drag would have turned the ship like a shuttlecock, directing its lightly shielded nose (with the precious parachutes) into the onrushing plasma. Several minutes of this thermal stress would have been enough to breach the hull and possibly destroy the vehicle.
But at some point, the aft section did tear free, probably because of the mounting aerodynamic torques and heating. This may have been no mere lucky break. Russia suffered a series of near disasters early in its program, including Yuri Gagarin's first mission in 1961 and a chillingly similar Soyuz nosedive in January 1969. So Russian engineers apparently modified module-to-module connectors to tear loose, if needed, under such entry stresses, even if the separation system fails entirely. If that modification was indeed made-which is unknown outside of Russian space circles-this may have been the first time this fail-safe system was flight-tested.
As the conjoined modules entered the atmosphere, voice communication with the ground was badly garbled, perhaps by the spacecraft turning out of its planned orientation, thus pointing its primary antennas away from ground receivers. However, according to secondhand reports from NASA flight controllers then on duty, some telemetry status indicators and snatches of voice communications did get through before all contact was lost. That was enough to tell controllers that a major malfunction had occurred with the separation sequence.
Nothing was subsequently heard from the crew or any of the spacecraft radio beacons for an hour, and nothing showed up on ground radar. The main fleet of recovery helicopters hovering over the planned landing area was first directed eastward to respond to an overshoot, then turned around and ordered westward toward a short landing. And when a rescue helicopter crew stationed in a contingency landing zone 400 km to the west first spotted signs of the lost craft, they saw a wide grass fire on the steppe, right next to gouged earth, and the landed vehicle nearby with no signs of a deployed parachute. Local herdsmen were milling around the downed vehicle, but there were no signs of the three crew members. Rescuers feared the worst.
Soyuz craft decelerates, then separates into three pieces. The center module, containing the crew reorients to enter the atmosphere. The other pieces burn up during the descent. On 19 April, the rear of the craft failed to fully separate from the crew module. The combined craft entered the atmosphere and remained joined up for an unknown amount of time, possibly exposing the wrong side of the crew module to the onrushing air.
Then the crew commander phoned home (all spacecraft communications systems had failed) by using a reserve satellite phone installed for just such an emergency. All the crew members were fine, he reported, and were awaiting the recovery helicopters. The herdsmen had quickly arrived and eagerly helped the crew out of the singed, sideways-leaning cabin. The unofficial rescuers had lain the three exhausted, weakened fliers in the shade of the spacecraft and had gone back inside to retrieve the satellite phone for them.
Despite widespread reports of massive charring and melting to the Soyuz TMA-11 exterior, inspection of photographs and reports from inside the Russian space program indicate otherwise. Comparison with detailed photographs of earlier missions suggests that the scorching was within normal ranges.
However, a suggestive detail in the postlanding photography, a thruster mounting with jagged gaps alongside it, indicates that an attitude thruster burned through. Such damage would have reduced or even entirely eliminated the crew's ability to point the crew module during descent. The thruster could have been lost as a consequence of a vain attempt to steer the much-heavier-than-expected combined vehicle through the initial buffeting.
Where the craft landed and why is the subject of intense investigation. Perhaps as a consequence of the modules failing to separate on time, the craft's autopilot then concluded that a normal entry was not feasible and switched to a simpler-but more stressful-trajectory. The baseline descent rolls the entry module in a way that offsets its center of mass to create a small lift force. This keeps the shallowly descending vehicle higher in thinner air, limiting the deceleration forces to 3 to 4 g's. The maneuver also helps steer the path toward a desired landing region.
If the normal shallow descent isn't possible, the autopilot performs what is called a ballistic, or nonlifting, entry, falling more quickly into thicker air and consequently enduring as much as twice the peak deceleration. Some reports say the Soyuz hit 11 g's for a few seconds, and one of the Soyuz astronauts, Peggy Whitson, recalls at one point seeing 8.4 on the craft's g-meter. But again, the full story will come only after reading the cockpit data recorders. The steeper entry brings the spacecraft down far short of the nominal aim point, and about 2 minutes earlier.
Reports from the crew bring up other issues that will require investigation. They reported smoke in the cabin during the later descent, after the parachute had deployed. This occurred after a pressure equalization valve had been opened to vent to outside air-and could have sucked in smells of external scorching. An alternate theory is that the smoke was from a landing display screen that was powering up during the descent.
Normally, with the Soyuz crew module oriented correctly, it performs a controlled descent that is kept to 4 to 5 g ’s by an amount of lift generated by the craft’s aerodynamics. On 19 April 2008, with the crew module oriented incorrectly, it made a much steeper descent at 8 to 9 g ’s, landing some 400 kilometers off target and 2 minutes early.
In addition, Yi So-yeon, the South Korean flight participant, reported in interviews in Seoul that the final ground impact was not vertical but sideways, causing many heavy baggage items to break free from restraints and hit her.
The ground fire also remains unexplained. Although NASA officials initially claimed it was merely a coincidence (local herdsmen were burning off stubble, they say), other accounts-and the placement of the Soyuz near the upwind vertex of the burned area-suggest that the landing caused it. Station program director Michael Suffredini, who was present in the landing zone, recalled seeing scattered grass fires as his helicopter rushed to the landing point. But at a 30 April press conference, he told reporters that he now believes that the fires nearest the Soyuz were indeed somehow caused by the landing.
The fire could have been started by the main heat shield, which was jettisoned several kilometers up to expose the soft-landing engines. But other sources of ignition include the engines themselves, the separation pyros on the parachute lines, or even flammable chemicals leaking from the cabin. The fire was close enough to quickly consume the craft's own parachute. But photographs show it did not burn the grass around the nose of the spacecraft.
The investigation board is faced with explaining this landing and with comparing it to earlier problems, including hauntingly similar anomalies on a previous Soyuz landing last October. Of immediate concern is the question of whether the Soyuz currently attached to the station--and its new crew of Sergei Volkov, Oleg Kononenko, and Garrett Reisman--is in danger.
After decades of service, it's hard to imagine that the Soyuz has a design flaw of any significance, so the issue here may instead be fabrication quality. This is a frightening possibility, since the Soyuz manufacturer, the Energia Korolev Rocket and Space Corp., in Moscow, has had to double its Soyuz production rate in preparation for the increase of the space station crew from three to six people next year. This extra workload is being borne by an aging workforce.
The political implications of the problem are also profound, since NASA's current plans are to ground the shuttle fleet in 2010 and then buy tickets on Soyuz missions to the space station until the new-generation Orion spacecraft becomes available around 2015. All of these plans are now open to debate, right in the middle of a U.S. presidential election campaign.
About the Author
JAMES OBERG, a 22-year veteran of NASA mission control, is now a writer and consultant in Houston. His October 2007 article for IEEE Spectrum Online used internal NASA documents to explain the origins of the International Space Station’s June 2007 computer crisis.