2. SUMMARY RESULTS. This data base records 222 flight sequences from 186 separate spacecraft, and all known failures during these sequences. As expected in a highly challenging space engineering program, the failures are usually heavily front-end loaded in the chronology. Of the 173 undockings, 2 failures occurred, the last in 1976. Of the 97 module separations (descent module from other modules of the same spacecraft, 1 failure occurred, in 1969. Of the 110 spacecraft landings (including entry and parachute deploy), 8 failures occurred, all but one of them in the first five years of flight operations (the 8th and last occurred in 1980). In contrast, deorbit burn failures (8 out of 182 attempts) showed a fairly constant rate across the chronology, probably due in large part to the contribution of operator error as well as hardware breakdown rate.

3. There are two attached detailed reports.

A. "Soyuz Landing Incident Narratives" describes 35 known cases where Soyuz- class vehicles encountered anomalies during operations related to the return- from-space-station function.

B. "Soyuz-class landing-related event catalog" is a data base of all known events, in order of date of occurrence, where systems relevant to space station return have been utilized.

4. ADEQUACY OF DATA BASE. All known flight history sequences on Soyuz vehicles and on vehicles which share major systems with Soyuz vehicles have been catalogued. This includes all Soyuz missions plus Progress (shared docking mechanisms and service modules), and lunar Zond L-1 (Soyuz descent modules) on Proton and N-1 launch vehicles. The list of event sequences is probably nearly complete. However, the completeness of the list of anomalies is uncertain.

A. Soyuz spacecraft often wind up on their sides after landing, which is a serious concern to evacuation of an injured or unconscious crew member. Documentation of how often this happens is inadequate, since it is rarely reported in the Russian media and most knowledge of such events comes either from inspection of video and photo records made at the landing site, or from personal testimony of crewmembers. It can be presumed that a large number of similar events, not photographed and not described orally, have also occurred without knowledge of this study.

B. Official Russian reports on Soyuz flight events are inadequate to assess effectiveness of medevac missions. As an example, compare the RSC Energiya report NASW-4727 on the Soyuz TM-2 through Soyuz TM-15 mission anomalies, with those anomalies registered in this study, to illustrate the deficiency of official Russian-provided data. The Russians reported only trivial procedural deviations, while the flight crews involved in the missions confronted serious operational difficulties, sometimes life-threatening, which often would have called the success of a medevac mission into doubt.

C. Incidents of "hard landings" appear to actually increase with time, over the history of the program. However, this is probably an artifact of the data collection process since more recent landings have been covered by non- government news media representatives who have provided this information, even as the "official" accounts still omit any such information.

D. While further inquiries with official Russian space program sources may not be useful, it seems that interviews with retired or emigrated Russian space personnel could be extremely valuable in supplementing and expanding on the data base presented here. This approach should be investigated, using this data base as a starting point in discussions with new Russian-side information sources.

5. COMMENT ON RANGE OF THREAT-TO-FUNCTION SOURCES. Survey of the known anomalies and their probable causes demonstrates that while many are random (such as geographic landing point, and weather conditions) or are independently mechanistic (such as failure probability of key subsystems), others are closely connected with human operations such as crew actions and ground support. Therefore, no assessment of system reliability can be complete which does not take into account the changing level of operator experience and training, both in flight and on the ground, and the range of impacts of human error on the overall system performance.

6. SPECIAL QUESTIONS. As part of the assessment, several specific technical questions were posed. They are:

A. Concentration on apparent pyrotechnic failures, such as the 1969 Soyuz-5 module separation anomaly. These details appear in the anomaly narrative section.

B. Confirmation that the Soyuz descent parachute deploy sequence has no manual inputs. I was able to confirm from trusted sources with access to the Gagarin Cosmonaut Training Center in Moscow that this is the case: the sequence is entirely automatic and the crew has no control over it.

C. Determination of how many ballistic ("high G") entries have been made during the approximately 80 manned Soyuz missions since 1967. Soyuz-1, Soyuz-5 (long denied), and Soyuz-33 made high-G ballistic entries, and one other flight experienced medium-high G deceleration forces.

D. Assessment of possibility of analyzing differences in separation of probe/drogue system versus APAS. Only two Soyuz missions have utilized the androgynous system: Soyuz-19 during ASTP in 1975 and Soyuz TM-16 in 1993 on Mir-Kristall. The sample size is too small to develop any meaningful statistics.

E. In general, we also followed a closed-loop cycle of preliminary information, request for addition details, and discussion of the implications of such new data (including new questions). Hopefully, this repeated cycle helped make these products as useful as possible to the study at hand.

7. CONCLUSION. Careful examination of archived and researched information on Soyuz-class descent operations has revealed a considerable wealth of details on anomalies, as well as a pattern suggestive that many features (such as capsule orientation post-landing, and frequency of "hard" landings) still remain inadequately known. Official Russian documentation is demonstrably inadequate. Although most vehicle failures were heavily concentrated in the first years of operation, one particular anomaly -- failure to perform deorbit burn -- showed a fairly constant rate (4%) over the entire 30-year period. The feasibility and value of a detailed flight history catalog and assessment, as an exterior validation on a parallel systems-level failure probability estimation, has been demonstrated.

------------------------------------------------

SOYUZ LANDING INCIDENT NARRATIVES / J. Oberg/ March 18, 1997

This report describes 35 known anomalous Soyuz-spacecraft-related undocking, de-orbit, and landing incidents relevant to crew safety on a Soyuz-based baseline medical evacuation application missions from the International Space Station. These reports have been collected from the Russian press (both official and independent), from recent official Russian space industry historical reports and recently-released contemporary archives, from private discussions with Russian journalists, and from interviews with cosmonauts (both Russian and foreign guests). Interestingly, the only significant information source which did NOT prove useful were the official Russian space industry reports to NASA regarding Soyuz reliability and safety. These detailed narratives supplement the separate tabular summary of nearly 200 separate Soyuz-class return-related events over the past thirty years, which forms another appendix to this study.

Acronyms:

CDR = crew commander
DM = Soyuz "descent module"
FE = crew "flight engineer"
OM = Soyuz "orbital module"
SM = Soyuz "service module"

01. Kosmos-133 (first unmanned Soyuz), 1966 Nov 30. Deorbit burn achieved only on fifth attempt. Loss of orientation during burn led to major downrange error (impact point in China), Russians believe self-destruct system triggered automatically, but Chinese may have recovered it. Details in "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

02. Kosmos-X (to be second unmanned Soyuz). 1966 Dec 14. Launch escape system triggered 27 minutes after pad shutdown (Details in "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.). Booster and pad (#31) destroyed, 1 to 3 fatalities in ground personnel.

03. Kosmos-140. 1967 Feb 09. During entry, autopilot failed and vehicle guidance defaulted to ballistic entry, so it landed far short of planned area, in fact, on an ice floe in the Aral Sea 3 km from shore. Sank in 10 m of water. Recovered, found to have 10x30mm hole burned in heat shield, cabin had depressurized. Details in "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

04. Soyuz-1. 1967 Apr 24. Well-documented disaster leading to death of pilot on ground impact. Several attempts at deorbit failed due to orientation problems related to a faulty infra-red horizon sensor (in response, operational restrictions called for only daylight deorbit burns for many years afterwards). During final descent after ballistic entry, parachute system failed and spacecraft impacted ground. Soft-landing engines then fired, igniting and destroying the wreckage and contents. Recent new details were found in "Space Catastrophes", M. Rebrov, IzDat Nekos, Moscow, 1993, and in "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996. Video of the Soyuz-1 wreckage, in "Korolev: The Secret Designer" (1993) and elsewhere, provided verification of the post-impact condition of the spacecraft.

05. 7K-L1-4 (28Sep1967). First stage failure, launch escape system unstabilized, spacecraft destroyed on impact near booster. P. 241, "Rocket- Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

06. 7K-L1-5 (22Nov1967). Second stage failure, escape system pulled spacecraft free, but at altitude of 4.5 km failure in altimeter led to premature firing of landing engine. P. 241, "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

07. 7K-L1-6 (Zond-4). March 9, 1968, orientation system failure leads to ballistic entry outside Soviet territory, self-destruct system triggered off Bay of Biscay, off France. P. 241, "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

08. 7K-L1-9 (Zond-5), circum-lunar. 1968 Sep 21. Ballistic trajectory into Indian Ocean, due to failures in star sensor guidance system. Capsule recovered. Landed Sep21/15:54GMT, 32:38S, 65:33E. P. 244, "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

09. 7K-L1-12 (Zond-6), circum-lunar. 1968 Nov 17. Depressurized near end of flight, led to failure of altimeter, leading to parachute line jettison at 5.3 km and subsequent free fall to impact. Entry was far off course and landing turned out to be only 16 km from launch pad at Baykonur. P. 245, "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

10. Soyuz-5. 1969 Jan 18. Major life-threatening failure kept secret for quarter century. "During descent of Soyuz-5, a dangerous deviation occurred: the connecting latches between the descent module and the equipment module (SM) did not separate and the motion went forward on the bare surface of the descent module. Layers (polki) of the shell peeled away under action of heating during entry into the thick layers of the atmosphere and internal pressure in the DM, but the shell (shpangout) endured these unforeseen conditions. As a result of the heating of the construction of the transfer module, the connections were broken, the DM broke free from the SM, and returned to the normal orientation. Descent went on along a ballistic trajectory, the landing system ensured a soft landing. This situation confirmed the correctness of the project decision for a titanium shell." p. 184, "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996. One recent press report described the interior smoldering of wall insulation blankets, with exterior explosions from SM tanks causing DM bulkhead buckling ("Difficult Return From Orbit", M. Rebrov, 'Krasnaya Zvezda', Apr 27, 1996). Also pp. 89-90, "Space Catastrophes", M. Rebrov, IzDat Nekos, Moscow, 1993. Landing occurred far uprange, probably on the Russian side of the Russia/Kazakhstan border.

11. Soyuz-6. 1969 Oct 16. Landed "right besides a children's school." Hervey, p. 186.

12. Soyuz-10 undocking. 1971 Apr 23. Probe/cone mechanism failed during docking with Salyut-1. Undocking command failed, probe was jammed. Crew jumped back and forth inside Soyuz to shake jam loose.

13. Soyuz-10 landing. 1971 Apr 24. On parachute, headed straight for a lake. A last-minute breeze pushed the spacecraft toward shore, and it landed 44 m from water's edge.

14. Soyuz-11. 1971 Jun 29. Well documented catastrophic crew loss, air leaked out through pressure equalization valve after orbital module was jettisoned from descent module. Valve pyro activator may have fired by accident when OM sep pyros fired, or may have already fired pre-flight but was not detected (OM structure blocked air valve until OM jettison).

15. Soyuz-15. 1974 Aug 28. Mission abort landing. Spacecraft descended through thunderstorm, but without damage. "Bitter Aftertaste of Glory", M. Rebrov, 'KRASNAYA ZVEZDA', Sep 9, 1994, p.2.

16. Soyuz-18A ("April 5 Anomaly"). 1975 Apr 5. Well-documented launch failure due to third stage tumble. Proper functioning of escape system (via Soyuz SM engine burn, since tower had already been jettisoned). Only recently revealed that spacecraft landed inside Mongolia, just across Soviet border. "Rocket- Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

17. Soyuz-21. Medical Evacuation. 1976 Aug 24. First separation from space station failed when release latches gave 'open' indication prior to completely opening, triggering firing of Soyuz separation thrusters, which jammed latches in partially open position. Soyuz hung loosely by extended probe for one full orbit, swinging back and forth near station structure, until ground control sent new commands to station latches, forcing them fully open. Undock failure documented in "Alibis, or What Happened on 'Almaz'", M. Rebrov, 'KRASNAYA ZVEZDA', June 7, 1996, and in "Between the Lines of Official Reports", V. Gorbunov (chief instructor at Gagarin Cosmonaut Training Center), 'Aviatsiya i Kosmonavtika', 1993. Spacecraft then landed at great distance from recovery forces. Off-course landing documented in "Alibis, or What Happened on 'Almaz'", M. Rebrov, 'KRASNAYA ZVEZDA', June 7, 1996. Also, "Space Catastrophes", M. Rebrov, IzDat Nekos, Moscow, 1993.

18. Soyuz-23. 1976 Oct 16. After successful launch, the space station rendezvous failed and a mission abort landing was declared. By freak chance, DM came down on Lake Tengiz 2 km from shore. Electrical short in water caused deployment of reserve parachute. Both parachute lines kept capsule lying on its side in water, preventing hatch opening and blocking air vent. Transmission antennas became inoperable due to submersion. Inner walls became covered with ice. Recovery forces concluded crew was dead, dragged capsule to shore, awaited special team to remove bodies. Hatch opened by crew after eleven hours. 'Spaceflight', August 1995, p. 283, largely based on "Between the Lines of Official Reports", V. Gorbunov (chief instructor at GCTC), 'Aviatsiya i Kosmonavtika', 1993.

19. Soyuz-24. 1977 Feb 25. Landed in snowstorm. Several hours on ground in blowing snow, helicopters could not find them until one crewman discovered that the search-and-rescue antenna was jammed closed from impacted snow, manually cleared it. Personal interview, private communication, letter of 1990 Nov 27.

20. Soyuz-33. 1979 Apr 12. Following failure of OMS engine, rendezvous with space station canceled and emergency landing ordered using backup OMS engine (pair of smaller thrusters on same tank set). Deorbit burn computed to be 188 seconds, but burn continued until manual shut-off at 213 seconds. Turned out that lower-than-expected thrust led autopilot to burn longer to try to achieve expected delta-V and it should not have been terminated by crew. Spacecraft on ballistic entry, which places landing point uprange, but since deorbit delta-V was less than planned (due to mistaken manual shut-off), impact point was driven downrange. Result was a near-perfect cancellation of both effects and a landing not far from the nominal point. "Space Catastrophes", M. Rebrov, IzDat Nekos, Moscow, 1993.

21. Soyuz-36. 1980 Jul 31. Failure of soft landing engine results in 30-G impact force. "Kaktus" altimeter redesigned. No mention of injuries. P. 193, "Rocket-Space Corporation 'Energiya' (Fiftieth Anniversary)", Yu. Semyonov et al. Moscow, 1996.

22. Soyuz T-7. 1982 Dec 10. Landed on hillside, rolled downhill, wound up on side. FE thrown from couch, landed atop CDR. Bad weather prevented evacuation until after crew had spent the night with rescue teams at the landing site. 23. Soyuz T-11. 1984 Oct 2. Although guided descent was attempted, spacecraft endured 5-6 G's as opposed to the nominal 3-4 G's. The reason was never officially given but a partial failure of the onboard guidance system is the most likely cause.

24. Soyuz TM-4. 1988 Jun 17. Landed in June heat wave, 42 degrees C, on a normally wet shallow salt lake which had dried out in the heat only a few days before.

25. Soyuz TM-5. 1988 Sep 6. Two de-orbit burn attempts fail, nearly leading to loss of crew. First burn was prevented by sensor glitch which went away after seven minutes and burn then started, but the crew manually shut it down in 3 seconds. Second burn two revs later, went on time for six seconds, then stopped, and the crew then manually re-started the burn, but after an additional sixty seconds (some sources say 39 seconds) it was cut off by the autopilot. Two independent private accounts indicate that in both cases, the post deorbit burn sequencer was activated and nominal entry commands were being issued. Crew only manually interrupted command sequence shortly before descent/equipment module separation pyros were to have been fired. Source 1 is an ESA cosmonaut involved in the Euromir program; source two is a private interview with one of the two Soyuz crewmembers, which described how the first post burn sequence got within 20 seconds of separation pyro initiation, and the second post burn sequence got within 2 seconds. This is also supported by an enigmatic press conference comment from cosmonaut Pavel Popovich, deputy head of the GCTC: "Volodya [Soyuz commander] shut the program down and thus averted, well, let us not speak of it at this stage, but possibly very serious trouble in which the crew might have found itself in orbit." As to the causes of the burn failures, the lead engineer at ROCKET AND SPACE CORPORATION Energiya authoritatively and credibly wrote: "The main cause of the crew's daylong torments was acknowledged to be a combination of incorrect actions of the crew commander and mission control personnel." -- "The Warped Tracks of Space", V. Semyachkin (operations specialist for Rocket and Space Corporation 'Energiya' in Moscow Mission Control Center), in "Zhurnalist", No. 3, March 1990, pp. 50-51. Spacecraft completed mission by falling over on its side ("In the Zone of Risk", M. Rebrov, 'KRASNAYA ZVEZDA', 1995 Oct 14.

26. Soyuz TM-6. 1988 Dec 21. De-orbit burn cancelled. MCC discovered that state vector had been prepared incorrectly on the ground, recomputed it and uploaded it in time for backup rev landing three hours late. "The Warped Tracks of Space", V. Semyachkin, in "Zhurnalist", No. 3, March 1990, pp. 50-51.

27. Progress-41. 1989 Apr 21. Deorbit burn fails when burn shut down by tank low-level sensor. Spacecraft decays randomly four days later. Excess propellant usage on orbit led to this deficit. "Progress 41 Reentry: Another Soviet Space Mishap", N. Kidger, 'Spaceflight', July 1989, p. 219.

28. Soyuz TM-7. 1989 Apr 27. Double-impact, "hard landing", crewman injured on leg requiring medical treatment at landing site. Attributed to "gusty wind". 29. Soyuz TM-9. 1990 Aug 9. Four insulation blankets on Soyuz DM tore loose during launch. They blocked critical navigation sensors, and threatened to allow low enough temperatures inside Soyuz during the on-orbit phase to create condensation in electronics and thus possible damage. Crew took two space walks to repair insulation blankets, prior to Soyuz being cleared for descent.

30. Soyuz TM-12. 1991 Oct 10. Hard impact, TV crew reported the capsule was "very dented" lying on its side. Down-cargo cannister tore loose on impact and hit one crewman, causing injury. No reasons given. Source: Correspondent A. Gerasimov at landing site, Moscow Central TV, Oct 10, 19:00 GMT.

31. Soyuz TM-14. 1992 Aug 10. Hard impact, DM turned over on side leaving crew lying sideways. Spacecraft hatch could not be opened from outside requiring crew to use tools to unstick jam. One crewman was trapped in his seat when helmet was jammed with cables, his suit had to be cut free to release him. Source: veteran space TV reporter S. Slipchenko, at the landing site, Ostankino TV, Aug 10, 17:00 GMT. Interview with crewmember suggests high winds may have contributed to impact severity.

32. Soyuz TM-15. 1993 Feb 1. Rolled down hill and stopped, lying on its side, 150 m from shore of a salt marsh.

33. Progress M-17. 1993 Aug 11. Inadequate propellant for deorbit, left to decay naturally seven months later.

34. Soyuz TM-17. 1994 Jan 14. During post-separation inspection fly-around, crew lost manual translation control due to configuration error, Soyuz bumped into Mir structure several times. No apparent damage. Missed landing aim point by 100 km.

35. Soyuz TM-19. 1994 Nov 4. "Rough" landing, bounced once. Attributed to strong winds by crew commander at postflight press conference (ITAR-TASS, Nov 6). No reported injuries.

In addition, other general reports of landing injuries and near-miss landing sites (in one case, near high tension power lines) have long circulated but cannot be attributed to any specific mission. The frequency of the appearance of new reports in recent years (often dating back a decade or two) should indicate that the data base of such incidents is far from complete.