National Aeronautics and 

Space Administration

The International Space Station

Operating an Outpost 

in the New Frontier

Executive Editor

Robert Dempsey
About the cover:

The flight director watches over the men and 

women of Houston’s Mission Control, the bastion 

that protects the astronauts on the International 

Space Station. In the background, the space station, 

as seen from the space shuttle Atlantis on its last 

mission, orbits the Earth. The station has been 

continually inhabited, 24/7, since October 31, 2000.
iii

To the women and men 

of mission control 

who keep ever vigilant. 

And to their families 

for supporting, 

and putting up with, 

their dreams.
iv

Foreword

Over a span of 20 years, the vision of an international orbiting outpost—one with continuous human presence, measuring 

the size of a football field, with mass of ~900,000 lbm, and orbiting the Earth every 90 minutes—became a reality. The 

International Space Station (ISS) is a testament to what engineering miracles can be accomplished with vision, leadership, 

perseverance, political support, and funding. The ISS enables world-class scientific research, forges pathfinders for future 

exploration travel, and unites 15 international partners working together with common goals to keep the ISS viable. 

We are grateful for the visionaries who planted the seeds of continuous human presence in space, beginning with science 

fiction books and movies that stretched the limits of our imagination. These futuristic dreams inspired technologies 

required to support civilian spaceflight and military endeavors that, over time, have not only turned out to be possible but 

are now part of our everyday life.

The ISS is part of NASA’s ongoing, deliberate, step-by-step approach for expanding the boundaries associated with 

human spaceflight exploration that will return us to the moon and eventually to inhabiting Mars. The ISS Program stands 

proudly on the shoulders of giants who accomplished increasingly complex and ambitious space projects. The early 

Mercury rockets demonstrated our ability to safely leave Earth’s atmosphere with human passengers, followed by the 

Gemini and Apollo projects, which were pathfinders for spacewalks, rendezvous, dockings, and human moon landings. 

The Skylab and Mir space stations, along with the Apollo/Soyuz program, established collaborations with international 

partners and demonstrated that we could safely operate long-term in low-Earth orbit. A winged Space Shuttle, with 

the capability to achieve low-Earth orbit for extended periods, enabled astronauts to conduct scientific research and to 

deploy, retrieve, and repair payloads and satellites. All of these experiences culminated with the adventure of assembling 

the ISS in low-Earth orbit, testing the ability of engineers, operators, astronauts, scientists, and numerous others working 

as a team with common goals. 

Beginning in 1998, the ISS evolved from two modules—one Russian and one American—into a complex composed 

of 14 elements operated by 15 countries that provides a continuously operating laboratory expanding the scientific 

boundaries of both physical and biological sciences. The ISS creates a stable platform for studying the effects of longterm human presence for life support, propulsion, electrical, and structural systems to allow humans to explore further. 

This will lead to technologies and operational techniques for longer-duration spaceflights, a deep space outpost, a 

permanent base on the moon, and eventually a human outpost on Mars. 

The flight directors involved in the planning and assembly of the ISS played a vital leadership role in planning, training, 

orchestrating, and executing each mission. Of the current 91 flight directors in NASA human spaceflight history, more 

than half of them have worked directly with planning and assembly of the ISS. This Flight Operations leadership and 

dedication helped to pave the way for the tactical real-time assembly of an operationally evolving spacecraft, knitting 

together individuals and teams from astronauts to design engineers who were all oriented toward the same strategic goal. 

We would be remiss to not mention that the ISS would never have become a reality without the ISS Program and 

Space Shuttle Program leadership providing the overarching vision, funding, and integration with the international and 

commercial partners. Countless individuals and teams support these programs in critical roles and have dedicated their 

lives to developing, assembling, and now keeping the ISS a reality. 

As we embark on new initiatives requiring human presence farther into the solar system, the Flight Operations team 

will carry with it the legacy of operational experience necessary to continue turning dreams into reality, all in support of 

NASA’s exploration goals. 

Brian Kelly

Director, Flight Operations

Patrick Forrester

Chief Astronaut, Flight Operations 

Norman Knight

Chief Flight Director, Flight Operations
v

Preface

Throughout my childhood, I was blown away, and inspired, by the amazing feats that NASA was accomplishing: 

walking on the moon; sending probes to Venus, Mars, Jupiter, and Saturn; flying a reusable Space Shuttle; and 

building space stations. Twenty years ago, I got the privilege of joining the NASA team, in particular in the famed and 

historic Mission Control. I realized early on that success was not built on technological marvels but on the shoulders 

of the men and women who worked at NASA. It was the men and women who laid awake at night and worried about 

what could possibly go wrong. It was the men and women who put all their passion into making sure the systems and 

the procedures, often challenged by tight budgets or a changing political climate, met the mission objectives. These 

engineers and scientists work in numerous directorates in various cities across the country to support the International 

Space Station Program. The Program office then turns to the Flight Operations Directorate to operate the space station. 

When the mission is occurring, it is the people in Mission Control who are on the front line to protect the lives of our 

astronauts, also members of our team, while ensuring mission success. We spend much of our time in consultation 

with the engineers, trying to anticipate problems in advance so that we are prepared for any eventuality. But when 

a problem occurs, things become truly extraordinary. That is when the people of NASA—all of NASA—put aside 

personal commitments and differences, roll up their sleeves, and work together nonstop until the issue is resolved. In 

fact, the passion of these people makes the job look so easy. The general public does not have a full understanding 

of what is involved in either the successful missions or those hit with a serious malfunction. That is why we chose to 

write this book. We want the reader to get a glimpse into what we do in our daily lives in Mission Control. 

This is an unusual book. Half the chapters are devoted to operations, meaning what we do in real time during a 

mission. For the International Space Station, real time is continuous 365 days a year, 24 hours a day. These chapters 

will describe different operational aspects of “flight control.” However to get the full context, the remaining chapters 

will provide technical descriptions of the primary space station systems. Although not strictly required to understand 

the operations, they are intended to provide more information for proper context. Hopefully, these chapters are not too 

dense for the reader.

A complete list of specific people to acknowledge, of which there are many, is in the back of this book. However, 

this project would not have been possible without the help, support, and full backing of the directors of the Flight 

Operations Directorate at Johnson Space Center, Paul Hill and Brian Kelly. Ginger Kerrick was also key in helping 

to find the financial support to back the director’s support. I must also thank my wife, Dorothea Lerman, who literally 

helped birth the book and provided early editing and feedback. Finally, we must acknowledge all the men and women 

who have worked in Mission Control from the first flight director, Christopher Kraft, to today. Literally everything we 

do today is based on lessons they learned and techniques they developed.

Robert C. Dempsey

Flight Director, Flight Operations

Ad Astra Per Aspera
vi

Table of Contents

Dedication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii

Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix

Chapter 1 Systems: 

International Space Station Planning—A Roadmap to Getting It All Done . . . . . . . . . . . . . . . . . . . 1

Chapter 2 Day in the Life: 

Living and Working in Space and on the Ground . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Chapter 3 Systems: 

Structure and Mechanisms—The International Space Station’s Skeleton . . . . . . . . . . . . . . . . . 35

Chapter 4 Day in the Life: 

The Making of a Mission . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

Chapter 5 Systems: 

Command and Data Handling—The Brains of the International Space Station . . . . . . . . . . . . . . 91

Chapter 6 Day in the Life: 

“Brain Transplants” on the International Space Station . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

Chapter 7 Systems: 

Motion Control System—Navigator of the Heavens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

Chapter 8 Day in the Life: 

Debris Avoidance—Navigating the Occasionally Unfriendly Skies of Low-Earth Orbit . . . . . . . . 139

Chapter 9 Systems: 

Electrical Power System—The Power Behind it All . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155

Chapter 10 Day in the Life:

Preparing for the Unexpected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 173

Chapter 11 Systems: 

Thermal Control—the “Circulatory System” of the International Space Station . . . . . . . . . . . . . 191

Chapter 12 Day in the Life:

Empty House—Decrewing the International Space Station . . . . . . . . . . . . . . . . . . . . . . . . . . . 209
vii

Chapter 13 Systems: 

Communications and Tracking—The Vital Link to the International Space Station . . . . . . . . . . 221

Chapter 14 Day in the Life:

Vital Visiting Vehicles—Keeping the Remote Outpost Crewed and Operating . . . . . . . . . . . . . . 233

Chapter 15 Systems: 

Robotics—the Construction Equipment for the International Space Station . . . . . . . . . . . . . . . 249

Chapter 16 Day in the Life:

In-Flight Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 267

Chapter 17 Systems: 

Extravehicular Activities—Building a Space Station . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Chapter 18 Day in the Life:

Risky and Rewarding Spacewalks—Space Shuttle Mission STS-120/ISS-10A . . . . . . . . . . . . . 305

Chapter 19 Systems: 

Environmental Control and Life Support System—

Supporting the Human Element of the International Space Station . . . . . . . . . . . . . . . . . . . . . 333

Chapter 20 Day in the Life:

When Major Anomalies Occur . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 353

Appendix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379

Acronyms and Nomenclature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 384

Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386

About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 387

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
viii
ix

Introduction

Mission Control

The International Space Station 

(ISS)—two-time nominee for the 

Nobel Peace Prize, and winner of 

the 2009 Collier Trophy—is a space 

outpost that is unfamiliar to many 

people. Behind this amazing feat 

of engineering is not just science 

and math but a team of devoted 

men and women from around the 

world and many walks of life that 

have made the ISS a success. These 

professionals comprise the Flight 

Control Team (FCT) of Flight 

Operations. This FCT is the Houston 

in such famous phrases as “Houston, 

Tranquility base here. The Eagle has 

landed,” and “Houston, we’ve had 

a problem.” Although astronauts 

are the visible front of the space 

program, the FCT works around 

the clock to ensure the health of 

the crew and the smooth operation 

of the vehicle. Many a controller 

has worked on Christmas, canceled 

a holiday, or lain awake at night 

worrying about failures or wondering 

what might have been missed before 

a mission. This passion and attention 

to detail has allowed the ISS and the 

programs that preceded it—Space 

Shuttle, Skylab, and Apollo—to 

succeed. These are the people who 

step up when things do not go well. 

The completed International Space Station with the Space Shuttle Endeavour on one end and the European Automated Transfer Vehicle on the other, as seen 

from the Russian Soyuz vehicle on May 23, 2011.

But, as with the hidden magic of a

stage crew on a theatre production, 

the FCT is rarely seen or heard. 

Most people’s exposure to the 

controllers is limited to what they 

see on NASA television: a serenelooking room full of men and 

women sitting in front of computer 

consoles, showing little difference 

between when the crew is asleep 

and when a major malfunction has 

occurred that threatens the crew, 

vehicle, or success of a mission. 

One way to tell things are not going 

as planned is when a collection of 

flight controllers, and potentially 

managers, huddle around the console 

of the flight director—i.e., the person 

responsible for keeping the whole 
x

mission proceeding along. This 

perspective provides little insight 

into what a controller or the flight 

director actually does while “on 

console.” Only when the movie 

Apollo 13—a film starring Tom 

Hanks as Jim Lovell, and one 

that NASA shows its newest team 

members as part of their training—

was fresh in people’s minds could 

NASA point to something and say 

to the general public, “See, that is 

what we do.”

For the control room to appear so 

serene, a great deal of work (some 

of it admittedly boring) has preceded 

those efforts. The flight director is 

always there and takes the operational 

lead—from training each controller 

to training the crew, while overseeing 

the implementation of the plan, 

developing procedures, writing rules 

to guide the mission as directed by the 

ISS Program, and coordinating with 

the Engineering team. This includes 

the training team itself; i.e., the 

clever, if not diabolical, people who 

try to find the potholes in the mission 

and, more importantly, come up with 

failure scenarios that, even if not 

probable, get the team thinking about 

how to deal with the unexpected. In 

fact, this sort of training had prepared 

the team to think about using the 

lunar module as a lifeboat during the 

Apollo 13 mission.

This book will discuss how the 

flight directors and their teams make 

it all happen. With a foundation 

built during Project Mercury, the 

focus will be on the ISS and the 

unique challenges that the project 

has presented over its many years. 

Various aspects of operations—

This emblem was originally developed during the Apollo program to recognize 

the mission control team’s unique contribution to manned space flight since the 

Mercury program. 

The sigma (S) represents the total mission team, including flight controllers, instructors, 

flight design, mission planning and production specialists, facility development and 

support teams. The launch vector and plume represent the dynamic elements of 

space, the initial escape from our environment, and the thrust to explore the universe. 

The orbiting star symbolizes a permanent human presence in space, conducting 

research, developing materials and leading the expanding utilization of the 

space environment. A single star is positioned over Houston, the home of the 

United States human spaceflight operations. At the top of the emblem, the Moon 

and Mars represent NASA’s mission to lead the nation’s permanent journey out 

of low Earth orbit.

The Mercury, Gemini, Apollo, Skylab, Shuttle and ISS programs are represented in 

the legacy ring on the bottom border, commemorating programs for which we have 

operated in space. On the upper border is the wording “Res Gesta Per Excellentiam” — 

“Achieve through Excellence” — which is the standard for our work. It represents an 

individual’s commitment to a belief, to craftsmanship, and to perseverance, qualities 

required to continue the exploration of space and the quest for the stars.

The white stars in the background represent the four original principles of the Mission 

Operations team: discipline, morale, toughness, and competence. 

The comet represents those individuals who have given their lives for space exploration, 

while the seventeen blue stars represent our fallen astronauts, to whom the flight 

controllers dedicate their commitment to excellence. These symbols serve as a 

reminder of the real human cost and risks inherent to space flight and the ultimate 

responsibility the Mission Operations team bears in facing those risks.

Figure 1. The current Flight Operations Directorate emblem with an explanation as to its meaning.
xi

from training, to planning a mission, 

to executing a spacewalk or, as 

happens, responding to a failure—

are discussed in these chapters. 

Several chapters also describe the 

technical aspects of the systems 

to help the reader understand the 

challenges faced by the flight director 

and his or her team.

The FCT has always consisted of 

highly dedicated and proud people, 

from NASA’s first flight director, 

Christopher Kraft Jr. and his team, 

Apollo 13 Flight Director Gene 

Kranz, and Shuttle Flight Director 

Milt Heflin, to the people who sit 

in Mission Control today. Books 

by Kraft (2001), Kranz (2000), and 

Houston and Heflin (2015) provide 

additional details on the early days 

of flight control from the beginning 

of NASA through the Space Shuttle 

era. Those men created the Houston 

FCT, making it up as they went but 

continually learning to make things 

better as ever-more-challenging 

and complicated missions were 

performed. Two important items that 

every flight controller holds dear—

the mission patch and the foundations 

of flight control—were developed 

in the early days and, as with flight 

control itself, have adapted over the 

years. These two symbols reflect the 

pride and philosophy that has shaped 

the teams over the past 50-plus years.

Figure 2. As with the FCT, which has proven to be flexible and adaptable over time, the operations patch has also evolved over the years. Artist Robert T. 

McCall designed the initial patch in 1973. The Saturn V rocket was moved to the background and a shuttle launch was added to the center of the patch when 

that program began. In 2004, Mike Okuda updated the emblem to include the ISS Program, and the number of stars was increased to 17 to represent the 

US astronauts whose lives were lost. Program symbols were made more generic to reflect the ever-growing family of crewed missions. When the Astronaut 

Office merged with the Flight Operations Directorate in 2014, elements of the astronaut logo (i.e., the three contrails with a circle) were incorporated. 

Top row, left to right: 1973, 1983, 1988. Second row, left to right: 2004, 2012, 2014.

As with the individual teams, mission 

operations has its own patch, which 

is rich in symbolism and history. As 

operations changed, so did the patch. 

In 2014, the Flight Crew Operations 

Directorate and Missions Operations 

Directorate were merged into the 

Flight Operations Directorate. 

Figures 1 and 2 show the current 

patch, its meaning, and its evolution. 
xii

The foundations of flight control 

were born out of the ashes of failure. 

Shortly after the Apollo1 fire in 1967 

that killed three astronauts on the 

launch pad, Flight Director Gene 

Kranz told his team that henceforth 

they would need to be “tough” 

and “competent” to ensure such an 

accident would not happen again. 

“From this day forward, Flight 

Control will be known by two words: 

‘Tough’ and ‘Competent.’ Tough

means we are forever accountable 

for what we do or what we fail to do. 

We will never again compromise our 

responsibilities. Every time we walk 

into Mission Control we will know 

what we stand for,

“Competent means we will never 

take anything for granted. We 

will never be found short in our 

knowledge and in our skills. Mission 

Control will be perfect.”

Gene Kranz (2000) 

Out of this grew what is called the 

Foundations of Mission Control. 

The majority of flight controllers 

have this on their wall or desk, 

or have committed it to memory. 

This is the creed to which the team 

literally lives by every second of 

the day. The current version is 

shown below. This “tough” and 

“competent” stance was exhibited 

during the Apollo 13 mission 

whenever everyone gave their 

all to save the crew, and it has 

continued. Although Kranz is not 

sure whether he ever really uttered 

“failure is not an option” during 

the mission, it applied then and 

has been the mantra repeated 

throughout the FCT ever since. 

Foundations of Flight Operations

1. To instill within ourselves these 

qualities essential to professional 

excellence 

Discipline...Being able to follow 

as well as to lead, knowing that we 

must master ourselves before we can 

master our task. 

Competence...There being no 

substitute for total preparation and 

complete dedication, for flight will 

not tolerate the careless or indifferent. 

Confidence...Believing in ourselves 

as well as others, knowing that we 

must master fear and hesitation before 

we can succeed. 

Responsibility...Realizing that it 

cannot be shifted to others, for it 

belongs to each of us; we must 

answer for what we do or fail to do. 

Toughness...Taking a stand when 

we must; and to try again and again, 

even if it means following a more 

difficult path. 

Teamwork...Respecting and using the 

abilities of others, realizing 

that we work toward a common 

goal, for success depends upon the 

efforts of all. 

Vigilance...Being always attentive to 

the dangers of flight; never accepting 

success as a substitute for rigor in 

everything we do. 

2. To always be aware that, 

suddenly and unexpectedly, we 

may find ourselves in a role where 

our performance has ultimate 

consequences. 

3. To recognize that the greatest error 

is not to have tried and failed, but 

that, in the trying, we do not give it 

our best effort. 

The Foundations of Mission Control

NASA is not unique in having a 

Mission Control. The others, either 

in another country or staffed by a 

private company, were inspired by 

the Mercury control center built 

by Kraft. These control centers share 

the same approach and mentalities, 

but with the influences of different 

cultures. Although the space station 

is international in scope, this 

book focuses on the US systems. 

High-level interfaces are discussed 

so that the reader can get a good 

understanding of the vehicle and 

operations; however, NASA defers 

to the experts among its partner 

organizations to tell their own 

story—e.g., the nice summary of 

the European Columbus module in 

Uhlig, Nitsch, and Kehr (2010), and 

the story of the Automated Transfer 

Vehicle by Castel and Novelli (2015). 

Each partner has its own control 

team, as shown in Table 1. The call 

signs are important since the flight 

directors and their teams change 

personnel throughout the day.

The job of flight control is to ensure 

the mission goes as smoothly and 

successfully as possible. The whole 

purpose of the space station is to 

conduct research that cannot be done 

on the Earth as well as developing the 

capabilities to return to the moon and 

go to Mars. NASA’s job is to facilitate 

the research getting done, again as 

with the stage crew ensuring a theatre 

production executes smoothly. This 

means ensuring the systems are 

working properly, and minimizing 

the impact (usually in the form of 

available crew time) when systems 

encounter problems. Although not 
xiii

experts in research operations, the 

FCT needs to understand what 

research is being performed, and 

how it is being performed. For 

example, if an experiment requires 

a microgravity environment as free 

from perturbations as possible, the 

operations team needs to ensure 

thrusters are not firing or that a 

visiting vehicle is not about to dock. 

The FCT works closely with the 

control centers that lead the research, 

and strives to maximize its ability to 

complete tasks. Several other books 

discuss utilization in greater detail, 

including a book by Harm & Ruttley 

(2012). If the FCT is successful, the 

ground-breaking research is all the 

public hears about, which is the case 

for other national laboratories or 

outposts such as Los Alamos National 

Laboratory or the Amundsen-Scott 

South Pole Station.

Table 1. All Control Centers that Operate the ISS, or Visiting Vehicles that Support the Space Station

Location Call sign Function

Houston, Texas Mission Control Center – United States On-orbit Segment 

Houston (MCC-H) or (USOS) or control of the Boeing 

Houston; also MCC-CST Company’s CST-100 (Starliner) 

crewed vehicle

Korolev, Russia Mission Control Center – Russian Segment

Moscow (MCC-M) 

or Moscow1

Tsukuba, Japan Tsukuba Japanese Experiment Module 

elements and H-II Transfer Vehicle 

Oberpfaffenhofen, Munich2,3 or Columbus European laboratory module

Germany Control Center

Toulouse, France Automated Transfer European Automated Transfer 

Vehicle Control Center Vehicle cargo vehicle operations

[retired from service]

St. Hubert, Montreal Remote Multipurpose Support 

Canada Room for USOS Robotics

Dulles, Virginia Mission Control Center – Orbital ATK “Cygnus” cargo vehicle

Dulles (MCC-D)

Hawthorne, Mission Control Center – Space Exploration Technologies 

California SpaceX (MCC-X) Corporation (SpaceX) “Dragon” 

crew and cargo vehicles

Huntsville Huntsville Payloads Operations and 

Integration Center 

1 Even though the control center is located in Korolev, which was kept secret in the days of the 

Soviet Union, it is called Moscow.

2 Although the control center is located in this small suburb of Munich, the control center is always 

referred to as Munich.

3

The European Space Agency has various payload support centers around Europe that interface 

with Munich.

The Road to the International 

Space Station

A Brief History of the ISS

Much has been written about the 

genesis of the ISS and its embryonic 

form, Space Station Freedom. 

However, the story really goes much 

further back and will not be elaborated 

on here. Considerably more detail 

can be found in such references as 

Catchpole (2008). A space station 

was always a goal early on at NASA, 

especially among the German team, 

led by Wernher von Braun, that 

came to America after World War 

II and developed NASA’s rocket 

technology. Landing on the moon 

became the priority once the Kennedy 

administration perceived it as an area 

in the space race that the US could 

win. The Soviets launched various 

space stations throughout the 1970s, 

including the first and culminating 

in the Mir complex in the 1980s. 

As soon as the moon landing was 

achieved, NASA scientists, including 

von Braun, began pushing for a space 

station. The result was Skylab—the 

first US station. Skylab was a great 

start for the US program, but it was 

literally assembled from spare parts 

out of the canceled Apollo program. 

During the 1980s, as the Space 

Shuttle Program began to take off, 

quite literally. The push again grew 

for the US to create a space station. 

President Ronald Reagan eventually 

approved Space Station Freedom 

in 1984 with an $8 billion budget; 

however, the program continued to 

fumble as the costs of the project 

escalated. The design was repeatedly 
xiv

changed. With costs again projected 

to greatly exceed the budget, 

President Clinton ordered a rescale 

of the platform in 1993 with the 

requirement to keep the project under 

a $2.1 billion annual cap. As a result, 

NASA developed three options that 

were called, in true NASA fashion, 

options A, B, and C. Option A was 

basically a restructuring of the 

Space Station Freedom modules. 

This option had a crew of about 

five that spent 1-month intervals 

on orbit. Option B was larger and 

could allow two shuttle orbiters to 

dock simultaneously. However, it 

would only have a human presence 

during shuttle missions with the 

science payloads operating untended 

in between. Although producing a 

capable station, this option required 

a large number of launches. Finally, 

Option C was thrown together 

from “spare” parts of the Space 

Shuttle Program and Space Station 

Freedom Program, including using 

the Columbia orbiter as a permanent 

module. This would get the program 

going quickly and more cheaply, 

but it did not really support a good 

platform down the road. Option C 

was essentially a modern Skylab 

option. All three options, however, 

did call for a strong international 

cooperation, including the European 

and Japanese space programs. In fact, 

the first two options even included 

using Soyuz spacecraft for the crew’s 

emergency return vehicles. Option A 

was selected and the project was now 

called ISS Alpha. The plan called 

for the first element to be launched 

in 1997, with “assembly complete” 

status slated for 2002.

What was the Space Shuttle?

The term Space Transportation System referred to the entire program, 

which included the Space Shuttle, the mobile transportation launch pad, 

and even the assembly buildings. The Space Shuttle consisted of the 

external tank, which contained the liquid propellant, solid rocket boosters, 

and winged orbiter that launched like a rocket but landed like an airplane. 

The orbiter contained the crew in a pressurized area and an unpressurized 

payload bay. The fleet was composed of five orbiters, two of which 

(Challenger and Columbia) were destroyed during launch and reentry, 

respectively, resulting in the loss of 14 astronauts. Although not strictly 

correct, the terms shuttle and orbiter are used interchangeably.

At the same time, the world was

undergoing a marked change. In 

particular, 1991 saw the collapse of 

the Soviet Union. In late 1993, it 

was announced that Russia would 

be full partners in the ISS project. 

This decision was made as much out 

of engineering necessity as political 

reality, but it has proven to be a robust 

partnership that has enabled the ISS 

Program to be a success. However, it 

presented some interesting challenges, 

which were to be expected when 

essentially splicing together two 

different space stations. Even basic 

infrastructure such as power was 

different, as every American traveler 

has experienced when trying to plug 

an American electrical device into 

a foreign socket. Even the planned 

orbit around the Earth was adjusted 

to accommodate the Russian rockets, 

which had less lifting capability than 

the Space Shuttle. 

Because of this history, the ISS is 

separated into two segments—US 

and Russian. The United States 

On-orbit Segment (USOS) includes 

all the non-Russian partners, most 

notably the European Space Agency 

(ESA) module, the Japanese modules 

operated by Japan Aerospace 

Exploration Agency (JAXA), and the 

Canadian robotic systems operated 

jointly between NASA and the 

Canadian Space Agency (CSA). The 

remainder is the Russian Segment. 

Although different countries built 

the various modules of the USOS, 

NASA integrated them all from the 

beginning; therefore, the modules all 

have the same look and feel (e.g., use 

the same base power standard). 

The assembly sequence was laid 

out in three phases. Phase one was 

to be the learning interval. To make 

the project work, Russia and the US 

would have to learn how to cooperate 

in order to merge two very different 

programs. During this interval, US 

astronauts would spend time on 

the Russian space station Mir, and 

several cosmonauts would fly on 

the Space Shuttle. Due to the Iran 

Nonproliferation Amendments Act 

(2005), NASA could not pay for the 
xv

astronauts to be housed on Mir as 

Russia had done with other countries. 

The shuttle would help ferry up 

much-needed supplies in exchange 

for letting US astronauts gain station 

living experience. Simply docking 

the American orbiter to the Mir 

space station was an engineering and 

political feat in itself since neither 

the vehicles nor the programs were 

designed for such activities. Although 

automated supply ships, called 

Progress, serviced Mir, their capacity 

was nowhere near that of the shuttle. 

Seven US astronauts stayed aboard 

Mir from 1995 to 1998 for a combined 

on-orbit time of more than 30 months. 

In the second phase, the ISS would 

be constructed up to a minimal set 

of components that would make it 

a self-supporting scientific outpost. 

To help jump-start the program, the 

Russians would provide the first two 

modules that would anchor the station 

by providing living quarters, power, 

life support, propulsion (to keep 

the station from falling back to the 

Earth), and attitude control (to keep 

the vehicle in the proper orientation). 

This phase ended with the addition 

of the US airlock, which provided 

redundant extravehicular activity 

(EVA), or spacewalk, capability. 

At this point, the ISS would consist 

of living quarters, docking ports, 

propulsion and control modules, 

power-generating solar arrays, and 

airlocks that allowed for spacewalks 

that were critical for repair and 

further assembly. This would be a 

self-sufficient mini-station. 

Phase 3 would see the ISS evolve 

to “core complete.” Although more 

modules were planned beyond core 

completion (e.g., the habitation 

module), this phase represented a 

truly complete station that would 

include three science modules: 

the US laboratory, ESA Columbus 

astrophysics module, and the 

Japanese modules with an External 

Exposure Facility. Initially, the ISS 

crews consisted of three people. 

When the advanced US life support 

system was activated in 2009, the 

standard crew size increased to six. 

The ISS will be able to routinely 

support a crew of seven. It is 

anticipated the permanent crew will 

reach this number upon completion of 

the US Commercial Crew Program.

The Program Office, located at 

Johnson Space Center in Houston, 

Texas, manages the USOS. Run by 

the program manager, the Program 

Office is responsible for all aspects of 

the program under NASA direction. 

A number of divisions under the 

program manager oversee every 

aspect of the vehicle integration and 

operations, including engineering 

support, software development, 

external integration, planning and 

safety, and mission assurance. The 

chief scientist and the ISS Research 

Integration Office are tasked with 

maximizing the research, often 

referred to as utilization, on the 

space station. Also under the ISS 

Program Office is Mission Operations 

Support. This is performed by the 

Flight Operations Directorate and the 

flight control team that executes the 

real-time operation of the vehicle. 

Note that while each international 

partner and its FCT is responsible 

for its systems, NASA is responsible 

for integration and all safety aspects 

of the space station. The Space 

Shuttle was managed out of a separate 

Space Shuttle Program Office.

Getting to Know the International 

Space Station

The fully assembled ISS is shown in 

Figure 3, with each element indicated. 

Although there is no true up, down, 

left, or right in space, a system is 

required to ensure everyone—crew 

and ground—are talking consistently. 

Therefore, as with a seagoing ship, 

the direction of motion is referred 

to as forward, which makes the 

opposite end the aft. In Figure 3, the 

Pressurized Mating Adapter number 

2 (PMA-2) module is at the front of 

the station and is generally the nose 

pointing in the direction of flight 

most of the time. Facing forward 

(i.e., sitting on PMA-2 and looking 

forward) means the port side is on 

the left and starboard is on the right. 

Unlike a ship on the water, the ISS 

is exposed to additional directions in 

space—i.e., up and down. When the 

ISS is orbiting forward around the 

Earth, the direction pointing down 

toward the Earth is called nadir and 

the direction away is the zenith. More 

details are provided in Chapter 8.

Each module or segment of the 

ISS has a functional name such as 

Node 2, Laboratory, S0 truss, or 

Service Module, for example. The 

FCT uses these names on all its 

operations and clearly indicates the 

function of that element. For example, 

Node indicates a pressurized module 

that serves as a hub for other modules 

to be attached. The Integrated Truss 
xvi

Figure 3. Composite image of 

the fully assembled ISS with key 

elements noted. (Top) View from 

the front-looking aft. (Middle) View 

from below (i.e., nadir) looking up at 

the ISS. (Bottom) View from above, 

looking down on the ISS. Orientation 

of the ISS is with respect to normal 

attitude, which is discussed further 

in Chapter 8. These images were 

compiled from dozens of photographs 

taken during the fly-around of the 

Space Shuttle Endeavour after it 

undocked and flew around the ISS 

in May 2011 during one of the last 

missions to the outpost. This picture 

also shows the European Automated 

Transfer Vehicle, the Russian 

autonomous cargo vehicle Progress, 

and the Russian Soyuz spacecraft 

that transports the crew to and from 

the space station. The components 

are defined in Table 2. 
xvii

Segment is numbered by section and 

whether it is located on the port or 

starboard side of the ISS. Thus, S4 

is the fourth truss segment on the 

starboard side, whereas P6 indicates 

the sixth element on the port side. To 

complicate matters, the P6 solar arrays 

were temporarily located on the zenith 

side of the ISS in 2000 until P6 was 

relocated to its final position in 2007. 

Additionally, the S2 and P2 truss 

segments were cut from the design 

during the transition from Space 

Station Freedom; however, the other 

truss segments were not renumbered. 

These technical names were defined 

early in the design and are found in 

every technical document used on 

the program. Later, countries named 

their pressurized modules with more 

user-friendly names, which are used 

in public discourse. For example, the 

Laboratory module is also known as 

Destiny and the European Attached 

Pressurized Module became the 

Columbus module. The technical 

names for the segments will be used 

throughout this book. 

Figure 4 shows a graphic of all the 

ISS elements and which country 

operates them. 

NASA Elements CSA Elements

NASA-provided element integrated 

into the Russian segment

Roscosmos Elements

JAXA Elements ESA Elements

Figure 4. Components of the ISS color coded by contributing country.

The ISS is the largest vehicle ever 

flown in space. Figure 5 compares the 

assembled station to a football field 

for scale. 

Assembly Sequence

Since the ISS was too big to launch 

on any one rocket, it was constructed 

through 31 missions and, in fact, 

is still growing. The assembly 

sequence underwent many changes 

during development and execution. 

Sometimes, changes were dictated by 

delays. For example, when the next 

module was not quite ready to install, 

a logistics flight might have been 

added to take up crew supplies or 

smaller pieces of hardware. In another 

case, the launches of the Japanese and 

European modules were accelerated 

to ensure their installation on the ISS 

prior to the Space Shuttle retirement. 
xviii

Figure 5. Size comparison of the ISS to a US football field. The following statistics provide additional information to offer a sense of scale.

• Size: 51 m (167.3 ft) from front to back (PMA2 to Service Module) and 109 m (375.5 ft) from one tip of the truss to the other. That is equivalent 

to the length of an American football field including the end zones (a football field measures 110 m [360 ft] in length). The ISS is almost four times 

as large as the Russian space station Mir and about five times as large as Skylab, the first US space station.

• Power Generation: Eight solar arrays on the US Segment are capable of producing a total of 84 kilowatts of solar power. The solar array wingspan 

(73 m [240 ft]) is longer than that of a Boeing 777-200/300 model, which is 65 m (212 ft). The total ISS solar array surface area is nearly 4,050 m2

(1 acre) in size. Thirteen km (8 miles) of wire connect the electrical power system.

• Mass: 419,400 kg (924,700 lbs), the equivalent of more than 320 automobiles.

• Pressurized Volume: 916 m3 (32,333 ft 3), or equal to that of a Boeing 747.

• Habitable Volume: 388 m3 (13,696 ft 3), roughly the same living space as a 158 m2 (1,700 ft 2) house that has 2.5 m (8 ft) walls.

During the assembly phase, some 

missions were purely logistical 

in nature, bringing up equipment, 

supplies for the crew (e.g., food and 

water), or research payloads. Russia 

transports supplies to the ISS using 

its unmanned autonomous Progress 

vehicle. On 12 shuttle flights, the 

orbiter transported temporary 

Multi-Purpose Logistics Modules 

(MPLMs) containing approximately 

4,500 kg (~10,000 lbs) of materials. 

The MPLM would ride up in the cargo 

bay of the Space Shuttle. After the 

shuttle docked, the robotic arm would 

take the MPLM out of the cargo 

hold and berth it to the ISS where 

the astronauts could then exchange 

cargo. Before the shuttle left, the 

MPLM would be stowed in the cargo 

bay. It was later realized it would be 

of significant benefit to leave one of 

the MPLMs permanently on the ISS. 

One MPLM, nicknamed Leonardo, 

was retrofitted with additional debris 

shielding for a continuous life in 

space. Conceptually designed to act as 

a storage closet for the ISS, Leonardo 

was renamed as the Permanent 

Multipurpose Module (PMM) and 

installed on the space station in 2011. 

NASA and the international partners 

also had their own autonomous cargo 

vehicles. These included the ESA 

Automated Transfer Vehicle, the 

Japanese H-II Transfer Vehicle, and 

the American commercial vehicles 

Dragon and Cygnus.

Later, when the ISS Program needed 

to ensure two berthing ports for cargo 

vehicles and two docking ports of the 

new US crewed vehicles, the PMM 

was moved from its position on the 

nadir side of Node 1 to the forward 

side of Node 3 in 2015. In 2016, 

the Bigelow Expandable Activity 

Module was installed on the aft side 

of the Node 3 module as part of a 

demonstration of such technologies. 

Several other modules are planned for 

the Russian Segment.
xix

Each assembly mission flown by 

the Space Shuttle generally had two 

designations. First was the mission 

designation. For shuttle flights, this 

would be the Space Transportation 

System (STS) number such as 

STS-88, which indicated the 88th 

shuttle mission. Every ISS assembly 

mission would then have an assembly 

identification consisting of the 

numerical position in the planned 

sequence followed by the country of 

origin. US missions were denoted 

with an “A,” whereas “R” indicated 

Russian launches. Thus, the first 

US assembly mission is commonly 

noted as STS-88/ISS-2A, indicating 

it was the second American flight. 

One exception was the launch of 

the Functional Cargo Block, which 

was funded by the US but built, 

launched, and operated by Russia. 

This mission was designated 1 A/R, 

where the “A/R” indicates the joint 

nature of it. Sometimes, flights were 

added to the original plan. These were 

denoted by a decimal number such 

as 12A.1. When the order of flights 

were changed, as happened following 

the Columbia accident, the sequence 

was not renumbered. For example, 

flight 10A was moved after 13A.1. 

Table 2 lists all the assembly missions 

through 2016, plus several planned 

ones for future Russian modules. 

Note that assembly also required a 

number of EVAs. Those that occurred 

during a shuttle mission where simply 

numbered 1, 2, 3, etc. during that 

mission. Stage EVAs—those that 

occurred outside of shuttle flights—

were numbered sequentially (1, 2, 3, 

etc.), with the prefix of R or US for 

Russian or USOS, respectively. As 

of 2017, there had been more than 

80 USOS and Russian Segment EVAs 

to assemble and maintain the space 

station. More details can be found in 

Chapters 17 through 19.

Crews (which generally consist 

of three people) to the ISS are 

called expeditions, and are also 

known as increments. Since the 

first, Expedition 1, was launched 

to the ISS in 2000, the station has 

been continuously inhabited. The 

first crew flew to the ISS on board 

a Soyuz but came home on the 

Space Shuttle Discovery, which also 

delivered the second expedition crew 

to the ISS on STS-102/ISS-5A.1. 

During early ISS operations, most 

increment crews flew to and from 

the ISS on shuttle flights as shuttlerotating expedition crew members, 

or “ShRECs.” Separate crews visited 

the ISS to rotate the Soyuz rescue 

vehicles when they reached their 

6-month on-orbit expiration date. 

After the loss of Columbia orbiter 

and her crew in 2003, Increments 

7 through 10 consisted of only two 

crew members—one Russian and 

one American—who flew to and 

from the ISS on the Russian Soyuz. 

Since then, most crew members have 

flown on the Soyuz. In 2009, the ISS 

was sufficiently mature to support 

six crew members permanently. 

Until the Commercial Crew Program 

provides crew rotation services, all 

crews rotate to and from the ISS in 

the three-crew Soyuz. The Soyuz 

stays docked at the Russian Segment 

for the duration of the expedition in 

case an emergency forces the crew to 

evacuate. Half of the expedition crew 

members are Russian cosmonauts and 

the other half are made up of NASA 

and international partner astronauts, 

whereas the position of commander 

is rotated between the cosmonauts 

and astronauts. Crews consist of 

personnel from multiple countries and 

were selected, especially in the early 

days, to ensure that there would be at 

least one American and one Russian 

on the ISS at all times. Astronauts 

from ESA, CSA, and JAXA now 

routinely fly to the outpost and have 

also served as commanders. The 

other crew members on an expedition 

are referred to as flight engineers, 

designated generically as FE 1, 

FE 2, etc. These designations are used 

so that generic planning can occur 

even prior to a crew being selected 

or if crew members are swapped for 

whatever reason.

The ISS changed considerably, and 

sometimes dramatically, through the 

construction phase of the assembly 

process. Operational products such 

as flight rules (described below) and 

procedures executed by the crew or 

ground differed as well, depending 

on hardware and software capabilities 

or available modules that changed 

after a given shuttle assembly 

mission. Thus, the increment was 

also subdivided into stages, one 

stage beginning at the launch of a 

shuttle flight and lasting until the next 

launch. All operations products such 

as procedures referenced this stage.

A list of all the assembly missions 

is found in Table 2. Generally, 

construction occurred by attaching 

new modules and segments of the 

truss. However, modules or structures 

sometimes had to be moved from 

a temporary position to a final 

installation location. For example, 

P6 was the first set of USOS solar 
xx

Table 2. Listing of all Flights Assembling the ISS

ISS 

Assembly 

ID

Launch Date Element Public Name, 

if applicable (English 

Translation)

Launch 

Vehicle ID

1A/R November 20, 1998 Functional Cargo Block (FGB in Russian) Zarya (“Dawn” as in 

dawning, new)

Proton

2A December 4, 1998 Node-1, PMA-1, and PMA-2 Unity (Node-1) STS-88

2A.1 May 27, 1999 Integrated Cargo Carrier (ICC) for supplies STS-96

2A.2a May 19, 2000 ICC for supplies STS-101

1R July 12, 2000 Service Module Zvezda (“Star”) Proton

2A.2b September 8, 2000 ICC for supplies STS-106

3A October 11, 2000 Z1 Truss and PMA-3 STS-92

4A November 30, 2000 P6 Truss STS-97

5A February 7, 2001 US Laboratory Destiny STS-98

5A.1 March 8, 2001 MPLM External Stowage Platform (ESP)-1 Leonardo STS-102

6A April 19, 2001 MPLM 

Canadarm2

Raffaello STS-100

7A July 12, 2001 USOS Joint Airlock Quest STS-104

7A.1 August 10, 2001 MPLM Leonardo STS-105

4R September 15, 2001 RS Docking Compartment-1 (DC-1) & Airlock Pirs (“Pier”) Soyuz-U/Progress

UF-1 December 5, 2001 MPLM Raffaello STS-108

8A April 8, 2002 S0 Truss, Mobile Transporter STS-110

UF-2 June 5, 2002 MPLM 

Mobile remote servicer Base System (MBS)

Leonardo STS-111

9A October 7, 2002 S1 Truss STS-112

11A November 23, 2002 P1 Truss STS-113

LF-1 July 26, 2005 MPLM 

MPLM ESP-2

Raffaello STS-114

ULF-1.1 July 4, 2006 MPLM Leonardo STS-121

12A September 9, 2006 P3/P4 Truss STS-115

12A.1 December 9, 2006 P5 Truss STS-116

13A June 8, 2007 S3/S4 Truss STS-117

13A.1 August 8, 2007 S5 Truss and MPLM ESP -3 STS-118

10A October 23, 2007 Node 2 Harmony STS-120

1E February 7, 2008 European Laboratory Columbus STS-122

1J/A March 11, 2008 Special Purpose Dextrous Manipulator 

(or Dextre) 

Japanese Experiment Logistics Module 

Pressurized Section (also known as the 

Japanese Experiment Logistics Module - 

Pressurized Section)

STS-123

1J May 31, 2008 Japanese Pressurized Module 

(Japanese Experiment Module [JEM]-PM) 

JEM Robotic Arm (JEM-RMS)

Kibo (“Hope”) STS-124

(continued next page)
xxi

Table 2. (continued)

ISS 

Assembly 

ID

Launch Date Element Public Name, 

if applicable (English 

Translation)

Launch 

Vehicle ID

ULF-2 November 14, 2008 MPLM Leonardo STS-126

15A March 15, 2009 S6 Truss STS-119

2J/A July 15, 2009 Japanese Exposed Facility (JEM-EF) STS-127

17A August 28, 2009 MPLM Leonardo STS-128

5R November 10, 2009 Mini Research Module-2 (MRM-2) Poisk (“Explore”) Soyuz-U/Progress

ULF-3 November 16, 2009 Expedite the Processing of Experiments 

to the Space Station (EXPRESS) 

External Logistics Carriers (ELC 1 & 2)

STS-129

20A February 8, 2010 Node-3 and Cupola Tranquility (Node-3) STS-130

19A April 5, 2010 MPLM Leonardo STS-131

ULF-4 May 14, 2010 MRM-1 Rassvet (“Dawn” as in 

daybreak)

STS-132

ULF-5 February 24, 2011 PMM (was Leonardo) ELC-4 STS-133

ULF-6 May 16, 2011 Alpha Magnetic Spectrometer and 

EXPRESS Logistics Carrier 3

STS-134

ULF-7 July 8, 2011 MPLM Raffaello STS-135

Commercial 

Resupply 

Services-8

April 8, 2016 Bigelow Expandable Activity Module SpaceX

Falcon 9

3R August 2018 

(scheduled)

Multipurpose Laboratory Module with 

European Robotic Arm

Nauka (“Science”) Proton

6R 2018 (scheduled) Node Module TBD Soyuz

TBD TBD Science-Power Module TBD TBD

arrays launched in 2000 (Chapter 9). 

These arrays provided power for 

the core systems in the early phase 

of the ISS. Since the truss was not 

yet completed, and to ensure that 

dynamic forces such as atmospheric 

drag worked uniformly on the ISS, 

the P6 was attached to the Z1 segment 

at the center of the structure. Later, 

when the truss had been extended, the 

arrays were retracted, P6 relocated 

to the end of the main truss, and the 

solar arrays were redeployed (see also 

Chapters 9 and 18). The Pressurized 

Mating Adapters (PMAs) numbers 2 

and 3 that serve as docking ports 

have been moved multiple times. 

The Node 2 module was delivered to 

the space station on a shuttle flight 

and was initially installed on the port 

side of Node 1 because the orbiter 

was docked at the final installation 

location of Node 2 (PMA-2). After 

the orbiter undocked, PMA-2 was 

moved to the end of Node 2. The 

Node 2 plus PMA-2 combination 

was then moved from its temporary 

position on Node 1 to its final location 

at the front of the Laboratory module 

via the robotic arm (Chapter 15) 

before the next shuttle mission. 

Subsequent shuttle missions docked 

to the PMA that attached to Node 2 

on the “front” of the space station. 

PMA-3 was moved to the Zenith port 

on Node-2 in March 2017 to support 

a second commercial crew docking 

port. An excellent video that shows 

the full assembly sequence, including 

this complicated dance, can be 

found at: https://archive.org/details/

ISSAssemblyAnimation-2011.
xxii

Standardized racks are fundamental 

components of the ISS (Figure 6). 

These racks are carried up in US 

and Japanese cargo vehicles and 

transferred to the ISS where they fit 

into contoured rack bays. Some bays 

are outfitted with power, computer, 

cooling, vacuum, or ventilation 

systems. In this fashion, equipment 

can be taken to or returned from the 

ISS. Many of the core racks contain 

vital hardware such as computers 

and pumps, but research payloads 

are also supported in this fashion. 

Thus, for example, a rack to study 

combustion in space is installed into 

a bay. With a few quick connections 

for power, computer interface, 

cooling, and vacuum ducts, it is 

ready to conduct ground-breaking 

research either with the astronauts’ 

support or remotely from the ground. 

When its research is complete, the 

rack can be returned to Earth to be 

fitted with a new experiment. With 

the retirement of the Space Shuttle, 

several vehicles can transport racks 

to the ISS, but only one can return 

them to the Earth (Chapter 14).

Figure 6. An example of a standard rack being installed in the Japanese Experiment Module. The rack is partially rotated into place on its pivot points 

(Chapter 3) while an astronaut works on connections behind it. To the right of the image is a fully installed rack.

Another level of modularity on the 

ISS is that almost all hardware can be 

replaced. Wherever possible, systems 

consist of Orbital Replacement Units 

(ORUs). The ORU is designed so that 

if it fails—or, as happens in some 

cases, is upgraded—the astronauts 

can take out the old one and put in 

the new unit. This may sound obvious 

when designing anything, let alone 

a multibillion-dollar space vehicle; 

however, it adds complexity and is 

a trade against cost and engineering 

challenges. For example, take a pump 

that moves cooling fluid around. The 

pump contains many elements such 

as electronics, motors, and valves, so 

there is always a chance that some 

component may fail. However, the 
xxiii

pump cannot simply be pulled out 

because the cooling fluid will go 

everywhere. Therefore, valves that 

can be closed off to isolate the pump 

from the fluid must be installed. 

These extra valves add cost and 

weight, and require software to 

control them. Since valves can fail, 

they too must be replaceable. ORUs 

exist on the inside or outside of the 

ISS. External ORUs are usually 

stored on External Stowage Platforms 

(ESPs) or Expedite the Processing 

of Experiments to the Space Station 

(EXPRESS) Logistical Carriers that 

are mounted on the truss of the ISS.

FLIGHT DIRECTOR AUTHORITY 

A. THE MISSION CONTROL CENTER HOUSTON (MCC-H) FLIGHT 

DIRECTOR OR THE MISSION CONTROL CENTER MOSCOW (MCC-M) 

FLIGHT DIRECTOR WILL BE IN CHARGE OF EXECUTION OF 

REAL-TIME STATION OPERATIONS AT ALL TIMES AS THE LEAD 

FLIGHT DIRECTOR. REFERENCE FLIGHT RULE {B1-10}, 

LEAD ROLE HANDOVER. 

The ISS crew and flight control teams must have a clear understanding 

at all times of who is directing the real-time station operations.

B. THE MISSION CONTROL CENTER-HOUSTON (MCC-H) FLIGHT 

DIRECTOR HAS INTEGRATION RESPONSIBILITY OF THE ONORBIT OPS SUMMARY (OOS), THE OOS UPDATES, SHORT TERM 

PLANS (STP’S), ONBOARD STP’S (OSTP’S) (IF DIFFERENT FROM 

THE STP’S), AND THE EXECUTE PACKAGES, SUMMARY PLANS, 

WEEKLY PLANS, AND DAILY PLANS (IF DIFFERENT FROM THE 

WEEKLY PLANS), AND OVERSIGHT OF REAL TIME OPERATIONS 

CONSISTENT WITH RULE {B1-9}, MCC RESPONSIBILITY

MCC-H and MCC-M will be involved at all stages of ISS assembly and 

operation. The lead MCC Flight Director will always work to forge a 

consensus among all partner control teams both when working real time 

and in planning issues.

Figure 7. A sample of a flight rule, in this case showing the authority of the flight director between 

the Mission Control Centers in Houston and Moscow.

The Team Behind The Curtain

Flight control has been a key part 

of spaceflight since the first rockets 

left the Earth’s gravity. In fact, the 

roots of flight control go back to 

aircraft tests that were conducted 

before the space age, such as the 

breaking of the sound barrier by 

Chuck Yeager in 1948, or the ultrahigh altitude balloon flights of the 

1950s (Ryan, 2003). Christopher 

Columbus Kraft Jr. adapted existing 

flight control processes for operating 

NASA’s crewed spacecraft in the 

beginning days of Project Mercury 

in the early 1960s (Kraft 2001). 

Additional historical details may 

be found in Herd, Dempsey, and 

van Leeuwen (2013).

The FCT is a rather large group of 

console operators, support personnel, 

and systems engineers. A clear 

hierarchy starts at the flight director’s 

console. While on console, “Flight” 

leads all the real-time operations. 

In reality, there are layers above 

Flight including the ISS Mission 

Management Team (IMMT), which 

is controlled by the Program Office. 

Technically, the ISS Program Office 

owns the space station and its 

operation is delegated to the FCT in 

the Flight Operations Division. The 

head of the ISS Program manages the 

mission requirements and objectives 

as well as the vehicle constraints. The 

head of the ISS Program Office, or 

his or her delegate, chairs the IMMT.

Before a mission or activity, the FCT 

will write flight rules and a mission 

plan based on these objectives and 

constraints. Flight rules are preplanned decisions and agreements 

that have been approved by the 

program. They are used to guide the 

FCT when time is of the essence. 

An example is shown in Figure 7. 

The mission plan is not only a 

timeline, it is a schedule of constraints 

(e.g., activity B is dependent upon the 

successful completion of activity A). 

When things go well, the team follows 

the rules, procedures, and timeline. 

Where possible, likely failures are 

anticipated and some level of products 

dealing with those cases are also 

created. If something goes wrong, or 

off-nominal, the flight director will 

determine whether the preapproved 
xxiv

rules cover the situation and, if not, 

consult the IMMT, time permitting. 

Otherwise, he or she will act to ensure 

the safety of the crew and the vehicle. 

Figure 8. The main control room, FCR-1, in NASA’s Mission Control Center in Houston, Texas. Flight Director Robert Dempsey (standing) leads the team as 

the Space Shuttle Endeavour approaches the ISS (two far-left video screens). The center screen projects a map of the Earth and the trajectory of the ISS as it 

orbits (top portion of screen), as well its orientation (bottom two panels of the screen). The right screen displays a history of all ground commands to the ISS 

as well as the status of any alarms on the ISS. Clocks for various activities are in amber along the top of the screens. 

The structure of the flight control

room around the world, whether 

for probes, satellites, or missions 

with astronauts, is pretty much the 

same and has changed little over the 

decades. The flight director directly 

interfaces with, and oversees, the team 

in the Flight Control Room (FCR), 

pronounced “ficker” (Figure 8). This is 

the room normally seen on television 

during missions. The ISS flight 

controllers sit in FCR-1, whereas the 

Space Shuttle operators sat in the 

White FCR. Simulation training is 

conducted in different control rooms. 

The front of the FCR usually contains 

large screen displays—video, Earth 

map, clocks—that the entire team uses 

to maintain “situational awareness” 

during the mission. An important 

situational awareness display showing 

malfunctions on the spacecraft is often 

displayed in the front of the room, as 

well. For the ISS, this is called the 

Caution and Warning Summary (see 

also Chapter 5). Various consoles 

that are specialized on a subset of 

spacecraft systems dot the room. Six 

systems—power, computer control, 

communication, attitude control, 

thermal control, and life support—

make up the core systems, which 

are required to keep the vehicle 

and crew alive. Additional consoles 

support specific tasks such as robotics, 

spacewalks, and timeline planning. 

The FCR operators may be supported 

by one or more additional operators 

in other areas of Mission Control, 

commonly called backrooms or 

formally referred to as a Multipurpose 

Support Room, pronounced “mipser.” 

Unlike other industries such as nuclear 

power plants, an operator is not 

assigned to monitor safety in real time, 

as the flight rules and training builds 

that function into the operations. Each 

system has its own call sign and logo, 

developed and displayed with a great 

deal of pride (see Table 3). Not listed 
xxv

Table 3. ISS Flight Control Positions during the Evolution of the ISS. The first column lists the system, whereas the second indicates the call sign of the 

person who operated the listed system during the assembly phase. Backroom support is listed in column three along with the call signs. During the assembly 

sequence, several positions were merged into two Gemini positions during some shifts; these positions and their call signs are listed in the 4th column. 

The name Gemini was chosen since the core systems were merged into two positions. After the assembly of the ISS was complete, several positions were 

permanently combined as shown in the last column. Generally, these positions do not use backroom support, or do so only during special mission activities. 

Position Name 

(call sign)

Backroom Support (or 

Multipurpose Support Room)

Gemini Phase Name 

(call sign)

Current Name 

(call sign)

Motion Control Attitude 

Determination and 

Control Officer 

(ADCO)

HAWKI†† Telemetry Information Transfer 

and Attitude Navigation (TITAN)

 Attitude 

Determination and 

Control Officer (ADCO)

Command & Data 

Handling

Onboard Data 

Interfaces and 

Network (ODIN)

Resource Avionics Engineer 

(RAVEN)

Communications Rf 

Onboard Network 

Utilization Specialist 

(CRONUS) Communications 

and Tracking

Communications 

and Tracking 

Officer (CATO)

STAtion Radio frequency (Rf) 

Communications (STARCOM)

Assembly Video Engineer 

(AVENGER)

Electrical Power 

Systems

Power, Heating, 

Articulation, 

Lighting Control 

(PHALCON)

PHALCON: Power Resource 

Officer (PRO) 

SPARTAN: Station Power 

Operations Controller (SPOC)

Atmosphere Lighting Articulation 

Specialist (ATLAS)

Station Power, 

ARticulation, 

Thermal ANalysis† 

(SPARTAN)

Environmental 

and Life Support 

Systems

Environmental 

Control and Life 

Support Systems 

(ECLSS)

Atmosphere/Consumables 

Engineer (ACE)

Environmental and 

Thermal Operating 

Systems† (ETHOS)

Thermal Control 

Systems

Thermal Operations 

and Resources 

(THOR)

Thermal Control (TCON)

Structures and 

Mechanisms

Operations Support 

Officer (OSO)

OSO Support Operations Support 

Officer (OSO)

Planning Operations Planner 

(Ops Planner)

Long Range Planner (LRP)

Resource Planning Engineer (RPE)

Orbital Communications Adapter 

(OCA)

Operations Planner (Ops Planner) Operations Planner 

(Ops Planner)

Flight Director Flight Director 

(FLIGHT)

Flight Director (FLIGHT) Flight Director 

(FLIGHT)

Spacecraft 

Communicator

Capsule 

Communicator 

(CAPCOM)

Capsule Communicator 

(CAPCOM)

Capsule 

Communicator 

(CAPCOM)

International 

Partners Liaison

Remote* Interface 

Officer (RIO)

Houston Support Group (HSG) 

Columbus Support Group (CSG) 

SSIPC Support Group (SSG)

Houston Support Group (HSG) 

Columbus Support Group (CSG) 

SSIPC Support Group (SSG)

Remote* Interface 

Officer (RIO)

On-board 

computer 

networks

PLug-in-plan and 

UTilization Officer 

(PLUTO)

PLUTO Support (PLUTO Support) PLUTO Support (PLUTO Support) Plug-in-Plan and 

Utilization Officer 

(PLUTO)

Medical support BioMedical 

Engineer (BME)

Crew Health Care System 

Hardware (CHeCS)

Crew Health Care System 

Hardware (CHeCS)

BioMedical Engineer 

(BME)

Surgeon Surgeon 

(SURGEON)

Surgeon (SURGEON) Surgeon (SURGEON)

Ground Systems 

and Networks

Ground Controller 

(GC)

Numerous support positions 

such voice, command and 

communications systems

Ground Controller (GC) Ground Controller 

(GC)

Trajectory and 

Tracking

Trajectory 

OPerations Officer 

(TOPO)

Trajectory OPerations Officer 

(TOPO)

Trajector OPerations 

Officer (TOPO)

Pointing position 

of the ISS

Pointing Officer 

(Pointing)

Pointing Officer (Pointing) Pointing Officer 

(Pointing)

Stowage tracking Cargo Integration 

Officer (CIO)

Integrated Stowage Officer (ISO) Integrated Stowage 

Officer (ISO)

(continued next page)
xxvi

Table 3. (continued)

Task-Specific Positions

Robotics Robotics Officer (ROBO) Mobile Servicing System – 

Systems (Systems)

Mobile Servicing System – 

Task (Task)

Robotics Officer (ROBO)

Spacewalks Extravehicular Activity (EVA) Systems (EVA Systems)

Tasks (EVA Tasks)

Extravehicular Mobility Unit (EMU)

EVA

Visiting Vehicles Visiting Vehicles Officer (VVO) Automated Rendezvous Officer 

(ARO)

Visiting Vehicle Dynamics 

(VV DYN)

Visiting Vehicles Officer (VVO)

Integration for 

Visiting Vehicles

Integration and Systems 

Engineer (ISE)

Integration and Systems 

Engineer (ISE)

 * Initially Russian Interface Officer until additional partners added when it was changed to Remote Interface Officer.

 † SPARTAN operates the external thermal systems and ETHOS controls the internal.

†† The origin of this name is less straightforward than the other positions. The letters do not spell out words; they are actually 

standard mathematical symbols: Momentum (H), Attitude (A), Angular Rate (w), Kinetic Energy (K), Moment of Inertia (I)

in Table 3, but still an important part 

of the team, is the payload operations 

director who is the flight director 

equivalent for the science operations 

that are run out of the Payload 

Operations Integration Control Center 

in Huntsville, Alabama. 

The FCT has evolved over the 

life of the ISS. Between the first 

element launch (1998) and the first 

crew (Expedition 1) taking up a 

permanent residence in 2000, the 

FCT only worked one 9-hour shift 

a day, Monday-Friday, to check 

on the systems, as limited as they 

were. Outside of this window, the 

station duty officer and flight director 

monitored the systems, calling in the 

full team when needed to support 

a major dynamic activity or to deal 

with an anomaly. With astronauts 

and cosmonauts on board beginning 

in 2000, the core team supported 

24/7, 365 days a year. Two Gemini 

officers monitored the six core 

systems to relieve burnout of the team 

during quiet times, typically during 

crew sleep or off-duty weekends. 

All consoles and the Multipurpose 

Support Room were staffed during 

major events such as shuttle missions 

or spacewalks. After assembly was 

completed, it was possible to reduce 

the number of flight controllers 

since systems were now fully mature 

and configurations changed less 

frequently. Several disciplines were 

merged in 2010, and most positions 

do not have backroom support, except 

for major activities. On the weekends 

or when the crew is asleep, non-core 

systems personnel can go home, 

albeit staying on-call for problems. 

Flight and ground control are always 

on console.

As with the Space Station, 

Mission Control Also Evolves

The Blue FCR was the original control room for the ISS. Before the ISS, this 

control room was the Special Vehicle Operations room from which single 

mission projects, such as the Hubble Space Telescope servicing flights or 

specific payload launches, would be operated. Later, the ISS team moved 

into the FCR-1, which was the original FCR built at Houston’s Mission 

Control Center in 1965. Apollo 7, Apollo-Soyuz Test Project, Skylab, some 

Space Shuttle missions, and the ISS have all been operated from FCR-1.

Flight controllers communicate 

with each other via voice loops. 

Although the control room always 

appears serene and peaceful, chaos 

is generally reigning in the ear of 

an operator. Each operator wears 
xxvii

a headset that is plugged into an 

audio display panel. There are 

approximately 20 audio conference 

channels or “loops” on a given 

display, and 10 displays to choose 

from. Using the display, the controller 

can select which loops to listen to 

and which one loop on which to 

talk. Four loops are reserved as the 

primary channels for the astronauts 

and ground to communicate. These 

are designated as Space-to-Ground 

1, 2, 3, and 4. Additional channels are 

described in Chapter 13. One of the 

first skills a controller needs to master 

is the ability to listen to multiple 

conversations simultaneously, picking 

out the things that affect him or her 

directly, hold conversations above 

the cacophony, and stop everything 

instantly when there is a call on the 

space-to-ground loops from the crew. 

To facilitate this process, the FCT 

uses codes and special phrases to 

keep discussions concise and crisp, 

as described in Chapter 10.

Staffed by NASA and contractor 

engineers (primarily from the Boeing 

Company), the Mission Evaluation 

Room (MER) also supports 

operations. As the primary contractor 

of the ISS since the early days of the 

program, the Boeing Company and 

its subcontractors designed and built 

the majority of the US ISS hardware. 

These MER personnel retain and 

manage valuable design specifications, 

manufacturing documentation, and 

general system knowledge that is 

highly beneficial for the operation 

of the space station. The MER 

supports the operations team with a 

structure similar to that of the FCT 

(i.e., a Command and Data Handling 

subject matter expert that supports 

the Communications Rf Onboard 

Network Utilization Specialist flight 

controller). Each MER discipline 

has its own call sign and set of loops 

to communicate among themselves 

or the FCT. As with the controllers, 

the MER team has a leader called 

the MER manager, which is similar 

to the flight director. The MER 

manager is consulted if a question 

comes up during operations, such as 

how something worked in testing or 

how the software might respond in a 

particular configuration. If the MER 

does not have the information on 

hand, he or she will consult with the 

vast Boeing organization to collect 

and provide the data. Generally, the 

MER is staffed only between the hours 

of 9:00 a.m. - 5:00 p.m., MondayFriday, but is supported around the 

clock during major activities or if an 

anomaly occurs. In the event of an 

anomaly, it is the MER’s function to 

gather data, ascertain the problem, 

and devise a fix. These activities are 

coordinated with the FCT throughout 

such investigations.

As owners of the ISS, the Program 

Office also has a team that supports 

operations on a regular basis. This 

team, the ISS Management Console, 

provides coordination with the 

program management, including 

keeping them apprised of all 

activities, successful or not, as well 

as coordinating with the management 

teams of the other partners. 

Finally, representatives from the 

international partners maintain some 

presence in the Mission Control 

Center-Houston, mainly to help with 

the integration of the operations from 

day to day. Most notable among 

the partners presence is that of the 

Russians, who maintain a small team 

of flight controllers, trainers, and a 

flight director as part of what is called 

the Moscow Support Group. Besides 

performing coordination tasks, 

the group can operate the Russian 

Segment in the event of a significant 

problem with the control center near 

Moscow. Likewise, NASA maintains 

a small team in Russia known as 

the Houston Support Group. NASA 

and the international partners also 

exchange support group personnel, 

though sometimes only during critical 

mission phases.

Flight control is different for the 

ISS than it was for the shuttle and 

earlier spacecraft. In the case of the 

Space Shuttle, the astronauts were 

responsible for most operations, 

and the ground followed along. 

Almost all commands to the vehicle 

were “switch throws” or other 

similar operations by the crew. In 

contrast, the vast majority of the ISS 

commands are sent from the ground. 

This allows the crew to focus more 

on the science payloads and less on 

vehicle operations. A typical day 

during a shuttle mission saw the FCT 

uplink less than 500 commands. The 

collective station FCTs, located all 

around the world, routinely send 

50,000 commands per day to the ISS. 

It takes several years to become a 

certified flight controller (see also 

Chapter 10). Although, generally, the 

team is made up of engineers—and 

positions and degrees are highly 

correlated (e.g., an electrical engineer 
xxviii

supports the power systems https://

www.nasa.gov/sites/default/files/

atoms/files/np-2015-05-022-jsc-issguide-2015-update-111015-508c.pdf, 

a computer scientist might support the 

computer systems)—it is not strictly 

required. Math and English majors 

and even astronomers have been, 

and still are, flight controllers. Initial 

training provides every new person 

with general knowledge of spaceflight 

operations, the vehicle, visiting 

spacecraft, the NASA organization, 

how to work with international 

partners, and even how to conduct 

meetings. Training involves 

completing computer-based training, 

reading manuals and instruction 

books, and attending classroom 

lessons. Eventually, the student 

supports simulations where the 

operations of the ISS are reproduced 

by computers and significant failures 

can be experienced by the team. 

Training in general and simulations 

specifically are described in more 

detail in Chapter 10. Once certified, 

flight controllers, instructors, and 

flight directors all must continue to 

perform proficiency training and 

evaluation to ensure they remain 

at peak performance levels. Flight 

directors are generally selected from 

seasoned flight controllers. As of 

2017, 91 individuals have become 

certified NASA flight directors.

CSA (St. Hubert, Canada)

• Space Operations

Support Center (SOSC)

Orbital ATK (Dulles, USA)

• Orbital ATK Control Center – Dulles

(MCC-D)

NASA/Johnson Space Center

(Houston, USA)

• Mission Control Center – Houston (MCC-H)

NASA/Marshall 

Space Flight Center

(Huntsville, USA)

• Payload Operations

Integration Center

(POIC)

Space X (Hawthorne, USA)

• Space X Control Center 

(MCC-X)

RSA (Korlev, Russia)

• Mission Control Center – Moscow (MCC-M)

ESA (Oberfafenhoffen, Germany)

• Munich Control Center

NASDA (Tsukuba, Japan)

• Space Station Integration

and Promotion Center

(SSIPC)

Figure 9. Control centers that affect the ISS around the world. 

Similar structures, room layouts, 

training, and operations occur in 

the various control centers around 

the world that manage the ISS 

(Figure 9). See also Herd, Dempsey, 

& Leeuwen. (2013). Joint training 

between the various control centers 

is performed for specific mission 

activities (e.g., activating the 

Columbus module, docking the 

European cargo vehicle). Pictures of 

the different control centers can be 

found in https://www.nasa.gov/sites/

default/files/atoms/files/np-2015-

05-022-jsc-iss-guide-2015-update111015-508c.pdf. The control rooms

of the CSA Space Operations Support

Center (see also Chapter 15) and

the Payload Operations Integration

Center are shown in Figure 10. The

American visiting vehicle control

centers are displayed in Chapter 14.
xxix

Image Courtesy of the Canadian Space Agency

Figure 10. Other key USOS control centers. The top image is of the CSA Space Operations Support Center in St. Hubert, Quebec, which supports robotics 

operations. The bottom image is of the Payload Operations Integration Center in Huntsville, Alabama. 
xxx

Naming Conventions

Flight controllers and their flight 

director can hold whole conversations 

awash in acronyms or “NASA speak.” 

Throughout the book, we have tried 

to use as few acronyms as possible. 

Unfortunately, it is not possible 

to tell the story of the ISS without 

referencing many of the common 

terms. This will be explained, when 

used. A complete list can be found in 

the Appendix.

Another challenge with this topic is 

that it is international. Under NASA 

integration, all operations on the 

USOS are conducted in English. 

All procedures, labels, and even 

discussions with the astronauts 

use English. An exception to this 

rule are the Russians. All of their 

systems, flight control operations, 

and cosmonauts use Russian and, of 

course, the Cyrillic alphabet. Critical 

systems or emergency procedures are 

marked in both. The US FCT needs to 

be versed to some extent in Russian, 

since it is used when communicating 

with their counterparts. Thus, 

everything on the Russian Segment 

may have a Russian name, a Cyrillic 

acronym, an English transliteration, 

and an English acronym. Brackets 

are placed around the letters to 

indicate a transliteration from regular 

English acronym. For example, the 

central computer on the Russian 

Segment (Table 4), which is shown 

in Chapter 3, interfaces with the main 

computer on the USOS. This book 

will use the English acronym.

Table 4. Example of Russian-English Acronym Reference

Russian Name Russian Cyrillic 

Acronym

Translation English 

Transliteration

English 

Acronym

Служебный модуль 

центрального компьютера 

(Sluzhebnyy modul’ 

tsentral’nogo komp’yutera)

ЦВМ Service Module 

Central Computer

[TsVM] SMCC

Book Layout

This book is comprised of two types 

of chapters. Ten chapters provide 

an overview of the key systems on 

the ISS. These are the computer, 

communications, thermal control, 

life support, power, structures, and 

motion control systems. Each one 

of these is critical to supporting 

the crew and the other systems 

so that the ISS can continue to 

operate. Additional technical detail 

can be found in Chamitoff and 

Vadali (2018). Although one would 

not consider them core systems, 

the planning, robotics, and EVA 

(i.e., spacewalking) functions are 

extremely critical to the construction 

and operation of the space station. 

These systems are therefore included 

in the technical chapters. These 

chapters provide the foundations 

for the remaining “Day in the Life” 

chapters, which detail the operations 

of the ISS by the FCT. 

Each Day in the Life chapter 

focuses on a theme in the area of 

operations. The themes will cover 

the routine operations of the space 

station—though it might be argued 

that nothing is routine in space—

and the unusual or contingency 

operations. Change supported by 

flexibility and adaptability make up 

the reality of operating a complex 

vehicle in space. Chapter 2 describes 

the day-to-day life during the time 

an increment crew is on the ISS, 

whereas Chapter 4, The Making of 

a Mission, describes the process of 

putting together and executing major 

missions using a shuttle assembly 

flight for illustration. A specific 

example of change is discussed 

in “Brain Transplants” of the ISS 

(Chapter 6) where, as with terrestrial 

desktops, laptops, and smartphones, 

the software that is operating the 

vehicle is completely updated. 

Low-Earth orbit is a dangerous 

place for many reasons, but most 

notably due to a large amount of 

debris that, if it struck the ISS, could 

kill the crew. Therefore, the FCT 

continuously monitors this debris and 

occasionally maneuvers the space 

station out of the way, as described 

in Chapter 8. Training is critical, and 

Chapter 10 provides a small flavor 

of that world from the viewpoint of 

the team members as they simulate 

life and death on the station. Flight 

controllers have to spend a great deal 

of time planning for the unexpected 

and preparing for contingencies 

that, if things go well, may never be 

needed. Having the crew members 

abandon the station and come home 

in order to save their lives is one of 
xxxi

the things the ground team has to 

think about. If the unfortunate day 

ever comes, NASA will be prepared 

(Chapter 12). As with any remote 

outpost, supplies and fresh personnel 

have to be brought to the station and 

ferried home. This process, which 

has also evolved significantly over 

the lifetime of the space station, is 

discussed in Chapter 14, along with 

the continuous coming and going of 

these visiting vehicles. As can happen 

in any home or research facility 

on Earth, things sometimes break 

or need to be modified. In-Flight 

Maintenance (Chapter 16) discusses 

making these repairs—whether it 

be finding a leak, or fixing a stuck 

hatch or a broken computer. Some 

installations or repairs require 

a spacewalk, as described in 

Chapter 18. More serious failures 

also occur in space, such as when the 

pump that controls half of the critical 

cooling system on the ISS fails. In 

this case, all systems are affected and 

every team, including robotics and 

EVA, are involved in the recovery 

in what is known as an “all hands 

on deck” scenario. These cases are 

discussed in Chapter 20, “When a 

Major Anomalies Occur.”

Acronyms, references, and 

information on the authors of this 

book can be found in the Appendix. 

Chapter 1 Systems: 

International Space 

Station Planning—

A Roadmap to 

Getting It All Done
2 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

Building both the pyramids and the International Space Station presented significant logistical challenges that required careful planning. 

Clockwise from upper left: the pyramids of Giza, the completed space station, Mission Control, a graphic showing the construction of the pyramids.

More than 4,500 years ago, Egyptian 

pharaoh Khufu and his architects 

stood upon the Giza plateau near 

modern-day Cairo and contemplated 

the building of what was at the time, 

and is still considered to be, one of 

the most immense undertakings of 

humankind: the building of the great 

pyramids of Giza. Foremost in their 

minds was the scale and complexity 

of the task, and the organization, 

choreography, and supply of the vast 

number of architects and laborers 

needed to complete the job. Thus, 

one of the seven wonders of the 

ancient world was completed over 

a period of 20 years through careful 

planning and execution, as well as by 

establishing a reliable supply chain 

of food and materials. 

It has been argued that the scale, size, 

and complexity of the International 

Space Station (ISS) along with the 

distributed international workforce 

of engineers, managers, technicians, 

and scientists is this era’s equivalent 

to the pyramids. As a result of careful 

long- and short-range planning and 

a well-developed logistics plan, the 

ISS has served as a continuously 

occupied human outpost and 

research laboratory in low-Earth 

orbit since November 2000. Unlike 

the pyramids, however, the ISS 

has evolved significantly during 

and subsequent to its construction, 

adapting to catastrophe (e.g., Space 

Shuttle Columbia) or political goals.

This chapter focuses on both 

long- and short-range planning. 

Any activity that occurs on the 

ISS—whether it be running a 

science experiment or performing a 

spacewalk—takes years of planning 

and preparation. The ISS Program 

office first lays out high-level 

priorities and plans years in advance. 

When will a supply mission launch? 

Who will the crew members be? 

Will the astronauts stay on orbit 

for 6 months or a year? When will 

spacewalks be needed? More and 

more details are worked out as the 

time for a mission approaches. A 

robust planning process also allows 

for change, whether it is due to 

a failure or problem, or simply a 

change in priorities. During any 

given week, hundreds of activities are 

performed, each with its own resource 

needs (e.g., power, sample bags), 

constraints (e.g., needing the same 
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 3

physical space), or crew availability 

(e.g., a given crew member trained 

for a particular task). The focus of 

this chapter is on the increment, 

typically a 6-month stay for a crew, 

where multiple events—spacewalks, 

supply missions, scientific research—

take place, whereas Chapter 4 details 

the planning process for a specific 

mission. The long- and short-range 

planning process will be discussed 

along with the specific products and 

groups involved. With assembly of 

the ISS complete, the ultimate goal in 

planning is to maximize the amount 

of research that will be performed by 

a well-resourced crew.

Long-Range Planning—

Building Up to the Increment

Years in advance, ISS Program 

personnel lay out a high-level 

manifest. The focus of this manifest 

is primarily supply—i.e., when 

will cargo vehicles be available 

to transport critical food, water, 

oxygen, fuel, spare parts, clothing, 

and scientific payloads. Since supply 

vehicles can, and have, failed to reach 

the station (e.g., the Russian Progress 

and the American Orbital and SpaceX 

launch failures in 2014 and 2015), 

the program tries to allocate extras 

wherever possible. Another factor in 

this planning may be the availability 

of hardware. For example, an 

experiment might be planned for a 

particular increment; however, if the 

hardware runs into unexpected issues 

during development, the schedule 

will slip, perhaps to an increment 

that does not have the necessary 

upmass capability or enough 

crew time available due to higher 

priorities. Approximately 2 years 

prior to a given increment, ISS 

Program personnel, with input from 

the operations team, begin detailed 

planning by establishing priorities for 

a given increment. These priorities 

are documented in an incrementunique requirements document 

called the Increment Definition 

and Requirements Document 

(IDRD). The IDRD contains 

specific categorical requirements for 

areas such as medical operations, 

science operations, photography, 

ISS maintenance, and equipment 

manifests. Unique to each increment, 

the IDRD is used in conjunction 

with a more-generic requirements 

document called the Generic 

Groundrules, Requirements, and 

Constraints (GGR&C), which applies 

to all increments. The GGR&C 

provides general requirements for 

all activities. For example, it dictates 

that the astronauts should normally 

plan for at least 8.5 hours of sleep per 

day, 2 hours of pre-sleep to unwind 

and prepare for bed, and 1.5 hours 

of post-sleep to wake up, perform 

hygiene duties, and prepare for the 

day. The execution planning teams 

use this document as the primary 

guidance for developing the plans that 

will be described in this chapter. 

The primary focus of the IDRD 

development phase is to define 

requirements for the increment (e.g., 

number of spacewalks or reboosts 

needed to maintain vehicle altitude). 

Since there is always more to do than 

available time or resources allow, the 

IDRD provides priorities to aid in 

decision making during execution, 

should trades need to be made. The 

IDRD also details the availability and 

expected use of key consumables that 

the ISS uses over the course of the 

increment. Managing consumables is 

also a complex process. Consumables 

include those needed for life support 

as well as for the spacecraft or 

experiments. Program personnel 

estimate how much oxygen, water, 

fuel, etc. are needed. This can be a 

tricky calculation because individual 

crew members consume oxygen and 

water at different rates. Even fuel 

can be difficult to manage because 

the altitude of the ISS is affected 

by a number of parameters, not the 

least being the irregular activity 

on the surface of the sun. Once 

the needs are identified, program 

personnel evaluate the available 

upmass—i.e., which launch vehicles 

have available space. Something 

big or heavy being launched on one 

vehicle means less available upmass 

for other items. Program personnel 

put forth considerable effort 

analyzing the stowage configuration 

throughout the increment based on 

the visiting vehicle traffic plan along 

with the expected trash generation 

and disposal plan. Development 

of the research plan—specifically, 

which experiments will fly, and when 

those experiments will fly—occurs 

in parallel with this planning. This 

intricate planning can be especially 

challenging when an experiment, 

new hardware, or even a replacement 

part is not ready as scheduled, due to 

unexpected challenges. 

Program requirements determine 

how much time is available for 

specific activities. Per the GGR&C, 

astronauts are required to have 

8.5 hours a day allocated for sleep. 

Four hours a day are set aside for 

post-sleep and pre-sleep, 3 hours for 

meals, and approximately 2.5 hours 

for exercising. Daily planning 

conferences are scheduled twice a 

day to allow the ground and crew 

time to tag up on the activities about 

to be performed or completed. Time 

for other tag-ups are also allocated 

to discuss stowage and transfer, 

especially prior to and during cargo 

resupply missions or in preparation 

for spacewalks. Since the astronauts 

are typically on the ISS for 6 months, 

unlike a short Space Shuttle mission, 

they have a half day on Saturdays to 

perform weekly housecleaning, and 

a full day on Sundays to do whatever 

they please. Several major holidays 
4 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

per increment are also set aside for the 

crew to have time off from work. The 

remaining time is divided between 

maintenance or assembly activities 

or “utilization”—the catchphrase for 

all scientific research. Construction 

or developmental tasks dominated 

crew time during the assembly time 

frame, with little time available for 

utilization. Utilization time was so 

short in the early days of the ISS 

Program that astronauts would often 

do volunteer science on Saturdays. 

However, this practice can lead to 

overly tired crews and, possibly, 

burnout. By about 2013, 30 hours 

a week was being carved out for 

utilization, which is expected to reach 

more than 70 hours a week around 

2018 when the new US commercial 

crewed vehicles, which can carry four 

astronauts, become available. 

Crews are assigned to an increment 

at about the same time that the IDRD 

development kicks off. Early in 

the program, especially during the 

assembly phase, crew selection was 

often based on planned activities. 

For example, astronauts who were 

skilled in robotics could be assigned 

to increments where a great deal 

of robotic work might be needed. 

Similar assignments could occur for 

increments heavy in spacewalks. 

This proved challenging to the flight 

control team, astronauts, and trainers 

as schedules frequently shifted, 

often due to shuttle mission delays. 

As the ISS evolves, and as planners 

gain more experience with the everchanging nature of ISS operations, 

crews are being provided with 

generic skill-based training such as 

preparation for any type of operation. 

For example, a crew might be trained 

to perform a spacewalk and change 

out a generic box instead of learning 

the specifics of a particular unit. 

Electrical connectors for all boxes are 

similar, thus specific instructions can 

be provided just prior to a specific 

extravehicular activity (EVA). 

Now where did I put that?

A lot of equipment and supplies go to and return from the ISS. Experiments 

and food, for example, go up; research specimens and broken parts 

needing repair come down. Imagine keeping track of everything in your 

house over many years. Now, add in the complexity that occurs when the 

residents change every 6 months. Every bit of space on the ISS is used for 

something—e.g., if a system component or an experiment is not in a spot, 

that spot is probably being used for stowage. ISS Program personnel try 

to position as much spare parts, food, and water to keep operations going 

for as long as possible since supply rockets can, and have, failed to deliver 

precious supplies. Managing where and how to store all the supplies and 

equipment required to keep the ISS going is literally a full-time job. That job 

belongs to the Inventory Stowage Officers (ISOs) in Houston, along with 

their counterparts in Tsukuba, Munich, Huntsville, and Moscow. Most items 

have a barcode that can be read by a laser device. These barcodes are 

similar to those found on products in terrestrial stores or radio frequency 

identification chips, and are tracked in a database known as the Inventory 

Management System. The ISO works with the rest of the flight control team 

to build stowage notes for crew activities. These notes tell crew members 

where to find the tools and equipment they will need, and where everything 

goes when they are done. Gathering and stowing tools takes a significant 

amount of time and is built into the time allocation of each activity. The 

ISO works out how to unpack and put away cargo brought up to the ISS in 

arriving vehicles, how to pack whatever needs to be returned to Earth, and 

where to temporarily store items that will be thrown away. Each week, the 

ISO tags up with the crew during a short conference to make sure all the 

instructions that the crew members received for stowage management that 

week were clear, to answer any questions they may have, and to start the 

planning process for the next week.

Even with barcodes and the ISO team on the ground, items get lost or 

misplaced. When this happens, the flight control team will actually create 

a “wanted” poster, alerting crew members to keep their eyes open for the 

missing hardware. Although most missing items are small, even large ones 

can disappear, as was the case of a pump module that measured 72.9 x 

45.0 x 45.7 cm (28.7 x 17.7 x 18.0 in.). That pump module was eventually 

found tucked behind a rack.

As the increment gets closer, 

placeholder events documented in 

the IDRD (e.g., EVAs) evolve into 

specific tasks such as repairs or 

experiment payload deploy. The final 

IDRD is published 1 month before 

the start of the increment. At this 

point, planning enters the execution 

phase with the Operations Planner 

(OPS PLAN) leading the detailed 

schedule development. 

Planning by the flight control team 

begins in parallel with the final phases 

of IDRD development. This allows 
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 5

planners to evaluate the set of 

proposed increment requirements 

for feasibility before the final 

requirements are approved while 

allowing planners to begin developing 

their databases of activities. Increment 

planning, performed by the flight 

control planning team, is broken into 

pre-increment planning and execute 

planning. The pre-increment planning 

phase begins 1 year prior to the 

increment start and ends at increment 

start—3 weeks (I-3 weeks). As 

described in detail below, the primary 

products generated during this phase 

are the Increment Overview, On-orbit 

Operations Summary (OOS), and the 

Execute Planning Groundrules and 

Constraints (Gr&C).

Three weeks prior to start of the 

increment, the planners begin what 

is called the “execute” phase. The 

primary products of the execute phase 

are the Monthly Calendar, Weekly 

Lookahead Plan (WLP), Short Term 

Plan (STP), Onboard Short Term Plan 

(OSTP), and Daily Execute Package. 

Although this process is orderly, 

significant change is occurring 

through the entire process as ISS 

Program priorities change. Problems 

such as broken hardware or a supply 

mission delay are the main drivers for 

these changes. Thus, replanning is an 

ongoing process. 

Increment Planning

The International Execute Planning 

Team (IEPT), led by the lead 

operations planner resident at 

NASA Johnson Space Center, 

develops the pre-increment products. 

Planning representatives from 

each international partner (see 

Introduction)—NASA, Russia, 

Europe, and Japan—comprise the 

IEPT. The Payloads Operations 

and Integration Center organizes 

research in the United States, 

whereas the lead mission control 

center for each partner coordinates 

its respective research activities. 

The IEPT members conduct regular 

conferences, routinely exchange 

planning data according to a 

predefined schedule, and participate 

in two face-to-face meetings for 

pre-increment planning product 

finalization. During the execute 

planning phase, IEPT meetings 

(telecons) are conducted 3 days a 

week to facilitate WLP and STP 

development and replanning. 

A key task during pre-increment 

planning is to evaluate the feasibility 

of the program requirements. At this 

stage of the process, planners begin 

translating program requirements 

into activities and assigning these 

activities to periods of time during 

the increment to determine whether 

sufficient resources (e.g., crew time) 

are available and whether defined 

activity constraints (e.g., microgravity 

periods, sufficient day/night cycles, 

etc.) can be satisfied. Detailed 

procedures and time estimates are 

generally not available at this stage; 

however, the operations team has 

done enough analysis to have a 

reasonable estimate on how long each 

activity will take. If an activity is 

particularly complex, the operations 

team may conduct a dry run in the 

mock-up facility to improve the time 

estimate. Eventually, as the time of 

executing the activity gets closer, the 

procedure will be verified and the 

final time estimate will be available. 

If the activity has been performed 

previously or is suitably similar to 

another activity, the time can be better 

estimated. However, individual crew 

members can take a different amount 

of time to perform the same activity, 

depending on background or previous 

experience in space. The IEPT 

develops the primary products of 

this phase—the Increment Overview, 

OOS, and Gr&C—according to a 

predefined schedule (Table 1). 

Table 1. Dates are referenced to the start of the increment (I) and the time. I-12 indicates 12 months 

before the start of the increment.

Increment Overview

Increment-Specific 

Groundrules & Constraints On-orbit Summary

Draft: I-12 months Draft development occurs 

~I-8 through I-4 months

Draft development occurs 

~I-8 through I-4 months

Preliminary: I-6 months Preliminary: I-4 months Preliminary: I-4 months

Final: I-1 month Final: I-1 month Final: I-1 month

The Increment Overview (Figure 1) 

is the official planning document 

until 1 month prior to beginning of 

the increment when the final OOS 

provides the information for the final 

stages of planning. The document 

contains a summary of key increment 

operations such as spacewalks and 

illustrated vehicle traffic to and from 

the ISS. Vehicle traffic includes the 

Soyuz flights that bring the new 

crew as well as the cargo resupply 

missions. Further, the Increment 

Overview provides estimates of crew 

time for research utilization. For 

example, the crew might have an 

expected amount of 30 to 40 crew 

hours available in one week for 

experiments, whereas another week 

might contain a spacewalk and may 

only have 5 to 10 hours available. 

The OOS as shown in Figure 2 is 

a high-level plan, organized by 

day, spanning the entire increment 

that addresses crew time usage and 

indicates other major operations 

(e.g., visiting vehicle arrivals/

departures, EVAs, significant noncrew operations, etc.). The intent 
6 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

of the OOS is to provide an initial 

implementation of the increment 

requirements, as identified in the 

IDRD, GGR&C, and program 

directives, and establish the feasibility 

of satisfying the science commitments 

for the increment. Conversely, the 

OOS also serves to point out “hot 

spot” areas during the increment 

where crew time availability will be 

constrained or where other operations 

may not be possible to execute unless 

priorities are adjusted, often through 

detailed negotiation with the partners. 

Specifically, the OOS contains the 

following information: Greenwich 

Mean Time date, activity, activity 

location, comments, Russian ground 

site on-range times, solar beta angle 

(see Chapter 7), and increment day. 

Figure 1. Increment Overviews from the first expedition (top) and one from Expedition 41/42, 15 years later (bottom). In the top figure, the dates are placed 

across the top. Major vehicle attitude is listed, such as X-Perpendicular Out of Plane (XPOP) and local vertical/local horizontal (LVLH) as well as beta angle (see 

Chapter 7). Major activities such as a Soyuz launch are also shown below on the given date. Activities tend to be high level—Service Module (SM) outfitting, 

laboratory checkout (Lab C/O), and EVA preparation. In the bottom image, the data are essentially the same, though neither beta angle nor attitude are listed since 

the ISS now generally flies the same attitude.
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 7

It does not contain the specific time 

in which an activity is scheduled on 

the given day. 

The OOS is developed over 

the course of several months, 

culminating in a final version that 

the IEPT members and ISS Program 

management review and approve 

at I-1 months. Planning takes into 

account resource availabilities 

(primarily crew time and, on 

occasion, power, etc.), trajectory 

data (i.e., solar beta angle, Russian 

ground site availability), and other 

defined constraints. Upon approval, 

the final OOS shows the plan for 

accomplishing increment objectives 

along with a detailed activity 

database. It should be noted that 

mission planners use the results from 

the development of the Increment 

Overview and the Final OOS for 

updating and developing the IDRD. 

This ensures the requirements going 

into the increment execution phase 

are aligned with the feasibility of 

implementing these requirements.

Execute planning describes the phase 

of operations from publication of 

the Final OOS through the end of 

the increment. Execute planning 

deals with development of plans 

for execution by crew and ground 

control teams based on the OOS 

(Figure 2). The long-range planning 

(LRP) team develops these execution 

planning products. The OPS PLAN 

team is responsible for executing 

and replanning while on console in 

the Mission Control Center (MCC) 

in Houston. Both teams require 

significant interfaces with disciplines 

that are both internal and external to 

Johnson Space Center to generate 

and execute effective ISS plans.

Figure 2. Several weeks of the OOS from Increment 43, which was the first 1-year increment to the ISS beginning in March 2015. Activities and their 

durations are color coded to indicate the major category in which they belong (e.g., vehicle operations, EVA, scientific research), thus facilitating crew 

resource analysis and optimization. The operations planning team, international partners, and ISS Program office analyze the distribution and allocation 

of crew time in the OOS time frame prior to execution, primarily to assess the feasibility of IDRD requirements implementation. Task color coding persists 

through all phases of flight (pre-increment, in-flight, and post-execution reports are analyzed) so that the teams can measure progress and apply appropriate 

lessons learned to future planning cycles. 

The LRP team generates WLPs and 

STPs using the OOS, ISS Program 

directives, current vehicle operations 

status, and unique operations 

constraints. The OPS PLAN team 

takes these timelines and generates 

executable plans, or versions of the 

STP, that the crew and ground teams 

will use to perform daily ISS tasks. 

The OSTP is the new “executable” 

version of the STP that is used by 

the crew and ground teams. At this 

point, activities are detailed enough 

that specific procedure steps, stowage 

items, and key notes directing the 

crew in how to perform the task 

have already been established. The 

OPS PLAN team further prepares 

supplementary materials (i.e., Daily 

Execute Package) to aide in daily plan 
8 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

execution. This package includes data 

such as the current state of the ISS 

(e.g., which computers are configured 

as primary, safe angles to park the 

solar arrays in the event of a loss of 

attitude control [see Chapters 5 and 7, 

respectively]), questions for the crew 

from the previous day’s operations, 

answers to crew questions from the 

previous day, summaries of key 

operations for that day, and a list of 

the key flight control personnel from 

the various ISS control centers. Any 

changes to the plans are coordinated 

with the LRP team and are reflected 

in updates to the WLPs, STPs, and 

OSTPs. The overall WLP, STP, 

and OSTP development timeline is 

depicted in Figure 3.

OOS

WLP

STP

OSTP OSTP

Development 

Plans

Execution 

Plans

Ground Onboard

Figure 3. Plan 

Development Flow 

showing how the 

OOS feeds into 

ever-more-detailed 

products such 

as the WLP, STP, 

and OSTP.

Figure 4. WLP—list by day of crew operations and other major objectives for 1 week of ISS operations. Activity durations are listed under the crew member 

who will be performing the activity, but the specific time during the day is not yet defined. All activities are given standard reference codes that the crew and 

flight controllers understand. For example, EVA-PROC-CONF means the EVA team will have a procedure review conference with the crew on Thursday, though 

the specific time is not yet scheduled. Russian activities are shown in Cyrillic. As with the OOS, activities and their durations are color coded to indicate 

to which major category they belong (e.g., vehicle operations, EVA, scientific research). In the WLP phase, the team’s analysis of crew resource allocation 

focuses more on optimization and measuring progress, and serves as a tool for navigating planning “tradespace.” For example, if an unplanned EVA is 

required to repair a pump module that has failed, the team must quickly understand how many hours are needed to perform a spacewalk as well as the 

hours of scientific research, periodic maintenance, or cargo transfer that must be rescheduled to make room for the contingency EVA.
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 9

Figure 5. The development cycle of the STP and OSTP generation cycle starting 7 days prior to the Day of Execution (Day of Exe) with each day indicated 

as Execution, or E, minus the day. All Planning Product Change Requests (PPCRs) are due 3 days prior to execution. The final plan is uplinked to the crew the 

day before execution and reviewed during the evening Daily Planning Conference (eDPC) on the planning or orbit 3 (O3) shift.

The beginning of the execution 

plan development process begins 

2 weeks prior to a week of plan 

execution with the development 

of the WLP. The LRP team begins 

WLP development by revisiting 

a particular week from the OOS 

to update the planned information 

based on recent changes encountered 

during the execution of the increment 

since the OOS was published. 

Figure 4 shows the WLP plan, which 

has a detailed list of crew activities 

assigned to each crew member for 

each day of a particular week in 

the increment, in addition to any 

significant non-crew operations on 

each day. The operations team or 

payload organization provides the 

crew time requirements for each crew 

activity planned and summarizes to 

ensure compliance with GGR&C 

crew time constraints (e.g., 6.5 hours 

of schedulable crew time each crew 

workday). The WLP plan looks 

similar to the OOS, but it contains 

the information for only a single 

week of the increment, as can be 

seen in Figure 4. Up to this point 

in the planning process, managers 

have planned and assigned all tasks 

to specific days or weeks of the 

increment, with an emphasis on crew 

time availability. Now, planners look 

at the details of the planned activities 

and begin the process of creating a 

timeline or schedule of events. Other 

constraints and resources, such as 

communications coverage, equipment 

use, day/night cycles, data bandwidth 

availability, etc., are considered at 

this phase of the planning process, 

in addition to crew time constraints. 

Details of unique activity constraints 

are contained in an activity database 

maintained by the planners as well 

as in a Gr&C document created by 

the international planning team at the 

start of the increment. For example, 

it might be the case that astronauts 

cannot eat or perform certain types 

of exercise within a certain amount 

of time prior to a medical procedure, 

such as a blood draw. Operations 

that were not completed earlier in 

the increment due to problems or 

a lack of time may, depending on 

priorities, get pushed to a later week. 

Although the program previously 

baselined the requirements for the 

increment, changes are inevitable. 

During the increment, the ISS 

Mission Management Team (see 

Introduction) approves the updates, 

which the planners also incorporate 

during this time frame. Once 

drafted and before implementation, 

the IEPT, flight controllers, and 

program managers conduct a final 

review to ensure everything fits 

within the requirements and needs 

of the program, as well as within the 

capability of the crew, ground team, 

and vehicle. This level of attention to 

detail is required since crew time is 

extremely precious and any wasted 

time can impact the success of the 

program goals. The Final WLP then 

serves as a type of contract between 

the flight team and the ISS Program 

regarding what will happen for that 

particular week.

The STP is a timeline derived directly 

from the WLP and consists of all 

activities to be performed on the ISS 

for a particular day. Figure 5 shows 

the development timeline for an STP 

covering 1 day of ISS operations 

to take place 7 days in the future. 

As mentioned, an STP is created 

(following the template outlined in 

Figure 5) for each day represented in 

the Final WLP. The STP is presented 

as a graphical timeline of crew and 

ground activities for a particular 

day (Figure 6) to be used as an 

output from a common planning 

system shared by all ISS planning 

communities. The format includes 

horizontal bands for individual 

crew member activities, trajectory 

information (day/night, Tracking Data 

Relay Satellites for communications 

coverage, Russian Ground Sites, 

Daily Orbit Number, spacecraft 

attitude), systems and payload 

commanding, automated systems 

and payload operations, and ground 
10 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

coordination activities. The STP is the 

baseline plan, and it takes precedence 

over the Final WLP for operations on 

that particular day. The STP is also 

loaded into a computer-based viewing 

application, the Operations Planning 

TIMeline Integration System 

(OPTIMIS), to enable easy review 

by flight controllers in all control 

centers as well as initial review by 

the ISS crew. Ultimately, on the day 

of execution (e.g., Day of Exe in 

Figure 5), the entire ISS operations 

community conducts operations 

from the OSTP—a single integrated 

timeline. Figure 7 shows an OSTP as 

depicted in the OPTIMIS application. 

During execution day, crew members 

provide an ongoing status of activity 

execution using the OSTP. Flight 

control team members provide the 

crew with an ongoing status of 

ground or on-board systems activity 

execution using the OSTP. For 

example, the crew will mark a task 

“gray,” which indicates it has been 

completed. These statuses by crew 

and ground teams are exchanged and 

synchronized to allow all plan users 

to follow the execution status on the 

ground. The Russians additionally 

communicate a subset of the official 

OSTP plan to the Russian crew 

members using a document called 

Form 24, which is essentially a text 

summary of the day’s events.

Figure 6. Graphic depiction of the STP timeline generated from the WLP for a particular day of the week. The top bands show when S-band or Ku 

communications coverage is available, when the day/night cycles occur, the station attitude, and even the configuration of the planned telemetry link to the 

ground. Crew member activities (e.g., CDR for Commander or FE1 for Flight Engineer 1), shown near the top, detail their specific activities. Other display 

bands indicate which activities are using the S- or Ku-band systems, and required coordination with the MCC or, in this example, what the Columbus (COL) 

flight control team members are doing.
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 11

Figure 7. OSTP timeline of crew and ground commanding used by all control centers for daily ISS operations. This looks similar to the STP in Figure 6, 

but here it is viewed in the crew’s OPTIMIS. The dashed red line indicates the current time. A pop-up in the center provides additional detail on a specific 

activity under the cursor.

Plan Configuration 

Management

Early discussions with all the 

international partners during the 

formative phases of ISS operations 

development determined that the 

distributed nature of ISS operations, 

coupled with the fundamental tenant 

of a single integrated plan, required 

a rigorous configuration control 

process. Without this configuration 

control, the various control centers 

and the crew could end up working 

from old or different schedules. 

Keeping track of all the changes input 

through the WLP, STP, and OSTP 

development cycles is a daunting 

task. Rigorous control of changes 

and inputs must be maintained as 

the planners strive to produce, daily, 

a single integrated plan from which 

all ISS operations teams execute. 

The on-console flight control teams 

around the world document any 

modifications to the timeline from 

the Final STP in a Planning Product 

Change Request (PPCR). A webbased tool is used to generate, review, 

and implement the PPCRs. 

Figure 8 shows the PPCR tool 

summary interface. Each change 

request is assigned a tracking number 

based on the increment (i.e., 43-0541 

is the 541st change request during 

Increment 43) and indicates the 

title of the request, the flight control 

discipline authoring the request, the 

status of the request (e.g., Open, 

Implemented, or Withdrawn) along 

with an approval status matrix for 

the ISS control center participants. A 

PPCR is used to document changes 

to existing approved planning 

products. These changes include 

modifications or additions to a plan 

or changes to any details (e.g., start 

time, duration, procedure reference, 

execution notes, etc.) for an activity 

timeline. Specifically, PPCRs are 

generated to request or document 

changes from a Final WLP while 

in STP development, or to request 

changes to a Final STP. Changes 

affecting only a single partner require 

approval by the issuing partner and 

are provided to the other planning 

partners as “information only.” This 

allows each partner flexibility in 

planning without slowing the process. 

Other updates affecting crew time or 

integrated vehicle operations require 

approval by all international partners. 

For example, the Russian flight 

control team might need to adjust the 
12 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

time during which a cosmonaut is to 

exercise on one of the pieces of shared 

exercise equipment. However, before 

the change can be implemented, the 

planners will verify that a US crew 

member is not already scheduled at 

that time or doing maintenance in that 

area. Changes are not accepted into 

planning products without a PPCR. 

The PPCR form includes specific 

information regarding the change 

description, rationale, source (e.g., an 

error in the information or a piece of 

equipment that is broken), resource 

requirements (e.g., power), scheduling 

constraints, and initiator. The LRP 

or OPS PLAN team assesses the 

feasibility or impact of implementing 

the change and provides feedback to 

the initiator as part of the approval 

process. For example, a flight control 

team or partner may want to add an 

activity to a crew member’s timeline, 

but the OPS PLAN team may find it 

would exceed the astronauts’ allowed 

workday length. The flight director 

at each control center grants final 

approval. Once a PPCR is approved 

for implementation, the LRP or 

OPS PLAN team, as applicable, 

implements the changes in the 

appropriate plan. The LRP and OPS 

PLAN teams routinely interface with 

the various elements of the MCC 

flight control team to solicit plan 

inputs, verify procedure references, 

Figure 8. A snapshot of the PPCR tool summary interface. The tool Web page assigns a tracking number in the left column (increment number followed 

by an incremental number of each PPCR), the title of the request, the discipline that submitted the request, and the current status of the request (Open, 

Implemented, or Withdrawn). The six columns to the right are labeled for each control center around the world. A PPCR may be indicated as Information 

Only (IO) in that it doesn’t affect another partner’s activities but may be something the partner might want to know is occurring. Alternatively, a yellow 

In Review (IR) means the partners must evaluate and agree or disagree on its implementation. Once the control center agrees, the line item is marked as 

a green Approved (A).
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 13

and coordinate replanning. This 

process continues around the clock, 

7 days a week; tweaks to the schedule, 

whether small or large, occur on a 

daily basis.

The real-time OPS PLAN team is 

also responsible for reviewing and 

approving all messages to be uplinked 

daily for the crew’s Daily Execute 

Package. A significant part of the 

package is a Daily Summary. As 

the name implies, this part provides 

a high-level summary of notable 

activities and constraints (e.g., “The 

thruster will be fired at a specific time 

today, so ensure the window shutters 

are closed to prevent contamination.”) 

as well as follow-up questions to the 

crew (e.g., “Last week, a piece of 

hardware was reported broken. Can 

you please provide the serial number 

of the item?”) or answers to questions 

the crew had asked (e.g., “Can I move 

my exercise on Wednesday to later 

in the day?”). These messages also 

include procedure updates, activity 

overviews (e.g., a big-picture plan 

for an upcoming spacewalk), or 

system data. This is the final product 

generated by the planning team in 

preparation for plan execution.

Changes to the plan that occur 

during the day of plan execution, 

due to anomalies encountered or for 

a variety of other reasons, are fed 

back into the planning process by the 

planners. Constraints for completing 

activities or urgency to implement 

new activities in response to system 

failures (e.g., exercise equipment 

breakage, toilet troubles, laptop 

failures, computer network problems, 

etc.) dictate how quickly plan changes 

need to be implemented. Again, the 

PPCR system is used to document 

these plan changes and work them 

into future plans. 

Scheduling Challenges 

During ISS operations, planners 

routinely grapple with a number of 

scheduling problems. For example, 

scheduling activities that need 

communications satellite coverage, 

managing resources and temporal 

relationships (e.g., Activity B must 

occur no earlier than 30 minutes after 

the end of Activity A), scheduling 

activities for globally distributed 

users, handling uncertainty in task 

duration, and wrestling with onboard stowage and worksite issues. 

Mission planners and crews continue 

to evolve the understanding of types 

of information the crews need and 

how to more effectively tie crews 

into the planning process during 

increment execution.

Communication relay satellite 

scheduling can be especially 

challenging, given the complex nature 

of communications requirements, 

the competition for services with 

other users (e.g., the Hubble Space 

Telescope, the Department of 

Defense), and the uncertainties in 

coverage quality with variances in 

vehicle attitude. Science payloads, 

major events such as visiting 

vehicles dockings and undockings, 

spacewalks, and video events 

intended for the public generally all 

require using NASA’s Tracking and 

Data Relay Satellite (TDRS) (Kuband for video and high-rate data 

transmission; S-band for voice and 

health and status telemetry. See also 

Chapter 13). The ISS planners make 

requests of TDRS services weeks in 

advance in competition with other 

TDRS users. Even uncertainties in 

vehicle attitude, which affects the 

ability of the radio antennae on the 

ISS to have the required direct line 

of sight to the TDRS, and where the 

solar arrays might be in their constant 

motion that sometimes can block the 

signal, may render a communication 

pass unusable. These factors make 

it difficult for planners to commit to 

specific times more than 1 week in 

advance for ISS TDRS service needs. 

Late changes may result in a lack of 

available TDRS time since service is 

scheduled on a first come, first served 

basis. If the ISS Program suddenly 

needs TDRS coverage—such as for 

an emergency spacewalk—the NASA 

flight director can declare the TDRS 

time as critical, thereby forcing 

other users off the network. Due to 

the impacts to other uses, which can 

include loss of science, this is not 

done unless absolutely required. 

Scheduling use of the exercise 

equipment is one of the bigger 

challenges in daily planning. Three 

main exercise devices are located 

on the USOS part of the ISS. These 

devices include Treadmill 2, a CycleErgometer with Vibration Isolation 

System, and the Advanced Resistive 

Exercise Device. Crew members are 

required to exercise a minimum of 

2.5 hours per workday and follow 

strict exercise programs created by 

the medical team. Additionally, crew 

members often have preferences 

as to when they would like to 

exercise. Some crew members prefer 

to complete their exercise in the 

morning, others prefer to spread it 

throughout the day, and some like to 

perform their exercises in a particular 

order (e.g., aerobic followed by 

resistive). All six crew members must 

use the Advanced Resistive Exercise 

Device, thus compounding the 

planning. When a piece of exercise 

equipment breaks, a great deal of 

replanning is usually required until 

the equipment is repaired. 
14 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

Planners also contend with sequences 

of activities where each activity 

requires the preceding one to be 

completed, sometimes with additional 

time between end and start. For 

example, the repair of a piece of 

equipment might require the ground 

control team to power the device off 

for a few hours before the astronaut 

performs the repair so that the device 

will cool down enough to be handled. 

Even gathering the tools for the repair 

has to be taken into account since, 

as with everything in microgravity, 

activities take longer than they do 

on Earth. The astronaut also must 

ensure that another crew member 

is not using the one item needed 

for the repair. Also, since every bit 

of available space is used to stow 

equipment or supplies, the equipment 

that needs to be repaired could be 

situated behind another object, which 

would need to be temporarily moved 

to another area. A simple repair 

can be tough to schedule with the 

addition of more temporal constraints 

such as the crew members’ desire to 

eat their meals together, which can 

be critical for psychological support 

when away from home and their 

usual routine for so long. 

Crew time is another limited resource 

that his highly constrained. Ground 

rules and constraints limit overall 

scheduled crew time per day to 

6.5 hours, with the remaining days’ 

time comprised of exercise (see 

above), sleep, morning and evening 

preparation (i.e., time to review the 

current or next day’s plan, review 

procedures to be used, etc.), and 

midday meal time. Further, the 

6.5-hour scheduled time is bounded 

by being allowed only after the 

morning crew/ground planning 

conference and needing to conclude 

by the start of the evening crew/

ground planning conference. The 

goal of managing crew time is to 

provide as much time as is practical 

for science scheduling. Science 

planners also contend with other 

limited resources such as batteries for 

small handheld devices, consumable 

gases (e.g., argon, nitrogen), water, 

test tubes, sample bags, test strips, 

etc., thereby further complicating 

the scheduling problem. Finally, 

planners must manage constraints 

imposed or required by the external 

environment such as day/night cycle 

requirements, attitude constraints, 

microgravity requirements, and 

satellite communications availability. 

Planners at the various ISS operations 

control centers manage many of their 

own resources as well as the use of 

common resources such as crew time, 

power, air, other gases (previously 

mentioned), tools, etc. To accomplish 

this, the planning teams use complex 

scheduling software to define and 

manage all these constraints and 

resources, and to generate valid 

effective timelines of crew and 

ground operations to support each 

day of ISS operations. Primary to its 

other tasks, the Houston flight control 

team, led by the ISS flight director, is 

responsible for integrating all these 

plans into a single, integrated plan 

that is presented in the OPTIMIS.

Lessons Learned

As previously mentioned, on-orbit 

crew time is at a premium. All efforts 

are made to minimize unnecessary 

use of this limited resource. One 

problem that all planners face is 

accurate prediction of task durations. 

Underestimating task duration leads 

to the replanning of uncompleted 

activities and, in many cases, requires 

crews to work longer hours to avoid 

getting too far behind the general 

plan. Planners usually arrive at task 

duration estimates through ground 

procedure verification and simulation, 

as well as through previous related 

experience, as described above. 

The time is usually increased to the 

predicted duration for new tasks 

or for astronauts executing a task 

for the first time on-orbit. In many 

cases, additional time is scheduled 

for crews to review procedures. A 

good example of this occurred during 

Expedition 1. The crew was asked to 

connect a newly flown control box to 

an on-board laptop to allow manual 

control of the Control Moment Gyros 

heaters (see Chapter 7) that had 

been experiencing extreme thermal 

fluctuations. Ground controllers, at 

the time, had no means to control 

the heaters. Upon reviewing the 

procedures on the ground, planners 

initially determined that 2.5 hours 

would be required for the astronauts 

to review the procedure and execute 

the task. The initial performance by 

the crew took 2.5 hours. However, 

subsequent performance only 

required 1.5 hours because of the 

familiarity gained with the apparatus 

and procedures.

Early planners quickly learned 

the importance of accounting for 

the overhead involved in worksite 

preparation, equipment gathering, 

worksite cleanup, and equipment 

stow. A good example of this 

occurred during Expedition 4. The 

crew was asked to take samples of the 

US Laboratory Low and Moderate 

Temperature Loops (see Chapter 11) 

to check for microbial growth or 

particulate contamination. Ground 

task duration estimates predicted 

about 1 hour of crew time for the 

activity, including gathering the 

equipment. However, upon review 

of the procedure, the crew members 

pointed out that to access the loops, 

they would need to remove two 
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 15

panels on which they had deployed 

and affixed several laptop computers 

and other general support equipment. 

Preparation of the worksite was then 

estimated to add at least 1 to 2 hours 

to the initial task prediction. This 

illustrated, to ground controllers and 

planners, the need to keep crews 

directly involved in the planning 

and replanning process as well as 

keep track of where everything on 

the ISS is located. Accounting for 

this additional overhead is especially 

important when scheduling the 

first couple of weeks of a newly 

arrived crew that is still in the 

adjustment phase. Maintaining a 

thorough inventory database and 

routinely providing time for crews to 

organize the habitat go a long way in 

minimizing the time needed to find 

equipment and organize worksites. 

The increased efficiency gained by 

the crew with time on orbit also helps 

the situation (Figure 9). Repetition 

of task execution, the experience of 

living in space, and the increased 

situation awareness gained by crews 

living and working in the same 

workspace for many months lead 

to efficiency in performing routine 

tasks as well as executing new tasks. 

By the end of an expedition, crew 

members are efficient in knowing 

the time required for task execution. 

Returning crew members (e.g., 

those who flew on the ISS during a 

previous expedition) have a much 

shorter learning or relearning curve to 

achieving peak efficiency.

Arrival Departure

Time On Orbit

1-2 Weeks

Crew Days

Hard Scheduled

Introduction

of Task List

Increased Task

List Content

Crew Efficiency

Figure 9. Crew efficiency with time on orbit. Shortly after arrival, new increment astronauts need time 

to familiarize themselves with the location of items and how to live and work in microgravity. As the 

crew member gains more experience and acclimates, task efficiency increases.

Not only is proper duration estimation

and worksite preparation important 

to the success of the plan, it is very 

important for crew psychology. Early 

in the ISS Program, astronauts often 

exceeded the ground rule for the 

day length. A common complaint 

was poor estimation of task length 

(some of which was understandable 

since almost everything was “new”) 

and not enough time allocated for 

worksite preparation. During this 

early phase, astronauts often felt as if 

they were running a relay race. They 

didn’t want the team to fall behind, 

so they often worked extra hours to 

make up for problems or to perform 

extra science, as discussed above. 

That pace might have been acceptable 

for short-duration shuttle missions, 

which were about 2 weeks long; 

however, in addition to affecting 

sleep and performance, that pace 

can lead to burnout over a 6-month 

increment. The flight directors now 

manage the crew day much more 

carefully. This proved to be critical 

for the success of the yearlong 

increment of Scott Kelly and Mikhail 

Kornienko in 2015–2016. Pacing is 

necessary to maintain focus on the 

critical task of operating the ISS.

Early on, it became evident to both 

the crew members and the planners 

that ISS crews need a bigger-picture 

view of the plan, along with a 

detailed daily timeline, to provide 

a sense of what is coming up and 

where the crew is headed. This helps 

improve success in two ways. First, 

from a psychology point of view, 

the detailed timeline helps crew 

members know how their daily tasks 

fit into the bigger picture and ensures 

that they feel part of the team. 

Second, it helps with efficiency. For 

example, if the crew members put 

tools away for a task but know a 

similar task will be performed the 

next day, they might temporarily 

stow the tools at the future worksite, 

thus saving time down the road. 

To this end, the OPS PLAN team 

developed a monthly calendar 

plan. This plan view is regularly 

updated, and is used as a basis for 

the Weekly Planning Conferences—

i.e., a dedicated time each week 

where the OPS PLAN team for the 

increment discusses the upcoming 

week’s plan with the crew over the 

space-to-ground voice loops. Now, 

crew members are more frequently 
16 CHAPTER 1 SYSTEMS: INTERNATIONAL SPACE STATION PL ANNING—A ROADMAP TO GE T TING IT ALL DONE 

tied into replanning discussions to 

obtain the benefit of their situational 

awareness and experience. They are 

involved in the planning, even at 

the OOS stage. During increment 

execution, crew and ground operators 

conduct daily planning conferences. 

The morning conference focuses on 

describing unique supplementary 

information for that day’s schedule, 

whereas the evening conference 

concentrates on reviewing that day’s 

accomplishments and reviewing the 

next day’s detailed plan. 

An additional lesson learned from 

the Mir, Skylab, and early ISS flight 

planning experiences was that crew 

flexibility can lead to increased crew 

productivity. Crew timelines today 

include many activities marked as 

“flexible,” allowing crew members 

to perform them whenever they want 

during the day. These activities have 

no constraints (e.g., a strict deadline, 

or when resources such as power are 

needed). Allowing crew members 

to perform many of their routine 

activities such as exercise, the midday 

meal, and on-board training modules 

when it makes the most sense for 

them enhances productivity (e.g., 

multitasking). In addition, some 

astronauts—especially those who 

have flown to the ISS previously—

may be more efficient in completing 

tasks than have been estimated by the 

ground for a “typical” crew member. 

Original ISS planning, which was 

based on Space Shuttle planning 

heritage, consisted of hard scheduled 

plans for the crew each day. These 

activities were to be performed in a 

linear fashion at prescribed times, 

thus leaving no option for flexibility 

based on crew situational awareness 

or multitasking. Derived from both 

Skylab and Mir, the notion of a 

“job jar” or “task list” of additional 

unconstrained activities folded into 

ISS operations planning. A task list 

activity is something that needs to 

be done at some point, but which 

doesn’t make it into the estimated 

time on a given day or week. If the 

astronauts get ahead on the timeline, 

which happens if the planning is 

done well and/or crew members are 

highly experienced, they may have a 

few minutes to complete one of these 

activities. Today, daily crew plans 

are highly populated with flexible 

activities and contain a robust task 

list. This shift in planning philosophy 

from more-optimized plans to moreflexible plans leads to more crew 

autonomy. Crew autonomy is seen as 

necessary for further crew exploration 

beyond low-Earth orbit or to Mars, 

where astronauts will be exposed to 

significant time delays and will thus 

be required to manage their plans 

and vehicle more autonomously from 

ground teams. The ISS has also seen 

an increase in crew productivity and 

efficiency with the expanded use of 

flexibility and task lists. 

The arrival of new crews to the 

ISS creates an opportunity for an 

operational dichotomy where new 

crew members, who are adjusting 

to life in space in an unfamiliar 

environment, are matched with a 

veteran ground team that operates at 

a high level of efficiency. To prevent 

this dichotomy, a throttling-back 

effect is imposed on the ground 

team while, at the same time, 

providing time for the on-board 

crew to acclimate. Through Gr&Cs, 

schedulable crew time during the 

first 2 weeks on orbit is reduced 

to permit time for adjustment and 

settling in. This allows the crew 

and ground to jointly arrive at an 

operations pace for the increment. 

This process is repeated with the 

start of each increment. However, 

considerations for particular crew 

complements to account for crew 

experience are made to increase ISS 

science returns. For example, the day 

after Peggy Whitson arrived for her 

second stay on the ISS, she called the 

ground team to report completion of 

all activities on her timeline as well 

as everything on the task list, and 

that she would appreciate additional 

tasks. Another complication is that 

the ground controllers, who work 

on weekly shifts, are not tied to 

specific crew arrivals and departures. 

As such, those ground controllers 

will achieve a level of efficiency 

independent from ISS crews. Lead 

flight controllers from every system 

are assigned to each increment to 

help mitigate this problem. Their task 

is to ensure uniformity from week to 

week for a given crew.

Over time, the flight controllers and 

crew members have learned that 

staying synchronized is crucial, 

yet doing so non-intrusively is key. 

Asking a crew member repeatedly 

whether a task is done can get 

annoying. The OPTIMIS tool was 

modified to allow the crew to add 

crew notes (i.e., brief messages to 

the ground) in each activity, which 

will provide additional information 

about the execution of a particular 

activity (e.g., stowage information 

after completing a task, equipmentidentifying information such as 

serial numbers or barcode numbers, 

or comments about the execution 

of an activity—how long it really 

took, procedure issues encountered, 

etc.). The flight controllers and 

crew found that this nonverbal 

means of communicating certain 

information, as mentioned above, 

is highly effective and frees up the 
SYSTEMS: INTERNATIONAL SPACE STATION PLANNING—A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 17

space-to-ground channels for more 

important conversations.

Following the conclusion of an 

increment/expedition, mission 

planners, through the Lead Ops 

Planner, work with the ISS 

Program operations team to 

reflect overall increment metrics 

of accomplishments in the Post 

Increment Evaluation Report. 

Additionally, the lead increment flight 

director conducts a lessons-learned 

meeting to roll up significant topics 

that need to be either generically 

addressed for all future increments 

or unique items that need to be fed 

into the next increment’s execution 

team. In many cases, planners provide 

lessons learned on activity duration 

estimations (based on crew feedback) 

as well as lessons learned on activity 

planning conflict resolution. The 

aim is to keep the ISS safe for crew 

operations while continuing to make 

operations more efficient to support 

the goal of greater scientific gains.

Conclusion

Flight planning has been a necessary 

yet ultimately challenging task since 

the beginning of the space program. 

Each mission that NASA performed 

brought its own unique planning 

and scheduling challenges, which 

were met by planners using the latest 

technology of the day. Planners 

continue to meet these with a credo 

of flexibility and a constant eye 

toward improvement. Unlike other 

NASA projects, the ISS Program 

involves a worldwide team working 

24/7/365. Plans for every activity 

that takes place on the ISS start years 

out and are continuously refined in 

detail as the actual time approaches. 

This ensures maximum success and 

minimal wasted time. Planning was 

difficult during assembly of the ISS 

due to constant changes. Some of 

these changes were necessary to 

the evolving vehicle, whereas some 

were induced by the Space Shuttle 

Columbia accident and concentrated 

on the vehicle build-up. In 2009, the 

ISS increased from three permanent 

crew members to six, and began 

the shift in focus from assembly to 

science. Starting in 2018, commercial 

crew vehicles will add further 

complexity as the rate of scientific 

operations increases with a permanent 

crew of seven.

Chapter 2 Day in the Life:

Living and Working 

in Space and 

on the Ground
20 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

The first six-person crew—Increment 20 in 2009—included astronauts and cosmonauts from all international partner agencies for the first (and, so far, 

the only) time. From left: Canadian Bob Thirsk, European Frank De Winne, Russian Gennady Padalka, Russian Roman Romanenko, Japanese Koichi Wakata, 

and American Michael Barratt.

The International Space Station 

(ISS) is a hub of never-ending 

activity, around the clock, around 

the world, every day. On board 

the orbiting laboratory, the crew 

members are not only the laboratory 

technicians, they also keep the facility 

up and running by working as janitors, 

plumbers, electricians, information 

technology support, medics, kitchen 

crew, and housekeeping. They manage 

the arrival of vehicles delivering 

new crew, new equipment, and 

additional supplies, as well as the 

departure of vehicles returning crew 

and equipment to Earth or disposing 

of trash. They are responsible for 

completing any necessary repairs or 

reconfiguration that cannot be done 

by simply changing parameters in 

software. On the ground, the flight 

control teams—both on console and 

off—support the increment as a whole 

by working between control centers 

and management teams around the 

globe to keep the crew safe, keep 

the ISS running smoothly, and meet 

all mission objectives. Together, the 

on-board crew and the ground teams 

respond to problems, incorporate new 

priorities, and adapt the mission plan 

as conditions change—sometimes on 

a daily basis.

Crew rotation flights are currently 

done using Soyuz vehicles, 

launched by the Russian Space 

Agency Roscosmos from Baikonur, 

Kazakhstan. A Soyuz can fly up to 

three crew members, and can stay on 

orbit and docked to the ISS for about 

6 months, where it is available as a 

“lifeboat” to return the crew to Earth 

in the event of an emergency. Four 

Soyuz crews have been flown each 

year since 2009, maintaining a total 

crew of six people on board the ISS 

most of the time. Prior to 2009, the 

ISS had a permanent crew of three 

people, with two Soyuz launches 

per year. The launches take place 

approximately every 2-4 months. 

Usually, flights are arranged in a 

pattern of “indirect handovers”: one 

Soyuz will undock just before launch 

of the next, so the crew goes from six 

people on board down to three, and 

back up to six when the next Soyuz 
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 21

arrives. The pattern of launches and 

the number of crew members on 

board at any time will change when 

the new commercial crew vehicles 

being built by the United States are 

ready to rotate crews around 2019 

(see Chapter 14).

ISS operations are managed in periods 

called increments, which are defined 

by the on-board crew complement: 

an increment is the period of time in 

which a dedicated crew of astronauts 

and cosmonauts are on board the ISS 

under a specific commander. Each 

new increment begins when one 

commander hands over to another 

before departing the ISS. Before 2009, 

each increment lasted approximately 

6 months – the full duration of each 

Soyuz crew’s stay on orbit. Today, 

each increment corresponds to the 

period of overlap between two Soyuz 

crews, so each increment lasts about 

2-4 months, and each ISS crew 

member serves on two increments. 

As discussed in Chapter 1, 

preparation for flight begins years 

in advance. A team of flight 

controllers is assigned to manage 

the increment. Depending on each 

discipline’s involvement in crew 

training and mission planning, flight 

controller assignment may happen 

a year or two before the increment 

begins. A lead flight director is 

assigned to manage this team and 

lead the overall operational mission 

integration and preparation. The flight 

control team follows the six crew 

members through their final training 

as they transition from generic skills 

to lessons more closely tailored to the 

specific tasks and research that will 

be performed during their time on 

orbit. The two different Soyuz crews 

will launch 2 to 4 months apart, 

and each will be part of two 

increments. Therefore, each crew 

may work with two different lead 

flight directors and teams during its 

time on board the ISS.

This chapter describes how the team 

of flight controllers in Houston, 

Texas, their international partner 

counterparts around the world, 

and the ISS Program, engineering, 

safety, and medical support teams 

work together to manage day-to-day 

operations of the most complicated 

international laboratory ever built.

Before the Crew Reaches 

Space

Mission integration and preparation 

is organized through a Joint 

Operations Panel (JOP), chaired 

by the increment lead flight 

director. All of the assigned flight 

controllers, instructors, ISS Program 

representatives, engineering and 

safety team members, along with 

partner teams supporting payload 

operations and international partner 

teams are members of the JOP. This 

team will review new operations, 

priority adjustments or requests from 

ISS Program management, new 

candidates for complex tasks such as 

extravehicular activities (EVAs) or 

vehicle relocations from one docking 

port to another, and new data on ISS 

systems performance.

The team also reviews any significant 

changes being made to crew training 

and, in some cases, participates 

in the actual training events. For 

example, each crew of six holds one 

emergency scenarios training event 

during a time when both sets of three 

crew members are in Houston. The 

lead flight director, along with his or 

her lead training team, will observe 

the event (Figure 1).

Figure 1. Expedition 49 astronauts and cosmonauts discuss an emergency scenario exercise with 

the training team and the lead flight director. From left to right: Andrei Borisenko, Interpreter Ksenia 

Shelkova, Sergey Ryzhikov, Shane Kimbrough, instructors Amy Holloway-Margiolos (standing), Bobby 

Fard, and Elisca Hicks, and Flight Director Amit Kshatriya (standing). 

The flight director and flight 

controllers assigned to lead that 

activity might also observe other 

significant training events, such as 

EVA training in the Neutral Buoyancy 

Laboratory or rendezvous training on 

the simulator for visiting vehicles. 

Flight control team members take 
22 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

every opportunity to make sure 

they understand the crew members’ 

perspective and how they work 

together in complex operations and 

critical scenarios.

In the month leading up to the 

beginning of the increment, the 

various teams within NASA and at the 

international partner agencies conduct 

a series of Flight Readiness Reviews, 

culminating with a final review led by 

NASA Associate Administrator for 

Human Exploration and Operations 

William Gerstenmaier. At this review, 

the ISS Program and all supporting 

teams confirm readiness for the 

beginning of the new increment, the 

landing of the Soyuz with the current 

ISS commander and crew, and the 

launch of the next Soyuz.

Three weeks before the increment 

begins, the real-time process “kicks 

in” for mission planning. At this 

point, the increment team starts to 

participate in day-to-day planning 

and integration in Mission Control. 

About 1 week before launch, most of 

the planning process is being done for 

the new increment. By the time the 

new ISS commander has taken charge 

on board, the increment lead flight 

director and his or her team is well 

and truly installed in Mission Control.

Synchronizing All Watches

“Morning,” to the crew, has nothing to do with sunrise. The ISS orbits the 

Earth once every 90 minutes, thus the crew sees the sun rise and set every 

hour and a half—that’s 15 or 16 times each day. Instead, a common time 

zone needed to be selected so that the crew—and all of the teams on 

Earth—are on the same clock. The ISS Program picked Greenwich Mean 

Time (GMT), also known as Coordinated Universal Time (UTC) or “Zulu” 

time. The crew gets up at about 0600 GMT, starts work around 0800, 

ends the workday at about 1700 GMT, and goes to bed at 2130 GMT. 

This means the crew’s workday most closely lines up with the Columbus 

Control Center workday in Munich, with Moscow just a couple hours 

ahead. For the Kibo team in Tsukuba, the crew’s workday begins in late 

afternoon, while for Houston and Huntsville, crew members wake up in 

the middle of the ground controller’s night. Although flight control teams 

are on console in all those locations, 24 hours every day, the teams tend 

to plan complex or intensive activities to line up, as much as possible, 

with local working hours. This applies especially when it comes to major 

systems maintenance or assembly of new equipment—i.e., activities that 

might need extra support from specialist engineering or support teams. 

Thus, major Kibo, Columbus, and Russian Segment systems work tends 

to be scheduled in the crew morning, while NASA tends to schedule major 

work on its systems, or in its modules, later in the crew day. Science 

activities and related support work are scheduled throughout the day for 

investigative teams around the world.

A Day in Space—and on 

the Ground

At about 7:30 a.m. (0730 Greenwich 

Mean Time [GMT]), flight control 

teams in Houston, Huntsville, 

Munich, Tsukuba, and Moscow 

wait for the ISS commander to make 

the call that marks the official start 

of the workday for the crew on 

board the ISS:

“Houston, Station—good morning! 

We are ready for the morning DPC.”

Each morning’s Daily Planning 

Conference (DPC) gives the flight 

control teams a chance to ask 

questions and provide any latebreaking news or updates to the plan 

for the day. Houston starts things 

off with general items and anything 

related to core US Segment systems. 

If needed, the other four United 

States On-orbit Segment (USOS) 

centers take their turns: Huntsville for 

the NASA experiments and related 

systems; Munich for the Columbus 

module and European Space Agency 

experiments; and Tsukuba for the 

Kibo module and Japan Aerospace 

Exploration Agency experiments. All 

of these conversations are in English. 

Once the USOS operations have 

been covered, it is Moscow’s turn to 

address anything related to Russian 

Segment systems and experiment 

operations. This part of the 

conference is in Russian. The whole 

morning DPC may take anywhere 

from 2 to 15 minutes, depending on 

the complexity of that day’s plan.

By the time this conference takes 

place, the crew members have been 

awake for about 1.5 hours. That 

early morning time is set aside for 

their normal waking-up routines, 

creatively labeled “post sleep” on 

the crew’s timeline. They also look 

at the ISS version of the morning 

news: a message sent up every 

workday and once per weekend 

called the Daily Summary, which 

is used to ask/answer questions and 

provide key pieces of data that might 

be too detailed or too repetitive to 
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 23

talk through in the morning DPC. 

On some mornings, crew members 

are also busy with life sciences 

and medical data collection—e.g., 

drawing blood samples, etc.—in 

which case some post-sleep time is 

blocked for them after DPC to make 

up for their early activities.

Once the DPC is complete, the 

crew day begins. A video camera is 

turned on, and is usually in the US 

Laboratory module, Destiny, which 

is generally a thoroughfare for most 

of the crew. If science or other work 

is planned in other modules, cameras 

will be used in those places, as well. 

The ability to see the crew members, 

sometimes looking “over their 

shoulder” to follow their activities, 

helps the team on the ground 

understand the situation on board, 

anticipate questions, and turn around 

answers more effectively (Figure 2). 

But the video is treated with special 

care. After all, the ISS is not just 

a laboratory: it is where the crew 

members live. Cameras are not used 

outside their scheduled working week, 

or in areas where a private activity 

such as a family conference, medical 

checkup, or exercise is taking place.

Figure 2. Flight Engineer Kjell Lindgren is photographed in the US Laboratory as he prepares one of the lockers for installation of the Common 

Communications for Visiting Vehicle hardware that will be used by the new commercial crew vehicles (Chapter 14).

Morning DPC occurs around

1:30 a.m. in Houston—basically 

in the middle of the night for the 

flight controllers. Mission Control 

is quiet at this hour. Usually, only 

the flight director, core systems 

team, and any specialists needed to 

support the crew’s morning activities 

are on console. On a good day, 

the increment team is at home and 

asleep. As the increment team starts 

to wake up in Houston—around 

the crew’s lunchtime—they start 

checking in with the real-time team 

to see how things are going. Unless 

they got called in overnight for a 

problem, or came in early to watch 

a particular activity, the increment 

lead flight controllers will start by 

reading their discipline’s console 

logs from the past few shifts. This 

tells them what has happened in their 

system, maybe what agreements have 

been reached with their international 

partner counterparts, or what 

questions have come up from the 

crew or other team members. Some 

mornings, everything checks out as 

expected. However, most of the time, 

something unexpected is documented 

in the logs or on the crew’s timeline, 

which means the flight controller’s 

first order of business will be to 

figure out what went wrong, or what 

needs to be replanned. 

The increment lead flight director also 

hits the ground running by reading 

the console logs. He or she checks 
24 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

in with other team members and ISS 

organizations as appropriate, given 

that day’s activities (Figure 3). Then 

the meetings begin, sometimes as 

early as 6:00 a.m., Houston time. 

The ISS Mission Management 

Team (IMMT) meets twice a 

week. The IMMT is chaired by 

by the ISS Operations Integration 

Manager Kenneth Todd and includes 

representatives from each of the 

international partner agencies, and 

from all offices within NASA’s ISS 

Program as well as flight operations, 

safety, engineering, and health 

and medical. The IMMT approves 

mission priorities and real-time 

Flight Rule changes and waivers, and 

conducts final readiness reviews for 

major activities including launches, 

dockings, landings, and EVAs, 

and dispositions major anomaly 

investigations. The chairperson 

usually conducts a series of oneon-one tag ups with various partner 

agencies and commercial vehicle 

teams before each IMMT. The 

increment lead flight director supports 

the process, as well. Twice a week, the 

NASA team meets internally with the 

ISS Operations integration manager at 

an operations tag up for more focused 

review of NASA internal topics, 

sometimes in preparation for an 

upcoming IMMT presentation to the 

rest of the partnership. Owing to the 

continuous operation of the ISS and 

the complexity of the systems, daily 

meetings between the operations team, 

the engineering support team, and the 

integration manager normally occur in 

between these more formal reviews.

Photo courtesy of Robert C. Dempsey

Figure 3. Lead Increment 44 Flight Director Michael Lammers works in the Flight Director’s Suite, a small 

office that overlooks the ISS Mission Control room in Houston. 

In parallel, the crew continues to

follow the timeline. Each crew 

member is scheduled for two daily 

exercise sessions (Figure 4). The 

ISS has two treadmills and two 

stationary bikes— one of each in the 

Russian Segment and US Segment. 

The equipment also includes one 

resistive exercise system for strength 

training. Managing to get all six crew 

members scheduled for the exercise 

they need without double-booking 

the associated equipment can be a 

tricky planning problem, particularly 

on days when maintenance is needed 

on any of the exercise equipment, or 

even on other systems nearby.

One hour of each crew member’s day 

is set aside for the “midday meal.” 

Attempts are made to line these up 

for all, or most, of the crew. The crew 

members can use this time as they 

see fit. This is a chance for them to 

take a break during a busy day, grab 

a bite to eat, and maybe hang out 

with their crewmates for a bit before 

getting into the afternoon schedule. 

Aligning the times for the entire crew 

also provides psychological support 

for long missions away from friends 

and family.

As the afternoon progresses, the 

ground teams—in addition to 

following along with the crew 

members as they work through the 

timeline—are reviewing and updating 

the next day’s plan. The goal is to get 

an updated version on board before 

about 1730 GMT so that it is on board 

when the evening DPC takes place 

about an hour later. The evening DPC 

starts with a crew call to Houston, as 

with the morning DPC. The calls then 

go around the world to control teams 

again for any comments, questions, 

answers, and last-minute bits of news 

from the day, ending with Moscow. 

As soon as the DPC concludes, the 

crew’s workday is officially over. 

All interior camera views are turned 

off to provide the astronauts privacy 

during their “evening” time. Except 

for occasional conferences or short 

research activities, the crew’s evening 

is marked “presleep” on the timeline, 

followed by a 9.5-hour stretch marked 

“sleep.” NASA does not track how 

they use that time, and no one calls 

the crew members or otherwise 

disturbs them unless their help is 

needed right away to deal with a 

major problem on board.
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 25

Figure 4. Expedition 7 (July 8, 2003) Science Officer Ed Lu exercises on a Cycle Ergometer Vibration 

Isolation System in the US Laboratory. Each crew member is scheduled for two exercise sessions per day.

The workday never really ends for 

the flight control teams. Most of 

the teams—Houston, Huntsville, 

Munich, Tsukuba—split the day into 

three shifts of 9 hours, with an hour 

of overlap for the teams to hand over. 

In Moscow, the flight control team 

works a full 24-hour shift, handing 

over just before morning DPC, at the 

start of the workday in Moscow.

The flight control teams on console 

are responsible for putting together 

the detailed timelines for the 

upcoming 7 days based on ISS 

Program requirements and direction 

from the increment flight control 

team. As discussed above, before 

the end of each crew workday, the 

ground teams will review and discuss 

any major changes for the next day’s 

timeline so that the crew can be 

informed as to what will be discussed 

during the evening DPC. The team 

may make additional changes while 

the crew sleeps, or may simply 

“fill in the blanks” by attaching 

procedures and messages to provide 

all the detail the crew and flight 

control teams will need to execute 

the timeline. The console team 

also typically reviews and updates 

the “3-day-out” and “7-day-out” 

timelines each day, so that they are 

continually looking ahead a few days 

to make sure all the details needed 

to complete each day’s objectives 

are captured in the plan. A standard 

process described in Chapter 1, 

with milestones throughout each 

24-hour day and 7-day week, allows 

all of the control teams a chance 

to make inputs to each plan review 

before the final timeline approved 

and put on board for execution. 

The detailed plan for the day might 

not be finalized until a few hours 

before the crew awakens, even if the 

major objectives for that day were 

selected weeks, or even months, 

ahead of time. 

The increment lead flight controllers 

continue to hold JOPs as well, now 

focusing on assuring all details 

needed to support planned operations 

are ready to go, including the 

procedures, flight rules, analysis, 

and any associated agreements 

with international partners or 
26 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

commercial providers (Figure 5). It 

may take quite a bit of coordination 

and detailed development work to 

put the procedures and supporting 

material together as well as testing 

or simulating the process before 

a specific operation. The JOP 

coordinates that work, and the 

individual lead flight controllers spend 

most of their days building those 

detailed products for final review and 

approval before they get attached 

to the appropriate plan. Although 

many activities have become routine, 

the dynamic and evolving nature of 

the ISS necessitates the continuous 

development or modification of 

many procedures.

Figure 5. The Increment 40 JOP, working in Mission Control Center Houston, reviews current and future activities, and coordinates all the key elements 

between the engineering and science teams as well as the international partners. 

Photo courtesy of Robert. C Dempsey

Figure 6. Increment 44 Lead Flight Director Mike Lammers (sitting) discusses crew activities with 

fellow Russian Flight Director Alexei Buchilin (far right) and his interpreter Paul Kharmats. The Russian 

Space Agency houses several of its team members as part of the Moscow Support Group in Houston, 

while a number of NASA flight controllers work in Moscow as part of the Houston Support Group. 

See also the Introduction. 

The increment team, meanwhile, is 

looking out at the weeks ahead, and 

working to find homes for all the 

activities that the ISS partnership has 

agreed are priorities for this mission. 

This is an ongoing process. The 

increment manager, representatives 

of the ISS Program office that 

ensure the right activities are being 

performed, and their team in the 

Increment Management Center 

regularly review the Increment 

Requirements Definition Document 

(see Chapter 1). Those priorities 

are allocated to different stages in 

the increment via the Current Stage 

Requirements Document, which 

breaks down the 6-month Increment 

Requirements Definition Document 

period into the stages defined 

between major mission events— 
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 27

usually vehicle launches or landings. 

The increment lead planning team 

then works the stage priorities into 

upcoming weekly plans. Once a 

week, the increment lead flight 

director and the whole team review 

the next 3 weeks in the Weekly Plan 

Review. Crew activities are assigned, 

crew workday durations are tallied 

up, task list items (“job jar” activities 

that can be completed any time the 

crew is free), and off-duty days or 

holidays are planned at this meeting. 

In addition, recent trends on system 

performance, consumables usage, 

and upcoming vehicle traffic are 

accounted for, and associated onboard activities may be adjusted.

In between meetings, the lead flight 

director, who is set up in an office in 

Mission Control (Figure 6), works 

with all their counterparts, flight 

control team members, and ISS 

Program cohorts to address issues 

and develop future priorities and 

plans. On any given day, the flight 

director may be working with people 

who are down the hall, in the next 

building, halfway around the world, 

or just one time-zone away.

Time Off, Conferences, 

and Celebrations

Unlike a Space Shuttle mission that 

would last about 2 weeks at most, 

an increment mission lasting 6 

months is a long time and therefore 

the crew members need time off 

to prevent them from burning out. 

Each expedition crew agrees upon 

its holiday schedule prior to flight. 

The crews need to decide this 

together, since different countries 

celebrate different holidays. Each 

Soyuz crew gets about four holidays 

during their 6-month stay. Some 

crews end up celebrating both the 

Eastern and Western Christmas 

holidays (Figure 7). When those 

holidays are also celebrated in one or 

more of the partner Mission Control 

Centers (MCCs), those teams get 

to help the crew celebrate, and vice 

versa. Sometimes, crew members 

send food to Mission Control via 

Earth-based friends and family. The 

flight controllers will sometimes put 

together a special message for the 

crew, or uplink video views from 

inside MCC to say “hello.” These 

activities help keep morale high both 

for the crew members, who are totally 

isolated on the ISS, and the flight 

controllers, who have to spend long 

hours away from families during the 

holidays to support operations. 

Figure 7. The crew shares a meal in the Node 1 during Christmas 2009. From left to right: 

Japanese astronaut Soichi Noguchi, cosmonauts Maxim Suraev and Oleg Kotov, and American 

astronauts T. J. Creamer and Jeffrey Williams (commander).

In addition to holidays, crew 

members receive regular time off. 

They generally work Monday 

through Friday, and have Saturday 

and Sunday mostly to themselves. 

Some time may be scheduled for 

short stretches of work—e.g., routine 

systems maintenance, housekeeping 

and cleaning, science or medical 

sample collection—but on a normal 

weekend, this time is limited to an 

hour or so each day.

What do ISS crew members do with 

time off? Yes, they have television – 

when the ISS has a communication 

link with the ground, MCC can route 

video to an on-board computer. 

Limited bandwidth means only a 

couple of feeds can be sent at a time, 

though, and MCC is in charge of 

changing the channel. They have 

internet access—not fast, and not 

all the time, but they can tweet or 

surf a bit. They can choose from an 

impressive stash of digital videos 

(mostly movies) on board. The 

stash gets refreshed periodically—

sometimes with releases that have 

yet to reach theaters. Many crew 

members bring up supplies for their 

own hobbies. For example, the ISS 

has established quite a collection of 

musical instruments over the years. 

Models have been assembled, quilts 
28 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

have been pieced, and art has been 

made on board the ISS. See Figure 8.

Figure 8. Examples of free time for the space station crews. Top: Dan Burbank, Expedition 30 

commander, plays a guitar in the US Laboratory on December 16, 2011. Bottom: Expedition 45 crew 

members watch an advance screening of the movie The Martian in the Unity Node 1. Clockwise 

from left: Flight Engineer Oleg Kononenko, Flight Engineer Sergei Volkov, Commander Scott Kelly, and 

Flight Engineer Mikhail Kornienko.

The crew schedules conferences

every week with various folks on the 

ground, for work and for personal 

contact. Private video conferences for 

each crew member with their family 

are scheduled every weekend. Each 

week, every crew member has a oneon-one video conference with his or 

her flight surgeon who monitors that 

crew member’s health. Periodically, 

the ISS Program manager and chief 

of NASA’s Astronaut Office schedule 

conferences with each crew member 

to check in with them directly. Each 

crew member can also organize a few 

special conferences with whomever he 

or she chooses while on board the ISS.

Crew members can make phone 

calls via laptop—i.e., “voice-over 

internet protocol” (see Chapter 13)—

and through that means can contact 

family, friends, and colleagues any 

time the ISS has the right kind of 

communications link to the ground. 

There is nothing quite like the 

surprise of that first phone call from 

space, and it provides a huge morale 

boost to both the crew and the flight 

control team to be able to have such a 

direct line of communication.

At the end of each working week, 

NASA’s lead flight director and the 

lead Russian shift flight director 

hold their own conferences with 

the crew. These are often “working 

discussions” where the ground teams 

fill the crew in on any developments 

regarding upcoming launches, 

program decisions, or new activities, 

and can answer questions about 

any issues being tracked or worked 

for the increment. It also is a time 

for the crew and ground to relax and 

unwind with some good-natured 

kibitzing. In addition, since the flight 

directors often act as advocates for 

the crew with the rest of the ground 

teams, these conferences are one 

way for them to stay in sync with 

each other on issues or concerns. 

It can also be a good chance for 

team building. When a complicated 

maintenance activity is coming up, 

for example, the flight director might 

invite the Operations Support Officer 

or the hardware owner (or both) to 

come talk to the crew members in 

case they have questions about the 

procedures. When crew members 

from other international partner 

agencies are on board, those teams 

will hold a weekly conference with 

their crew members, as well. Finally, 

special working conferences will be 

scheduled to help the crew prepare 

for some complex operations, such as 

complicated maintenance procedures, 

EVAs, or visiting vehicle operations.
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 29

Chasing the Red Line 

Sunita Williams, Expeditions 14/15 and 32/33

Every day is different, but they all have one thing in 

common: the Red Line, which is either chasing you or you 

are chasing it (see Chapter 1, Figure 7). All activities are 

planned out—even exercising (mainly to accommodate all 

the crew members on the limited equipment). But that’s 

okay, because there is no way one individual could think 

of all the things that need to be done, or prioritize them.

The main categories of activities are science, 

maintenance, public relations and outreach events, and 

robotics and spacewalks; however, the categories also 

include installation of new or upgraded modules and 

systems, since the things need to be fixed or added on 

the inside and outside as the ISS continues to evolve. 

The activity subject matter can range from the mundane 

to the incredibly complicated. In any given week, you 

could be updating the on-board computers, setting up 

tools for a spacewalk, practicing grappling a free-flyer 

spacecraft, fixing the toilet, fixing the water system, 

inventorying food and supplies, sequencing DNA, setting 

up for fire experiments, taking your own blood samples, 

making contacts through Ham radio, and talking to the 

NASA administrator, a Queen, or even the President of the 

United States! The science never stops up here—we are 

in microgravity and we can’t escape. Even cool science 

experiments have mundane aspects, such as when we 

had to clean the aquarium and remove air bubbles—

which, ironically, could kill the fish in weightlessness—for 

some Medaka fish we were studying. Of course, we need 

to plan time for exercise, eating, and hygiene as well.

Whether I had two other crewmates, such as on my first 

expedition, or five as I did on my second visit, one key 

element was that everyone has a great sense of humor, 

even with all the different personalities. Humor is essential 

to living in an environment like this. 

 We are always interacting with the people in Mission 

Control. They are our team, our family. Our mood on the 

ISS can dictate their mood in Mission Control. Likewise, 

their mood in Mission Control can dictate our mood on the 

ISS. We are symbiotic by the nature of our work together 

on this complex and extraordinary station in space. 

Mission Control watches our backs every night as they 

monitor the station system. This allows us all to sleep on 

the same schedule, thereby making us a stronger team.

On the ISS, we have to monitor ourselves and our 

psychological health, as well as our physical health. 

You can work all the time, but everyone needs a break. 

Everyone needs a reserve in case of an emergency in 

the middle of the night. To function normally, the space 

station runs on a regular Earth workweek and workday. 

We emphasize taking a break for lunch, but each person 

needs to think ahead and plan his or her next meal. Some 

of it needs to be hydrated or heated up, which takes time 

for the water absorption. Best not to rush these things. 

So, in the process of grabbing a bag of coffee and heating 

up veggie quiche, we usually put some food in the heater 

to be ready for lunchtime. The Russian food is generally 

some type of meat with rice, noodles, and kasha, which is 

best heated up. It’s hearty food! Part of the fun is seeing 

what is available to eat. We eat out of a box for 10 days 

or so. We don’t open another box until that box is done. 

So, the philosophy was not to save something, because 

someone else will eat it. Eat what you think is best that 

day. There will be a new best thing the next day.

Often on the weekend, we try to have a family dinner 

where everyone pitches in. We would all get our special 

food and spread it out on our table. One time, we had 

Azman’s sausages—something I was able to import from 

Cleveland—cooked and sliced. Yum! Everyone loved 

them. I was only able to save a couple for later. We had 

corn tortilla chips with bean dip and jalapenos. One of 

the very special packages we received from a recent 

Progress flight included fresh garlic, lemons, apples, and 

grapefruits fresh from Kazakhstan! Food and friendship 

are all part of the maintaining our health—both physical 

and psychological. 

Luckily, exercise is part of our daily routine, and it is a 

great stress reliever. Most folks also have space hobbies 

that help them deal with stress—hobbies such as being 

in contact with friends and family at home through the 

IP phone or net meetings, doing self-designed science 

experiments, taking videos and pictures, writing in a 

journal, doing social media, etc.
30 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

Complex Operations

Many days are anything but normal. 

A vehicle launch and rendezvous, a 

spacewalk, a failure on board—all 

these events can rearrange the crew’s 

working schedule, and require the 

attention of a lot more specialists 

on the ground. Most of the time, a 

separate lead flight director and a 

team of lead flight controllers and 

other specialists are assigned to that 

specific activity. This lead team 

coordinates with the increment team 

to make sure it is clear who will 

do which tasks to prepare for and 

execute the operation, and how the 

right team members will coordinate 

with the on-board ISS crew. 

Planning an EVA is a complex 

task for the ISS team and crew. 

When everyone involved knows 

far in advance that an increment 

will include a spacewalk, and the 

tasks for that spacewalk are welldefined, the crew members can train 

on those tasks before they launch, 

and the flight controllers building 

the EVA plan can account for their 

specific experiences in training, 

preferences, etc., as they put together 

the final plan and procedures for the 

EVA. Many times, however, one 

or more spacewalks were added to 

an increment to deal with failure 

of critical hardware. Although 

all EVA-certified astronauts get 

preflight training on the significant 

tasks involved in critical hardware 

replacement or repair, in such cases 

the flight control team does not 

have a specific EVA timeline to 

walk the crew through preflight. 

Once the failure occurs, the flight 

control team starts planning the 

recovery spacewalk(s), and builds the 

associated procedures and timelines 

for the crew. This is typically done 

via Team 4, which is described in 

more detail in Chapter 20. A flight 

director is assigned to manage that 

effort and lead the team that will 

support the EVA. This team will 

coordinate with the increment lead 

flight director to make sure all the 

preparation and recovery tasks can 

be integrated into the increment plan, 

which is then brought to the IMMT 

for final approval (Figure 9).

Figure 9. The Expedition 46 Team 4 flight controllers discuss how to repair the stranded Mobile Transporter in a meeting of the IMMT on December 18, 2015.

On the day of the spacewalk, the

designated crew members spend 

several hours getting suited up and 

ready to go outside. Once in their 

suits, they execute a sequence of 

steps to safely depressurize the 

airlock so they can open the hatch 

and go outside. An EVA timeline is 

carefully choreographed ahead of 

time, and the team on the ground is 

supporting the crew literally every 

step of the way up to and during the 

spacewalk to respond to issues or 
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 31

develop work-arounds in real time, 

as needed. A spacewalk may take 

6 or more hours outside. Once the 

crew is back inside, a couple hours 

of work is required to get the airlock 

repressurized, get the crew members 

out of their suits, and (essentially) 

close up shop for the day.

Vehicle dockings can be just as 

complex, especially for the ground 

team, although in most cases the 

ISS crew does not have as much 

of the workload as on an EVA day. 

In the weeks prior to the arrival of 

a visiting vehicle, the lead team 

assesses the ISS power requirements, 

reviews any station attitude control 

configuration changes or maneuvers 

needed for rendezvous, and looks 

at the trajectory of the incoming 

spacecraft to determine positioning 

constraints for any of the articulating 

appendages such as the robotic arm, 

solar arrays, or radiators. In most 

cases, the team needs to feather at 

least some solar arrays so that plumes 

from the thrusters of that vehicle do 

not hit the wrong part of the array, 

which could cause structural loading 

and/or contamination. Arrays that are 

feathered generally are not producing 

as much power as normal, so it might 

be necessary to turn some systems off 

to preserve margin on the batteries 

during the rendezvous, as discussed 

in Chapter 9.

ISS systems are configured for the 

operation several hours ahead of 

the vehicle arrival (Figure 10). As 

much of the systems configuration 

as possible is done from the ground, 

but any system that the crew may use 

during approach will be set up by 

the crew. Depending on the vehicle, 

that may include video cameras, the 

robotic arm system, ship-to-ship 

communications and monitoring, or 

simply a still camera used by a crew 

member at a window facing the right 

direction. The crew will also prepare 

the hatchway(s) and pressure check 

hardware for use after docking.

Figure 10. NASA Flight Director Dina Contella monitors the launch and docking of the Expedition 

46/47 crew (Yuri Malenchenko, Tim Kopra, Tim Peake) on Soyuz from the Baikonur Cosmodrome in 

Kazakhstan on December 15, 2015.

Back to Earth

Figure 11. The Soyuz is seen as it lands with 

Expedition 43 Commander Terry Virts of NASA, 

cosmonaut Anton Shkaplerov of the Russian 

Federal Space Agency (Roscosmos), and 

Italian astronaut Samantha Cristoforetti from 

the European Space Agency near the town of 

Zhezkazgan, Kazakhstan, on June 11, 2015.

As with any mission, the work 

does not end just because the crew 

has made it back to Earth, as seen 

in Figure 11. Unlike getting the 

astronauts from Houston to the 

launch site where the crews take 

commercial flights to Moscow and 

then a Russian Space Agency plane 

to the launch site, getting the crew 

back to Houston expeditiously is 

a major operation in itself. It is 

important to return the crews as 

quickly as possible to perform 

postflight medical studies and begin 

the rehabilitation to Earth’s gravity. 

NASA uses a Gulfstream G3 aircraft 

to fly the astronauts from Kazakhstan 

back to Houston (Figure 12). With 

a range of about 4,200 km (2,600 

miles), the G3 cannot make the trip 

with a single crew due to the long 

duty day. Hence, it requires two flight 

crews of three personnel (two pilots 

and one flight engineer) to handle the 

long transit time of about 19 hours. 
32 CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND

About 8 days before the crew is 

expected to land, the first flight 

crew flies commercial to Europe, 

usually Scotland or Norway, and 

waits for the G3 to arrive. The G3 

departs Houston with the second 

crew 4 to 5 days prior to the landing. 

The two crews swap in Europe, 

and then the G3 continues to 

Kazakhstan to await the return of 

the crew. The crews swap again 

when the G3 arrives in Europe and 

the first crew returns on commercial 

airlines the next day.

Figure 12. The NASA Gulfstream G3 waits on the tarmac in Karagandy, Kazahkstan, in June 2016 

to return the Expedition 47 astronauts Timothy Kopra and Tim Peak to Houston for postflight medical 

studies and rehabilitation. 

Postflight medical evaluations and 

debriefs with the various specialist 

teams take up several weeks of the 

returning crew’s schedules. The 

crew members are asked about 

their experience on board with key 

systems, procedures, payloads, and 

activities. Their feedback helps 

the team improve operations and 

overall support. Just as during flight 

preparation, this process can include 

international travel, although as 

much postflight activity as possible 

is planned to take place in the crew 

member’s home country.

The increment lead flight director 

schedules a lessons-learned JOP, 

at which the lead flight controllers 

discuss issues, gotchas, and process 

improvements, and watch items for 

upcoming increments. Major topics 

from this discussion roll into a report 

up to the ISS Program management, 

where actions may be assigned to 

track specific issues to resolution 

before they can impact a future 

increment team.

Fun, welcome-back events take 

place, as well. Friends, family, and 

colleagues may come to Ellington 

Field in Houston to greet the returning 

US astronauts, usually within a day 

of landing. NASA hosts a welcomehome ceremony and presentation 

by the crew members of memorable 

slides and videos from their time on 

board for the personnel (and their 

families) who supported the mission.

Terrestrial Challenges Getting Home

After more than 24 trips to return astronauts to Houston, the Aircraft 

Operations Division within the Flight Operations Directorate has proven 

to be successful in its mission to get the crews back quickly and safely. 

However, the flights are rarely routine. Weather can create challenges for 

pilots, such as delays in departure and en route. Since a relief crew is 

staged at a particular location, the G3 has to pass through or very near 

that town. Even the best planning can run afoul, as was the case when 

the Grímsvötn volcano in Iceland erupted in May 2011 while the G3 was 

in Kazakhstan awaiting the Soyuz landing. The team had to scramble 

to move the Europe crew to a location in England, which involved 

planning new routes at the last minute to complete the missions. NASA 

replaced the G3 with a G5 aircraft with longer range to eliminate some 

of these challenges.

The increment lead flight director and 

any lead flight directors for major 

complex ops during the increment 

have a difficult task at the end of 

the mission: they have to pick the 

flight controllers who will “hang 

the plaque” in Mission Control. 

This is a time-honored tradition in 

Houston. A flight controller who 

distinguished himself or herself 

through work supporting the mission 

gets to climb a ladder and hang the 
DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND CHAPTER 2 33

increment or mission plaque. The 

plaque is the patch design that was 

developed by the crew and placed 

by the flight director’s console 

during the increment. This event is 

typically scheduled when the crew 

can also attend; the on-board crew 

via videoconference is tied in to the 

event. Visitors to Mission Control 

will see dozens of these plaques 

hanging in the various flight control 

rooms. See Figures 13 and 14.

Figure 13. On February 17, 2016, Operations Support Officer Chelsea Shepherd gets the honor 

of hanging the plaque for her work during Increment 45. Behind her is lead increment flight director 

Mike Lammers (center), flanked by astronauts Kjell Lindgren on his left and Kimiya Yui on his right. 

In the background, Expedition 46 astronauts Scott Kelly (commander, on the right within the screen 

image), Tim Peake (image center), and Tim Kopra (image left) support the ceremony with a live video 

link from the ISS.

Figure 14. Expedition 19/20 plaque-hanging ceremony in Mission Control on November 5, 2009. 

Left to right: astronaut Michael Barratt, Lead Flight Director Courtenay McMillan, cosmonaut Gennady 

Padalka (behind McMillan), Telemetry Information Transfer and Attitude Navigation specialist Andrew 

Lee, Ground Controller Mitch Venable, astronaut Koichi Wakata, and astronaut Tim Kopra. Lee and 

Venable jointly hung the Soyuz TMA 14 plaque, as decided by McMillan. 

Conclusion

Each increment takes a great deal 

of teamwork between the flight 

controllers and the crew. More than 

a year before the astronauts fly, a 

dedicated team of flight controllers 

led by a flight director begins 

training the crew and preparing all 

the operations and procedures that 

will be needed during that time 

frame, and provides support as they 

complete training. Once the crew is 

launched, the team is responsible for 

all day-to-day operations. When the 

time frame is over, the team reviews 

what worked well and what did not, 

handing that information to the next 

team so that the operations continue 

to improve. The crew and flight 

controllers get very close, which is 

important because the crew depends 

heavily on the ground team. At the 

end of the increment, an exhausted 

team hands off to another team. A 

flight director once compared the 

process to climbing a mountain: It 

starts off gradual, then becomes very 

steep and requires a lot of hard work. 

Then you reach the summit and are 

glad you did it. By the time you get 

back to the bottom, you are ready to 

do it all over again.

Chapter 3 Systems: 

Structure and 

Mechanisms—

The International 

Space Station’s 

Skeleton
36 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

The Flight Director Class of 2009 (left to right: Scott Stover, Dina Contella, Ed Van Cise) in the Leonardo 

module as it was being upgraded from a short-duration Multi-Purpose Logistics Module to become the 

Permanent Multipurpose Module. Numerous elements of the module’s structure are visible, including the 

hatch, rack panels, bulkhead, ducting, and module feedthroughs—all aspects discussed in this chapter. 

As on Earth, revolutionary 

research in space often requires 

a physical laboratory. Although 

the International Space Station 

(ISS) is a state-of-the-art research 

facility, it is also an outpost in lowEarth orbit that needs to sustain its 

crew to enable the research being 

performed. That means designing a 

space station that provides a shelter 

where the crew can live in a habitable 

environment that is protected from 

the dangerous conditions outside 

Earth’s atmosphere. That shelter 

needs supporting hardware to provide 

power, methods for distribution 

of that power, and computers 

with software to control all of the 

equipment. Facilities to support 

the living quarters and life support 

equipment inside the laboratory 

are required, in addition to actual 

research capabilities and facilities.

These hardware and software systems 

are described in detail elsewhere in 

this book. This chapter describes 

the physical structures of the space 

station as well as the various methods 

used for assembling the spacecraft 

over the course of numerous 

assembly missions. 

Primary Structure

The exterior of the ISS is made up of 

multiple modules with a very long 

truss structure running from side to 

side, as seen in Figure 1. 

Figure 1. Assembly Complete configuration of the ISS as of July 2011.

Photo courtesy Ed Van Cise

The Integrated Truss System—or 

simply “the truss”—centered atop the 

US laboratory module, supports eight 

large solar arrays (see Chapter 9), 

mechanisms that allow those arrays to 

track the sun, two large radiator beams 

(see Chapter 11), and numerous 

Orbital Replacement Units (ORUs). 

ORU refers to any unit on the ISS 

that is designed to be serviced, 

repaired, or completely replaced. 

The ORUs on the truss include 

power distribution and conversion 

devices, Multiplexer/DeMultiplexers 

(MDMs) (see Chapter 5), pumps, 

sensors, and numerous research 

projects and experiments that 

need to be exposed directly to the 

unpressurized space environment. 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 37

The truss also contains wiring and 

plumbing to connect all the ORUs. 

The Mobile Transporter and the 

Mobile Base System are mounted to 

a rail system on the front face of the 

truss. The Mobile Transporter can 

be moved to one of eight different 

worksites along the length of the 

truss. The space station’s robotic arm 

can be based on the Mobile Base 

System at any of these worksites. It is 

this mobility of the arm that enabled 

the assembly of the station’s truss and 

modules. These systems are covered 

in more detail in the Chapter 15.

The cylindrical modules of the 

ISS—be they American, European, 

Japanese, or Russian—connect to each 

other to create a pressurized habitat 

where the crew lives and works in a 

shirtsleeve environment. The pressure 

inside the modules is maintained near 

Earth’s sea-level pressure, which is 

approximately 760 mm Hg (1 atm 

or 14.7 psi). The pressure outside 

the modules is essentially zero. That 

means the module structures must 

withstand an immense pressure 

force (760 mm Hg / 14.7 psi) across 

every facet of its pressure-containing 

shell. The cylindrical shape of the 

modules is a strong shape that readily 

withstands this pressure. As seen 

in Figures 2 and 3, this shape also 

conforms to the shape of the Space 

Shuttle payload bay (for US Segment 

modules) and launch vehicle fairings 

(for Russian modules).

Node 3

Cupola

Figure 2. Left image is the empty payload bay of orbiter Endeavour. The front of the payload bay is to the right where the Orbiter Docking System is installed 

and two flight deck windows are visible. The payload bay was 4.6 m (15 ft) in diameter and 18 m (60 ft) in length. This meant any cargo in the payload bay 

could be no larger than a 4.6 m (15 ft) diameter cylinder. The right image is the payload bay configuration for Space Transportation System (STS)-130/ISS-20A 

with Node 3 and Cupola as the primary cargo. Notice how the cylindrical shape of the module conforms to the shape of the payload bay. 

Figure 3. The US Laboratory module, Destiny, is supported by a frame that allows it to be rotated as it 

is being built. The reinforcing ribs that make up a waffle pattern that crisscrosses the primary pressure 

shell of the module can be seen. These pieces are normally under the orbital debris shielding and 

thermal insulation that makes each module appear smooth and round (as with Node 3 in Figure 2). 

This reinforcement is what gives each module enough strength to contain the atmospheric pressure 

that allows the crews to work in a shirtsleeve environment. 

Although the primary purpose of 

the pressurized modules is to keep 

the atmosphere in, and thus keep 

the crew alive, the modules must 

have feedthroughs to allow fluids 

(liquid and gas), power, and data to 
38 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

transfer between the inside and the 

outside (Figure 4). The feedthroughs 

are designed to ensure the holes 

in the module have at least two 

seals to vacuum. Additionally, the 

internal pieces of each feedthrough 

are specially sealed and tested to 

ensure no leaks occur from the cabin 

out to space through the connector. 

Every effort was made to minimize 

the number of items that must cross 

the pressure shell of the modules to 

minimize the risk of air leaks.

Cabin 

Vent Valve 

Feedthroughs 

Group of 

Electrical 

Feedthroughs

Figure 4. 

The interior of 

the Permanent 

Multipurpose 

Module pressure 

shell endcone 

with a number 

of power, data, 

and gas 

feedthroughs. 

Each electrical 

feedthrough in 

this photo is 

approximately 

4 cm (1.5 in.) 

in diameter.

Hatchways are also feedthroughs

that provide a means to get into and 

out of each module (reference the 

“Hatches” section of this chapter). 

Windows provide a means for 

science experiments to study the 

Earth, for crew members to view 

their home planet, and for the 

operation of a number of educational 

programs. Windows are essentially 

large feedthroughs with optical 

panes installed instead of power 

or data connectors (reference the 

“Windows on the World” section of 

this chapter). 

Each of the holes in the primary 

structure of the modules for these 

feedthroughs was designed and 

reviewed for its ability to keep 

the atmosphere in and keep the 

crew safe. Each feedthrough is 

required to have at least two seals 

to the vacuum of space. Even with 

these precautions, the ISS crews 

are trained extensively on how to 

handle unexpected depressurizations 

that are either due to a failure in 

a seal of a module feedthrough or 

from an impact by orbital debris. 

Crew members are equipped with 

emergency response procedures and 

equipment that they can use to try 

to pinpoint the leak location and 

attempt to repair it. 

Pressurized Module 

Assembly

Figure 5. The probe docking mechanism of an incoming Progress cargo vehicle. This funnel-shaped 

probe interfaces with a receiving cone on the docking mechanisms of the Russian segment of the 

space station. The hatchway that the crew will translate through after docking, which is the space 

inside the two orange rubber o-rings, is 80 cm (31.5 in.) in diameter.

Although the Russian modules of 

the ISS are all connected using an 

automated “probe-and-cone” docking 

system (Figure 5), this system does 

not allow for large hatchways that 

can accommodate transferring large 

objects, including various payload 

racks (reference the “Racks” section 

of this chapter), between modules. 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 39

The hatchways of US Segment 

modules are larger than the Russian 

or Space Shuttle hatchways to 

accommodate the transfer of larger 

hardware. This larger interface 

required a different attachment 

mechanism that would hold the 

modules together in a way that could 

withstand larger forces. These forces 

are greater than those experienced 

by the Russian or shuttle docking 

interfaces due to having a larger 

surface area exposed to vacuum on 

one side and the sea-level pressures 

of a shirtsleeve environment on the 

other side.

Figure 6. Top image: ISS as it appeared to the crew of STS-92/ISS-3A (2000) as they approached 

the space station. Middle image: The first assembly of ISS components using the CBM. Astronaut 

Peter J. K. (Jeff) Wisoff monitors as the crew of the orbiter uses the robotic arm to bring the Z1 truss 

(CBM at the top of the image) toward being ready to be latched by the active CBM of Node 1 (CBM at 

the bottom of the image). Bottom image: ISS as it appeared to the crew members as they departed the 

space station. Note that not only was the Z1 truss installed, but also the Pressurized Mating Adapter 3 

on to Node 1, opposite the Z1 truss (bottom of Node 1 in this photo). 

As shown in Figures 6 and 7, the

Common Berthing Mechanism 

(CBM) is a complex collection of 

latches, bolts, Ready to Latch (RTL) 

indicators (reference the “Finding 

Ready to Latch” section of this 

chapter), and computers to control 

this equipment. This system can be 

operated by either the ground or 

the crew; extravehicular activities 

(EVAs) (i.e., spacewalks) are not 

required to use this mechanism, 

unlike some of the truss attachment 

systems. Once a new module is 

close enough to the ISS (RTL), four 

latches on the ISS side (usually a 

Node module) are used to reach out 

and “grab” the incoming module 

and pull it closer. Alignment guides 

ensure the bolts and nuts of the 

mechanism are in line with each 

other. Once the latches have pulled 

the two halves together, bolts on 

the active CBM are extended into 

nuts on the passive CBM. Each 

of the 16 bolts has a preload of 

approximately 90 kN (20,230 lbs) of 

force on it after the bolting sequence 

is complete. That is the equivalent 

of having the weight of just over six 
40 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

mid-size automobiles stacked on 

each bolt/nut location. This keeps the 

three seals between the two halves 

securely compressed even with the 

high pressure difference between 

the ISS cabin and the vacuum of 

space. Three seal beads on the CBM 

interface provide fault tolerance. One 

seal bead can be scratched, leaking, 

or damaged and the CBM will still 

have two good barriers between the 

atmosphere and the vacuum.

Capture 

Latch

Passive Nut

Alignment 

Guide

Passive

Structural

Ring

Capture 

Latch Fitting

Alignment

Guide Controller Panel

Assembly

Structural

Ring

Powered 

Bolt

Figure 7. Hardware component breakdown of 

the active (top) and passive (bottom) halves of 

the CBM. An RTL indicator is situated next to four 

of the alignment guides on the active CBM (not 

shown in the figure). 

Figure 8. An example of a vestibule. This is the vestibule between Node 1 and Node 3 on 

STS-130/ISS-20A (2010) before all the power, data, and fluid jumpers were connected. Power and 

data cables for the active CBM are still installed (seen floating) but no jumpers are connected 

yet to the large or small feedthroughs on Node 3 (the module with the closed hatch). 

Figure 9. The vestibule between Node 1 and Node 3 after it has been fully outfitted and a white cloth 

closeout barrier has been installed to keep objects from getting trapped or lost inside the vestibule.
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 41

A vestibule is created between the 

two hatches when the two modules are 

connected. This is just like a vestibule 

between two train cars. In this 

vestibule area, the astronauts connect 

gas (e.g., oxygen, nitrogen, air), water, 

data, and electrical lines between the 

two modules. All of these utilities 

are connected inside the pressurized 

area of the vestibule but outside 

of the hatchway itself. This means 

the utility lines can be connected 

without an EVA, but the lines will 

not run across the open hatchways 

of the modules. For an example, see 

Figures 8 and 9. This configuration 

enables the crew to close the hatches 

quickly to isolate a module in an 

emergency, should it be required. 

The CBM not only connects the 

permanent US Segment modules 

during ISS assembly, it is also used to 

connect US cargo vehicles (e.g., H-II 

Transfer Vehicle [HTV], Dragon, 

and Cygnus) when they arrive. These 

cargo vehicles use the CBM interface 

because it provides capability for 

transfer of both small cargo bags 

and large hardware such as racks 

between the cargo vehicle and the 

ISS. Crewed vehicles use smaller 

docking systems because large 

hardware does not need to transfer 

between the crewed vehicles and the 

ISS. Docking mechanisms can also 

release the docked spacecraft faster 

than vehicles connected by CBM. 

Each CBM location can be operated 

multiple times, if needed. This 

capability enables cargo vehicles 

to be attached and detached from 

CBM locations dedicated to cargo 

operations. That CBM capability also 

means that permanent ISS modules 

can be detached and relocated to 

alternate CBM locations, if needed. 

The Manual Berthing Mechanism

The early ISS assembly sequence had the Pressurized Mating Adapter 

(PMA)2 docking adapter on the front of Node 1. The Space Shuttle brought 

the US Laboratory to the ISS on STS-98/ISS-5A (2000). The orbiter docked 

to PMA3, located on the bottom (nadir) side of Node 1. The astronauts 

needed to remove PMA2 from the front of Node 1, put PMA2 somewhere, 

install the US Laboratory on the front of Node 1, and then put PMA2 on 

the front of the US Laboratory. To make this happen, an additional CBM 

location was required to temporarily store PMA2 while the US Laboratory 

was being installed. This need was realized early in the ISS design 

development; therefore, a manually operated CBM that used only latches 

(i.e., the Manual Berthing Mechanism (MBM]) was added to the front side 

of the Z1 truss (Figure 10). This enabled the astronauts to move PMA2 to 

this Z1 location and house it there temporarily while the US Laboratory was 

being installed. The spacewalkers then released PMA2 from the MBM and 

moved it robotically to the front of the US Laboratory. The MBM, while still 

in place on the front of the Z1 truss, fulfilled its job during that mission and 

has not been used since.

Figure 10. Photo of the ISS as STS-92/ISS-3A (2000) departed, showing the Z1 truss on 

top of Node 1 with the large ring of the MBM on the front of the truss. The round and square 

targets in the middle of the MBM are Space Vision System targets. The Space Vision System 

is discussed in more detail later in this chapter. 
42 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

Truss Assembly

The ISS is not solely a collection of 

connected cylindrical modules in 

which the crew can live and work. 

In addition to these modules, the ISS 

needs the additional truss structure 

to support its eight solar arrays, its 

external radiators, the equipment to 

run all of those external systems, and 

a place to mount the large number of 

science experiments that are running 

in the space vacuum. 

This truss system, often called the 

“backbone of the ISS,” is attached 

to the US Laboratory module by 

10 struts that connect to the center 

S0 truss segment. The truss was, 

of course, not flown up as a single 

unit. Rather, smaller truss segments 

were flown up, and the truss was 

assembled on orbit. As can be seen 

in the image of the ISS in Figure 1, 

one side of the truss system appears 

to be a mirror image of the other 

side—and that is indeed the case. 

Not only are the truss segments 

mirror images, the system hardware 

installed on the truss is mirrored in 

many places. For example, for the 

Port Solar Alpha Rotary Joint, which 

connects the P3 and P4 trusses (see 

also Figure 3 in the Introduction and 

Figure 8 in Chapter 9), to turn in 

the same direction as the Starboard 

rotary joint, ground controllers must 

use commands with values that are 

the negative of what is sent to the 

Starboard joint. If this inverse-value 

commanding were not performed, 

the two joints would turn in opposite 

directions because the joints are on 

opposite sides of the truss but use the 

same rotary joint control software.

Assembly of some of the truss 

segments was completed using 

only robotic arms and computer 

commands. The computer-controlled 

attachment mechanism, known as 

the Segment-to-Segment Attachment 

System, connects S0 to S1, S1 to S3, 

S0 to P1, and P1 to P3. During EVAs, 

astronauts used handheld power tools 

to drive the interfacing bolts of the 

Rocketdyne Truss Attachment System 

for other truss segment connections, 

namely the Z1 to P6 (during the 

early ISS assembly time frame), S4 

to S5, S5 to S6, P4 to P5, and P5 to 

P6 connections (all the connections 

outboard of the P3/S3 trusses).

The mechanical concept was 

the same whether an automated 

mechanism or a manual mechanism 

was used—four large bolts on one 

side of the truss segment were driven 

securely into the receiving nuts of 

the adjoining truss segment. All of 

the major truss pieces, all of the 

large components attached to the 

trusses (some of which rotate), and 

all of the hardware within the truss 

segments are connected through 

only four bolts/nuts at each truss 

element interface. This entire truss, 

which is 109 m (375.5 ft) in length, 

is connected to the US Laboratory 

module by 10 attachment struts. 

Structural Health

A primary engineering concern is 

how loading events can cause the 

hardware of the ISS to fatigue over 

time, which may impact how long 

the engineering teams believe the 

spacecraft structure can remain 

in orbit without failing. With the 

significant mass of the ISS and the 

loads it experiences being handled 

across the relatively few connecting 

points of the truss, engineering 

teams need to ensure their ground 

models of the ISS structural stress 

and loading match what is actually 

being experienced by the vehicle. A 

few of the various loads that the truss 

must withstand include vibrations 

from rotating equipment, crews 

pushing off interior walls, contact 

with a vehicle that is docking, and 

thermal expansion and contraction. 

The ground model comparison is 

especially important in the assessment 

on whether the lifetime of the ISS 

hardware can be certified beyond the 

original design life expectancy. A 

number of instrumentation systems 

have been installed both inside 

the ISS pressurized modules and 

externally on the ISS truss. These 

systems—the Internal Wireless 

Instrumentation System, the External 

Wireless Instrumentation System, 

and the Structural Dynamics 

Measurement System, along with 

others—collect engineering data 

on the stress, strain, dynamics, and 

accelerations imparted on the ISS 

structure during various events 

and stages of ISS assembly and 

operations. These data are not only 

useful for improving the accuracy of 

ground engineering models to help 

perform analysis for future events 

such as upcoming vehicle dockings or 

space station maneuvers, the data are 

also useful for reconstructing what 

impact past events may have had on 

the ISS structure.

For example, in 2009, a 

misconfiguration of some thruster 

parameters during a reboost caused 

the Service Module main engines 

to pulse at a frequency that was a 

harmonic with the ISS truss. This 

essentially meant that the ISS truss, 

along with the attached ISS modules, 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 43

were flexing and bending at the same 

time each thruster firing occurred. 

Each thruster firing then further 

excited or increased the bending and 

loads being experienced by the ISS 

structure. After the reboost, engineers 

used structural measurement data 

to assess any damage to the ISS 

structure (none occurred) and the 

potential impact to the overall 

lifetime of the structure (engineers 

noted a slight, nearly negligible 

reduction in ISS structural life of 

some components).

A household example might be akin 

to having an off-balance load in a 

clothes washer. In this situation, 

the washer will “jump around” due 

to the off-balanced load. This will 

cause some wear and fatigue on the 

spinning parts and structure of the 

washer. A single off-balance event 

will cause minimal impact or damage 

to the washer. However, if the washer 

ran with numerous off-balance loads 

for long periods of time, the hardware 

would degrade and the washer would 

likely break or fail earlier than 

designed or expected.

Why is there no S2 or P2 truss?

The heritage of the ISS design shows up in many different, oftentimes small, 

ways. One of the larger but perhaps not as obvious instances is with the 

naming of the truss segments. Although the ISS does not have an S2 truss 

or a P2 truss, these truss segments were actually in the Space Station 

Freedom design (the precursor design to the ISS). These truss segments 

were going to house the thrusters needed to control the attitude and altitude 

of Freedom. When the Russian Space Agency became an ISS Partner and 

its modules took the role of housing the thrusters, the S2 and P2 truss 

elements were no longer needed and were removed from the design. The 

overall design was far enough along in development that it was decided to 

not rename the other truss segments.

Truss Attachment Sites

Another component of the two truss 

attachment mechanisms is a capture 

latch. This component was used in a 

fashion similar to the latches on the 

CBM. When a new piece of truss was 

close enough (i.e., RTL) to the ISS 

truss, the latch would be used to grab 

a capture bar on the new truss and 

draw it closer to the ISS truss. This 

capture latch can best be pictured as 

a large claw that would close around 

that capture bar.

Due to its robust and adaptable 

function, this capture latch/claw 

design is used in many other places 

externally on the ISS. As mentioned 

previously, a number of science 

experiments are mounted on the ISS 

truss. Also, a large number of spare 

parts are mounted on the truss for 

use by spacewalkers or the Special 

Purpose Dexterous Manipulator robot 

to fix broken external hardware (see 

Chapter 15). Spare parts and many 

research experiments are attached to 

large carrier platforms, either External 

Stowage Platforms or Expedite the 

PRocessing of Experiment to the 

Space Station (ExPRESS) Logistics 

Carriers. These carriers are secured to 

the truss using a Payload Attachment 

System (PAS) or an Unpressurized 

Cargo Common Attachment System 

(UCCAS). These systems use 

mechanisms that implement the 

common capture latch design as well 

as Umbilical Mating Assemblies 

(UMAs). The UMAs provide power 

and data from the ISS to the carrier. 

Two UCCAS sites are located on 

the P3 truss, and four PAS sites are 

located on the S3 truss. Reference 

Figure 4 in the Introduction to identify 

the hardware carriers attached to 

the S3 and P3 trusses on the ISS. 

In that figure, the Alpha Magnetic 

Spectrometer telescope is mounted to 

one of the S3 PAS sites.

As has been pointed out, the 

attachment mechanisms of the ISS 

are required to hold a large amount 

of mass and withstand significant 

loading, bending, and vibration. The 

mechanisms themselves must be 

very robust and capable to ensure the 

various designs will perform these 

functions. Care had to be taken during 

assembly operations using these 

mechanisms to make certain that the 

mechanisms, while actuating latches 

or bolts, were operated in a specific 

sequence. This sequence was analyzed 

prior to the operation to ensure the 

use, or a failure of a component 

during that use, would not cause 

damage to any of the ISS hardware 

involved (including the robotic arm). 

This is just one more example where 

the operations and engineering teams 

worked closely together to ensure the 

method of operations planned by the 

operations teams would stay within 

the limits analyzed by the engineering 

teams (often integrated by the End-toEnd Berthing Integration Team).
44 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

Finding Ready to Latch

Assembling truss segments and 

pressurized modules all start with 

the same requirement—the new 

component needs to be close enough 

to its intended mating location to be 

RTL. The actual RTL indicators look 

different depending on the mechanism 

being used, but they perform the 

same function. The RTLs move when 

touched by the incoming module/

truss. This movement signals to the 

robotics operators (crew or ground) 

that the new piece is indeed close 

enough, and that use of the mechanism 

can start. An example of this can be 

seen in Figure 6 (middle). This image 

from STS-92/ISS-3A (2000) shows 

the passive CBM of the Z1 truss 

being robotically brought close to the 

active CBM of Node 1 Zenith prior to 

achieving an RTL condition.

The robotics operators need to 

know how well the new element is 

positioned with respect to the ISS 

mechanism prior to the element being 

at the point of touching the RTLs.

Although the trusses and modules 

are large, very little tolerance for 

misalignment is allowed between 

two pieces. The robotics operators 

must precisely align the incoming 

element so that it can touch those 

RTL indicators. 

Realizing this critical need for 

assembly of the ISS in orbit, engineers 

designed a computer-generated Space 

Vision System (SVS). The SVS was 

an optical system that used computer 

evaluation of camera views to 

precisely determine the misalignment 

between the ISS and the new 

component. Myriad SVS targets—

decals with white and black dots 

(visible in Figure 10)—were installed 

on modules and truss segments. Prior 

to launch, the placement of these 

targets was measured precisely with 

respect to various reference points on 

the truss/module. This measurement 

information was loaded into the vision 

system computers of the robotic 

arm. These computers, knowing 

the precise location of the targets, 

could then use camera views to 

identify specific targets, precisely 

compute misalignment information, 

and provide that information to 

the operators.

Unfortunately, an SVS solution could 

only be obtained in orbital daylight 

(which is roughly 45 minutes or less of 

every orbit). The SVS was susceptible 

to losing an acquired solution due to 

sun reflection off the surfaces of the 

trusses, modules, or orbiter, or if the 

targets were obscured by shadows. 

NASA successfully used the SVS 

during early stages of ISS assembly; 

however, the agency decided soon 

after the first assembly mission 

(STS-88/ISS-2A [1998]) that a new 

“boresight” or centerline camera 

misalignment system was needed.

Centerline camera systems were not 

a new concept. The Space Shuttle 

always used a centerline camera on 

its docking mechanism window to 

help crews make final alignments for 

docking to the Mir space station and 

to the ISS. Space Station Freedom, 

a design precursor to the ISS, also 

included use of a centerline camera 

mounted on the ISS hatches to view 

incoming modules through the hatch 

windows to determine misalignments.

9

8

7

6

5

4

3

2

1

0

0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0

Roll Angle (deg)

Roll vs. Translation to Ensure Proper Guide Meshing

Risk of

Mis-meshing

Proper

Meshing

PCBM

ACBM

X

Y

Lateral Offset (in.)

FLIGHT RULE B12-111, PARAGRAPH A: During mating operations, when between 

14 inches and 6 inches X-distance separation, the roll and lateral misalignments 

shall ensure 9R+20L < 73 (depicted in diagram below). If this constraint is not maintained, 

the operator must separate the PCBM and ACBM rings. The operator should back out in 

the X direction until 14 inches of separation is met, or the corridor is reattained.

Figure 11. A portion of Flight Rule B12-111 “CBM Capture (RMS Translation) Corridor Constraints” 

that explains to the flight controllers how wobble (i.e., a combination of roll and lateral offsets) must be 

controlled to ensure the CBM halves are properly aligned at the RTL position. Meshing occurs when the 

CBM halves are separated between 15 cm and 35.5 cm (6 in. and 14 in.). The lateral offset can range 

between 0 cm and 10 cm (0 in. and 4 in.).

Although the SVS was ultimately

selected for use with the ISS in its 

design phase, the centerline camera 

was not completely removed from all 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 45

Freedom design drawings. As many 

Freedom components were carried 

into the ISS design with minimal 

change, the US Segment ISS hatch 

was the same hatch design as the one 

originally created for Space Station 

Freedom. The mounting points for 

the centerline camera system were 

not removed from the hatch design in 

the conversion to the ISS. This meant 

that when a centerline camera was 

developed after the Node 1 mission, 

the hatches already on orbit on Node 1 

as well as the hatches on the modules 

being assembled already had locations 

in which to mount a centerline camera 

to the hatch. Thus, the Centerline 

Berthing Camera System (CBCS)—a 

cousin to the initial design concept for 

Space Station Freedom—was rapidly 

designed, certified, and implemented 

to assist in berthing pressurized 

modules to the ISS.

The CBM is relatively intolerant 

to misalignments. When the two 

halves are 35 cm (14 in.) apart, 

only 5 degrees of wobble and 

minimal roll and lateral offsets are 

allowed (Figure 11). When it comes 

to misalignments, operators are 

concerned about both translational and 

rotational errors. Lateral misalignment 

is the offset in the up-and-down and 

side-to-side directions relative to the 

center of the CBM. Rotational errors 

are measured in roll (twisting about 

the center of the CBM) and wobble 

(a combination of pitch-and-yaw 

errors). By using the CBCS camera, 

robotics operators who are looking 

at a target on the hatch of the new 

module coupled with a data overlay 

on the robotics monitor (Figure 12) 

can detect any misalignments and 

adjust the position of the module until 

all misalignments are within limits. 

The operators can also determine the 

proximity of the module (the target 

gets bigger as it gets closer to the 

camera) and whether it is about to 

push one of the RTL indicators. CBCS 

was first used on the STS-98/ISS-5A 

mission in 2000; the camera was 

mounted on Node 1 and used to 

connect the US Laboratory to Node 1. 

CBCS has been used successfully on 

every pressurized module installation 

since that time.

Figure 12. The view of an incoming module that an astronaut sees on his or her Robotic Workstation 

monitor from the CBCS camera. Green reference and targeting lines are computer generated by the 

robotics system and drawn on top of the video image. These lines assist the crew in aligning the new 

module. The four quadrants of red lights are reflections of light-emitting diodes around the CBCS 

camera that are used to illuminate the CBCS target on the incoming element. The camera is looking at 

the hatch window of the incoming module (Node 2 in this case) and the reflective CBCS target mounted 

around the hatch window (red chevrons).

Unfortunately, a CBCS type of 

system could not be designed swiftly 

enough to assist in the connection 

of the ISS truss segments. Instead, 

those operations relied on the lessuser-friendly SVS along with the 

on-the-scene direction from nearby 

spacewalking astronauts. With these 

astronauts in close proximity to the 

massive truss segments helping guide 

the installation, special care and 

choreography was required to ensure 

the crew was always safely away 

from the truss connection points and 

moving hardware. 

An External Berthing Camera 

System (EBCS) was, however, 

installed on the S3 and P3 trusses. 

This system is used to assist in 

installing the cargo carriers to the 

PAS and UCCAS sites. The targets 

for this system are installed on the 

S3 and P3 trusses, and the cameras 

are installed on the cargo carriers. 

This is the opposite of the CBCS 

where the camera is attached to the 

ISS, and the target is on the new/

upcoming hardware. The cameras 

on the carriers receive their power 

from the space station’s robotic arm 
46 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

instead of from the truss (Figure 13). 

This novel approach of putting the 

cameras on the carrier and the passive 

target on the truss enabled the EBCS 

to be implemented on a schedule that 

would not slow down the fast pace 

of readying the truss segments for 

launch and installation.

Figure 13. A photo of a monitor of the ISS robotics workstation during installation of an Expedite 

the Processing of Experiments to the Space Station (i.e., ExPRESS) Logistics Carrier during the 

STS-129/ISS-ULF3 mission in 2009. Similar to Figure 12, the monitor shows both a view from the 

centerline camera as well as a green, digitally drawn graphical overlay. The robotics operators 

(crew or ground) use the overlay lines to gauge the amount of misalignment between the target 

(center of the picture) and the camera (ring of light-emitting diodes).

Due to the success of the CBCS and

EBCS camera systems, the Japanese 

HTV cargo vehicle uses a similar 

HTV Berthing Camera System to 

assist with inserting its Exposed Pallet 

(EP) back into HTV after it has been 

removed from a temporary stowage 

location on the Japanese Experiment 

Module (JEM) Exposed Facility. 

Secondary Structure

With the foundation and walls (the 

primary structure) of the orbiting 

laboratory built, the ISS needed to 

be outfitted to actually be able to 

accomplish its mission. “Secondary 

structure” provides the means 

for outfitting the laboratory. The 

secondary structure is the equivalent 

of elements such as wallboard, 

light fixtures, flooring, and major 

appliances in a home. 

Docking Systems

One of the first necessary pieces of 

secondary structure is a way for the 

occupants of the ISS to get into the 

space station. This means having a 

method to dock a crewed vehicle. 

The ISS is outfitted with six docking 

ports. Four docking ports on the 

Russian Segment use the Russian 

probe-and-cone docking system. 

Visiting Progress cargo ships, crewed 

Soyuz ships, and the European 

Automated Transfer Vehicle dock to 

these ports. On the US Segment, the 

Space Shuttle used a Russian docking 

system called the Androgynous 

Peripheral Attachment System 

(APAS). The Space Shuttle used 

this system to dock with the Russian 

Mir space station as well as to the 

ISS. Whereas the Space Shuttle had 

the active half of the APAS, the ISS 

had two docking ports with passive 

APAS halves. These halves were 

located on PMA2 and PMA3. After 

the retirement of the Space Shuttle 

fleet, the PMAs are being updated to 

add International Docking Adapter 

extensions to the passive APAS 

halves. This will allow future crewed 

vehicles to use a newer docking 

mechanism, built off internationally 

agreed-to standards, to dock to PMA2 

and PMA3.

Shields Up!

One significant concern—in fact, one 

of the ISS Top Program Risks—is 

the orbital debris environment in 

low-Earth orbit. The US Air Force 

tracks large pieces of space debris 

(i.e., debris larger than 10 cm [4 in.] 

in diameter) and the ISS can perform 

debris-avoidance maneuvers (see 

Chapter 8) to change its orbit and 

thereby avoid those objects. The 

impact of a 10 cm (4 in.) object on 

the ISS would have an explosive 

force equivalent of 7 kg (15 lbs) of 

trinitrotoluene (i.e., TNT). Being able 

to get out of the way of these large 

debris pieces is an important part of 

the overall strategy of ensuring the 

ISS is not penetrated by orbital debris.
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 47

Really androgynous?

Most mechanisms that involve joining two items together have a side that 

is active and a side that is passive. The active side has all the hardware that 

moves and all the computers needed to command and control that moving 

hardware. That moveable hardware (e.g., latches or bolts) interfaces with 

non-moving (passive) hardware on the other side of the interface. Examples of 

passive hardware include nuts, non-moving hooks, latch capture plates, etc. 

In some mechanisms, both halves have the same moveable hardware. In these 

cases, one side of the mechanism is designated as active, and its hardware 

is made to move while the hardware on the other side remains stationary and 

passive. These roles could be reversed on a subsequent use. This setup for a 

mechanism is termed an “androgynous” configuration. See Figure 14.

If the APAS were truly androgynous, the system on the ISS PMA or on the 

orbiter could serve as the active half of the docking system. Although both 

halves indeed had the same hooks and latches, the active hardware (i.e., 

motors, controlling computers, pyrotechnic bolts, etc.) was removed from 

the ISS halves prior to launching the PMAs. That means the orbiter side was 

always active. The ISS half of the docking mechanism hooks could not be 

driven, and the explosive bolt pyrotechnics for releasing those hooks were 

not installed. Should the hooks on the orbiter side have failed to release the 

ISS, the orbiter side could have pyrotechnically separated its hooks (and, 

thus, left that docking port permanently unusable). And, if for some reason the 

pyrotechnics did not work either, a spacewalking astronaut could manually 

separate the two docking system halves by removing 96 bolts around the 

perimeter of the docking mechanism. Thankfully, that task was never required.

Figure 14. The two androgynous docking system alignment guides are about to overlap, as 

seen out the orbiter’s aft flight deck window just prior to docking on STS-100/ISS-6A (2001). 

The orbital debris strategy must, 

however, also deal with thousands 

of smaller objects that cannot be 

tracked and thus cannot be directly 

avoided. The ISS modules—US 

Segment, Russian Segment, and all 

temporary crew and cargo vehicles—

are designed to protect against 

the impact of very small (1 cm 

[0.4 in.] diameter or smaller) debris. 

This protection comes via another 

secondary structure component, 

debris shielding, which is described 

in more detail in this section. 

Debris too small to be tracked but 

still too big to be assuredly stopped 

by debris shielding could penetrate 

the ISS shields and pressure shell. 

The ISS crews are trained extensively 

on how to respond to rapid cabin 

depressurizations due to midsize 

orbital debris penetrations, should one 

ever occur. In these scenarios, crew 

members first remove themselves 

from the immediate area of impact, 

ensure their rescue vehicles are not 

leaking, and work to isolate the 

module with the leak by closing 

various module hatches.

In the event a piece of debris 

penetrates the pressure shell of the 

ISS, on-board tools and repair kits 

help the crew pinpoint the leak/

penetration point (which could be 

a very small hole, numerous small 

holes, or a larger gash) and attempt to 

repair the damage. Current on-board 

repair kits should allow the crew to 

repair holes up to 1.25 cm (0.5 in.) in 

diameter, assuming enough reserve 

time is available to find and repair the 

leak. Reserve time is the calculated 

time remaining before the cabin 

pressure drops below 490 mm Hg 

(9.5 psi). Once the pressure drops 

that low, crew members must isolate 

and seal off the leaking compartment 

(if the location is known) or isolate 
48 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

themselves in their return vehicle 

and prepare for possible departure 

from the ISS. To provide some time 

margin, the crew is trained to seal 

off a leaking compartment with 10 

minutes of reserve time remaining.

Research efforts to develop the best 

possible methods for mitigating the 

risks and damage from debris impacts 

have been ongoing for as long as 

humans have been flying objects 

in space. This research has been 

conducted within NASA, academia, 

industry, and internationally. The 

potential outcome from debris 

impacts puts risk on uncrewed 

satellites as well as human-tended 

spacecraft. For the ISS, the placement 

and type of debris shielding varies 

depending on the location of the area 

being shielded and the duration of 

time that module is on orbit. This 

is all factored into an engineering 

calculation called the Probability 

of No Penetration. For more details 

on the ISS Program response to the 

Micrometeoroid and Orbital Debris 

(MMOD) risk, reference the 2012 

Aerospace Safety Advisory Panel 

Report at http://oiir.hq.nasa.gov/asap/

reports.html. 

Most US Segment debris shielding 

employs hard aluminum panels 

mounted atop the primary pressure 

shell of the module. The thickness 

and placement of debris shields 

are based on the Probability of 

No Penetration. Shields that will 

face forward—i.e., the direction 

in which the ISS is flying for most 

operations—are generally thicker 

since these areas have the higher 

probability of being hit by debris. 

The panels of the US Segment 

debris shields are separated from the 

pressure shell to create a gap between 

the panel and the shell. This gap 

serves two purposes. First, numerous 

utility lines and other hardware that 

do not need to be in the pressurized 

environment are underneath these 

panels. This protects them from 

exposure to the atomic oxygen of 

the low-Earth orbit environment and 

also protects them to some degree 

from orbital debris. Second, a layer 

of tough, insulating material called 

Multilayer Insulation (MLI) is placed 

between the debris panels and the 

pressure shell. This provides another 

debris barrier and thermal insulation 

for the pressure shell. Figure 15 

shows the build-up of this type of 

debris shielding. 

Node 2 module pressure shell. The final barrier 

between debris and the internal pressurized 

cabin. Note the waffle pattern on the aluminum 

cylinder that helps increase the strength of the 

shell, and the large longitudinal rings that create 

barrel sections of the cylinder.

Generally, a number of wire harnesses for 

power or data, or fluid lines run outside the 

pressure shell but underneath the MMOD shields 

and insulation. Shown are some of the wires 

running underneath MMOD shields of the 

Node 2 module.

Once all the equipment that needs to be attached 

to the pressure shell or run under the insulation 

blankets is installed, the blankets themselves are 

installed. These blankets are a thick composition 

made of materials such as Nextel® and Kevlar®. 

These materials not only insulate the pressure 

shell, they serve as another debris barrier where 

MMOD energy is dissipated and debris is broken 

into smaller fragments. This photo shows some of 

the MLI blankets on the Joint Airlock.

Once the MLI blankets are installed, the MMOD 

shields can be installed. Some equipment, such 

as these EVA handrails on Node 2, are also 

installed onto the outside of the shields. The 

shields are designed to be easily removable 

by spacewalking astronauts to access the 

equipment under the shields and MLI blankets.

Figure 15. The debris shielding of the Node 2 module starting at the top left with the pressure shell, 

followed (top right) with various wire harness, followed (bottom left) by insulation materials, and finally 

(bottom right) the outer debris shield panel.

This shielding setup is a Stuffed 

Whipple Shield design. When a 

piece of debris strikes the debris 

panel, some debris is stopped at that 

point since it does not have enough 

energy to penetrate the shielding. 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 49

Some debris with higher energy will 

penetrate the shielding. The debris 

will lose energy and fracture into 

multiple smaller pieces. These pieces 

will travel through the insulation 

material, which will cause the debris 

fragments to continue to lose energy 

and spread out from the point of 

penetration. Debris that started 

smaller than 1 cm will either not 

make it to the primary pressure shell, 

or will strike the pressure shell but 

not penetrate. 

Other areas of the ISS where the 

likelihood of debris strikes and 

penetration are lower, or areas that 

are not habitable by the crew, may 

be protected only by thick insulating 

blankets. This is true for many areas 

of the Russian Segment, especially 

the shorter-duration Soyuz and 

Progress vehicles. For this shielding, 

the blanket properties and thickness 

are such that the debris will be 

stopped prior to penetrating the 

pressure shell.

Hatches

As mentioned previously, one of the 

larger feedthroughs in any module is 

the hatchway. These hatchways enable 

crew and cargo to pass between 

modules. Each module has a hatch to 

close off each hatchway vestibule for 

each module to remain pressurized 

before it is attached to the ISS, and to 

allow for the isolation of the modules 

in the event of a depressurization or 

contaminated atmosphere. The US 

Common Hatches are 1.2 m (50 in.) 

square in size (Figures 16 and 17). 

The hatch system is designed such 

that when the hatch is closed, the 

force of the internal module air 

pressure pushes the hatch against the 

bulkhead seals of the module and 

provides the sealing force. Latches 

are included on the hatches, but these 

latches are only needed to ensure the 

hatch is aligned with the bulkhead 

and pulled close enough to the 

module such that the air pressure can 

provide the sealing force. The latch 

mechanisms also have a component 

called a “kicker” that pushes against 

the module bulkhead when the hatch 

is unlatched to help push the hatch off 

the bulkhead.

Figure 16. The smooth internal side of a US Common Hatch. This side faces into each module. Note 

the handle in the center right that the crew turns to latch or unlatch the hatch, a deployable handle at 

the bottom center to engage or release the hatch from its stowed position, a valve in the bottom right 

corner of the hatch used to equalize the pressure between the two sides of the hatch prior to opening 

the hatch, and a window in the center of the hatch.

The round hatches of the Russian 

Segment modules are 80 cm (31.5 in.) 

in diameter. This includes the hatches 

between module vestibules as well as 

hatches between modules and docked 

vehicles (i.e., Progress, Soyuz, or 

Automated Transfer Vehicle). The 

hatches on PMAs 1, 2, and 3 are also 

80 cm (31.5 in.) in diameter, based on 

the Russian hatch design.

Additional hatches on the ISS include 

the inner and outer hatches on the 

Japanese Airlock and the outer egress 

hatch of the Joint Airlock. The EV 

(for extravehicular) hatch on the Joint 

Airlock is the same Shuttle B-type 

hatch that was found on the airlock 

of the orbiter. This is due to the fact 

that the Crewlock portion of the Joint 

Airlock is actually an exact duplicate 
50 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

of the orbiter airlock. The Crewlock 

is attached to the larger Equipment 

Lock of the airlock. A US Common 

Hatch at the Equipment Lock/

Crewlock interface allows only the 

Crewlock to be depressurized when 

crews go on EVAs (see Chapter 17).

Figure 17. The external side of the Permanent Multipurpose Module hatch prior to launch. The actual 

hatch mechanisms and linkages are all on this side of the hatch—the side that faces space vacuum. 

Note that both the internal side and the external side of the hatch have crank handles; the hatches can 

be opened or closed from either side of the hatch.

Windows on the World

The ISS has numerous windows. 

These windows are large 

feedthroughs that run the risk of 

leaking; the large, fragile panes of 

glass could easily be damaged by 

orbital debris. It stands to reason 

that the occupants of the Earthorbiting outpost would want to be 

able to see the planet. Although the 

windows enable crew members to 

look down at their home, sightseeing 

is far from the primary purpose 

for those windows. In fact, the 

windows on the ISS are positioned 

primarily for scientific research and 

educational purposes as well as for 

enabling the crew to have situational 

awareness of the space immediately 

around the space station during 

EVAs and robotic operations, and 

during the approach or departure of 

visiting vehicles. 

The Service Module alone has 

12 windows, most of which are 

Earth facing. Other Russian Segment 

modules contain a number of 

windows, as well. Each US Segment 

hatch also has a window, although 

most windows on closed hatches 

are usually covered by a protective 

blanket on the outside or by stowage 

bags on the inside, meaning that the 

crew rarely uses the hatch windows 

for viewing. The primary purpose 

of the hatch windows is to view 

incoming modules (reference the 

“Finding Ready to Latch” section of 

this chapter). Thus, an external flap 

is left closed over the window to 

protect it from orbital debris until a 

hatchway is intended to be connected 

to a new module. Hatchways are also 

highly convenient locations inside 

the ISS where crews can temporarily 

stow hardware that might be staged 

for an upcoming cargo vehicle. This 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 51

staged hardware usually covers the 

window of that particular hatch. 

That leaves three primary window 

locations for viewing events outside 

the US Segment of the ISS for 

research, educational events, or 

crew viewing and photography. The 

US Laboratory has a single, largediameter window (Figures 19-21). 

Research experiments are mounted 

into the Window Observation Rack 

Facility, which is installed over the 

top of this window, thus enabling 

detailed observations of Earth. The 

JEM has two large-diameter windows 

on its port bulkhead; these windows 

are used to monitor operations of the 

JEM robotic arm, activities on the 

JEM Exposed Facility, and operations 

of the JEM Airlock. The Cupola is a 

module of windows attached to the 

bottom of Node 3 (Figure 18). It has 

one large, round window at its center 

and six trapezoidal windows around 

its perimeter to provide a breathtaking 

bay-window view of Earth. The 

Cupola is used by the crew not only 

for Earth viewing, but also to monitor 

the arrival and departure of visiting 

vehicles as well as EVAs and robotics 

occurring on the bottom of the ISS.

Figure 18. “The ‘Cupola’, attached to the nadir side of the space station, gives a panoramic view of our beautiful planet,” said Expedition 25 Commander 

Doug Wheelock (shown in photo) about this module that has seven large windows. 

The Earth-facing science window 

in the US Laboratory was specially 

designed and manufactured to support 

scientific investigations. This was 

accomplished through specific and 

fine polishing specifications, and 

through application of coatings on 

the glass surfaces (as well as specific 

decisions on which coatings to leave 

off the window). This detail on the 

US Laboratory window enables 

excellent optical qualities that 

allow the use of various cameras 

and telescopes that operate in both 

the visible and non-visible light 

wavelengths. The windows in the 

Laboratory, JEM, and Cupola, as 

well as many of the windows in the 

Service Module, are also protected 

with shutters to ensure as little debris 

as possible makes its way onto the 

high-quality optical glass. These 

shutters—some manually controlled 
52 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

and some electrically controlled—

serve to reduce the exposure of the 

outer window pane to contamination 

from jet firings or material offgassing, provide debris shielding for 

that outer pane, and block sunlight 

from entering the ISS cabin.

How big are 

the windows?

Size (diameter) of common 

ISS windows:

n US hatch: 

20.3 cm (8 in.)

n US Laboratory: 

51 cm (20 in.)

n JEM (two): 

51 cm (20 in.)

n Cupola center: 

70.6 cm (27.8 in.)

n Cupola trapezoidal (six): 

0.22

 m area (322 in2)

n Service Module Window #9: 

48.3 cm (19 in.)

None of the windows on the ISS are

composed of a single pane of glass, 

nor is each pane as thin as one found 

in a home window. Rather, two panes 

of relatively thick glass maintain the 

pressure integrity of the module and, 

typically, there are additional thinner 

protective panes on the inside and 

outside of the window. That makes 

for a total of four panes. The inner 

protective pane (called the “scratch 

pane,” as it is intended to prevent the 

crews from inadvertently scratching 

the glass pressure pane) can be 

removed if necessary. A vacuum is 

drawn on the inter-pane space to 

prevent condensation from forming 

between the two panes of window 

glass. That is the purpose of the flex 

hose that Mike Foale is inspecting in 

Figure 19. That flex hose also proved 

to be an inviting hand hold for early 

ISS crew members; over time, this 

resulted in the development of a 

small leak in that hose. A protective 

box has now been installed over 

these flex hoses to ensure they do 

not get bumped and start leaking, as 

shown in Figure 20.

Figure 19. Expedition 8 Commander Mike Foale using the Ultrasonic Leak Detector in 2004 to 

pinpoint a small leak that had developed in one of the seals of the hose used to maintain a vacuum 

between the panes of glass within the large window of the US Laboratory. Once the leak point was 

identified, the hose was disconnected (which stopped the leak to space) until a replacement hose could 

be flown to the space station. 

Figure 20. The US Laboratory window with its shutter closed (noted by white cover visible through the 

window) and protective box covering its vacuum flex hose. Clockwise from the box is the handwheel 

crews use to open and close the shutter.
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 53

The design concept of these windows 

is that any high-velocity debris 

would hit the outermost debris pane, 

followed by the outer pressure pane. 

If the debris were going fast enough 

to break through both panes, the 

particles would be slowed enough 

such that they would not penetrate 

the inner pressure pane. As shown 

in the diagram in Figure 21, this 

design is similar to the Whipple 

Shield design of the module debris 

shields described earlier. The smaller 

windows on the ISS, such as the US 

hatch windows, have the same dualpressure pane design concept as well 

as inner and outer protective covers. 

Window Assembly Components Window Panes

Figure 21. Overview of the US Laboratory window. Note that the flex hose was the source of the leak discussed in Chapter 16. 

The windows of the US hatches,

US Laboratory, JEM, and Cupola are 

designed to be replaceable in the event 

a window pane breaks. An astronaut 

would install an external pressure 

cover over the window, via an EVA, 

to replace the windows exposed to 

space. The window would then be 

removed from the inside of the ISS. 

The windows themselves cannot be 

removed by a spacewalking astronaut; 

the removal must be done from the 

pressurized environment of the ISS 

cabin. Thus, if debris were to damage 

both panes of a window and cause a 

module to depressurize, it would not 

be possible to replace that damaged 

window. Instead, the crew would 

install the external pressure cover, via 

EVA, and repressurize the evacuated 

module. The crew could then go into 

that module and remove the window. 

With the window removed, the 

crew would install an internal 

pressure cover over the window’s 

hole until the new window was ready 

to be installed. The pressure covers 

are on orbit to provide a means to 

respond to a broken window pane; 

however, no spare windows are kept 

on board the ISS. A spare would 

need to be manufactured and flown 

after the failure.
54 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

Racks

With a pressure shell, protective 

debris shielding, and windows in 

place, it is time to discuss a piece of 

the ISS modules with which crews 

interact on a continual basis. In the 

US Segment, the cylindrical modules 

are broken up into four quadrants. 

For each module, there is a floor 

(“deck”), ceiling (“overhead”), a 

left side (“port”), and a right side 

(“starboard”). An empty squareshaped space runs the length of the 

center of each module; this is where 

the crews live and work (Figure 22). 

A series of racks separate the pressure 

shell from the crews’ living and 

working space. 

Figure 22. Cosmonaut Sergei Krikalev, flight engineer for the Expedition 1 crew, floats in the US Laboratory shortly after it was installed on STS-98/ISS-5A 

(2000). The four walls are actually the front faces of different racks. Note the empty central corridor. This photo was taken before the numerous science racks 

were launched and installed in the Laboratory.

The numerous types of racks on the 

ISS can be broken down into four 

major categories. The avionics racks 

contain the computers, fans, power 

converters, air conditioners, etc. 

that are required to keep the vehicle 

functioning and the crew alive. 

Payload racks house the various 

science facilities and experiments that 

are conducted. Crew support racks 

contain items such as the galley, food 

refrigerators, food warmers, and the 

toilet. (See Figures 23 through 28.) 

Finally, there are stowage racks.

Given that stowage space is at a 

premium on the ISS, the crew can 

find stowage spaces not only in 

dedicated stowage racks but also in 

various compartments in all the other 

racks. Stowage space is also found in 

standoff areas, endcones, hatchways, 

and pretty much any other nook and 

cranny that may not have an alternate 

dedicated use.
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 55

Figure 23. A view of the JEM from its Airlock looking starboard toward Node 2 and Columbus. The camera taking this photo would be in Bay 7 of the JPM. 

The JPM1F2 location would be the second rack bay from the hatch on the forward wall (which is to the left in this picture). That means it would be the rack 

bay covered by the white fabric panel on the left side of the image, second rack bay from the blue wall/hatchway. 

The rack concept for the US 

Segment hearkens to similar 

concepts in use in laboratories and 

research facilities on Earth. Using 

standard interfaces—i.e., interfaces 

between rack and module as well as 

those inside each rack—allow for 

relatively simple and straightforward 

interchangeability of avionics and 

research experiments throughout 

the US Segment. Each rack on the 

ISS is held to the structure of its 

ISS module by four points—one 

at each corner of the front of the 

rack. As shown in Figure 23, spaces 

exist between the top of one rack 

and the bottom of the next. Lights, 

ventilation grids, power outlets, and 

other equipment are installed in these 

areas of each module. These standoff 

areas are also where the racks 
56 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

attach to the module. Pivot pins are 

installed at the bottom of the rack. 

This configuration allows the crew to 

detach the two attachments at the top 

of the rack and rotate the rack on its 

two pivot pins. This gives the crew 

generally simple access to the back 

of the rack and to the pressure shell 

of the module. This easy access is 

important in the event the crew needs 

to look for hull penetrations caused 

by orbital debris.

Figure 24. Astronauts Ken Ham (top), STS-124 pilot, and Greg Chamitoff, Expedition 17 flight engineer, install various racks in the JEM module after it was 

attached to the ISS on STS-124/ISS-1J (2008). Some of the racks were launched in one location due to orbiter center of gravity requirements and needed to 

be moved to their final locations after the module was attached to the ISS. 

Of course there is no “up” or “down”

in zero gravity, so how do the crews 

remain properly oriented? All of 

the lights within the module are 

overhead and the air return grilles 

are on the deck. The walls are port, 

starboard, forward, or aft, depending 

on where the module is located on 

the ISS. (This system works well 

for horizontal modules but can still 

be confusing in the vertical modules 

such as visiting cargo vehicles.) 

When dealing specifically with a 

rack, all references are made with 

respect to the crew member facing 

the rack with his or her feet being 

toward the pivot brackets. That way, 

the crew member always knows 

where the top of the rack is located.

It can still be confusing to find 

places inside the ISS because it is so 

large. For that reason, the ISS as a 

whole has a common location coding 

scheme. The system for identifying 

a location inside a pressurized 

module includes the name of the 

module, the rack bay, the particular 

rack in that bay, and even a locker 

within that rack.

For example, the location code 

JPM1F2_D1 would be Japanese 

Pressurized Module (JPM)1 (i.e., 

JPM1—commonly called the JEM), 

Forward 2 (second rack bay from 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 57

Figure 25. An example of an avionics rack. This is 

the Moderate Temperature Thermal Control System 

rack (see Chapter 11) in the US Laboratory with its 

closeout panels removed, prior to it being installed at 

the LAB1S6 location. On the left side of this rack is a 

fluid pump that is covered by black insulation. On the 

right half of this rack is a heat exchanger (top half) 

and cabin fan (bottom half) that, together, make up 

one of the Laboratory’s air-conditioning systems. 

Figure 26. A payload rack, Expedite the Processing 

of Experiments to the Space Station (ExPRESS) 4, in 

the US Laboratory module during Expedition 4 (2002) 

prior to it being relocated to the JEM. An ExPRESS 

rack has a number of locker locations where smaller 

payloads can be installed; these payloads can get 

power and data from the central area of the rack. The 

smaller locker payloads can be exchanged regularly, 

and can even be returned to the ground, if necessary.

Figure 27. The Waste and Hygiene Compartment (WHC), located at NOD3F4, is an example of a 

rack designed for crew support. The WHC is the bathroom for the US Segment. To use this facility, 

crew members close a privacy curtain (located approximately where the camera was located to 

take this photo). Liquid waste enters a funnel at the end of the hose, as seen in the upper-right 

corner of the above image. Solid waste goes into the solid waste receptable (metal can), as seen in 

the middle of the image. Liquids and solids are drawn into their respective destinations by airflow 

from a fan that runs when the WHC is powered on. 
58 CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELE TON 

the center of the ISS, the rack on the 

forward wall of that rack bay), locker 

D1 (a label is located on each locker 

location; A and B are at the top of the 

rack). This common location coding 

system is also used as part of the 

Inventory Management System, thus 

enabling all equipment on the ISS to 

be tracked to a specific location.

Figure 28. The Fluids Integrated Rack (FIR) at LAB1S4 is an example of a payload facility rack. 

Here, Expedition 29 Commander Mike Fossum works on an experiment inside the glove box that is 

part of the FIR rack (2011). 

Figure 29. European Space Agency Astronaut Leopold Eyharts, Expedition 16 flight engineer, holds a closeout panel in the newly attached Columbus 

laboratory during the STS-122/ISS-1E (2008) mission. This panel bears the names of European engineers who built Columbus. Note the other white closeout 

panels—both hard panels and soft fabric panels—inside Columbus. 

Closeouts

Many of the racks and standoffs 

have closeout panels installed to 

keep the ISS looking nice, to avoid 

numerous open holes and places 

for items to get lost, to aid proper 

airflow through the station, and to aid 

in fire suppression and prevention 
SYSTEMS: STRUCTURE AND MECHANISMS—THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 59

(Figure 29). These panels, held 

in place by a few fasteners (that 

sometimes get stuck and need to be 

“convinced” to open), serve to close 

out open spaces and provide a good 

aesthetic for each module.

Conclusion

The structures of the ISS provide 

the critical role of creating a stable 

platform for the completion of the 

space station’s mission of scientific 

research and preparation for 

exploration beyond Earth orbit. The 

buildup of the ISS over time and 

numerous international launches 

created both unique challenges and 

unique opportunities that have led 

to a diverse and highly capable 

structure. The remaining chapters will 

explain how crew and ground teams 

have used the capabilities provided by 

these structures to ensure the crews 

remain safe in their orbital home and 

are able to perform their missions. 

Chapter 4 Day in the Life:

The Making of 

a Mission
62 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

50064 blk 50081 white 50070 red 50539 true royal 50194 china blue 50606 vibrant chicory 50445 cloud 50501Mango gold

The STS-130/ISS-20A crew mission patch. Since the Cupola was a major new module, the perspective 

represented here is the view of Earth from inside the module.

When all goes well, most space 

missions do not garner any 

real headlines or discussion in 

the media. This absence of coverage 

understates the amount of effort that 

goes into making a mission successful. 

All missions to the International 

Space Station (ISS) possess common 

characteristics. This chapter illustrates 

this process by telling the story of 

a “typical” ISS assembly mission. 

During assembly missions, Space 

Shuttles rendezvoused with the ISS, 

crews transferred hardware (often a 

completely new module), astronauts 

conducted multiple spacewalks (i.e., 

extravehicular activities [EVAs]), and 

NASA and its partners established 

new capabilities. A team of flight 

controllers, with Boeing engineering 

support, worked around the clock 

during each mission to ensure 

everything went as planned, and to 

intervene when it didn’t. The orbiter 

would return to Earth after about 

2 weeks, leaving the increment 

crew behind to carry on while flight 

directors and controllers working with 

the ISS Program Office prepared for 

the next mission.

Planning for such a mission began 

several years in advance. Initially, the 

program office detailed high-level 

objectives that drove the specifics 

of the mission. Approximately 

1 year prior to launch, a group of 

controllers, led by a flight director 

whose full-time job was to prepare 

for the mission, detailed development 

of the mission timeline, wrote flight 

rules and procedures, and planned 

EVAs. A flight director and a team of 

controllers were each assigned for the 

two sides of a mission: Space Shuttle 

and ISS. These represented the prime 

teams for the mission. In addition, 

another team was assigned to the ISS 

increment (see the “Planning” section 

of this chapter) where the mission 

was scheduled to take place. The 

three flight directors worked closely 

together to ensure everything was 

integrated on both programs.

Change was ever-present in the 

process of preparing for a mission as 

priorities and needs shifted such as 

when a major component on the ISS 

required repair. In fact, change was 

probably one of the most significant 

issues a flight director confronted in 

preparing for a mission. Needs and 

objectives changed constantly as a 

mission evolved: schedules might 

have slipped; critical hardware 

could have broken, thus requiring 

immediate replacement; or a failure 

on the space station may have driven 

a late change. Therefore, the teams 

had to continuously adapt. 

Attention to detail, in any plan, is 

critical. Careful planning and vigilance 

reduces the chance of surprises or 

failures. Even so, the flight director 

and the team spent many a sleepless 

night during the assembly missions 

wondering “What did we not think 

of? What could possibly go wrong?” 

Inevitably, things did go wrong. 

Frequently things went wrong that no 

one had ever considered. When this 

happened, the experience, training and 

preparation of the crew and the flight 

control team came together to resolve 

those problems as quickly and as 

safely as possible.

Training was next. Once the timeline 

was developed in significant detail, 

flight control teams and crews 

simulated the mission’s critical 

activities. The Space Shuttle flight 

control team conducted a number of 

simulations with the shuttle crew, 

focusing primarily on launch and 

possible aborts. Likewise, the ISS 

flight control team assigned to the 

mission practiced activating the 

module or other key tasks. However, 

the increment crew members that 

would be present during an assembly 

mission were often scattered 

around the world, preparing for 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 63

their increment or, in some cases, 

already on board the ISS during 

these flight-specific simulations. 

Generic increment crews, often 

composed of astronauts who had 

already been crew members on the 

ISS, played the parts of the actual 

crews in these simulations. Space 

Shuttle missions often changed 

launch dates and sometimes even 

order (see Introduction). Therefore, 

multiple increment crews might 

have needed to prepare for the same 

shuttle mission, thus making training 

even more challenging. Both teams 

conducted several simulations, called 

“joint sims,” to rehearse integrated 

tasks such as rendezvous or handing 

off the module between the robotic 

arm of the orbiter and the arm of the 

space station. Once a mission was 

under way, the ISS increment team 

ceded responsibility to the prime 

station team and therefore did not 

participate in the joint training. The 

members of the training team were 

very much part of the team, and they 

would review the timeline and look 

for issues to help the flight controllers 

succeed during the flight.

Execution of the mission followed 

all the training and preparation. 

The execution phase—also called 

“Fly”—included some of the most 

intense and longest days faced by the 

flight control teams. Tension built 

prior to launch since a critical number 

of operations were about to occur. 

However, if everyone had done their 

job, the teams were well prepared 

to handle any situation. The flight 

control teams tried to take a couple 

of days off before launch to rest and 

close out the last few details. 

The 130th shuttle mission/32nd 

ISS assembly mission—Space 

Transportation System (STS)-130/

ISS-20A—took place over a 13-day 

timespan in February 2010. The 

core objective of the mission was to 

attach the new Node 3 and Cupola 

modules. The success of this and 

many other tasks rested on the 

shoulders of a highly competent and 

passionate team that spent years 

working to make it all happen. Most 

of the challenges encountered along 

the way actually occurred on the 

surface of the Earth. Each challenge 

was resolved, often in parallel, as the 

team prepared for the actual mission. 

With the impending retirement of the 

Space Shuttle, it was a mission that 

might never have happened.

Planning

The assembly sequence of the ISS, 

as discussed in the Introduction, 

underwent many changes over the 

years. Once the plan laid out the 

order of module assembly, the Space 

Shuttle Program personnel managed 

the complicated logistics years in 

advance to ensure that an orbiter with 

the right capability (e.g., light enough 

for a heavy payload) was available 

for the right mission. More detailed 

preparation began a few years out 

from a planned mission. In the case 

of 20A, NASA assigned the core of 

the ISS flight control team in the fall 

of 2007 to a mission that, at the time, 

was possibly going to be the final 

shuttle flight. The crew would be 

assigned about 1 year prior to launch. 

The STS-130/ISS-20A mission was 

tasked to accomplish four primary 

objectives during an estimated 11-day 

mission, as defined by the Space 

Shuttle Program and ISS Program. 

These objectives included:

n Launch the orbiter with Node 3 

module and Cupola

n Install Node 3 module on the

ISS (but do not activate or 

connect anything)

n Transfer critical items

n Land the orbiter

During one or more space station 

increments after the mission, the 

following would be accomplished:

n Attach the power and cooling lines 

from Node 3 to the main systems 

of the ISS

n De-mate the Cupola from its launch 

configuration, at the end of Node 3 

module (required for it to fit into the 

orbiter’s cargo bay, see Figure 2 in 

Chapter 3), and attach it the nadir 

side of the module

n Relocate all the regenerative

life support systems and exercise 

equipment to Node 3, which 

was located throughout the US 

On-orbit Segment

About 12 to 18 months in advance of 

an assembly mission, NASA assigned 

a lead from each Space Shuttle and 

ISS discipline. The lead’s job was 

to oversee every aspect of his or her 

system throughout the process of 

developing, training for, and executing 

a mission. This included training the 

astronauts—both the ISS expedition 

and the Space Shuttle crews. A 

designated flight director led and 

directed each team during the mission 

development as program requirements 

and objectives were translated into a 

timeline, flight rules, procedures, and 

crew training. Besides being the point 

of contact for developing the plan, the 

discipline lead typically worked the 

primary console shift for the mission. 

Usually, the lead was a senior flight 

controller who had supported multiple 

previous missions as an off-shift 

controller, a backup to a mission 

lead, or a backroom controller (see 

Introduction) before being assigned 

a mission of his or her own. Some 

flight controllers had the privilege 

of working multiple missions as a 

lead over the course of their careers. 

Typically 6 to 12 months in advance 
64 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

of a mission, the teams of a flight 

controller and a flight director would 

be assigned for the other two shifts 

(missions always worked with three 

9-hour shifts around the clock). 

Several flight controllers had to be 

assigned more than 2 years prior to 

the STS-130/ISS-20A mission. These 

assignments included the leads for 

EVA, Operations Support Officer 

(OSO), and the Environmental Control 

and Life Support System (ECLSS). 

The lead EVA officer is usually one 

of the first to be assigned to a mission 

because spacewalks take a long 

time to plan, train for, and execute. 

However, the lead OSO would also 

be busy on this flight because the 

STS-130/ISS-20A mission involved 

a lot of hardware changes and the 

berthing of a module. In fact, because 

the OSO task was so large, several 

people were assigned at an early stage, 

including one whose main job was to 

focus on the Node 3 module whereas 

a separate person focused on the 

Cupola. Major changes to the ECLSS, 

including additional components in 

the regenerative environmental control 

system, were scheduled to occur 

during and after 20A. 

Cupola on Node 3 

Nadir Port prior to 

relocation

Node 1

Node 2 US Lab

Cupola on Node 3 

Forward Port after 

relocation

Node 1

Node 2 US Lab

Figure 1. Initially, the Node module was supposed to project nadir (teal blue silhouette); however, it 

was changed to the port side. The Cupola would be launched on the end of Node 3 to fit in the cargo 

bay of the orbiter, and then relocated to its permanent position through use of the robotic arm. Inset: 

launch configuration of the module pair with Cupola on the end of Node 3. 

Images courtesy of MAGIK Robotic Analysis Team

Normally, mission preparation ramped 

up slowly as the plan was developed, 

first taking the major objectives 

listed above and creating a timeline 

as tasks were added. Preparation for 

20A got off to a busy start as the ISS 

Program officials considered changing 

the location of Node 3 on the ISS. 

Originally, the module was to hang 

down in the nadir direction, pointing 

toward the Earth with the Cupola 

facing forward (the direction the ISS 

flies around the Earth), as shown 

in Figure 1. In this configuration, 

NASA’s crewed vehicle, Orion, and 

the Japan Aerospace Exploration 

Agency’s uncrewed cargo ship, H-II 

Transfer Vehicle (HTV), were to 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 65

be attached to the space station at 

the nadir side of Node 3. But it was 

realized that interference could occur 

with the Russian Mini-Research 

Module projecting nadir from the 

Functional Cargo Block module. 

The nadir of the Mini-Research 

Module was also to be the location 

for the Soyuz and, possibly, Progress 

vehicles. Although visiting vehicles 

such as HTV, Orion, and Soyuz could 

likely dock and undock with no 

interference, the ISS Program officials 

decided to ensure a certain amount of 

clearance due to unexpected errors, 

uncertainties in sensors, or systems 

failures. A miscalculation could cause 

a collision (similar to when a Progress 

vehicle struck the Russian Mir station 

in 1997 with US astronaut Michael 

Foale on board), destroying a module, 

or worse, the entire station.

To solve the clearance issue, ISS 

Program officials asked whether 

Node 3 module could be installed on 

the port (left) direction off of Node 1, 

as shown in Figure 1. Although the 

berthing mechanisms were designed 

to allow a module to be mounted in 

any orientation, the plumbing to that 

module was not as accommodating. 

All of the ventilation lines, computer 

circuits, water tubes, nitrogen lines, 

and communication cables had been 

installed years earlier in Node 1 under 

the assumption that Node 3 would 

be on the nadir. To place Node 3 on 

the port side meant all these had to 

be rerouted—in space. Furthermore, 

the electrical power cables and the 

external ammonia lines used for 

cooling the Node electronics would 

have to be rerouted. Figures 1 and 2 

show the final proposed configuration.

Figure 2. Drawing of the ISS now showing Node 3 berthed on the port side (red outline). 

As was typical of the flight control

and engineering teams, the question 

was not whether they could do this, 

but how they could make it work. 

The first task was to figure out how to 

modify the Node 1 module that was 

already on orbit to accommodate the 

change and make sure the hardware 

and procedures could be done by the 

ISS crew. The task was analogous 

to modifying a bedroom by moving 

the bathroom to the other side of the 

room. The changes also would have 

to be somehow verified in advance 

to ensure that everything aligned 

just right when Node 3 was installed 

during the mission. Node 1 was 

already in orbit, so no direct fit checks 

could be performed. The teams had 

to use the Node 1 mock-up in the 

training facility. The mission would 

be a complete disaster if the shuttle 

was launched and then Node 3 could 

not be physically mated to Node 1. 

Even if the modifications to Node 1 

could be made, they had to be done 

in the limited time available to the 

astronauts with the training that could 

be accommodated in the alreadypacked training schedules. If the 

modifications were not completed 

before NASA retired the Space 

Shuttle fleet, Node 3 module might 

never make it to orbit.

The first of many issues arose as this 

was being worked out. Although 

the berthing mechanism could, in 

principle, accommodate a module 

in any one of four orientations 90 

degrees apart, bumpers existed on 

both modules to provide additional 

protection when two modules were 

mated. The result was that Node 3 

could only be installed in two of four 

orientations on Node 1. Either option 

had the module lights on the back 
66 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

wall (i.e., away from the direction 

of motion) or the forward wall (i.e., 

toward the direction of motion) from 

a crew perspective. This seemingly 

minor issue was an important one for 

the crew. No “up” or “down” exists 

in space; therefore, any reference 

frame is artificially introduced. The 

lights on all of the other modules 

were in the same orientation (on the 

“ceiling”) to provide an “up.” If this 

one module was different, it could be 

disorienting for the crew, especially 

during an emergency where visibility 

was greatly reduced due to smoke. If 

the node was rotated 90 degrees, the 

lights would again be on the “ceiling.” 

To do this, the bumpers from Node 3 

would have to be removed and the 

plumbing would have to be rerouted a 

little differently on Node 1. Removing 

the bumpers was relatively easy 

with Node 3 still on the ground. 

Since the plan was to gut Node 1, it 

really didn’t matter where the lines 

were routed; therefore, changing the 

destination by a few more feet was 

not an issue. The biggest roadblock 

was actually external. 

Two boxes—InterFace Heat 

eXchangers (see Chapter 11)—are 

located on the outside of Node 3 

where the cool ammonia on the 

outside removes heat from the internal 

water lines. In the new orientation 

for Node 3, an astronaut would not 

be able to replace these units due 

to interference from the Laboratory 

module (Figure 3). Although the 

likelihood of a failure was estimated 

to be one failure in 29 years of 

continuous operation, the impact was 

significant: if either one of these heat 

exchangers actually failed, half the 

systems in Node 3 would have to be 

shut down permanently. In 2007, the 

hope was that the ISS would be flying 

until at least 2028; therefore, the risk 

was real enough to spend some time 

considering the overall situation.

Figure 3. A computeraided design drawing 

showing an astronaut 

working on Node 3 heat 

exchanger with the 

Laboratory module over 

the left shoulder. Note 

that there are just a few 

centimeters (inches) 

of clearance between 

the astronaut’s life 

support backpack and 

the Laboratory module. 

It would be nearly 

impossible to work in 

such a small area without 

banging into the module 

and possibly damaging 

the spacesuit. 

With support from the engineering 

community, the flight control team 

began to work out a plausible repair 

scenario. If a heat exchanger needed 

to be repaired, the team could unberth 

Node 3 using the robotic arm, rotate 

it 90 degrees, rebirth it temporarily, 

perform the repair, and return it to its 

normal configuration. This also meant 

the crew would have to disconnect 

the external ammonia cooling and 

electrical power lines before the 

operation started, and reconnect 

them when done. At least two 

EVAs would be added to any repair 

operation, in addition to potentially 

exposing the crew to toxic ammonia. 

This whole process would not be a 

trivial operation since everything in 

Node 3 would have to be shut down 

for days, if not weeks, while the crew 

conducted multiple spacewalks and 

never-before-performed robotics 

operations. Since Node 3 would house 

many of the vital life support systems, 

shutting it down for any length of 

time would impact the mission. The 

solution was to lengthen the electrical 

lines significantly so that they would 

not have to be disconnected (the 

ammonia lines already had enough 

slack in them to remain connected). 

This complicated pas de deux took 

several months to work out with 

confidence, and included several 

test dives in the Neutral Buoyancy 

Laboratory (NBL). Once the team 

was comfortable that this repair could 

be performed, if ever needed, it was 

agreed to reorient the module to make 

it seem more natural for the crew. 

Making the modifications to Node 1 

would require extensive work. The 

OSO team estimated that at least 

120 man-hours would be needed to 

modify Node 1 on orbit. To add to 

the difficulty, some tasks could not 

be performed prior to the installation 

of Node 3. For example, water and 

oxygen lines run between the modules 

(see Chapter 3). If Node 3 was ever 

struck by debris and depressed, the 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 67

crew needed to be able to close the 

hatch to preserve crew members and 

the rest of the ISS. Therefore, these 

oxygen and water lines could not run 

through the hatchways. The lines are 

actually located within the aluminum 

structure of Nodes 1 and 3, passing 

through what is called the bulkhead. 

The required modifications to Node 3 

were made prior to launch. However, 

for Node 1, this meant the crew had 

to make new holes in the port side, 

reroute the lines, reseal the bulkhead, 

and carefully check for leaks to 

ensure the integrity of the new seals. 

To perform the leak checks, the crew 

first needed to make the modifications 

and then measure for leakage on 

both sides of the seal. This was not 

possible without Node 3 in place. At 

that time, the other side of the wall 

of Node 1 was a vacuum. Per the 

initial mission plan, Node 3 would be 

installed and the crew would perform 

the modifications after the shuttle left. 

This meant, however, that the many 

hours needed to activate and outfit the 

module would have to be performed 

by three people—without the benefit 

of the seven extra astronauts that were 

available during a shuttle mission.

The flight control team came up 

with an interesting proposal. A 

small connector module called the 

Pressurized Mating Adapter (PMA)3 

resided on the ISS. Atlantis docked 

with PMA3 during the STS-98/

ISS-5A mission, but the module 

was not currently being used. This 

module could be moved by the 

robotic arm and installed on Node 1, 

thus providing a pressurized area 

in which to make the changes. The 

module would be moved back to its 

original location upon completion 

of the modifications. If the 120 

hours of crew time could be found 

during the increment for this task, 

the modifications to Node 1 could 

be performed prior to the ISS-20A 

mission. This meant Node 3 could 

be connected and activated during 

the flight (i.e., “plug-and-play,” 

as the team called it) when those 

extra sets of hands are available. 

As with the change in the port 

location of Node 3, this had to be 

carefully coordinated and reviewed, 

especially since it meant taking the 

expedition crew away from research 

during the increment. However, 

a little investment in the time of 

the increment would significantly 

increase the larger shuttle crew’s 

efficiency. The more tasks completed 

during the shuttle mission, the less 

work for subsequent increments. 

This resulted in a net gain of 

increment time in which to focus 

on research. Many reviews and 

meetings later, the idea was given 

approval by the ISS Program.

Originally, the modification hardware 

was to go up on 20A because it would 

be installed after the flight. With the 

new plan, the design, fabrication, 

and testing had to be accelerated 

to go up on an earlier shuttle flight. 

This proved to be a real challenge to 

the Boeing team members, but they 

worked extremely hard to pull this off. 

Another challenge discovered at this 

point was that the planned route of 

the power cables would be blocked 

as soon as Node 3 was installed. 

Therefore, the power cables had to 

be installed prior to the 20A mission. 

The STS-128/ISS-17A team members 

picked up this task because they had 

some spare EVA time.

In 2008, the timeline leading to 

20A changed to the following series 

of events:

n During the interval following the 

second Japanese/American mission, 

STS-127/2 J/A, the ISS crew would 

move PMA3 from Node 1 nadir 

to Node 1 port using the station’s 

robotic arm

n On STS-128/ISS-17A, the crew 

would route the power cables from 

nadir to port during an EVA

n After STS-128/ISS-17A, some 

Node 1 modification work 

would begin if the parts could be 

accelerated to be ready in time

n STS-129/ISS-Utilization

Logistics Flight (ULF)-3 would 

bring up the remainder of the 

Node 1 hardware and finish most 

of the modifications

n After ULF-3, the PMA3 would 

be relocated back to its pre-2 J/A 

location on the nadir of Node 1 

by the ISS crew, again using the 

station’s robotic arm.

n 20A crew would install Node 3

The 11-day mission now looked 

like this:

n Launch the orbiter with Node 3 

and Cupola

n Install Node 3 on the ISS 

n Install ammonia lines, activate the 

module, and integrate the ammonia 

cooling into the system

n Transfer critical items

n Land the orbiter

Finally, the following would be 

completed after the mission:

n Relocate the Cupola from the end 

cap of Node 3 to its permanent 

nadir location

n Relocate the life support systems 

into Node 3 and activate

n Move the Advanced Resistive 

Exercise Device into Node 3

n Move the Treadmill 2 (T2) into 

Node 3
68 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

Spacewalks

The spacewalk plan for the mission, as 

dictated by the key mission objectives, 

was evolving as well. To help preserve 

the limited oxygen on the ISS, it was 

preferable to perform spacewalks 

during Space Shuttle missions so that 

the tanks could be topped off before 

the orbiter undocked. Therefore, 

the ISS Program officials preferred 

to schedule as many spacewalks as 

practical during a docked mission. 

Over the life of the ISS assembly, 

the number of spacewalks grew 

from one, to two, and sometimes 

three during shuttle missions. By the 

fall of 2008, three spacewalks were 

standard, as shown in Figure 4. Tasks 

similar to those performed during 

previous missions were well known 

and their time estimates were pretty 

accurate. For new tasks, however, the 

performance estimate was usually 

pretty conservative until dives in the 

NBL could provide a better indication 

of the required time.

Figure 4. STS-130/ISS-20A EVA timeline from October 2008. Note that there is still open time on the first spacewalk since the crew could not touch Node 3 

while the Space Station Robotics Manipulator System (SSRMS) was maneuvering Node 3 into position prior to mating to Node 1. The Launch-to-Activation 

(LTA) cable, which is used to keep the module from freezing, is disconnected during the installation and reinstalled at the end of the first spacewalk until the 

internal systems can be activated on a later mission day. The loop A and B Quick Disconnects (QDs) indicate where the ammonia lines are integrated into 

each of the cooling systems. One astronaut would be on the end of the SSRMS during the removal of the Multilayer Insulation (MLI) that protected the Cupola 

until it was activated, as well as the removal of the locks that held the protective windows in place during ascent. Note that the timeline mentions jettisoning 

the MLI, but this was later deleted in case the insulation was needed in the future (i.e., in case the Cupola had to be relocated).

The first EVA accomplished removing 

Node 3 from the orbiter cargo bay 

and berthing it on the ISS. The first 

thing the crew did was disconnect 

the Launch-To-Activation (LTA) 

jumpers. The LTA jumpers provided 

power to the heaters in the module, 

thereby keeping the hardware from 

freezing until the Thermal Control 

System was fully functional. The 

protective flap covering the hatch 

window (see Chapter 3) needed to 

be opened to allow the crew that was 

using the Centerline Berthing Camera 

System to see the incoming Node 3. 

The shuttle crew used the SSRMS to 

grapple Node 3 (see Chapter 15) and 

move it into the berthing position. 

Although a number of small tasks 

needed to be done on the outside of 

Node 3 (e.g., installing hand holds 

used for future spacewalks), this 

could not be done while the SSRMS 

was moving the node. Therefore, 

the team needed to find other tasks 

to fill this large gap in the timeline. 

Once the module was berthed, the 

astronauts reconnected the critical 

LTA cables. These tasks consumed 

all of the time available for the first 

EVA. In fact, it took so long to move 

and bolt the module that the team ran 

the risk of running out of time before 

completing that task.
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 69

The second spacewalk primarily 

focused on installing the ammonia 

jumpers along with the main power 

and data connections that had been 

previously installed on the outside 

of the ISS and routed. The ammonia 

lines had to be installed first for two 

reasons: it was the main objective 

of the spacewalk for that day; and 

ammonia could leak out when 

integrating the ammonia hoses with 

those already in use on the ISS. 

Ammonia is highly toxic and can be 

tricky to see. Just a little on one of 

the suits could kill the entire crew 

once the crew members got back 

inside. The EVA team developed 

complicated procedures to detect 

ammonia and clean the crew before 

opening the hatch. Among other 

things, the affected crew member 

had to sublimate the crystals off the 

suit using a warm metal tool. Then, 

he or she would float to a sunny spot 

in space and hang out for a while 

to allow any possible remaining 

ice crystals to evaporate. Once in 

the airlock after repressurization 

to 259 mm Hg (5 psi), the crew 

member measured the amount of 

ammonia in the air before fully 

repressing and removing his or her 

helmet. If ammonia was detected, the 

contaminated atmosphere would be 

vented overboard and fresh air would 

be pumped in. Again, the check 

was performed and repeated until 

it was safe for the crew. Since the 

spacesuits only had a limited amount 

of consumables (e.g., battery power, 

oxygen), time for these cleanup 

procedures (~90 minutes) had to be 

planned for in the timeline. 

At that point, only one more 

spacewalk was planned. The intent 

was to prepare the Cupola for its later 

relocation from its launch position 

to its permanent nadir location (see 

Figure 1). This meant removing the 

insulation and locking bolts on the 

external shutters that were required 

to prevent launch vibrations from 

causing damage. Since the insulation 

was large and bulky, the team decided 

to jettison it (i.e., throw it away in 

space so it would reenter Earth’s 

atmosphere and burn) rather than 

return it to Earth inside the shuttle. 

Since there was a chance that the 

Cupola might need to be moved again 

in the future, the team later changed 

this decision and the insulation was 

taken inside and stored on the ISS.

As team members better understood 

the time required to perform 

each activity, they saw several 

opportunities to get ahead. In 

particular, they concluded that 

there might be time to perform the 

Cupola relocation. This task would 

benefit from the extra available 

shuttle astronauts, and its completion 

during the shuttle mission would 

reduce the crew’s workload in the 

smaller increment. Therefore, in the 

spring of 2009, the team added the 

Cupola relocation to the end of the 

second EVA. This also meant a quick 

activation of the module because 

electronics were needed to operate 

the berthing mechanisms and cooling 

was needed to prevent the electronics 

from overheating. Choreography 

would be tight. 

Integrating Node 3 cooling lines 

into the existing ISS systems meant 

shutting down those systems. As 

discussed in Chapter 11, the external 

cooling system is broken into two 

functionally redundant, separate 

loops—A and B. Choreography would 

then look something similar to this:

n Power down systems on loop A

n Turn off loop A cooling

n Astronauts to disconnect the 

hoses and integrate Node 3 lines 

on the A side

n Turn on loop A cooling

n Power up systems on loop A

n Verify everything is working 

properly

n Repeat for loop B

This took a fair amount of time. 

Spacewalking astronauts had 

approximately 6.5 hours to conduct 

the EVA (see Chapter 17). Therefore, 

only one set of lines would be 

opened on this EVA. Next, the 

ground activated the key systems 

of Node 3. Once the module was 

basically working, the attachment 

mechanisms could be used to 

relocate the Cupola. Although this 

sounds straightforward, any glitch 

would derail the entire plan. The 

flight control team and training team 

began extensive work to refine the 

activation procedures and to train 

them very carefully.

Remodeling

With the current EVA timelines, 

some free time was still available 

during the mission. The ISS Program 

officials asked whether the team 

could move the PMA3 module from 

its current temporary position to its 

new home on the end of Node 3—i.e., 

the port end (Figure 5)—where the 

Cupola was located at the time of 

launch. After the robotics, EVA, and 

OSO teams assessed the proposal, 

a workable plan was developed; 

however, the plan required adding 

another day to complete the mission.

Adding days to a shuttle mission 

required substantial analysis to 

ensure the supplies required for the 

seven-member crew could fit on the 

already busy and heavy mission. 

With the Space Shuttle Program 

winding down, the ISS Program 

was looking to take up as much 

equipment and supplies as possible. 
70 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

Therefore, a trade occurred among 

supplies and hardware for the ISS, 

supplies for the shuttle crew for an 

extra day, and the amount of work 

those additional astronauts could 

perform in the allotted time. An 

additional factor was that as the 

mission got longer, the team had to 

allow the crew a day off to rest. 

PMA 3

Node 3

Cupola

HRS Dynamic Envelope 

(brown shading)

77.2 cm (30.4 in.) 

Clearance

Images courtesy of MAGIK Robotic Analysis Team

Figure 5. The PMA3 relocated on the port end of Node 3 (top), showing the tight clearance 

with the radiator (bottom) where the brown shading illustrates the dynamic clearance envelope 

of the moving radiator. 

Also around this time, the ECLSS 

team realized that with the many 

available hands of the shuttle and 

increment astronauts, significant 

progress could be made in relocating 

the regenerative life support and 

exercise racks that were destined to 

be installed. This promised to be a 

complicated task. Much of the US 

Segment life support system would 

have to be shut down, transferred, 

installed, and reactivated. This 

large amount of work had to be 

accomplished in as short a window as 

possible because of the critical need 

for life support and the additional 

demand of seven more people on the 

station at the time. Since the team 

had to add a day to the mission to 

relocate the PMA3, this provided an 

extra day to start the rack relocations 

(i.e., two crew would perform the 

PMA3 robotics operations while 

the remaining crews could work on 

configuring Node 3). It was assumed 

that the programs would find this 

worth the cost of adding supplies 

to the mission. By the end of the 

summer of 2009, the mission had 

grown to a 13-day mission. However, 

to be conservative and to allow for 

things going wrong, the additional 

day was considered optional and 

would be officially added to the 

timeline only during the flight if all 

was proceeding reasonably according 

to plan. If things did not work out 

well, these tasks would fall to future 

increments after the orbiter departed.
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 71

Node 3 was closed off for a couple of 

days, and was therefore unavailable 

for the astronauts to begin any 

outfitting. If the crew could work in 

Node 3 and prepare the Cupola for 

relocation, this task could be done 

during the docked shuttle mission. 

Four key issues had to be overcome 

for this to occur. First, although the 

modules were constructed in clean 

rooms, there were always small bits 

of debris that could not be found and 

removed on Earth. Once in space, 

these particles float freely, posing 

an eye injury or inhalation risk. 

Therefore, for the new modules, the 

safety engineers required the fans be 

up and running for some time before 

the crew could ingress. In this way, 

the filters would have time to capture 

all the loose debris. The second 

concern was that carbon dioxide 

and humidity would build up inside 

Node 3 if no airflow was present 

in the module; furthermore, the 

buildup of humidity would result in 

condensation. Next, the module would 

be dark inside since the power would 

not be available for lights. A final 

issue was the inability to determine 

whether ammonia was somehow 

leaking into the cabin. Normally, the 

pumps and computers have sensors to 

detect the presence of ammonia. 

The ECLSS and Thermal Operations 

and Resources teams, with support 

from the BioMedical Engineer 

group and Boeing engineers, came 

up with workable solutions. The 

astronauts would wear eye goggles 

and surgical masks to prevent the 

debris from causing any injury, 

even though these options weren’t 

particularly comfortable. 

To solve the second issue, the ECLSS 

team combined gray tape with some 

unused ducting that was tucked 

away with another duct (one that 

was normally used to help pump air 

into the orbiter). This effort created a 

7-m (23-ft) long duct that would be 

relocated into the Cupola during the 

time the astronauts were inside. If the 

crew members were in Node 3, they 

were not going to be on the orbiter. 

Therefore, the duct was connected 

to an IntraModule Ventilation fan in 

Node 1 and dragged into the inactive 

Cupola vent. Note that any cables or 

hoses passing through a hatchway 

were normally not allowed because 

if a catastrophic cabin leak were to 

occur, the crew would have to be able 

to exit the module and quickly close 

the hatch. The ECLSS team worked 

out a plan with the astronauts so that 

this could be done quickly during the 

small window of time in which the 

astronauts were inside Node 3. 

Portable lights ensured visibility. 

Finally, the team analyzed and 

concluded that if the ammonia was 

not flowing through any of the 

cooling lines, the risk of a leak was 

acceptably low enough to allow the 

crew to be inside the module. This 

mission was evolving into one of 

the most challenging for the ECLSS 

team, as it had for the OSO team.

With approval from both programs, 

work to add these tasks to the mission 

began in earnest. As with any task, 

the PMA3 relocation grew more 

complicated as the team worked out 

additional details. With the PMA3 

on the end (i.e., port side) of Node 3, 

the clearance between the farther port 

radiator panel and the module was 

going to be tight (Figure 5, bottom). 

In fact, at this point, the team didn’t 

even know whether there was enough 

clearance. When thousands of parts 

have been built by many different 

people from around the world, 

pinpointing the measurement of the 

final assembled structure was not an 

easy task. The size of all parts were 

recorded in drawings and in computer 

models, but verification was required 

to ensure everything was actually 

built as planned. Thermal expansion 

and, more critically, the flexing of the 

radiator panel as it moved also had to 

be taken into account. After careful 

calculation, engineers estimated that 

there was slightly more than 2 feet 

of clearance. Yet, that was true only 

if the calculations were right. In 

the event of a calculation error, the 

radiator and PMA3 could endure 

serious damage.

The station team developed a 

conservative plan in case of 

calculation errors. After Node 3 

was installed on the ISS with the 

Cupola still positioned for launch, 

the robotic cameras took images 

that were used to measure the exact 

clearance. Although the PMA3 was 

different than the Cupola, this was 

much closer to reality and permitted 

the engineering team to get more 

precise measurements. Images 

were taken from multiple positions 

to generate photogrammetry for 

a three-dimensional (3-D) model. 

After Node 3 was installed early in 

the mission, and before the team 

was given the green light to move 

the PMA3, engineers analyzed the 

3-D model to ensure their preflight 

calculations were right. The team also 

had to develop a flight rule that stated 

under what conditions it would be 

“go” for the relocation. 

The team remained cautious. The plan 

was to move the PMA3 between the 

second and third EVA. This meant the 

Cupola had to be moved quickly after 

Node 3 was up and running to open up 

that berthing port for the crew to hook 

up the heater cables on PMA3 during 

the third spacewalk. Even so, the team 

planned to methodically move the 
72 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

radiator toward its final position on 

the PMA3 and watch with the cameras 

to confirm the clearance. After plenty 

of margin was confirmed, the radiator 

was allowed to rotate freely and be 

“go” for the relocation.

A new problem surfaced in the fall 

of 2009. With the decision to install 

the new Permanent Multipurpose 

Module (PMM) on the nadir side 

of Node 1, concern arose that the 

billowy insulation over the ammonia 

lines that ran right beside the Node 

1 nadir berthing port might interfere 

with the module during installation. 

Analysis showed that the lines would 

pass through the PMM (Figure 6). 

This is what happens when late 

changes are made to a program that 

has been working on these issues for 

years. The team had to adapt.

Figure 6. A computer-generated analysis showed the ammonia hoses (four white lines) for Node 3 

(upper left) would pass through the PMM near the astronaut’s feet on their way to Node 1 (upper right).

Once the issue was identified, 

the team came up with some 

modifications to the insulation and 

tie-down plan (Figure 7). Newly 

mocked-up ammonia lines were 

built and the crew practiced the 

EVA in the water at the NBL. The 

EVA team became concerned that 

the modifications were not adequate 

enough to ensure clearance with the 

PMA3. With approximately 4 months 

remaining before flight, it was 

getting late to work out some of these 

issues. The team convinced the ISS 

Program officials that it was prudent 

to temporarily shuffle the PMA3 to 

the top of the Node 2 zenith to ensure 

it was not in the way. This meant a 

lot of new, last-minute work, but this 

removed all the residual risk. Training 

for the task of moving the PMA3 

also had to be quickly performed and 

scheduled during Expedition 22—less 

than a month before the mission. 

Fortunately, the ground and crews 

were becoming highly experienced at 

moving PMA3.

Image courtesy of Art Thomason

Figure 7. The spacewalking astronauts from STS-130/ISS-20A and EVA team try to figure out a new 

routing of the ammonia lines and the insulation using a crude mock-up of where the connectors would 

be on the various modules.

The other half of the ammonia lines 

would be integrated on the third 

EVA. Within this time frame, Boeing 

engineers worked out a new plan for 

the ammonia lines so they would not 

interfere with the PMM. Elbows with 

90-degree turn would be added to the 

lines to angle them away from the 

PMM. Tethers would then be used 

to tie the lines back. This required 

a great deal of analysis because the 

tethers had to be installed prior to the 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 73

lines being pressurized (they might 

be too stiff to move after), but they 

had to be strong enough not to break 

when the hoses were pressurized.

At this point, the mission had 

changed a great deal. The plan now 

included the following:

n Launch the orbiter with Node 3 

and Cupola

n Install Node 3 on the ISS during the 

first spacewalk

n Outfit the vestibule of Node 3 

in preparation for activation 

and ingress

n During the second spacewalk, install 

two pair of the ammonia lines and 

open one pair to begin cooling and 

allowing for activating half of the 

module. As soon as the systems 

were working, relocate the Cupola 

from the port end of Node 3 to its 

nadir side. Perform 3-D imagery 

analysis to verify radiator clearance.

n The next day, move the PMA3 

from its temporary location on top 

(zenith) of Node 2 to the port end 

of Node 3

n During the third spacewalk, 

integrate the second ammonia loop, 

open the shutters on the Cupola, 

and take photogrammetry to verify 

the PMA3 will not interfere with 

the Thermal Radiator Rotary Joint 

and that the PMM will not interfere 

with the ammonia lines

n Transfer critical items including life 

support systems

n Land the orbiter

What’s in a name?

In 2009, NASA initiated a novel public outreach 

project: have the public name Node 3. Each module 

of the ISS, however, had been given a friendly name 

by its country of origin (see Introduction); therefore, 

NASA set up a website and asked the public to submit 

names for Node 3. The most popular name would be 

selected. Comedian Stephen Colbert of the Comedy 

Central show The Colbert Report tried to get his 

audience to name Node 3 after him. This campaign 

proved hugely successful and his entry (the “Colbert 

module”) was at the top. By law, NASA could not name 

a module after a private citizen or commercial entity, 

which put the agency in a difficult situation. Colbert 

did a great job of raising awareness of the mission. To 

show appreciation for his efforts, NASA sidestepped 

the issue directly by naming the module Tranquility and 

coming up with a consolation prize: naming the new 

treadmill in Node 3 after Colbert. Initially called by the 

accurate-but-unexciting name of T2, the treadmill was 

rechristened the Combined Operational Load Bearing 

External Resistance Treadmill, or COLBERT (Figure 8). 

It even had an official logo. Figure 8. Tom Marshburn of Expedition 34 exercising 

on the COLBERT in 2012. 

The Challenge of the 

Ammonia Lines

The ammonia lines (see Chapter 11) 

actually turned out to be another 

major challenge for this flight. The 

four lines needed to be about 8 m 

(~25 ft) long—the longest lines on the 

ISS. In addition, the ammonia could 

be at a fairly high pressure (3,400 kPa 

or 500 psi—more than 10 times the 

pressure in a typical car tire) to ensure 

enough fluid was passing fast enough 

to provide an adequate amount of 

heat-removal capability. Once in 

place and pressurized, a rigid line 
74 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

was not an issue; however, the crew 

members needed to be able to route 

and install the lines while wearing 

their bulky space suits. Therefore, 

NASA chose a flexible design. A line 

of flexible hose was to be attached to 

longer hoses using a braided sleeve 

welded to the joint. This is shown 

in Figures 9 and 10. The hoses were 

scheduled to be completed in May 

2009 (9 months prior to flight).

Node 3

Node 1

Port

Nadir

Figure 9. Graphic showing where the four ammonia lines would be routed from the S0 truss to 

Node 3. (Note that this figure is meant to show crew access for a given astronaut. Only two astronauts 

would actually perform the spacewalk.)

US Lab

Airlock

Node 3 Ammonia Jumpers

* Gap spanners not shown

Zenith

Port

Aft

Node 1

PMA 1

Node 3

Z-1

ESP-1

Cupola

FGB

Images courtesy of MAGIK Robotic Analysis Team 

Figure 10. A schematic showing the routing of the ammonia lines (colored). There are four ammonia 

lines—one for the ammonia flowing to and one for the ammonia flowing away from the pump for each 

the A side and B side.

A significant setback occurred in

July 2009 (about 7 months prior 

to flight) when an ammonia hose 

exploded at 50,300 mm Hg (973 psi) 

during pressure testing on the ground, 

causing significant damage to a 

second line nearby. Normally, the 

lines operated at approximately 

20,000 mm Hg (380 psi) with a 

program requirement to be able to 

withstand pressures of 52,000 mm Hg 

(1000 psi). A safety valve should open 

at 23,300 mm Hg (450 psi) completely 

venting the lines in the event of a 

problem, such as a pump running 

at too high of a speed. The hoses 

were tested up to 52,000 mm Hg 

(1000 psi) to ensure that the lines 

would not rupture if the valve itself 

failed. Analysis of the exploded hose 

seemed to indicate that the explosion 

was the result of a manufacturing 

issue and not a design problem, 

thus new lines were produced. The 

number of braids in the welding 

was doubled to improve margin. 

The new hoses began testing in 

November 2009. One of the hoses 

showed a leak. Metallurgical 

analysis revealed that liquid-metalinduced embrittlement during the 

welding process led to the failure. 

At this point, the team was less than 

3 months to launch. To add insult to 

injury, a third hose that had passed 

testing was damaged during shipping 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 75

from the manufacturer. Of great 

concern was that the damage seemed 

greater than one might expect from 

simply dropping the container. This 

led some to think a critical design 

flaw would prevent the lines from 

meeting their stringent requirements.

At this point, a “tiger team” was 

formed. A tiger team is a panel of 

experts given the authority to focus 

on a particular issue until a resolution 

is found. At an already busy time, 

numerous reviews and meetings 

were occurring at all hours of the 

day and night, all over the country. 

When the great sleeping beast that is 

NASA awoke, all resources turned to 

this problem. Many members of the 

20A flight control and engineering 

teams were busy supporting the tiger 

team. In addition to understanding 

the issues, the team had to identify 

impacts that any proposed solution 

would present to the mission, and 

then figure out how to modify 

procedures or training. All of this 

had to be done while continuing the 

other ongoing work and training. 

On any mission, the teams sprinted 

to the finish line to have everything 

in place. The extra work provided 

additional pressures and the lead 

flight director had to ensure that 

members of the operations team did 

not burn themselves out before the 

mission. Several parallel paths were 

chosen. First, more of the original 

hoses were being produced. With the 

revelation that the embrittlement was 

caused by welding, a new welding 

process was adopted to hopefully 

prevent this from happening. In 

addition, hoses using a new design 

were being built. Instead of the 

flexible line and sleeve, the middle 

would be a solid tube and a basic 

metal-to-metal, or butt-weld type 

would be used. Multiple versions 

of each type were manufactured to 

allow for further problems.

The new design really was simply an 

application of previous techniques. 

The method was previously used 

on the ISS, yet the length had never 

before been used either in space or 

on the ground. In fact, since time 

was short, leftover hoses from 

previous evaluations were to be 

used, thereby reducing the amount 

of testing. These hoses were dubbed 

“frankenhoses” because they were 

put together from several pieces. The 

welding process was tried and true. 

In January, the new lines were tested 

to their bursting point of 26,900 mm 

Hg (520 psi). Although the updated 

braided hoses were also ready, ISS 

Program personnel decided to go 

with the frankenhoses.

The frankenhoses were being 

completed literally as the crew 

went into quarantine. Spacewalkers 

Bob Behnken and Nick Patrick left 

quarantine and flew to Huntsville, 

Alabama, where the testing equipment 

and hoses were located, and where 

the two astronauts would be able to 

handle the items in advance. In fact, 

engineers at Marshall Space Flight 

Center quickly built a test stand that 

roughly represented the attachment 

points (Figure 11). Engineers were 

concerned that the equipment would 

be too stiff, but the astronauts felt 

they could work with the lines. After 

familiarizing themselves with the 

lines, the crew packed the hoses into 

a special EVA bag for shipping to 

Kennedy Space Center where the 

items would be loaded onto Space 

Shuttle Atlantis. 

Ammonia lines

Image courtesy of Art Thomason

Figure 11. Engineers at Marshall Space Flight Center built a test rig that allowed the astronauts to 

roughly lay out the final ammonia lines (wrapped in white insulation, as seen in the photograph) with 

realistic attachment points days before the mission was scheduled to launch.
76 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

Training

Training began in earnest 

approximately 6 months prior to 

the planned mission launch. Several 

types of training were involved. 

Since the teams were composed of 

experienced flight controllers and 

flight directors, the training at this 

point was called “flight specific” in 

that it dealt with the actual mission 

instead of any generic skills. On the 

Space Shuttle side, the team—i.e., 

the flight control team and the 

astronauts—performed a number 

of simulations, primarily practicing 

launching, landing, and aborts. 

The ISS teams also trained. Flight 

controllers on the ISS side of the 

house simulated the spacewalks, 

as well as the berthing, moving, 

and activation of modules during 

approximately a dozen simulations 

(sims). A key series of sims for the 

ISS team was the powering down 

of half the systems, integrating 

the loop A or B ammonia lines, 

and activating Node 3 and Cupola 

modules. Owing to the complexity 

of this task, the EVA steps were 

role-played during these sims instead 

of having the actual astronauts 

perform the steps in the NBL at the 

same time. Several joints sims were 

conducted between the two program 

teams, especially for rendezvous and 

docking. The station training lead 

and the shuttle simulation supervisor 

were key members of the operations 

team. Not only did they ensure that 

the crew and flight control team were 

trained and ready for the mission, 

they also poked at the timeline or 

flight rules to look for any issues 

the team had not considered. For 

example, looking into the timeline 

or flight rules might reveal the 

team had not allowed enough time 

for an activity, or a flight rule that 

was perfect for a nominal situation 

completely fell apart if something 

went wrong. The trainers would 

throw numerous malfunctions at 

the flight control team. This helped 

that team gain the confidence 

needed to deal with real problems 

in space while remaining composed. 

Although the specific simulated 

failures may not occur during the 

mission, the team knew how to work 

the problems in a cool and integrated 

fashion. The flight directors worked 

closely with the station training lead 

and shuttle simulation supervisor 

to ensure the core elements of the 

mission would be fully trained; 

however, the specifics were left to 

the training team. 

Figure 12. Astronaut Robert (Bob) Behnken installs a clamp to hold down the ammonia lines during a 

training run in the NBL.

As the months went on, the flight

directors ensured the controllers 

worked seamlessly as a team and 

that the plans were ready for the 

real mission. Since everyone was 

so nervous about the ammonia lines, 

the sneaky training team even 

threw in a simulated ammonia leak 

during one of the training runs. 

The team worked through it in the 

simulation, but everyone realized 

the situation had not been thought 

through completely. Therefore, the 

team cleaned up the procedures and 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 77

trained everyone with additional 

review and simulations.

A key part of the training was 

having the crew practice the 

spacewalks. The crew and EVA 

team, as well as the lead station flight 

director, conducted many dives in 

the NBL to practice the timelines. 

Although EVAs are always tricky, 

the ammonia lines were, once again, 

the biggest challenge (Figure 12). 

The crew needed to extensively 

practice the installation in the 

NBL because the ammonia lines 

were long, stiff, and covered by 

bulky insulation (Figure 13). The 

team also tried to figure out how 

best to carry such long lines out to 

the worksite, and then unpack and 

install them. Imagine carrying four 

stiff 8-m (25-ft) long rubber garden 

hoses from the garage. Then 

imagine doing it in weightlessness. 

A new bag was designed to hold the 

hoses. The crew practiced, in the 

water, how best to position and 

open the bag, and remove and install 

the lines without getting a big tangled 

hydra on orbit. Due to the presence 

of gravity in the NBL, the hoses 

tended to come springing out of the 

bag like a crazed jack-in-the-box—

or even something more disturbing, 

like in a scene from the movie 

Alien—once the crew opened the 

bag on the bottom of the mock-up. 

Figure 13. The billowy white insulation surrounding the ammonia lines at the NBL mock-up. This insulation drove the decision earlier on how to move PMA3 

so as to not interfere with the PMM. Note that when the bag that held the ammonia lines was opened in the pool, the lines would shoot out toward the bottom 

like a crazed jack-in-the-box due to the orientation of the mock-ups in the water. Due to the problems with ammonia lines, as described, the final flight units 

were not ready for the mission until a few days before the mission. The spacewalking crew members wanted to handle the final items so they would have an 

idea as to what to expect on orbit. Therefore, the final days before the launch, they flew to Huntsville, Alabama, where the lines were being manufactured. 

Not only did they handle the ammonia jumpers, they packed the specially designed bag. The packed hoses were then rushed to the launch pad and stored in 

the orbiter. The crew members flew back to their quarantine facility at Kennedy Space Center. 
78 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

The Making of a Crew Member 

Robert Behnken, Lead Spacewalker 

STS-130/ISS-20A

During the making of a mission into space, whether it is 

a short-duration, long-duration, first, or last flight, crew 

members need to strike a balance between taking enough 

ownership that they are ready for all the tasks they will 

face, but not taking so much ownership that they become 

too disappointed should the mission change before their 

eyes. NASA has plans for lots of exciting missions that 

have not been done, and none of us can do them all! For 

STS-130/ISS-20A and ISS Increment 22, the missions 

covered a wide range of exciting tasks right up until they 

were executed.

As a part of the many mission permutations, after the 

Columbia accident in 2003 and prior to the Space Shuttle 

Return to Flight in 2005, NASA built plans to keep the 

station populated in the face of an unpredictable shuttle 

launch schedule. I was part of a group of astronauts 

assigned to prepare for the ISS missions without a 

firm mission date. Our supervisor at that time was 

fellow astronaut and ISS veteran Peggy Whitson. I still 

remember her words to us as we began training: “The 

good news is you are all assigned to missions to the ISS. 

The bad news is I can’t tell you when they will be or how 

you will get there!” Officially, we were known as the “ISS 

Training Pool”... or “в бассейне” (literally “in the pool”) to 

our cosmonaut friends. (They found this quite humorous. 

To them, it implied we were on vacation in a “swimming 

pool” while they were hard at work!) And so we started, 

knowing we were headed to space but not knowing 

whether we were preparing for shuttle or Soyuz flights. 

When foam insulation again separated from the external 

tank during the STS-114/ISS-LF-1 (Return to Flight 

mission) launch, the launch manifest continued to evolve 

and we did our best to prepare for all options.

Figure 14. Bob Behnken and Nick Patrick installing ammonia lines and 

associated insulating blanket during the second STS-130 spacewalk. 

Limited consumables dictated that the installation plan proceed precisely 

according to schedule to ensure enough clean-up time after the 

predicted ammonia leakage time frame. 

Over the course of the next year and a half, those of 

us in the ISS Training Pool became certified operators 

and specialists on various ISS systems, continued our 

study of the Russian language, and traveled to Star City 

to be trained on the Russian portion of the ISS. From 

time to time we would hear snippets from the training 

or the planning flight controllers on what NASA had in 

store for us, and we would receive congratulations from 

cosmonauts that had seen our names on future manifests 

(sometimes as their crewmates). Through it all, we tried 

to not get our hearts set on any particular solution and 

to prepare the best we could for spaceflights...however 

and whenever they came. Largely outside our day-to-day 

life as assigned astronauts, NASA continued to make 

progress on the challenges with the shuttle external tank, 

and the flight manifest began to stabilize. For those of us 

who were prepping in the ISS Training Pool for uncertain 

missions, things became a lot clearer. For me, it meant 

leaving the “swimming pool” and preparing for the longest 

shuttle-docked mission to the ISS and the first fivespacewalk mission to the ISS, and leaving behind a Soyuz 

flight to the space station in the Increment 22 time frame. 

The shuttle manifest continued to remain relatively stable 

for the next year. In March 2008, my shuttle crew and I 

completed STS-123/ISS-1J/A, finished our post-flight 

activities, and began technical jobs back within the 

astronaut office. I was assigned to future program support 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 79

(vehicle development for exploration missions after space 

shuttle retirement), and was surprised late that year to 

learn that I was headed toward another shuttle mission on 

STS-130. After looking closely at the manifest, it became 

clear that this mission would likely be during Increment 

22 in the time frame I would have been on board the ISS, 

had my path continued on the Soyuz route 2 years earlier.

As the rest of the chapter outlines, the assembly mission 

STS-130 and its associated hardware took a twisted 

route to its final incarnation, just like I did as a crew 

member. Over the years, the cupola was an on-again/

off-again part of the ISS. Certainly no mission would be 

dedicated to delivering it, and much of the space station’s 

primary function could be performed without it. But, 

in the end, the value of having an observation port for 

visiting vehicles carried it to orbit. Node 3 was relocated 

even before it was ever installed and, as described in 

the chapter, the number of little things that had to come 

together to make that possible is just amazing. The 

fact that they all came together on schedule to allow 

for module activation during the STS-130 mission was 

an added plus for our shuttle crew (although it wasn’t 

something we could have our hearts set on). At one 

point during the ammonia flex line development and 

test sequence, when the schedule seemed particularly 

challenging, the idea of delaying install and activation 

to a future shuttle crew was considered. Having trained 

dozens of hours for these tasks in NASA’s Neutral 

Buoyancy Laboratory (NBL) and assisted with the 

development of the hardware itself, both myself and my 

spacewalking partner Nick Patrick knew that this task 

would not be easy, even for us, and that it would be 

extremely challenging if someone else picked it up on 

short notice and tried to squeeze it into their alreadypacked mission timeline.

Module activations for new parts of the ISS delivered 

by space shuttle generally involved the same basic 

steps. One: move module from payload bay to ISS. Two: 

connect power and cooling. Three: gracefully incorporate 

the new hardware into the rest of the ISS system. For 

Node 3, Step 2 was above average in difficulty, and it was 

the one being considered for transfer to a future flight 

if the ammonia flex line hardware was not available at 

launch time. The install required four stainless steel flex 

lines to be installed and then wrapped in a large insulating 

blanket. Normally it is pretty challenging if a spacewalk 

has to install something that is bigger than a crew 

member. In our case, this spacewalk had five big items, 

and keeping them under control simultaneously was even 

more challenging. After several months of development, 

Nick and I and the rest of our team had a pretty slick 

process for getting it all done and even looking graceful 

while we did it. Gone were the days of all the hardware 

falling to the floor of the NBL as the initial scene from 

our spacewalking show. As the lead spacewalker for 

STS-130, I remember being asked about the spacewalk 

content being moved to the next shuttle crew, and how 

some felt our crew should advocate to the ISS Program 

that we should keep the content. My input was that we 

should let the other crew try the install and see how they 

felt about taking this content on. As with the ISS training 

that I started years before for an uncertain mission, I felt 

we would execute whatever mission they eventually put 

in front of us whether or not it included ammonia flex lines 

and insulation. In the end, the follow-on crew members 

that attempted our “EVA 2” were the strongest advocates 

for STS-130 to keep the content. For them, 6 to 7 hours 

of wrestling ammonia lines and insulating blankets made 

it clear that this EVA had more than its share of blood, 

sweat, and tears to extract from the installation crew and, 

in their minds, they were happy to have it be ours!

During my time on orbit during STS-130, I had a great 

appreciation for all that had gone into the development 

of the mission (Figure 14). My discussion with the 

ISS commander regarding how we could task his crew 

to assist with our spacewalking preparations really drove 

home all the alternatives for which we had prepared. 

Having trained for that crew years before, I really 

understood what they could do for us and what we 

could do for them. In the end, both the Increment 22 

and STS-130 crews were really proud to be a part of 

the mission.
80 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

Fly

After an unusually lengthy and busy 

interval of preparation, it was finally 

time to fly. The road was long, but 

everyone was ready by February. The 

training was done. The multitude of 

programmatic reviews were complete 

at NASA, culminating in the Flight 

Readiness Review. The consoles were 

stocked with office supplies and extra 

food. The mission was scheduled to 

lift off on February 7, 2010, but was 

delayed due to poor weather. After a 

frenetic rush toward the mission for 

many years, there was an eerie calm—

not unlike that slow creep up and 

over the first hill by a roller coaster 

before it takes a deep plunge. On 

February 8, Space Shuttle Endeavour 

launched perfectly (Figure 15). The 

final mission timeline and plan for the 

spacewalks are shown in Figures 16 

and 17, respectively.

Figure 15. Launch of Space Shuttle Endeavour on February 8, 2010 (left). View of Endeavour’s cargo bay from the ISS showing Node 3 with Cupola attached 

to the end. Due to the weight of the module, the rest of the cargo bay was empty.

The Space Shuttle flight control team

and its flight director monitored 

all the systems of the orbiter while 

preparing for rendezvous and 

docking. Things were a little quieter 

in the space station flight control 

room, since their part of the mission 

did not begin until final rendezvous. 

This gave the team time to make 

the last updates of procedures and 

provided an opportunity for the flight 

director to, once again, write down a 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 81

Figure 16. The final 

overview timeline used to 

execute the 20A mission. 

Shuttle missions went 

by Flight Days with the 

first beginning at the 

moment of launch, even 

if the astronauts had 

been awake for a while. 

Twenty-four hours later, 

Flight Day 2 would begin, 

and so on. This graphic 

illustrates the major 

events that the Shuttle 

and ISS crews performed. 

Other key activities—just 

as “N3 ground act” 

(approximately 04:00 

GMT on Flight Day 07), 

which was performed 

by the ground—appear 

above the Flight Day 

events. Note that the 

flight control team and 

the astronauts followed 

a much more detailed 

timeline as shown in 

Chapter 1, but this 

provides a quick view of 

the key events and how 

they relate to each other.
82 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

list of open issues—or worse, think 

about the things that they might have 

forgotten. However, issues constantly 

surfaced. Big and small trades were 

made at every turn. The Oxygen 

Generator Assembly failed a few days 

prior to the launch of Endeavour. 

The engineers pushed to have it fixed 

before the rack was relocated into 

Node 3. That way, if it couldn’t be 

reactivated, it was definitely related 

to the move and not the original, 

yet-to-be-diagnosed failure. The 

ISS team revised their timeline 

to squeeze in some repair work. 

A cooling valve on the Columbus 

module was not working properly, 

thus the team had to evaluate how 

it would impact the shutting down 

of the ammonia loops. Several 

meetings were held where the flight 

controllers concluded that only minor 

impacts could be accommodated in 

the procedures. A recent longeron 

shadowing event (see Chapter 9) had 

ISS Program management concerned 

that damage may have been done 

to the mast. They wanted highresolution photographs to inspect for 

possible damage. The windows on 

the orbiter’s aft flight deck offered 

the best viewing location. However, 

the ultraviolet window screen would 

have to be removed to produce the 

sharpest photographs—an option 

that violated safety rules. Then the 

team got word that the president of 

the United States, Barack Obama, 

wanted to talk to the crew during the 

mission. The president’s schedule 

would drive the linkup, which 

meant the astronauts would not be 

speaking with the president during 

the prime part of their workday since 

it took place in the middle of the 

night, Eastern Standard Time. The 

flight directors began adjusting the 

schedule to make it work. Besides the 

public relations aspect, it would be a 

nice treat to give a hardworking crew 

during the mission.

Figure 17. The final EVA timelines. EVA 1 consisted of preparing Node 3 for berthing. First the LTA power cable that powered the heaters was disconnected 

and bolts holding the module in the cargo bay were released. While the robotic arm was moving Node 3 from the orbiter cargo bay to its berthing spot, 

the crew performed other tasks such as positioning the bag that holds the ammonia hoses and removing the Orbital Replacement Unit Tool Platform. Once 

berthed, the spacewalking astronauts reconnected the heater cable as well as an avionics computer cable that would allow the computers to talk to the rest 

of the ISS systems. On EVA 2, the ammonia line of the “A” side of the cooling system was installed, and MLI (see Figure 14) was installed. This was repeated 

on the “B” side. The trunions, which helped hold the module securely in the cargo bay, were then covered to prevent heat from leaking away from the module. 

During EVA 3, the Loop “B” cooling was fully integrated into the ISS system (Loops B QDs) followed by removal of the MLI that protected the Cupola and the 

releasing of locks that held the shutters in place during launch. The LTA heater cable, which was no longer needed since Node 3 systems were now fully 

functional, was removed. Other small tasks were performed on all three EVAs. The Get Ahead section on the last spacewalk consisted of a list of small tasks 

that were not required for STS-130/ISS-20A but that had to be performed at some point; time permitting, the EVA officer picked tasks from a list of various 

options for the crew to perform.

The flight control team was used to 

working around these types of issues. 

By all standards, the mission was 

going smoothly. The training and 

hard work of numerous people over 

the years was paying off. The first 

significant issues with the intricate 

ballet of module movements came 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 83

when the crew ingressed the Cupola 

on Day 6 of the mission to ready it 

for the relocation. To ensure adequate 

airflow with the 7 m (23 ft) duct 

(Figure 18), the crew used a device 

to measure the airflow and found it to 

be much less than expected. Per flight 

rules, fewer crew members were 

permitted in the area. Next, the crew 

went in and installed a protective 

cover over the Cupola to thermally 

shield it during the relocation. 

Unfortunately, the cover could not be 

installed on the ground and launched 

into position because the vibrations 

caused by the launch were greater 

than the structure of the Cupola could 

withstand if the cover was in place. 

When crew members installed the 

cover, they noted that the clearance 

between the cover and some brackets 

was too small—a thin metal ruler 

barely fit between the bracket and the 

insulation. If the clearances were even 

tighter on the nadir port, the Cupola 

could not be mated. 

Figure 18. The 7-m (23-ft) long duct extended through Node 3 and into the Cupola to ensure proper airflow. Pictured are NASA astronauts Jeffrey Williams 

(center), Expedition 22 commander; Terry Virts (left), STS-130 pilot; and Nicholas Patrick, STS-130 mission specialist.

The contingency teams, including 

Team 4 (see Chapter 20), roared to 

life to analyze the problem. There 

was only a small window of time 

before things such as the PMA3 

relocation dropped off the mission if 

the ballet got backed up. The teams 

considered different options. Could 

they do the move without the cover? 

What was the expected clearance on 

the nadir port since the module had 

never actually been physically mated 

together? Would the motors have 

enough force to bend the brackets 

without damaging the structure if 

there was interference? The root of 

the problem quickly became apparent: 

to save file size, the computer models 

did not include bolts since thousands 

of bolts added megabytes to each 

drawing. What seemed like a small 

issue became a significant wrinkle.

The mission was not placed on 

hold while that problem was being 

worked. While preparing Patrick’s 

space suit for the second EVA, 

the team discovered that the fan 

speed of the water pump was far 

less than expected. If it failed 

during the spacewalk, it could 

jeopardize his life and cause the 

flight control team to abort the EVA. 
84 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

Unfortunately, repairing the suit 

required two crew members for 

2.5 hours, which translated into the 

need for a significant amount of 

schedule replanning. 

It was common for the simulation 

team to be maligned for coming up 

with diabolical scenarios. Yet, their 

efforts paid off when, as if on cue, 

Patrick got a small spray of ammonia 

during the second EVA. Everyone 

knew what to do and how long it 

would take. The flight control team 

worked through the procedures, 

and no ammonia was detected in 

the atmosphere. Vindicated, the 

training lead knew his training had 

been successful.

After a number of meetings around 

the clock, the teams determined 

that there would be barely enough 

clearance for the Cupola to fit on 

Node 3 nadir. If enough clearance 

did not exist, it was likely some of 

the brackets would bend but nothing 

would break. This, however, was 

considered unlikely. The teams 

pressed ahead toward the relocation. 

After the second spacewalk, the 

Node 3 module was activated for 

the first time using half of the power 

and cooling systems (Figure 19). 

After the activation, one of the key 

Multiplexer/DeMultiplexers (MDMs) 

controlling Node 3 nadir Common 

Berthing Mechanism (CBM), where 

the cupola would be mated, failed 

into the diagnostic safe mode (see 

Chapter 5). While the flight control 

team tried to quickly interpret the 

cause, the flight director ensured 

the team didn’t get too far behind 

on the timeline and that the most 

critical objectives could still be 

accomplished. After a power cycle, 

the MDM was operating again and 

preparations for the mating could 

continue. However, this was not the 

only challenge keeping the Onboard 

Data and Information Network 

officers in particular, and the team 

in general, occupied. The computer 

system in the Columbus module had 

experienced an unknown failure and 

was not working. 

Figure 19. Flight Director Robert Dempsey and Capsule Communicator (i.e., CAPCOM) Hal Getzelman 

in Mission Control focus on activating Node 3 module during the STS-130/ISS-20A mission.

Flight Day 8 arrived, and it was time 

to relocate the Cupola. Problems 

in the CBM—basically, the system 

of bolts used to fasten modules 

together—rarely occurred on orbit, 

so it came as a bit of a surprise 

when in Mission Control OSO saw 

an indication that one of the bolts 

had jammed while trying to detach 

the Cupola. After quick discussions 

with the engineering team, OSO and 

the flight director decided to force 

the bolt to push harder. The bolt 

released, but a second one jammed. 

And then a third. This scenario 

was completely unexpected. The 

ground team had to stop to assess 

the situation, and to avoid damage 

to the hardware. However, it was 

like having an automobile tire half 

off, and not a good place to be in 

the long term. In real time, the team 

deduced that gravity caused the 

bolts to tighten unevenly during 

installation at Kennedy Space Center, 

unlike previous modules that were 

bolted together exclusively on orbit. 

Therefore, the forces on the bolt 

would be uneven as the Cupola was 

being de-mated (this is analogous to 

removing the adjacent lug nuts, rather 

than opposing nuts, while changing 

a tire). As in a simulation, the flight 

control methodically nudged and 

tweaked the bolts. Soon, the Cupola 

was free and moving to the Node 

(Figure 20). The clearances were fine, 

the MDM continued to operate, and 

the CBM bolts worked smoothly as 

the Cupola was firmly mated to the 

bottom of Node 3.

Since things were now running 

smoothly, the Space Shuttle Program 

and ISS Program teams agreed to 

use the extra mission day for the 

rack transfers. On the 8th day of the 

mission, the crew was like an army of 

ants, removing bolts that would hold 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 85

things in place during the tremendous 

vibrations during launch, removing 

items stowed in Node 3, moving 

the life support racks and exercise 

equipment into place, and trying to 

secure all the elements. It was slow 

work. Each rack was shut down and 

carefully moved to the new location 

(Figure 21). The flight control team 

then powered the system back up. 

Every rack experienced some small 

hiccup during the relocation—a 

cable not connected properly, the 

software not exactly as it had been 

tested on the ground, air bubbles in 

the plumbing—and the team had to 

work through each issue. As with 

the OSO position, the ECLSS team 

had so much going on that two front 

room flight controllers had to work 

the various rack activities. Each 

system was so busy with its own 

activities. The flight director had to 

ensure everyone worked as a team 

in completing the critical activities 

on the timeline while deferring, 

and replanning, those that needed 

to be moved, and while working 

with the engineering support team 

and the Europeans on the various 

other working issues. The role of the 

flight director is not unlike that of a 

Chinese acrobat who balances several 

spinning plates on poles. Every shift 

presents a new wrinkle, such as when 

the lead EVA officer came down with 

food poisoning and had to go home 

for a while, creating yet one more 

issue for the flight director to balance 

and work through.

Figure 20. Cupola being maneuvered into position on the nadir side of Node 3 (left), and astronaut Patrick, during the third spacewalk, after removing the 

insulation that protected the module from launch until its heating system was operational (right).

Figure 21. Astronauts maneuver one of the many racks relocated to Node 3 module during the 

mission. As two crew members pushed a rack into a place, a third crew member helped guide it. All the 

power, data, and cooling cables would then be mated. 
86 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

Figure 22. President Barack Obama talks to the astronauts (seen in a video linkup in the top right of the picture) while students look on. Although the president 

could see the astronauts, no video was transmitted in other direction; therefore, the astronauts could not see what was happening at the White House.

Due to the length of the mission and 

the intense work being performed 

to that point, part of the 9th day 

of the flight was crew time off. At 

this time, the crew members get to 

rest and enjoy some views from the 

Cupola. But first, as soon as the crew 

members awoke, they had a linkup 

with the president (Figure 22). After 

a brief period of rest, the crew began 

preparing for the final spacewalk, 

which would take place the next day.

Analysis of imagery taken during 

the first spacewalk revealed that 

the clearance with the radiator and 

the PMA3 should be sufficient. 

Therefore, PMA3 was relocated 

to the end of Node 3. As an extra 

precaution, the radiator was slowly 

rotated as the Thermal Operations 

and Resources flight control team 

watched to ensure there would be 

no contact. The team confirmed that 

everything was good. 

Without incident, EVA 3 integrated 

the B side of the ammonia lines, 

this time with no ammonia leak. 

Insulation was removed from the 

Cupola shutters during the spacewalk, 

and the windows were opened for 

the first time. Even in a business 

routinely filled with amazing 

visuals—a Space Shuttle launch, the 

ISS floating above the Earth, a person 

in a space suit floating among the 

heavens—the view from the Cupola 

was stunning (Figure 23).

As quickly as the storm began, 

the mission started to wind down. 

Although not every task was 

complete, it was time for the 

crew of Endeavour to undock and 
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 87

return home. Far more had been 

accomplished than had been planned 

for even a year prior to the mission. 

Endeavour undocked on February 20 

and flew around the station. Photos 

were taken of the new installed 

module (Figure 24). The ISS crew 

took a much-needed break and then 

completed the outfitting of Node 3 

and the Cupola over the next few 

weeks. On February 21, 2010, 

Endeavour made a flawless nighttime 

landing at Kennedy Space Center.

Figure 23. View of Earth from the newly installed Cupola.

Figure 24. The underside of the ISS, as photographed by astronauts aboard the undocking shuttle, 

showing the newly installed Node 3 and the Cupola.

Epilogue

The final task of any mission is 

to conduct a “Lessons Learned” 

review. Even though more than 100 

shuttle flights had flown and dozens 

of ISS assembly missions had been 

conducted, NASA still learned from 

its mistakes. Every organization 

examined every step, from planning 

through training and into execution. 

The flight control team generated 

recommendations in each area 

and the flight director conducted a 

panel to determine which of those 

should be elevated and instituted in 

future missions. For example, it was 

agreed that all future spacewalks 

that entailed working with the 

ammonia lines would conduct some 

sort of contamination scenario in a 

simulation. But it was not all about 

criticism. Things that worked well 

were also highlighted so that other 

teams in the future can carrying 

those practices forward to help 

ensure everything goes as smoothly, 

or better. This is a key part of the 

Flight Operations Directorate culture, 
88 CHAPTER 4 DAY IN THE LIFE: THE MAKING OF A MISSION

and this work ethic is reflected 

in the competence and teamwork 

statements in the Foundations 

(See Introduction).

The operations team conducts two 

major ceremonies after each mission. 

The first—and, to many, more 

meaningful—is the hanging of the 

plaque. Since the days of project 

Mercury, the flight director would 

pick the person, persons, or team that 

did the most outstanding job during 

the mission and let the honoree(s) 

hang the mission plaque (Figure 25) 

that had been displayed at the flight 

director’s console during the flight. 

Actually, two plaques—crew mission 

patch and ISS mission patch—were 

awarded for a given Space Shuttle 

assembly mission. 

Figure 25. Lead OSO Kyle Brewer (left) and Lead ECLSS Officer John Garr (right) hang the 20A mission and module patches in the control room following 

the successful mission in 2010. 

The second ceremony was held

at Space Center Houston—the 

Johnson Space Center visitor 

center. Here, the crew showed 

video and narrated highlights 

from the mission. Various 

individual and team recognitions 

were awarded at this ceremony. 

However, a few minutes of 

recognition and thanks by the 

managers of the Space Shuttle and 

ISS Programs and the lead flight 

directors never fully reflected the 

immense amount of effort that 

went into the mission. 

Although the ceremony marked the 

official end of one mission, the teams 

(Figure 26) were already poised to 

start the process all over again.

Later that year, when NASA was 

trying to figure out what to do 

after President Obama redirected 

the Constellation Program, some 

officials at the space agency wrote 

a press release stating that Node 3 

could be detached from the space 

station and incorporated as part of 

a new vehicle that would go to an 

asteroid. Flight Director Robert 

Dempsey shook his head, laughed, 

and uttered the words that the whole 

team was thinking: “If they only 

knew how hard that would be.”
DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 89

Figure 26. The seven flight 

directors and their teams that 

supported STS-130/ISS-20A. 

The ISS teams are pictured 

on the left (from top to bottom): 

the Galileo team on the prime 

shift (orbit 1), the Tungsten team 

(orbit 2), and the planning shift 

team led by Saturn Flight (orbit 3). 

The Space Shuttle teams are shown 

on the right (from top to bottom): 

Defiant (orbit 1), Viper (orbit 2), and 

Venture Flight (orbit 3). Amethyst 

Flight, with the launch or ascent 

team, is located bottom center.

Chapter 5 Systems: 

Command and 

Data Handling—

The Brains 

of the International 

Space Station
92 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

Astronaut Susan Helms does a little “light reading” on the International Space Station.

Brains. That is essentially what 

the Command and Data Handling 

(C&DH) system is for a spacecraft.

Part of what is termed avionics, the 

C&DH system is responsible for 

the control of the primary systems 

of a spacecraft. 

Early spacecraft used electrical and 

mechanical switches to operate 

the vehicle. From the beginning 

of the Space Age, up through the 

Space Shuttle era, the astronaut 

was a primary component of the 

C&DH system—adjusting dials 

as needed, throwing a switch to 

configure a system, and responding 

when a component malfunctioned. 

Over time, computers played an 

ever-more-crucial role. Computers 

performed critical calculations that 

required accuracy and speed such 

as calculating the trajectory of a 

spacecraft as it descended to the lunar 

surface. The lunar module navigation 

computer possessed less than 

40 kilobytes of memory and ran with 

a processing speed of 2.048 megahertz 

(MHz). By comparison, a basic Apple 

iPhone in 2014 contained 200 times 

more memory, ran 1,000 times faster, 

and produced pictures typically 

2 megabytes (MB) in size. For the 

International Space Station (ISS), the 

crew would no longer be a primary 

component of the C&DH system. 

Computers took over virtually every 

aspect of the vehicle’s operations. 

Whereas the crew on the Space 

Shuttle interacted with the flight 

systems primarily through the use of 

switches or dials, nearly all aspects 

of the spacecraft operating system 

on the ISS are operated by computer 

interface and are therefore readily 

operable by the ground control team 

(i.e., the ground). This frees the crew 

to focus on research.

The C&DH system directs the 

operations of other systems via 
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 93

“command” while moving, or 

handling, information around the 

vehicle. In essence, C&DH would 

be familiar to the average person as 

the computer network. A command 

is a set of instructions telling a 

computer to perform an action. 

For example, the print command is 

common among computer users on 

Earth. Spacecraft employ a variety 

of C&DH systems, depending on the 

functional need of the vehicle and its 

architecture. Complicating matters 

further, the ISS C&DH system—the 

largest such system ever operated 

in space—is in fact an amalgam of 

computer networks developed in 

multiple countries. Each segment, 

Russian and United States Onorbit Segment (USOS), has its own 

architecture bridged by Node 1, 

aptly named Unity. The USOS is 

split into the American, European, 

and Japanese modules, each with 

its own computer network. As part 

of its function, the C&DH system 

will detect failures—whether they 

involve a piece of hardware such 

as a valve or are in the computer 

system itself—and alert the crew 

and ground via alarm. Astronauts 

use a laptop called the Portable 

Computer System (PCS) to interface 

with the C&DH system. Using this 

laptop, they can run procedures 

that operate the vast majority of 

ISS systems, although the ground 

tries to perform most procedures to 

free up the crew for research. Due 

to its important role in operating 

the spacecraft, the C&DH system 

(including the PCS) is classified as 

critical and therefore requires robust 

hardware or redundant components 

to ensure proper operation as well 

as exhaustive software testing. 

Astronauts also have a separate 

laptop called the Station Support 

Computer (SSC) upon which they 

can view the timeline and read 

procedures. SSCs are not linked 

to the C&DH system; because the 

SSCs provide only a support role 

(i.e., perform no critical function that 

would impact operating the ISS if an 

SSC failed), they are not considered 

critical. The SSC laptops connect to 

a Local Area Network (LAN) that 

would be familiar to anyone using 

laptops on a network. Payloads are 

generally controlled from the SSC. 

Through the SSC, astronauts can read 

email, access the internet, and use an 

Internet Protocol (IP) phone.

Initially, the Onboard Data Interfaces 

and Network (ODIN) officer 

operated the ISS C&DH system. 

Later, the ODIN function merged 

with the Communications and 

Tracking Officer function to form the 

Communications Radio Frequency 

Onboard Network Utilization 

Specialist (CRONUS) position. ODIN 

was supported in the back room by a 

resource avionics engineer. Although 

the SSCs are computers, they are not 

part of the C&DH system. Rather, 

the SSCs are handled by the PLugin-plan and UTilization Officer flight 

control position (see Introduction)—

also known as PLUTO—and are not 

discussed here.

Overview

The USOS C&DH system consists 

primarily of 46 nearly identical 

computers networked into a topdown tiered structure, as illustrated 

in Figure 1. At the top of the pyramid 

is the Command and Control System 

(CCS), a triply redundant set of 

computers located in the Laboratory 

Module that act as the brains of the 

USOS. Only one computer controls 

the system at a given time; if that 

computer fails, the second or third 

will take over operations. Due to 

the critical role of the CCS, three 

computers are required to ensure 

that multiple failures would not 

disrupt the control of the vehicle. 

The ground directly interfaces with 

the CCS via uplinked commands 

through the Communication and 

Tracking (C&T) system (see 

Chapter 13), whereas the crew can 

interact using a PCS. The CCS 

interfaces directly with the top-level 

computer on the Russian Segment 

known as the Service Module 

Central Computer (SMCC), as well 

as the computers in the European 

and Japanese modules.

The local tier (Tier 2) is located 

below the control tier. Computers 

at the local level control most 

spacecraft functions as well as the 

partner modules. Computers inside 

the ISS control such functions as the 

regenerative life support systems, 

ventilation, and temperature control 

while those on the exterior control 

heat rejection and the giant solar 

arrays. Another Tier 2 function is that 

of Guidance, Navigation, and Control 

(GNC), which drives the Control 

Moment Gyros while calculating the 

trajectory of the ISS using Global 

Positioning Satellite (GPS) sensors. 

Although still important, the Tier 2 

computers are not as critical as the 

CCS and, therefore, have only a 

single backup in case of failure.

At the bottom of the triangle is the 

user tier, indicated as Tier 3. This 

tier is responsible for control of all 

sensors and end effectors that are 

wired to computer cards within the 
94 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

Tier 3 Multiplexer/DeMultiplexers 

(MDMs). Sensors include devices 

that can measure the carbon dioxide 

or oxygen level of the crew’s 

atmosphere, the pressure inside a 

cooling loop, the speed of a fan, or 

the temperature of something. These 

devices are wired to an Input/Output 

(I/O) card in the computer. The value 

read by the sensor is transmitted to 

the card, which the computer will 

output to the Tier 2 MDM above it, 

where it is passed to the Command & 

Control (C&C) MDM for downlink 

to the ground. End effectors are 

items with moving parts, such as 

a switch or a motor, to effect a 

change. Some end effectors actually 

fire pyrotechnics (i.e., explosives) 

such as those used to release straps 

holding collapsed radiators in place 

for launch. Solenoid Driver Output 

Cards provide the interface between 

the MDM and the end effectors. 

When power is applied to the card, 

a solenoid will physically move to 

push or pull an item such as a valve 

into position. The ISS has thousands 

of these sensors and effectors, and 

almost all are replaceable on orbit 

if a repair is required. The Remote 

Power Control Modules (RPCMs), 

which are effectively circuit breakers 

that can be opened or closed via 

computer, are the most common type 

of effectors.

MCC

Telemetry Format Loads 

(TFLs)

Data Dumps

File Transfers

File Transfers

File 

Transfers

Commands File Transfers

Commands

Data Loads

Data Collection

Data Distribution

Commanding

Display Data

Legend:

PCS

Tier 1 MDM

Payload MDM

Firmware

Controller

Firmware

Controller

Sensors Effectors

Tier 3 MDM

Tier 2 MDM

CDC Tier Interfaces

Figure 1. Representation of the USOS C&DH system illustrating the tiered nature of the computer system. Tier 1 (the top tier) is the control tier, directing 

(red lines) all the lower-level computers. Data, or telemetry (purple lines), rise from the lower tiers back to the top where it is radioed to the ground control 

team or sent to the crew’s portable computer system. Tier 2 (the local tier) is where major functions such as guidance or thermal control are performed. All 

the sensors, fans, pumps, valves, etc. are controlled at Tier 3 (the user tier). 

Robustness at the user tier level 

(Tier 3) is achieved through 

redundancy of the systems. For 

example, a critical system may have 

two independent power feeds so that 

no interruption of electricity occurs 

if one power feed fails. Another 

example is where two separate 

heaters exist when only one would 

ever be needed. Tier 3 computers do 

not have backup MDMs since the 

systems themselves have layers of 

redundancy to protect against critical 

failures; of course, spare boxes are 

available on orbit to replace failed 

boxes. A summary of all the tier 

computers is provided in Table 1.
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 95

Table 1. A Summary of the Computers and their Functions on the ISS

Multiplexer/

DeMultiplexer

Configuration Major Software Functions

TIER 1

C&C-1

C&C-2

C&C-3

• Three fully redundant MDMs

• All powered on

• One operating as Primary

• Located internal to US Lab

• Process commands from Mission Control Center-Houston and PCS provide 

telemetry to Mission Control Center-Houston and data to PCS, redundancy 

management for Tier 2 MDMs, and time management. They also control 

station modes, software interface to International Partners, and File Transfer 

management.

• Emergency and Vehicle Safing: Execute commands to safe vehicle in response 

to an emergency event 

• Manage S-band, Ku-band, ultra-high frequency, audio, video, control highrate data link, and access mass storage device in support Communications 

Outage Recorder function

• Control Lab Direct Current (DC)-to-DC Converter Units, control RPCM for 

S0 and External (EXT) MDMs, control rack power based on switch position, 

execute power and thermal load sheds

• Control and coordinate attitude control handovers

• Interface to Robotics Work Station

TIER 2

Connected to Command & Control

Internal (INT)-1

INT-2

• Two fully redundant MDMs

• One powered on

• One operating as Primary

• Located internal to US Lab

• Control most Lab RPCMs

• Monitor and control of Internal Thermal Control System (ITCS) in Lab/Node 2 

including failure and leak detection/response

• Atmospheric control, water recovery, fire detection, temperature control

• Common Berthing Mechanism (CBM) control and safing

EXT-1

EXT-2

• Two fully redundant MDMs

• One powered on

• One operating as Primary

• Located on S0 Truss

• High-level control of Solar Array Rotary Joint 

• High-level control of External Thermal Control System and Thermal Radiator 

Rotary Joint

• Provides high-level control of: Structural Dynamic Measurement System, 

Common Attachment System, Segment-Segment Attachment System

• Control of Mobile Transporter

GNC-1

GNC-2

• Two fully redundant MDMs

• Both powered on

• One operating as Primary

• Located internal to US Lab

• Provide non-propulsive attitude control by controlling Control Moment Gyros; 

generate and supply pointing data

Power Module 

Control Unit 

(PMCU)-1

PMCU-2

• Two fully redundant MDMs

• One powered on

• One operating as Primary

• Located internal to US Lab

• Monitor and control of Main Bus Switching Units and most Station DC-toDC Converter Units, provides gateway for PhotoVoltaic Module equipment, 

provides solar array pointing data, monitor and control of some Lab RPCMs, 

control RPCM for PL-2 MDM

• Control of PhotoVoltaic Control Unit (PVCU) MDMs

Payload (PL)-1

PL-2

• Two fully redundant MDMs

• Both powered on

• One operating as Primary

• Located internal to US Lab

• Payload software support

• Configure, monitor, and control: Automated Payload Switch and Payload 

Ethernet Hub Gateway

Habitation 

Control Zone 

(HCZ)† - 1

HCZ-2

• Two fully redundant MDMs

• One powered on

• One operating as Primary

• Located internal to Node 3

• RPCM control 

• Monitor and control of Node 3 ITCS including failure and leak monitoring 

• Atmospheric control, water recovery, fire detection, temperature control, 

regenerative life support systems 

• CBM control and safing 

† Initially intended to control the Habitation Module, these MDMs were repurposed after

that module was deleted from the program.

(continued next page)
96 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

Table 1. (continued)

TIER 3

Connected to Internal Multiplexer/DeMultiplexer

Node 1 (N1) • Two partially redundant 

MDMs

• Both powered on

• One operating as Primary, 

one as Secondary

• Located on PMA-1

• Also an connected to C&C 

MDM

• Node 1 monitor and control: fire detection and isolation

• RPCM control

• Heater control, cabin pressure monitoring

• Control CBM

• Recovery of USOS command and control interface (Mighty Mouse)

Laboratory-1 • Located internal to US Lab • Smoke detector monitoring, Common Cabin Air Assembly (CCAA) control, 

InterModule Ventilation (IMV) control

• Low Temperature Loop (LTL) temperature control, Loop Crossover Assembly 

(LCA) valve control, rack flow control

• Rack power switch monitoring

Laboratory-2 • Located internal to US Lab • Smoke detector monitoring, CCAA control, IMV control

• Moderate Temperature Loop (MTL) temperature control, LCA valve control, 

rack flow control

• Rack power switch monitoring

• Lab Caution & Warning (C&W) panel control

Laboratory-3 • Located internal to US Lab • Air revitalization, vacuum system control

• ITCS rack flow control

• Rack power switch monitoring

Airlock • Located internal to Airlock • Airlock smoke detector monitoring, CCAA, IMV control, depress pump control, 

Battery Charger Assembly, Umbilical Interface Assembly 

Node 2 (N2) • Located internal to Node 2 • Node 2 smoke detector monitoring, CCAA, pressure monitoring, IMV control

• Node 2 control and monitoring

• Rack power switch monitoring

• Node 2 C&W panel control (N2-2 MDM)

• Japanese Experiment Module C&W panel control (N2-1 MDM)

Connected to External Multiplexer/DeMultiplexer

S0-1, S0-2 • Two partially redundant 

MDMs

• Both powered on

• Operating as bus controller 

(BC) on different buses

• Located on S0 Truss

• Structural Dynamic Measurement System 

• Heat exchanger control, some External Thermal Control System monitoring 

and Failure Detection, Isolation, and Recovery

• S0 RPCM control

S1-1, S1-2, P1-

1, P1-2

• Two partially redundant 

MDMs 

• Both powered on

• Operating as BC on different 

buses

• Located on S1/P1 Truss

• Thermal Radiator Rotary Joint control, S1-1/P1-2 MDMs provide primary 

External Thermal Control System insight, S1-2/P1-1 MDMs provide External 

Thermal Control System pump commanding

• S1/P1 RPCM control, S1 MDMs control RPCMs for S1 and Starboard Thermal 

Radiator MDMs, P1 MDMs control RPCM for P1 MDMs 

S3-1, S3-2, 

P3-1, P3-2

• Two partially redundant 

MDMs 

• Both powered on

• Operating as BC on different 

buses

• Located on S3/P3 Truss

• Solar Array Rotary Joint control, S3/P3 RPCM control, S3 MDMs controls 

RPCMs for S3 MDMs, P3 MDMs controls RPCMs for P3 MDMs

Starboard 

Thermal 

Radiator, 

Port Thermal 

Radiator

• Located on S1/P1 Truss • Radiator beam insight and commanding

(continued next page)
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 97

Table 1. (continued)

Connected to Power Module Control Unit Multiplexer/DeMultiplexer

P4 PVCU-2A, 

P4 PVCU-4A

S4-PVCU-1A

S4-PVCU-3A

P6-PVCU-2B

P6-PVCU-4B

S6-PVCU-1B

S6-PVCU-3B

• Two fully redundant MDMs

• Both powered on

• One operating as Primary

• Located on respective Truss 

Segment

• Control power generation through pointing of Beta Gimbal Assemblies, control 

energy storage by control of Battery Charge/Discharge Units, monitor battery 

units, control, monitor, and provide control for Sequential Shunt Units and DC 

Switching Units

• Control PhotoVoltaic Thermal Control System 

Connected to Habitation Control Zone Multiplexer/DeMultiplexer

Node 3-1 

(N3-1)

N3-2

• Located internal to Node 3

• No redundancy

• Node 3 smoke detector monitoring, CCAA, pressure monitoring, IMV control

• Node 3 MTL [N3-1]/LTL [N3-2] control and monitoring

• Rack power switch monitoring

• Node 3 C&W panel control [N3-1 MDM]

The European and Japanese modules 

each have their own computer 

systems that monitor and control 

all the systems in that module. The 

primary computers in each module 

are Tier 2 computers underneath the 

CCS. On the Russian Segment, the 

computer system is also broken down 

by tiers, but with less resolution. 

The main computer on the Russian 

Segment consists of the SMCC, 

which is analogous to the C&C 

system on the USOS. The main 

connection between the segments 

for data transfer is between the 

SMCC and the CCS. Although the 

SMCC contains three computers, 

these systems are not redundant 

boxes such as the CCS, but are 

rather a voting block similar to the 

General Purpose Computers (GPCs) 

on the Space Shuttle. Specifically, 

all three computers are always 

operating, processing commands and 

telemetry; however, if one reports 

a discrepancy, it is voted out and 

the other(s) continue(s) without the 

malfunctioning computer. The three 

Service Module Terminal Computers 

(SMTCs) operate in a similar fashion. 

The SMTCs connect to, and parallel, 

the USOS GNC computers. Other 

functions such as thermal control and 

life support are spread out between 

the SMCC and SMTC systems.

Multiplexer/DeMultiplexer

The MDM is at the core of the C&DH 

system on the USOS. Multiplexing 

is the process of taking data from 

many inputs and formatting them 

into a single continuous data stream. 

Demultiplexing is the reciprocal 

process of breaking a single stream 

into its basic components and 

transmitting the resulting data to 

the required end user. These data, 

or telemetry, contain the details 

of everything about the spacecraft 

ranging from temperatures of items 

(e.g., the fragile aluminum shell of 

the ISS), to angles of articulating 

components such as the solar arrays, 

to the attitude and velocity of the 

vehicle. It also includes the health and 

status of the MDMs.

An Intel 386 processor is at the heart 

of most MDMs. In an age of evermore-powerful computer chips, this 

may seem ridiculously antiquated; 

however, this processor has enough 

computing power to get the job done. 

The lag behind current technology 

is due to the life cycle of computer 

hardware development. Designing 

a spacecraft, testing and certifying 

an item for the space environment, 

building the hardware, and finally 

implementing on orbit takes many 

years. For computers that evolve 

yearly, this may overlap several 

generations of improvements. Since 

the faster chips are also thinner, 

they are much more susceptible 

to radiation interference in space 

causing the computer to lock up. 

This is not acceptable for the MDMs 

that control critical functions. 

There is generally little need or 

ability to upgrade the MDMs in 

most spacecraft, once the MDMs 

are in operation. However, the ISS 

MDMs were designed such that 

improvements could be incorporated 

if the need and money were available. 

The major limitation of the MDM 

is not the processing speed, but 

rather the memory available and the 

communications network. As some 

of the functions on the ISS evolved, 

especially the Ku communications 

systems (see Chapter 13), the CCS 

processor was upgraded to the 

Enhanced Processor and Integrated 

Communications card, which 

contained a Pentium chip.
98 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

Table 2. Comparison between the Standard MDM with the Enhanced Unit. In recent years, the C&C, GNC, PL, and EXT MDMs were upgraded as indicated 

in parentheses. See also Chapter 6.

Component Function Standard MDM Enhanced MDM

80386 Processor Chip 

(Pentium 266 MMX)

Microprocessor (CPU) of the MDM 12 MHz 16 MHz (144 MHz)

Electrically Erasable 

Programmable Read-Only 

Memory

Nonvolatile storage area for the MDM and 

application software. This includes the 

MDM boot-up software.

1 MB 1 MB

Dynamic Random Access 

Memory

Volatile storage area where applications 

execute

2 MB 8 MB (64 MB)

Analog to Digital Chip 

Converter

Converts analog data received from I/O 

cards to digital data

Present Present, but only to measure the 

internal temperature of the MDM

Math Coprocessor Chip that assists the CPU in performing 

certain types of operations increasing the 

computer’s speed

Not present Present

Figure 2. Photographs of an MDM. The top picture shows the MDM with all the various computer 

cards. The SSMMU is the wide device at the right of the card set. A picture of the computer cards is 

shown in the bottom image.

The ISS MDMs come in two styles: 

standard and enhanced. Table 2 

lists the basic properties of the ISS 

MDMs. The main difference is that 

the enhanced ones have a bit more 

memory (8 MB versus 2 MB), 

a faster processor (16 MHz vs 

12 MHz), and can hold an additional 

memory card whereas the others 

cannot. The standard MDMs come 

in several sizes depending on how 

many I/O cards they can hold; i.e., 4, 

10, or 16. MDMs within a class are 

interchangeable. Whole boxes are not 

generally retained as spares on orbit, 

but a few generic MDMs or spare 

cards are present. If a specific MDM 

experiences a fatal failure, a new box 

or card is installed and the appropriate 

software is installed. Not all enhanced 

boxes contain a hard drive. Tier 1 and 

Tier 2 MDMs are of the enhanced 

type. Since the standard MDMs do 

not need to read data off of a disk or 

store data, they do not require hard 

drives and, at that point, resemble a 

tablet more than a desktop PC. All 

the system software is resident in 

nonvolatile electronic memory on 

a circuit card. Figure 2 shows the 

layout of a basic MDM. Two of the 

enhanced MDMs—C&C and Payload 
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 99

(PL)—come with additional memory 

storage. Initially, this storage was in 

the form of a 300 MB Mass Storage 

Disk (MSD). This was actually a 

spinning magnetic disk commonly 

found in most desktops. In 2001, 

Solid State Mass Memory Units 

(SSMMUs) with 2 MB flash memory 

cards replaced the disks. A High Rate 

Data Link card provides the interface 

to the MSD/SSMMU.

Since sensors come in a variety 

of types (e.g., analog, digital), the 

Tier 3 MDMs contain a number of 

I/O computer cards that transmit the 

data. The measurement of temperature 

or voltage are examples of analog 

data in that the sensor will read the 

value (e.g., 15.3oC [59.5oF]) and 

transmit that number to the computer. 

Data that are discrete in that they 

report binary data use digital cards. 

Of course, even the analog data are 

sampled and digitized—like music is 

sampled and digitized on a compact 

disc—so that the data may easily be 

transmitted to the ground. These cards 

are summarized in Table 3.

When Computers Crash

The C&C and PL MDMs were launched in 2001 with MSDs. Primary use 

for the disk was to store the operating software that could not fit into the 

nonvolatile memory. The C&C MSD also functioned as a telemetry recorder 

for later playback when the ISS was out of communication with the ground, 

as well as a staging place for uplinking or downlinking data files. NASA 

accelerated a planned upgrade to newer SSMMUs in the summer of 

2001 after the hard drives on all three C&C MDMs failed during the Space 

Transportation System (STS)-100/ISS-6A mission due to damage on the 

delicate surface of the disks. In 2004, the CCS software was redesigned to 

fit as a zipped file in nonvolatile memory so that the system could almost 

always boot up for most failures. In the initial design, display data needed 

for the crew’s PCS displays resided as files on the C&C MSD, which were 

transferred over when the crew activated that display. However, these 

displays would not work with a failed MSD, so they were moved to spare 

memory of the High Rate Data Link card. When the MSDs failed during and 

after STS-100/ISS-6A, identical units from the PL MDMs were removed, 

installed into the C&C MDMs, and reformatted. The CCS software was then 

completely reloaded onto the drives.

Table 3. Summary of Standard MDM Card Properties

Input/Output Card Typical Use Number of 

Channels

Number of Cards 

on the International 

Space Station

Low-level Analog Reads analog voltage or supplies the current source to 

measure the drop across a Resistive Temperature Device. 

Mainly used for precise temperature measurements.

32 57

High-level Analog Reads analog sensors (pressure, flow rate, speed). 32 24

Analog Input/Output Drives analog effectors (valves and switch positions) and 

reads voltages.

16 22

Digital Input/Output Reads discrete sensors (valve and switch positions). 32 54

Solenoid Driver Output Activates and deactivates solenoids and valves. 16 26

MDMs communicate over a network 

of busses that consist of twisted 

copper lines using the Military 

Standard 1553 communication 

protocol. This protocol may be a bit 

old, but it is well tested and robust, 

and has been used on aircraft and 

military ships. Originally, the design 

of the Space Station Freedom, which 

was to use as much groundbreaking 

technology as possible, called for 

a fiber-optic computer network. 

However, when this proved too 

costly, copper cables that did limit 

data transfer rates were adopted. The 

copper wire busses actually consist 

of two separate-but-identical cables 

called channels. If an MDM is having 

trouble talking to another device on 

one channel, the system will switch to 

another channel and try talking to that 

channel. Each channel’s wire is also 

physically separated from the others. 
100 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

This provides redundancy throughout 

the network, protecting against such 

problems as high-velocity debris 

hitting the ISS or a fire that may 

disable a single channel.

Data are transmitted at multiple rates 

at the same time (0.1 Hz, 1 Hz, and 

10 Hz), the higher speeds being for 

the most critical items. A controlling 

MDM is called a bus controller (BC) 

as it sends out commands and timing 

signals to all the devices on the bus 

and, in turn, reads the status telemetry 

that is transmitted by the client 

MDMs. Any device that is listening 

on the bus is known as a Remote 

Terminal (RT). The BC will send a 

command to an RT and the RT will, in 

turn, report the status of that command 

back to the BC. Thus, a command 

to open a valve might have to travel 

from the ground, over to White Sands 

Test Facility, up through the Tracking 

Data Relay Satellite System (see 

Chapter 13) and over to the ISS on 

S-band, and be received by the C&C 

MDM, transmitted to a Tier 2 MDM, 

and routed by the Tier 3 computer 

to the destination device before the 

action takes place. The status of the 

command on the RT is then routed 

along the reverse path to the flight 

controller’s computer display—a 

process that must occur within 

seconds of sending the command.

The MDMs have several different 

operating states, but generally there 

are three main ones. The first is an 

interim state called Standby. After 

booting up, the MDM is ready to 

perform its role but is not actually 

doing anything. This is similar to 

a desktop computer having booted 

up but with no applications having 

been launched. At this point, the 

MDM is a remote terminal on 

the bus, listening for commands. 

Some MDMs will transition to the 

Operational state automatically, 

whereas others require commanding. 

At this point, the MDM can 

exchange commands and telemetry 

between the lower computers or 

sensors on the busses underneath it, 

which means it is now the BC and 

is fully operational. Where there are 

redundant MDMs, only one can be a 

BC; the other MDM stays in Standby 

or Backup. As with earthbound 

computers, MDMs can fail at any 

time; however, due to extensive 

testing, such failures are rare. If the 

computer hardware fails or locks 

up, the computer is no longer a BC. 

If the software detects something 

wrong (e.g., a numerical value out of 

valid range), rather than lock up in 

an analogous “blue screen of death,” 

the MDM will usually automatically 

enter the Diagnostic state. This is 

similar to the safe mode on most 

desktops or laptops. In this state, the 

flight control team can look at health 

and status indicators to determine the 

problem. Generally, these errors are 

transient mistakes fixed by patching 

computer code or rebooting.

The C&C MDMs are configured as 

an operational Primary, a Backup 

ready to take over instantly, and a 

Standby. This is unlike the Russian 

system where multiple duplicate 

units run simultaneously, comparing 

data and voting on the results. If the 

Primary should fail or be commanded 

out of its role by the ground 

control team, the Backup would 

take over almost instantaneously. 

Whereas some reconfiguration of 

the system would be required, most 

critical functions are ready to take 

control. Some configuration can be 

commanded to the Backup while 

additional status information is 

routinely “check pointed” between 

the MDMs to ensure a smooth and 

expeditious transition. The Standby 

would take over directly as Primary 

if the other two MDMs should fail; 

however, additional configuration 

is required since no check point 

data or configuration is available 

in the Standby mode. (Although 

exchanging check point data is 

efficient in keeping computers in 

synchronization, it can potentially 

propagate some software error and 

therefore is blocked to the Standby.) 

However, the nominal case would 

be for the MDM to transition to the 

Backup role after a Primary MDM 

has failed or been commanded out 

of operations automatically, where 

the operators would then configure it 

as a Backup.

Time is one of the most critical 

parameters on the ISS for several 

reasons. First, time is critical for 

knowing the location of the ISS 

in its orbit. Traveling at a speed 

of nearly 8 kilometers/second 

(5 miles/second), a few seconds 

of error can quickly turn into large 

uncertainties in distance. Location 

accuracy is crucial when another 

vehicle is coming to the ISS or for 

pointing the Ku antenna precisely 

at a Tracking and Data Relay 

Satellite. Second, with such a large 

number of computers, it is important 

that information is exchanged 

carefully. The CCS acts as the global 

timekeeper on the ISS. Basically, it 

sets the time, and all other computers 

in the C&DH system synchronize to 

it. Although computers can maintain 

time fairly accurately, no two 

oscillators behave exactly the same. 

The oscillator essentially acts like 

a clock pendulum. Two computers 
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 101

that are synchronized will eventually 

drift apart as the “pendulum swings” 

of their oscillator are different. For 

the computers used on the ISS, 

the difference is on the order of 

milliseconds. Still, information can 

get garbled as it passes back and 

forth due to these differences. For 

example, a command might not 

reach its correct destination because 

one computer is trying to pass it to a 

second computer that is not ready to 

receive it. If an MDM gets ahead of 

or behind the CCS, it will adjust its 

pendulum swing in the oscillator to 

drift back to the correct time before 

the difference becomes too large.

Upon boot up, the default time in 

the C&C MDM is January 1, 1992 

(the time when the GPSs were 

initialized), not unlike a digital clock 

that defaults to 12:00 when first 

plugged in. Thus, the time in the 

C&C MDM needs to be reset. This 

can be accomplished in multiple 

ways. Most modern spacecraft use the 

GPS time, due to its accuracy. The 

GNC system has multiple antennae 

to receive the GPS signals for this 

purpose. Unfortunately, these signals 

can become interrupted or confused 

when, for example, some of the 

signal is reflected off parts of the ISS 

to the antenna. This can create the 

undesirable effect of causing the time 

value to jump around. The lowertier MDMs, designed to gradually 

drift their own clocks to keep up 

with the C&C, cannot respond 

fast enough. When this happens, 

lower-tier computers can become 

unsynchronized with the CCS. 

Therefore, the ODIN/CRONUS flight 

controller monitors the CCS time 

and manually adjusts its oscillator to 

maintain GPS time.

Portable Computer System

The PCS is the crew’s interface with 

the station’s computer system. With 

the PCS connected to the C&C MDM 

via a special cable to a 1553 bus, as 

shown in Figure 3, the crew can send 

commands to the vehicle and receive 

the status of most systems. As many 

as eight PCS laptops can be connected 

at any given time. These laptops are 

distributed around the ISS in areas 

where the crew will be working.

DC Power Cable

US DC Power 

and 1553 Cable

(UOP to 

Power Supply)

Figure 3. The PCS consists of a laptop with specially written software that plugs into a Utility Outlet 

Panel using a dedicated junction box that converts the station power to standard 120 V as well as a 

1553 data cable. This panel provides electricity as well as a 1553 data connection to the CCS. 

The PCS is currently an IBM T61 

laptop with a duo-core processor, 

which is in line with the goal of using 

as much commercial off-the-shelf 

equipment as possible. The PCS has 

the same hardware, although not 

the critical software, as the crew’s 

SSC so that spares can be swapped 

back and forth easily, as needed. 

Basic parameters of the PCS are 

listed below. The PCS platform 

is the Scientific Linux operating 

system, based on UNIX, which uses 

a graphical windowing environment 

based on X-Windows. Both the PCS 

and the SSC can talk to a printer.

As the crew’s primary systems 

interface, the PCS needs to provide 

easy-to-use software that is intuitive 

to an astronaut of any nationality, 

especially during an emergency. 
102 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

Table 4. Basic Parameters of the PCS

Features Specification

Processor 2.5 GHz core duo

Memory 4 Gb RAM

Hard Drive 160 Gb

Battery 2.0-hour lithium ion battery

Display 39 cm (15.4 in) diagonal LCD display with active matrix 1920 x 1200 pixel resolution, 256 colors

Dimensions 4 cm x 36 cm x 2128 cm (1.4 in. x 14 in. x 11 in.), 2.7 kg (6 lb) with battery and DVD drive

External Power Supply 28 V DC or 120 V DC

Expansion Slot Single slot for 1553 interface connector

Peripherals DVD-RW/CD-RW

Pressure Range 456 mm Hg (9.0 psi) to 827 mm Hg (16.0 psi)

Figure 4. An image of the home page on the PCS. Each module of the ISS is represented. In addition, the astronauts can navigate to a specific system using 

one of the icons on the right side of the screen. From top to bottom: C&DH, communications and tracking, life support, power, attitude control, mechanical 

(not used), thermal control, extravehicular activity, medical, racks (not used), robotics, and emergency escape system (not currently used). Certain functions 

such as viewing the listing of commands (“Cmd Log”) issued by the laptop, a summary of fire or rapid depress status, or other miscellaneous tools can be 

accessed on the left side of the screen. Visiting vehicles such as the Automated Transfer Vehicle are also shown, when appropriate. 
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 103

The home page Graphical User 

Interface (GUI) is shown in Figures 4 

and 5. At a high level, the home page 

is a graphical representation of the 

ISS. Crew members can examine the 

status of all the systems in a specific 

module by clicking on the appropriate 

icon. Alternatively, the crew can 

examine all aspects of a particular 

subsystem by selecting the icons for 

that system along the right side of the 

screen. Since the ISS is occupied by 

people from many different cultures, 

generic icons (e.g., a lightning bolt 

for the electrical system) are used as 

much as possible. The GUI graphics 

are integrated into the station’s 

Caution and Warning (C&W) system. 

For example, a module is highlighted 

red or yellow if a subsystem in that 

module is experiencing an alarm. 

Some emergencies, such as fire or 

toxic atmosphere, can result in the 

entire crew being isolated in the 

Russian Segment. A PCS is always 

maintained in that segment so that 

insight of the USOS is retained, even 

if the crew is temporarily cut off.

Figure 5. Alarm trace. The crew can use the PCS to zero in on the cause of 

an alarm. On the home page, a module will turn the color of the alarm class 

(top left). In this case, the electrical system and environmental systems in 

Node 3 and the P6 segments indicate an alarm. The crew selects the module 

that, in the example, shows a caution-level event in the Node 3 Environmental 

Control and Life Support System (top right). The control page for the rack 

shows (lower right) that the Carbon Dioxide Removal Assembly is in alarm. 

Selecting that module brings up a detailed page where the crew and ground 

can isolate the fault and perform further troubleshooting (bottom left). 
104 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

Caution and Warning

Figure 6. The C&W panel. Each button will illuminate red or yellow as appropriate to indicate the 

presence of an alarm. The crew will push the button to either manually initiate an alarm, or to silence the 

tones. A glass cover protects against crew members accidentally bumping one of the emergency alarms. 

Figure 7. The C&W Summary used by the crew and flight control team in mission control. Events 

that are actively in alarm are indicated with yellow or red, depending on the class. Less-critical 

advisories are shown in white. Text describing the alarm is shown in the middle, followed by the time 

the alarm annunciated (in Greenwich Mean Time). The bottom displays a log of events and history 

(e.g., in alarm, normal).

One of the most critical functions 

of the C&DH system is that of 

C&W. Alarms, or C&Ws, come in 

four classes. The most dangerous 

problems for a crew are fire, rapid 

depression of air, and toxicity in 

the atmosphere (i.e., from a leak 

in the ammonia cooling system, 

failed environmental equipment, 

or a spilled experiment). These are 

class 1 alarms (emergencies). Class 

2 alarms (warnings) indicate that 

the crew or ground needs to take 

immediate action to avoid injury or 

death of the crew or damage to the 

ISS. Emergencies and warnings are 

indicated by red on displays. Class 

3 alarms (cautions) are indicated by 

yellow and do not require immediate 

response by the crew or ground; 

however, if left uncorrected, such 

situations could develop into a 

warning-class event. The lowest 

level of alarms (advisories) indicate 

something is wrong that does not 

require immediate attention. These 

are more akin to the “check oil” 

light on a car. A special subset of 

advisories is the robotic advisories, 

which provide alerts for the robotic 

systems only. The number of 

alarms include approximately 80 

emergencies, 800 warnings, 2300 

cautions, and 6100 advisories. The 

majority of alarms indicate a failure 

of a redundant component, thereby 

posing no immediate threat. Failures 

are detected by an MDM in the 

chain and fed to the C&C MDM, 

which, in turn, determines the level 

of the alarm and routes it to audio 

speakers, light panels, and the PCS 

to alert the crew and ground. Most 

modules contain speaker systems for 

annunciating an audible alarm, much 

like a fire alarm in public buildings. 

Each class, except advisories, has 

a distinctive frequency to allow the 

crew to differentiate between alarms. 

Advisories do not produce an audible 

alarm. Distinctive frequencies are 

required because one anomaly (e.g., 

a fire) could produce multiple class 

failures and the crew needs to know 

quickly which is the most critical. 
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 105

Many modules possess C&W panels 

with colored lights that indicate an 

alarm is present (Figure 6). Pushing 

a button on the C&W panel will 

silence the alarm tones until another 

failure occurs. Crew members can 

manually initiate an alarm by pushing 

an alarm button on the panel if, for 

example, they detect something 

such as smoke that the automated 

systems failed to detect. Each alarm 

also has an associated detailed text 

message that is displayed in the C&W 

Summary. This text message explains, 

in English, the nature of the failure 

(Figure 7). Generally, the ground 

will try to work most events unless a 

long period without communications 

(either scheduled or unplanned due to 

a failure) is anticipated.

If an individual alarm becomes 

a nuisance, it can be “inhibited” 

to prevent disturbing the crew 

unnecessarily. In this case, the system 

completely ignores the alarm and no 

one, not even the ground, is alerted. 

An example might be the water level 

of a condensation tank. If the level 

is oscillating right above and below 

a critical level, the alarm might be 

triggered repeatedly. If it is deemed 

noncritical and the ground can 

monitor the level closely, the alarm 

is then inhibited. The audio alarm 

also could be suppressed when the 

crew might need to be alerted to an 

alarm eventually but not immediately. 

In this case, the lights would still 

illuminate and the message would be 

present on the PCS, but no alarm tone 

would be issued. Thus, the crew and 

ground could monitor the situation 

without being deafened by the loud 

tones. This is especially useful during 

crew sleep periods.

Software 

The software executing in each 

MDM, the User Application 

Software, is unique to the function of 

that particular MDM. For example, 

the software executing in the GNC 

MDM contains routines that are 

needed for attitude control and 

navigation. Different software runs 

in the External MDM, which is 

mainly concerned with controlling 

the solar arrays and the External 

Thermal Control Systems. Utilities 

such as communicating on the bus 

are common between all the MDMs 

(although with a few minor deviations 

developed across the different 

systems). Different segments of 

Boeing, the prime ISS contractor, 

produced different software systems. 

All combined, the ISS C&DH system 

consists of approximately 1.8 million 

lines of computer code.

Sometimes, software needs to be 

changed. This can be accomplished 

in two different ways on the ISS. 

First is through the use of a PrePositioned Load (PPL). A PPL is a 

file of data parameters or commands 

that can be uplinked by the flight 

controllers at any time to change 

specific values. For example, a 

critical PPL is the one that controls 

load sheds. A load shed occurs if 

the Electrical Power System cannot 

produce enough electricity. This 

could happen if the guidance system 

failed and the ISS was no longer 

able to point the solar arrays at the 

sun. If a load shed is triggered, the 

PPL will execute the commands 

inside of it to power off the leastcritical equipment first and then 

pause. If the power problem is more 

severe, the flight control team or the 

automatic software will resume the 

execution by the PPL, thus powering 

off additional equipment. This list 

of equipment also changes as the 

station changes (e.g., if modules are 

added or moved); therefore, the PPL 

is periodically updated. Alternatively, 

the temperature at which a heater 

turns on or off might need to change, 

just like adjusting the thermostat 

in a house. Rather than change the 

software code, the software looks at a 

particular value defined in the PPL. If 

this needs to be changed for whatever 

reason—say, from 18oC (64oF) to 

15oC (59oF)—a new value is set in 

that particular PPL. The software 

itself can also be updated. This is 

discussed further in Chapter 6.

Another critical function of the 

C&DH system is to recover the 

function lost when a failure occurs. 

This software is generally referred 

to as Failure Detection, Isolation, 

and Recovery. The software will first 

detect the failure of a component 

and annunciate a C&W message, 

depending on the severity. Many key 

ORUs on the ISS have what is called 

a heartbeat—basically, software that 

is constantly counting up. If this 

number is changing, the ORU is alive. 

A static heartbeat means the ORU 

is no longer healthy. Many systems 

that die will also loose computer 

communications with the MDM. 

Isolation refers to the software taking 

an action to put the system into a safe 

configuration. For example, if a valve 

is stuck closed in the cooling system, 

the pump can be damaged by trying 

to push fluid against it. This is called 

dead heading. The isolation software 

will turn off this pump. Recovery 

means that a backup system, if 

available, would be turned on. 
106 CHAPTER 5 SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION

A special case occurs when an 

MDM fails. Among the MDMs, 

the C&C performs the recovery of 

the Tier 2 MDMs since they are 

redundant. Upon detecting a loss of 

communication with a Tier 2 MDM, 

the C&C will power on the Backup 

(normally kept off to minimize 

wear and tear) and command it 

operational. This process is called 

Redundancy Management (RM). 

A serious scenario, such as a major 

power channel failure, can cause 

multiple components, including 

MDMs, to be powered off. The CCS 

will perform RM on each Tier 2 

MDM that failed, beginning with the 

most critical MDM. As the Tier 2 

MDMs are recovered, they will detect 

any problems in their systems and 

will execute automated software to 

reconfigure their system, including 

bringing online redundant equipment. 

For example, the same power channel 

failure that powered off an active 

INT MDM could have left half the 

pumps for the internal cooling system 

unpowered in the Laboratory Module. 

The newly recovered INT MDM will 

detect one pump as off (“failed”) and 

reconfigure the water loops so that the 

remaining pump is cooling the entire 

system. Flight controllers will then 

do any further cleanup of the lesscritical systems. Critical equipment, 

including MDMs, are usually put on 

different channels to minimize such 

impacts from the failure of a single 

power or cooling channel. Thus, if 

C&C-1 MDM is the Primary MDM, 

the INT-2 MDM on a different power 

channel may be configured as the 

Primary for that pair so that an issue 

with the power system is unlikely to 

power off both at the same time.

Another key function of the software 

relates to what are called modes. The 

ISS is a large, complicated system. 

When the vehicle is reconfigured 

for key activities—e.g, preparing 

for the docking of a visiting 

vehicle—a lot of systems have to be 

changed to support the new mode 

or configuration. Mode transitions 

are automated to help relieve the 

work of the ground team. When the 

ISS is supporting regular increment 

operations, it is in Standard mode. 

The ISS transitions to Proximity 

Operations mode for visiting vehicle 

dockings. When the command is 

given, the C&C MDM will fire off 

a large number of commands to all 

the systems to configure the systems 

appropriately. Other modes include 

Microgravity, Reboost (for raising 

the station altitude), and External 

Operations (intended to be used for 

extravehicular activities). A Survival 

mode attempts to maintain the 

minimum systems required to keep 

the crew alive.

Assembling the Command 

and Data Handling System

Assembling the C&DH system was 

relatively straightforward, unlike 

several other systems described 

elsewhere in this book. Adding a 

computer to the network on the 

ISS is not all that different from 

adding a computer on a home or 

work network—with one notable 

exception. Prior to ISS-5A, the only 

USOS MDMs were the Node MDMs 

and the P6 PhotoVoltaic Control Unit 

(PVCU) MDMs. The crew would 

interface with the Node Control 

Software using the early PCS. At 

5A, a number of MDMs were added 

and the PCS became the permanent 

method for crew interaction with the 

C&DH system. Transitioning from 

Node software to CCS control at 5A 

was the biggest expected challenge 

for the ODIN team during the ISS 

assembly process. 

The Node Control System (NCS) 

assumed interim C&C upon powerup in 1998 of the first element of 

the USOS—Node 1. The NCS 

controlled some fans and connected 

to the Early Communication System, 

which was used for talking to the 

crew and getting status telemetry 

on the ground. Later, at 4A, the 

Node MDMs worked with the 

PVCU computers on the P6 module 

to provide power. The Laboratory 

Module, launched in 2001, contained 

the CCS, which was destined to 

be the Tier 1 C&C as well as the 

INT, EXT, and GNC MDMs. The 

challenge is that the station cannot 

be without a Tier 1 computer for 

extended periods of time, and there 

can be only one Tier 1 controller 

at a time. Therefore, a careful 

handover from NCS to CCS had to 

be developed. Fortunately, a function 

designed to recover the C&C MDMs 

in the event of a failure provided a 

clever mechanism to achieve this.

The NCS is technically a Tier 2 

system under the CCS. Early on, 

it was realized that, in the unlikely 

event of all three C&C MDMs 

failing, there needed to be a way 

to power cycle them in the hope of 

recovering them (much as a desktop 

or laptop can be recovered if a 

software lockup occurs). If that effort 

was not successful, there needed to be 

a way to assume control of the ISS. If 

all three C&C MDMs were to fail, the 

NCS would detect the absence of a 

BC and begin power cycling the C&C 

MDMs. The NCS would then give 

up the bus control to allow the CCS 

to boot up and take charge. If, after a 

certain amount of time, the NCS still 

detected no BC, it would go back to 

controlling the main busses until the 
SYSTEMS: COMMAND AND DATA HANDLING—THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 107

flight controllers reconfigured the 

system. Although the NCS cannot 

really communicate with the INT, 

EXT, or GNC MDMs, it would still 

provide the crew with at least a small 

amount of insight and control. Since 

the Node MDMs were the “little 

guys” compared to the “big” C&Cs, 

this software process was dubbed 

Mighty Mouse, based on the old 

American television and film cartoon.

Activating the Laboratory Module—

the brains of the USOS—at 5A was 

a bit of a chicken-and-egg dilemma. 

Computers were needed to operate the 

systems, but they generated heat as 

did the other systems coming online. 

Therefore, the Thermal Control 

System needed to be activated as 

soon as possible to provide cooling 

to the computers already activated 

before they overheated. The Thermal 

Control System, of course, needed 

computers to operate. A variation of 

Mighty Mouse software was used to 

affect the handover of control from 

the Node to the laboratory during 

STS-98/ISS-5A. The successive 

waves of power cycling various 

C&C MDMs, followed by waiting 

for signs of life, were stripped out 

in the software to save time on the 

assumption that the C&C-1 MDM 

would not be failed at the start of its 

life on orbit. Instead, the NCS would 

power on C&C-1, relinquish control 

of the busses, and wait to either 

detect the CCS or resume control if 

unsuccessful. This software was now 

dubbed Minnie Mouse, based on the 

Disney character and building on the 

mouse theme. Upon transitioning 

to its normal Operational mode, 

the CCS would see no INT MDM, 

thus triggering RM to initialize the 

INT MDM. During the mission, the 

astronauts would command the Node 

computers into Minnie Mouse mode. 

The flight controllers and astronauts 

would hold their breath for 5 minutes. 

If it worked, automated software 

would begin configuring the rest of 

the systems. If it didn’t work, the ISS 

could be left in some limbo state with 

no computer in charge. Fortunately, 

everything executed flawlessly.

The new MDMs were integrated 

relatively seamlessly as new 

modules were added to the ISS. 

Upon activation of the module, 

the new Tier 2 or Tier 3 computers 

would immediately transition to an 

operational mode and begin talking 

to the next-higher level. From 

about 2000 to 2014, the C&DH 

system grew from two MDMs to 46. 

Major software upgrades have 

occurred about once per year (see 

also Chapter 6).

Conclusion

Unlike previous manned spacecraft, 

the ISS is almost completely 

controlled by computers. The 

computer system runs every 

spacecraft function from controlling 

the solar arrays to keeping the power 

generation going to communication 

with the ground. It also reconfigures 

other computers and hardware in the 

event of a problem. These failures are 

annunciated to the crew and ground 

through various cautions and warning 

with lights and audible tones. While 

the flight controllers on the ground 

communicate through the ISS via the 

C&C MDMs, the crew interface with 

a laptop called the PCS. Finally, as 

with the ISS itself, the C&DH system 

has evolved over the years, most 

notably by upgrades to the software 

and sometimes the hardware, as is the 

case with terrestrial computers.

Chapter 6 Day in the Life:

“Brain Transplants” 

on the International 

Space Station
110 CHAPTER 6 DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION

Flowchart showing the 1-year process required to plan and execute a software upgrade to the major systems on the International Space Station. Each block 

represents a milestone. The upper-left box indicates how far in advance of the transition (T) the activity should start. The upper-right box indicates when the 

activities should be complete. In this example, the actual completion dates for the Release 14 update (described below) are indicated in red above each box. 

Terrestrial computers need 

to be periodically updated to 

accommodate new features, fix 

bugs, or address compatibility 

issues as other systems evolve 

over time. Software on the 

International Space Station (ISS) is 

no different in that way. Where the 

software on the ISS does differ is 

that every vital function of the space 

station is controlled by a computer and 

cannot be suspended while software 

is changed. Critical ISS systems 

cannot afford to simply wait while 

updates are applied and computers are 

rebooted. The two main reasons for 

updating space station software are to 

install upgrades for new features and 

to fix problems. The development of 

the software was staggered over time, 

particularly over the ever-changing 

configuration of the ISS during its 

construction. There was no point in 

having software that performed a 

function—say, controlling a cooling 

loop or module—when that loop 

or module was to be installed years 

down the road. It takes years to design 

the code to control the space station, 

and additional years to write and test 

the software before it is installed. 

Furthermore, errors can arise from 

a simple typo when the code was 

written. Rigorous testing catches the 

vast majority of these problems. Other 

errors come from how the coders 

interpreted a software requirement, 

or are due to evolution of the team’s 

thinking as the system matured. If 

an error is critical, the code will be 

updated before it is loaded on the 

space station computers. The update 

to fix bugs that have a noncritical 

impact or that the flight team can work 

around may be made in a subsequent 

release so as to not impact the 

schedule. Considerable care in terms 

of testing, planning, and execution 

is taken when ISS computers are 

updated. If done properly, the crew 

hardly notices any changes.

The ISS software was first upgraded 

in October 2002. At the time, it was 

the largest software upgrade ever 
DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION CHAPTER 6 111

performed in space. The process took 

about a year to plan and execute. 

Since then, similar software upgrades 

have become “routine,” having been 

performed more than a dozen times 

since. To reduce cost and assist with 

scheduling, large-scale ISS software 

upgrades are now planned to take 

place once a year. The entire process 

of identifying changes, developing 

and testing code, and planning and 

executing the transition is ongoing. 

Once a change has been approved and 

implemented in the code, it is included 

in the next scheduled upgrade. 

The ISS hosts three types of 

computers (see Chapter 5). All critical 

ISS functions are controlled by the 

Multiplexer/DeMultiplexers (MDMs). 

The MDMs, and the Portable 

Computer System (PCS) that controls 

them, were designed for regular 

updates. This chapter discusses how 

the operations team prepares for 

and executes this critical task. The 

crew’s Station Support Computers 

are upgraded similarly to laptops on 

Earth and are not discussed here. 

Major upgrades are scheduled about 

once a year due to the complexity of 

the software controlling the ISS. It 

takes many months of planning and 

training to accomplish a software 

upgrade. This schedule allows careful 

development of the transition. In 

many ways, a software transition is 

just as complicated as the execution 

of a spacewalk or the docking of 

a new vehicle. The flight director 

and his or her team work closely 

throughout the year to prepare for 

the upgrade. This chapter describes 

the process of updating the software: 

changing the code, developing the 

complicated plan for installing it, 

testing the plan, executing the plan, 

and recovering from problems during 

the upgrade, as sometimes happens.

The Life Cycle of Code

During the design phase of the ISS, 

engineers determined which functions 

the software needed to control. For 

example, consider the operation 

of the massive solar arrays, which 

generate the critical power needed to 

run the space station. The arrays can 

articulate at the Solar Alpha Rotary 

Joint and the Beta Gimbal Assembly 

(see Chapter 9) to ensure they are 

always pointed in the direction of 

the sun. Software tells the arrays 

where the sun is positioned, and 

the motion of the ISS as it orbits 

the Earth. Thus, the arrays will 

slowly move throughout the orbit 

to maximize power generation. 

The arrays are parked and locked 

in a position during the arrival of 

docking vehicles to minimize thruster 

loading on the delicate surfaces of 

the arrays. The software needs to 

know how to move the panels to the 

required position and then use the 

gears to lock them in a fixed position. 

Software will respond if, for some 

reason, the gears have a problem 

and cannot lock properly (similar to 

the way a car’s transmission gears 

crash instead of mesh smoothly). If 

the power controlling these motors is 

lost, software will use alternate power 

or motors to complete the critical 

task. This is just one example of how 

engineers will define all the needed 

software functions and then write 

detailed requirements to describe how 

each function will operate. Flight 

controllers play a part in developing 

these requirements since they are 

the ones who will be operating the 

software that is on the ISS.

Software engineers then take the 

requirements and generate the code. 

The logic of the code is carefully 

reviewed with other programmers 

to ensure it does what is intended. 

During this phase, the flight 

control team works closely with 

the programmers to understand 

and influence the design. During 

the assembly of the ISS, the flight 

controllers were extremely involved 

in the development of the vehicle 

software. Once completed, the 

software undergoes various levels 

of testing to ensure that it correctly 

meets the requirements and interfaces 

with other software code properly. 

Testing culminates with a flight 

qualification test where the software 

is put through its paces under 

realistic situations. 

In a perfect world, a complete second 

space station would exist on the 

ground to run the software to ensure 

it works correctly; however, such an 

approach is cost prohibitive. Instead, 

testing is done on a combination of 

flight-like items and simulation or 

emulations. A flight-like unit may 

be an exact copy of a unit flown on 

the space station, or it might be a 

flight equivalent unit—something 

very close to the real hardware but 

with cheaper parts that replicate the 

behavior of the real unit. A simulator 

or emulator is essentially a software 

program that will react the same 

as the real system. For example, 

software controls the pump speed 

in the Thermal Control System 

loop, perhaps increasing water 

flow if more cooling is needed (see 

Chapter 11). The simulation will 

reveal the temperature to the MDM. 

The MDM will send a command 

back to the simulation, telling it to 

increase the pump speed. The revised 

pump speed and the resulting cooler 

water temperature are echoed back 

to the MDM. In this way, the control 

software inside the MDM is executed 
112 CHAPTER 6 DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION

without requiring an actual Thermal 

Control System to be connected. 

Note that this sort of testing has to 

be integrated with all the systems. 

The Command and Control System 

(CCS) software interfaces with the 

Internal, External, and Guidance, 

Navigation, and Control (GNC) 

software, to name a few, as well as 

the Russian, European, Japanese, 

and commercial partner systems. 

Code changes in the CCS have to be 

tested with the latest code in all these 

systems to ensure compatibility. 

Testing between the CCS and the 

Russian computers is some of the 

most complicated owing to the 

critical functions that both segments 

control, and because the systems are 

very different. This is called “fourbox testing” since it uses flight-like 

items for the four key computers 

(Command and Control [C&C] 

MDM, GNC MDM, Service Module 

Central Computer, and the Service 

Module Terminal Computer) on 

both sides of the interface. Flight 

controllers and engineers from 

multiple countries spend months 

testing the four-box configuration. 

Once the software has passed 

the flight qualification test, it is 

ready to be loaded on the space 

station computers.

Preparing for the Transition

Once the software is ready for uplink, 

the operations team—consisting of 

the key personnel from the various 

disciplines along with the flight 

director—begins the process of 

preparing for the actual installation. 

As with a Space Shuttle mission 

(see Chapter 4) or a spacewalk 

(see Chapter 17), a lead team is 

assigned to the project. The process 

of a software upgrade is fairly 

complicated. The first thing the 

team needs is to figure out is the 

strategy—i.e., which computers are 

to be updated and in which order. 

Changes to the CCS will affect other 

Tier 2 computers as well as the 

crew’s PCS and perhaps the robotics 

software. Therefore, changes to 

those computers are usually updated 

around the same time. For example, 

the 14th release of the CCS, called 

Release 14 (R14), was combined 

with seven other operating systems 

on 11 MDMs and PCS laptops. 

Although several computers are 

being upgraded, by convention the 

entire set of transitions is labeled 

according to the CCS software 

being uploaded. The upgrade is 

summarized in Table 1 and represents 

updates to nearly 1.5 million lines of 

software code.

Table 1. Summary of software systems upgraded in the R14 group transition. See Chapter 5 for more details on the different MDMs and software systems. 

This is the software transition shown in the flowchart at the beginning of this chapter. 

Software System Old Release g New Release Number of and Computers Affected

Command and Control Software (CCS) Release (R)13 g CCS R14 3 – Command and Control Multiplexer/DeMultiplexers (MDMs)

Portable Computer System (PCS) R16 g PCS R17 7 – PCSs

Mobile Servicer System (MSS) 8.1 g MSS 8.2 3 - C&C MDMs

Hub Control Software (HCS) R3 g HCS R4 2 – Hub Control Zone MDMs

Starboard 3 (S3) Port 3 (P3) R4 g S3P3 R5 4 – S3 and P3 MDMs

Laboratory System 3 R5 g LSYS3 R6 1 – LA-3 MDM

Node 2 System (N2SYS)2 R3 g N2SYS2 R4 1 – N2-2 MDM

The transition to the new software 

has to be seamless since the software 

is still controlling the vital functions 

of the space station. Therefore, 

the new software is loaded to the 

backup computer for those systems 

that have a backup. The primary 

and backup computers are swapped 

when the team is ready, during a 

time in which there are no major 

activities such as a visiting vehicle 

docking or a spacewalk. Usually, 

this is accomplished by telling the 

primary to mode itself to a standby or 

diagnostic safe state (see Chapter 5). 

Seeing no primary, the backup 

MDM will transition to that role, 

but will be operating on the new 

software. If a backup MDM does 

not exist, as is the case with the 

Tier 3 MDMs (see Chapter 5), 

the sole computer is loaded in a 

diagnostic state and then transitioned 

to operational when ready.

Whenever the CCS is upgraded, 

the PCS software is also upgraded 

since both work hand in hand. 

Unlike the MDMs, this can be done 

via CD-ROM (as can be done via 

laptop on Earth) or by sending up 

a new hard drive with the software 

already loaded. Half the PCS laptops 

are converted to the new software 

prior to the transition. Only half 

are loaded to allow for a possible 
DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION CHAPTER 6 113

“rollback” to the old configuration if 

a problem is encountered.

Generally, the C&C MDMs are 

swapped to invoke the new software. 

The crew connects the upgraded 

PCS laptops that are loaded with that 

software. The ground evaluates data 

to ensure everything is operating 

properly. If all is as it should be, the 

next pair of MDMs is swapped—

usually the Internal MDM, followed 

by other pairs. The computers with 

the old software are not immediately 

reloaded. An extensive amount 

of testing is performed before the 

computers on orbit are reloaded; 

however, there is always a chance 

that something is missed within the 

simulated environment, which is not 

100% identical to the real vehicle. 

Therefore, the operations team 

typically waits about day to make 

sure everything is working properly. 

If everything works, the computers 

with the remaining old software 

are reloaded and that portion of the 

transition is completed. If not, the old 

software can be rolled back quickly 

by swapping it with the computer 

that is still running the old software. 

The team then determines the best 

configuration for the software until 

the issue can be resolved. The realtime timeline for the R14 load is 

shown in Figure 1.

Load R14 into 

Backup & Standby 

C&C MDMs

Load, transition 

LAB-3 MDM to R6, 

Node 2-2 MDM to R4

Load, transition 

S3-1, S3-2, P3-1, 

P3-2 MDMs to R5

Transition 

Backup C&C 

MDM to Primary

Load R17 into 

half of PCSs

Transition 

Standby C&C 

MDM to R14

Load, transition Prime 

& Backup HCZ to R4

• Connect PCS

• Standby C&C 

MDM still R13

Day 

1 Day 

2 Day 

3 Day 

4 Day 

5

Figure 1. Graphic illustrates the day-by-day 

process over 5 days of loading all the computers 

for the R14, as defined in Table 1. Each block 

represents a set of activities performed on a 

given day. Each step-up is done in small steps 

to allow for time to assess how the software is 

working. If everything was transitioned at once, 

it might be hard to identify a problem. 

Flight controllers, under the direction

of the flight director and working 

with the engineers, figure out 

the transition plan, which is then 

reviewed by the engineering team. 

For example, do the systems need 

to be put in a certain configuration 

prior to the transition? Which 

operations must be stopped during 

the transition and which can 

safely continue? Once the plan is 

worked out, the procedures are 

written, including some for likely 

contingency scenarios. At that point, 

the procedures are operationally 

tested. In these tests, the flight 

control team in Mission Control 

executes the procedures with the 

ISS Software Development and 

Integration Laboratory in what 

are called flight-like operations 

readiness tests. These tests include 

configuring the simulated systems 

into a known ISS-like state for the 

actual swap, sending all the new 

code to the computers, executing 

the switchover, and reconfiguring 

all equipment back to the normal 

operating setup. Multiple tests are 

performed to ensure everything is 

properly evaluated. Once any issues 

are worked out, a test that uses a 

flight-like mission configuration 

is performed. 

Note that this describes only the 

process to develop the transition 

procedure. New software means new 

operations of generic procedures, 

and possibly new flight rules. 

Therefore, the transition team will 

also lead the development of all the 

procedure updates—typically on 

the order of 150 updates. Each 

procedure has to be revised and 

tested in an operations readiness test. 

The flight director oversees the flight 

rule modifications.

Planning the Transition

Once the uplink procedure has 

been developed and tested, it is ready 

for the transition. The increment 

team tries to find a time to perform 

the upgrade (see Chapter 1) while 

the testing is taking place. In an 

ideal world, the software is ready at 

a given time and the team performs 

the uplink. In the dynamic world of 

the ISS, this is rarely the case. For 

example, visiting vehicle software 

needs to be tested with the version 

of the ISS software that will be 
114 CHAPTER 6 DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION

operating during that vehicle’s 

mission to the ISS. However, both 

the visiting vehicle and the software 

transition schedules are often very 

dynamic. If a visiting vehicle 

mission was to overlap a software 

transition, its software would need 

to be tested with both versions of 

ISS software. Flexibility could be 

provided by testing all permutations 

of software interaction. However, 

the required testing is time 

consuming and expensive, thus a 

lot of effort is put into scheduling 

software transitions away from 

visiting vehicle and other dynamic 

operations. To date, this has not 

been anything more than a planning 

exercise. Therefore, careful 

evaluation of impacts to the software 

schedule are required when a mission 

does change its schedule. 

“EPIC or BUST” 

Don Pettit, Expedition 30 and 31 

An orbital “brain transplant” can be done with new 

software uplinked into the flight computers via radio 

waves. As in a B-grade sci-fi movie where some hapless 

creature’s brain is reprogrammed, the old system is 

replaced with the new—usually, but not always, with 

known results. This is accomplished from Mission Control. 

If the brain transplant goes as designed, the on-orbit crew 

may not even know it happened. 

Sometimes, the necessary upgrade actually requires 

new brains. This happened during my last visit to the 

space station in 2012 during Expedition 30. The central 

processing units for the main computers were being 

upgraded from the 8086/16 MHz processors that 

were launched with new Pentium 266/144 MHz chips 

(Chapter 5). These new brains, known as Enhanced 

Processor and Integrated Communication Controller, 

or EPIC, cards, were required to handle the more 

advanced software before the visiting cargo spacecraft 

could approach and berth to the United States On-orbit 

Segment—events planned for the very first time about a 

month into our mission. No pressure on us, except that 

the fate of the commercial space program hinged on our 

ability to perform this brain transplant. My commander 

Dan Burbank and I received hours of preflight training, 

prying the old computer boards from the MDM out from 

practice flight computers and replacing them with shiny 

new ones, complete with gold-plated contacts and 

conformal-coated circuits. The conformal coating is a 

polymeric film that keeps aimlessly floating bits—i.e., little 

chunks of zero-gravity detritus—from shorting out the 

circuit boards. All the brain transplants were planned early 

in our mission so that the first commercial spacecraft, 

Space Exploration Technologies Corporation (SpaceX) 

Dragon D1, could pay us a visit. The new brains, all 10 

of them, were already on orbit well before my launch. We 

were all set for brain surgery. Or so we thought.

Figure 2. Astronaut Don Pettit uses the oscilloscope to measure the 

EPIC cards’ timing signals. 

Then we found out the new processor cards (already on 

orbit) were built at the factory with a defective component 

that would cause the internal clock timing to go bonkers, 

thus causing the computer to do the orbital equivalent of 

the “blue screen of death.” It is not good for spacecraft 

brains to go into la-la land when you are traveling at 

28,163 km/h (17,500 mph) with a commercial spacecraft 

waiting on your doorstep (Chapter 14). To complicate 

Several program reviews are 

scheduled as the time approaches 

to ensure everything is ready for 

the transition. As with other major 

activities, the flight director will 

brief the program management on 

the proposed changes and plan, 

with the final “go/no go” occurring 

at the ISS Mission Management 

Team level a few days before the 

planned event. Here, the program 
DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION CHAPTER 6 115

manager, international partners, and 

operations team review the status of 

the transition to make sure everyone 

is ready to begin the process. 

Loading the New Software

The process of loading new software 

is time consuming. Since the MDMs 

do not have CD-ROM readers, all 

the software has to be uplinked. 

The software is large—representing 

about 30 MB of data in hundreds 

of files. Since the S-band link 

with the ISS (see Chapter 13) can 

transmit about 72 kbps, it takes about 

30 hours to uplink the files to the 

computers. At the same time, the 

crew will spend a couple of hours 

configuring several of the PCS 

laptops for the new CCS software.

Once all the software has been 

staged on board, the team executes 

the planned transition. Due to the 

need to reconfigure ISS systems, the 

transition will usually take multiple 

days with one or two MDMs being 

loaded each day. The ISS crew is 

kept informed of the progress of 

the transition, as specific versions 

of procedure may need to be run 

depending on which software version 

matters, this defective chip was estimated to be in only 

one out of the 10 circuit boards. We were playing orbital 

roulette. Only two or three spare circuit boards were in 

existence (still on Earth), and they fortunately checked 

out. These were manifested to launch with me on Soyuz. 

But how would we beat the odds of this game of orbital 

chance? The answer came from the orbital repair and 

maintenance team, passionately called Operations 

Support Office, or OSO, working closely with Honeywell, 

which had manufactured the cards. They found a small 

electronic widget that converts a laptop computer via the 

Universal Serial Bus port into a fully featured oscilloscope. 

The part was actually a Link Instruments’ MSO-19 

Oscilloscope, Logic Analyzer, Pattern Generator and 

Time Domain Reflectometer. As I said, a widget. With this 

device, it would be possible to power up the circuit boards 

on orbit and run them for a few hours where errant timing 

would become obvious. We now had a way to find the 

“bad boy.” All we had to do was stow this on my Soyuz. 

Or so we thought.

By the time the Mission Control team had this worked out, 

I was in Baikonur, Kazakhstan, literally halfway around 

the world from Houston. And I was only days away from 

launch. To officially have this manifested and tucked 

away into some tiny nook on the Soyuz was not deemed 

possible. Some things, seemingly simple, find unbelievable 

friction when they cause a change in the matrix. 

Each crew member has an allotment of 1.5 kg (3.3 lbs) 

of personal items, little knickknacks that help remind 

them of family and friends over the 6 months they are 

orbiting Earth. These items are painstakingly weighed 

on an electronic scale with no allowance for being 

overweight. I offered some of my personal mass so that 

the oscilloscope could fly; however, the flight unit was still 

in Houston. NASA worked to expedite the transfer of the 

flight unit from Houston to Moscow and from Moscow to 

Baikonur. Within days, the flight unit arrived in my dorm 

room. I even practiced measuring the signal from the 

coffee pot in my room. Our team’s mantra for this project 

was “EPIC or BUST.”

My personal allotment was already full, so I started pulling 

items off the scale until it reached the acceptable mark. 

My wife’s necklace, gone. My twin boys’ camping spoons, 

gone. My alma mater’s pennant, gone. Mission patches 

for family and friends, gone. The scale tipped to the good 

side and I was set to launch.

Dan Burbank was already on orbit, having launched the 

month before. I launched on December 21, 2011, the 

same day that comet Lovejoy surprised astronomers when 

it emerged from behind the sun with a brilliant tail. We 

unloaded the cards and widget the next day and started 

in on neural surgery. Dan did the surgery, replacing old 

brains for new. I set up the oscilloscope and checked out 

the circuit boards that were already on orbit. Working with 

all the folks in Mission Control, it took us a week or so 

to complete the brain transplant. This is teamwork at its 

best. Nine days later, we loaded the new software (“R11”) 

on the repaired computers. The new hardware, coupled 

with the new software, worked as designed. In May, I flew 

the Canada robotic arm and snagged Dragon D1, thus 

ushering in the world of commercial space.
116 CHAPTER 6 DAY IN THE LIFE: “BRAIN TRANSPLANTS” ON THE INTERNATIONAL SPACE STATION

is currently operating. After the 

software has been loaded, the team 

archives any products associated with 

the previous version of software and 

performs a lessons-learned review 

to identify any improvements to the 

process for the next transition.

Lessons Learned

Over the years of operating the ISS, 

many of the lessons learned have 

helped craft more-efficient software 

transitions and corrected items that 

caused issues in earlier transitions.

An early example of this came during 

the first major CCS transition. The 

operations team is responsible for 

developing certain configuration files 

for the MDMs. In this case, NASA 

developed a Load Shed Table—i.e., a 

list of commands used to deactivate 

electrical loads in off-nominal 

situations for CCS R1. When the 

planning process started for CCS R2, 

it was determined that the commands 

listed in the Load Shed Table did 

not need to be updated at that time. 

A default Load Shed Table built by 

software developers was used during 

CCS R2 testing. 

The operations team commanded 

the incorporation of its CCS R1 

Load Shed Table after the real-time 

transition to CCS R2. When this 

happened, the primary C&C MDM 

failed. When the backup C&C 

MDM took over, ground software 

automatically attempted to complete 

the load of the Load Shed Table, 

which caused that C&C MDM to 

fail. Luckily, the third C&C MDM 

was not configured for Tracking and 

Data Relay Satellite communications. 

When the third C&C MDM took over, 

the ISS did not have communications 

with the ground. This allowed the 

operations team to abort the attempted 

Load Shed Table uplink.

Upon investigation of the issue, 

NASA determined that the updated 

CCS software had been recompiled, 

which had caused the memory 

address for the Load Shed Table data 

to change. The Load Shed Table 

overwrote critical software when the 

CCS R1 Load Shed Table was loaded 

to a C&C MDM that was running 

R2, thereby causing the MDM to fail. 

Although the intended content and 

function of the Load Shed Table did 

not need to be changed, the actual file 

needed to be updated to match the 

recompiled software.

Multiple actions were taken to update 

the transition process as a result of 

this incident. First, the transition test 

procedures were updated to assure 

that the flight versions of all files 

were tested. Second, the ground 

commanding software was updated 

to abort any attempt to load a file if 

a C&C MDM transition occurred, 

thus preventing a bad uplink from 

taking down multiple MDMs. Third, 

the Load Shed Table (and similar 

files) are now being rebuilt for each 

software load, even if the intended 

function does not change. 

As occurs with visiting vehicle 

operations, spacewalks, and other 

dynamic events, the combined 

operations, engineering, and 

management teams apply lessons 

learned from software transitions 

to future plans. This improves the 

overall process of upgrading ISS 

software, which keeps the crew and 

vehicle safe and ultimately increases 

scientific output.

Conclusion

Despite the complexity of the space 

station, some aspects of its operations 

are familiar to the average person on 

Earth, especially when it comes to the 

need to periodically upgrade software. 

Due to the scale and critical nature 

of the software on the ISS, however, 

the planning and testing process 

takes about a year. As with any other 

system, the flight control team needs 

to adapt and respond to unexpected 

surprises that can occur, even within 

a well-orchestrated process. 


Chapter 7 Systems: 

Motion Control 

System—Navigator 

of the Heavens
120 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

Astronaut Dave Williams carrying one of the four massive gyroscopes used to control the orientation of the International Space Station (ISS) during 

replacement operations on STS-118/ISS-13A.1 in August 2007. Williams (anchored in a foot restraint) is being moved along with the Control Moment 

Gyroscope (CMG) by the space station robotic arm. The CMG is being installed on External Stowage Platform-2 near the ISS airlock, where it was stored 

awaiting a return to Earth for refurbishment. 

The Motion Control System (MCS) 

keeps the International Space 

Station (ISS) “right side up” 

rotationally as well as maintains 

the ISS in the proper orbit. Without 

it, the ISS would simply tumble in 

space, eventually lose altitude, and 

reenter the Earth’s atmosphere.

The MCS maintains the ISS in a 

constant attitude for day-to-day 

operations, maneuvers the ISS to 

special attitudes for visiting vehicle 

dockings and captures, and reboosts 

the ISS to counter atmospheric drag 

or avoid space debris. The system 

uses Global Positioning Satellites 

(GPSs), rate gyroscopes, and other 

sensors to allow the ISS to “know” 

its location as it circles the Earth. 

These data are also used to point 

solar arrays at the sun, antennas 

to communications satellites, and 

payloads to ground or other targets. 

The ISS MCS, as it exists today, is 

a shared responsibility between the 

US Segment and Russian Segment 

of the ISS. The core of the Russian 

Segment MCS was launched as part 

of the Russian Service Module (SM) 

on July 12, 2000. Nearly all of the 

Russian MCS, as it exists today, 

was activated when the SM was first 

launched. The thruster-based control 

system of the SM was extremely 

important for the early assembly of 

the ISS, as it was the only attitude 

control for the early portions. 

Today, the SM continues to provide 

thruster-based attitude control for 

larger maneuvers, or to assist the US 

Segment attitude control system when 

it cannot provide enough control 

force. Additionally, Progress cargo 

vehicles docked to various docking 

ports on the Russian Segment have 

thrusters that are commanded by the 

SM and augment its original thrusters. 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 121

The US Segment MCS was built up 

over several flights, starting with 

the United States On-orbit Segment 

(USOS) Destiny Laboratory, which 

was launched on February 10, 2001. 

The primary feature of the US 

Segment is four Control Moment 

Gryoscopes (CMGs), which can 

maintain attitude control for weeks 

at a time electrically without using 

precious rocket propellants. 

Because of its large size and 

extended lifetime, and because the 

MCS is shared between the US and 

Russian segments, the ISS has a 

number of unique features compared 

to the motion control systems of 

other satellites. These features 

include the following: 

n The Russian Segment carries 

several tons of hypergolic propellant 

for propulsive attitude control and 

reboosts. Hypergolic propellants (in 

this case, a fuel of hydrazine and an 

oxidizer of nitrogen tetroxide) react 

and ignite on contact with each 

other. The propellant is periodically 

replenished by Progress resupply 

vehicles launched from Russia 

(typically around four per year). 

In the past, propellant was also 

resupplied by the European Space 

Agency Automated Transfer Vehicle 

(ATV). The ISS is the only satellite 

for which the on-board propellant is 

periodically replenished; for other 

satellites, the depletion of propellant 

usually marks the end of useful life. 

n Although the SM houses a complete 

set of attitude control thrusters and 

reboost engines, it can also control 

and automatically fire thrusters and 

reboost engines on the Progress 

vehicles that are normally docked to 

the aft of the SM or on the Docking 

Compartment-1 (DC-1). 

n Most components, including the 

flight computers in both the US 

Segment and the Russian Segment, 

the CMGs, rate gyro assemblies, 

Space Integrated Global Positioning 

System/Inertial Navigation System 

(SIGI) receivers, and antennas 

can and have been replaced 

on orbit. In many cases, failed 

components have been returned, 

serviced and refurbished, and 

relaunched for use as spares. 

As with everything else on the ISS, 

computers are at the core of the 

MCS. The work of the MCS is shared 

between the US Segment and the 

Russian Segment, extending to the 

computer systems at the center of 

the system. The MCS is built around 

a portion of the Command and 

Data Handling System, informally 

referred to as the “4-Box,” which 

includes the four-computer systems 

that manage and execute the 

motion control task. Two computers 

on the US Segment and two 

computers on the Russian Segment 

work together to control the ISS 

attitude and orbit. These computers 

process inputs from sensors such as 

GPS, star trackers, and rate sensors 

(discussed below) while commanding 

CMGs and small rockets to control 

the attitude and orbit. 

Command and Data 

Handling Elements 

The 4-Box consists of the Tier 1 

Command and Control (C&C) 

Multiplexer/DeMultiplexer (MDM) 

and Russian Segment Central 

Computer and the Tier 2 Guidance, 

Navigation and Control (GNC) 

MDM and Russian Segment Terminal 

Computer. There are three C&C 

MDMs (Primary, Backup, and 

Standby) and two GNC MDMs 

(Primary and Backup). In both sets of 

computers, the Primary is performing 

all processing while sharing 

information with its powered-on and 

“hot” backup MDM. The Russian 

Central Computer and Terminal 

Computer are actually each a set of 

three independent computers that 

provide redundancy. See Figure 1.

Command 

& Control

Central

Computer

Bus Controller

RS US

Bus Controller

Bus Controller

Remote Terminal

Guidance,

Navigation,

and Control

Terminal

Computer

Remote Terminal Remote Terminal

Bus Controller Remote Terminal

Figure 1. 4-Box computer architecture of MCS.

The C&C MDM and Central 

Computer manage the overall 

configuration of the system (such 

as which segment is in attitude 
122 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

control), whereas the GNC MDM 

and Terminal Computer determine 

attitude and position through the use 

of sensors, and physically fly the 

ISS with CMGs and small thrusters 

under guidance from Mission Control 

Center-Houston (MCC-H), Mission 

Control Center-Moscow (MCC-M), 

and occasionally the crew. 

Vectors and How NASA 

Uses Them

An important concept to how space 

vehicles and Mission Control know 

their location in space and the relative 

location of other objects is that of the 

vector. The simplest kind of vector is 

a location within a coordinate system 

that is defined by a grid. 

In Figure 2, the point O is the origin 

of the system, and the point A is a 

point of interest at x coordinate 2 and 

y coordinate 3. Vector OA describes 

the location of this point in this 

simple coordinate system. 

0

A

0A = (2, 3)

x

y

Figure 2. A simple vector.

Figure 3 shows a slightly more 

complex system, which extends into 

three dimensions to show the location 

of point A. 

x

y

z

x, y, z

Figure 3. Vector representation in 

three dimensions. 

A practical example of the use of 

a vector is shown in Figure 4. A 

position vector for the ISS can be 

described using kilometers in the X, 

Y, and Z axes by setting a coordinate 

frame in the center of the Earth. 

Mathematically, this is how the 

computers on the ISS and those in 

Mission Control store knowledge of 

the ISS position. 

Z

X

Y

Figure 4. ISS position vector.

The following paragraphs include 

references to several types of vectors, 

but all of them essentially describe 

the position (and sometimes velocity, 

as well) of one object relative to 

another object. 

Where Is the International 

Space Station? 

Fundamentally, the MCS senses and 

controls two elements—the orbit in 

which the ISS circles the Earth, and 

the attitude that the ISS holds relative 

to Earth during that orbit. 

The ISS flies a nearly circular orbit 

inclined 51.6 degrees to the equator 

and circles the Earth once every 90 

minutes. Orbital altitude is typically 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 123

around 410 km (255 miles) above 

the surface of the Earth, although 

the exact altitude is manipulated by 

reboosts and by small manipulations 

of the drag of the space station 

through solar array positioning (see 

Chapter 9). This manipulation of the 

orbit ensures the ISS is at the correct 

altitude and position in orbit for the 

numerous cargo and crew transfer 

vehicles that rendezvous with the 

ISS, as well as in the proper position 

to undock cargo and crew transfer 

vehicles that return to Earth. 

The ISS maintains a rotational 

position using attitude control while 

in this orbit. Unlike, for example, an 

airplane in orbital space, there is no 

naturally defined “up” or “down” on 

the space station. The ISS usually 

performs attitude control within 

a coordinate frame called Local 

Vertical, Local Horizontal (LVLH) 

(see Figure 5). In this reference 

frame, the +X axis points along the 

velocity vector in orbit, the +Z axis 

points toward the center of the Earth, 

and the +Y axis is perpendicular to 

the X-Z plane. The frame is referred 

to as a rotating coordinate frame since 

the Z axis is always pointed toward 

the center of the Earth. 

XLVLH

XLVLH

YLVLH

YLVLH

ZZLVLH LVLH

ZZLVLH LVLH

Figure 5. LVLH reference frame. Note that the reference frame rotates so that Z 

(and the bottom of the ISS) always points at the Earth. 

Pitch

Yaw

Roll

Figure 6. YPR attitude definitions for the ISS.

The exact attitude of the ISS within

this frame is usually described by a 

Yaw, Pitch, and Roll (YPR) in degrees 

(Figure 6). When the ISS is precisely 

aligned with LVLH, it is at an attitude 

of Yaw=0, Pitch=0, and Roll=0—or, 

in shorthand, YPR 0,0,0. When at 

this attitude, if one were sitting atop 

the ISS, the Earth’s horizon would 

be visible in front of him or her, as if 

that person were in an airplane. If the 

person looked below, he or she would 

see the Earth. The ISS usually flies 

within a few degrees of the LVLH 
124 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

attitude, a typical torque equilibrium 

attitude (which is described later) 

as the space station coasts is 

YPR -4,-3,0. Some special attitudes—

e.g., a pitch up of 90 degrees for some 

Russian vehicle undockings—are 

used for short periods of time, usually 

for a few hours, at most. 

By flying in an LVLH reference 

frame, the “bottom side” of the ISS 

faces the Earth as the space station 

travels around it. This provides some 

advantages. Scientific packages 

intended for Earth observation (such 

as cameras) can be mounted in a fixed 

position on the underside of the ISS, 

whereas communications and other 

antennas are afforded a clear view of 

space on the top. Thermal protection 

can be specifically designed for the 

Earth-facing or space-facing side 

of the ISS. One disadvantage is the 

sun will appear to be constantly in 

motion as the ISS passes beneath it; 

thus, articulating solar arrays were 

designed to track the sun and provide 

maximum power generation. 

A final feature of the ISS orbit is 

the geometry of the ISS orbit with 

respect to the sun. As the space 

station orbits, the sun rises and sets 

every orbit (16 times a day). When 

the sun is highest in the sky, it is also 

referred to noon (as on Earth)—or, 

more specifically, orbit noon, since 

noon happens once per orbit. 

A line drawn from the center of the 

Earth to the spot on the orbit where 

orbit noon occurs is called the orbit 

noon vector. A line drawn from the 

center of the Earth directly to the sun 

is called the sun vector. Both of these 

can be visualized on Figure 7. 

Sun

Orbit 

 Noon

β Angle

Figure 7. Definition of beta angle (β).

Orbit 

 Noon

ZZXPOP XPOP

XXXPOP XPOP

YYXPOP XPOP

ZZXPOP XPOP

XXXPOP XPOP

YYXPOP XPOP

Figure 8. XPOP reference frame.

The sun can be almost directly 

overhead at noon or it may be well 

off to the left or right side of the orbit, 

depending on the orientation of the 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 125

ISS orbit. The angle between the sun 

vector and the ISS orbit noon vector, 

shown in Figure 7, is known as the 

beta angle (β). The beta angle varies 

between +75 degrees (low to the left 

of the ISS when flying in LVLH), 

0 degrees (directly overhead), and 

-75 degrees (low to the right of 

the ISS). The exact beta angle is 

dependent on where the Earth is in 

orbit around the sun (the sun is over 

the northern hemisphere in June and 

over the southern hemisphere in 

December), and the orientation of 

the ISS orbit about the Earth (which 

shifts westward a few degrees per 

day due to the bulged center of the 

Earth). The beta angle slowly swings 

between negative and positive 

extremes over the course of several 

months, by a few degrees per day. 

The most visible effect of beta angle 

on the ISS is that of the secondary 

gimbals on the ISS solar arrays, also 

known as the beta gimbals. These 

gimbals are used to turn the arrays 

to the left or right when the sun 

is lower in the sky (see Figure 8, 

Chapter 9).

A reference frame called 

X-Perpendicular Out of Plane 

(XPOP) was used for attitude control 

in the early parts of the ISS assembly, 

before the full complement of solar 

arrays and gimbals were installed. 

See Figure 8.

XPOP is a reference frame that 

is the equivalent of LVLH with a 

90-degree yaw, but only at orbit noon. 

The frame stays essentially fixed in 

inertial space, meaning it doesn’t 

rotate as the ISS goes around the 

Earth, as does LVLH. XPOP was 

designed to point the ISS toward 

the sun, which was useful at higher 

beta angles when the arrays could be 

placed only in limited positions. 

How the International Space 

Station knows its Position: 

Orbit Determination

The orbit of the ISS can be described 

by a vector consisting of six elements: 

three elements for position relative to 

the Earth (X, Y, and Z) as described 

previously and shown in Figure 4, 

and a corresponding three elements 

to describe velocity in each of those 

axes. That vector is known as a state 

vector, and is used by the ISS to know 

its location in space so that it can, for 

example, properly point antennas at 

data relay satellites and solar panels 

at the sun. The state vector is also 

used by Mission Control to know 

where to target cargo vehicles. In fact, 

if one uses personal-computer-based 

tracking software at home to track 

the location of the ISS and determine 

when the space station may be 

visible, that software is downloading 

an up-to-date ISS state vector from 

the internet. 

Once the position and velocity are 

known at a given time, mathematical 

equations can be used to calculate 

the position at a future time. This is 

accomplished through a computer 

process called propagation; however, 

the more days a state vector is 

propagated forward, the more error 

appears in the result. Because of 

this, the state vector on the ISS as 

well as on the ground needs to be 

updated with sensor-based position 

determination to correct and update 

the mathematical propagations. 

Figure 9. GPS antenna, one of four.The GPS antennas were designed to be replaceable by 

spacewalking astronauts. In this image, a technician fit checks an antenna while wearing spacesuit 

gloves to verify the design. 

Orbit position and velocity

determinations can be made in a 

variety of ways for the ISS. The US 

Segment has a pair of GPS receivers 

along with an array of four GPS 
126 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

antennas mounted on the S0 truss 

(Figures 9 and 10). These receivers 

are SIGI units, manufactured by 

Honeywell (Morristown, NJ). SIGI 

receivers are common in satellites 

today, although the ISS was the first 

to use it operationally. 

GPS

Antennas

Figure 10. GPS antenna array on S0 truss. The rectangle traced out by the four antennas is 3 x 1.5 m (~10 x 5 ft). 

For the most part, the SIGI receivers 

determine position in the same way 

a GPS receiver determines position 

in a vehicle on Earth. The receiver 

can triangulate a position of the ISS, 

as well as compute a time error to 

the microsecond level between the 

computer clock running on the ISS 

and that on board the synchronized 

atomic clocks on the GPSs, by 

receiving coded signals from at least 

four of the 24 operational GPSs that 

orbit above the ISS. The position is 

provided to the navigation software 

within the USOS GNC MDM to 

correct the navigation filters, if 

necessary, whereas the time error is 

occasionally adjusted by MCC-H to 

slowly adjust the on-board clock of 

the ISS (see Chapter 5). 

Similar satellite navigation equipment 

is also installed in the Russian 

Segment, which determines its own 

state vector and shares it with the 

USOS GNC flight software. The 

SIGI can also determine acceleration; 

however, this is normally only used 

during reboost maneuvers due to the 

relatively infrequent maneuvers of the 

ISS, and, even then, only occasionally. 

Additionally, tracking by ground 

radar and Tracking and Data Relay 

Satellite ranging can be used to 

determine the orbit of the ISS, 

although typically these data are used 

only by the ground. In some rare 

cases, both MCC-H and MCC-M 

may command new state vectors to 

the USOS and/or Russian Segment 

software when the ground solution 

is determined to be better or when 

the satellite navigation equipment in 

either segment is offline. 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 127

While the position in a particular 

orbit changes rapidly (8 km/sec 

[5 miles/sec]), the orbit itself 

changes little over the course of a 

day, mostly in the form of a small 

altitude decrease on the order of 25 

to 50 m per day (82 to 164 ft per day) 

due to atmospheric drag. Because 

of this, the MCS can easily go for 

24 hours or more without a position 

measurement (also sometimes 

referred to as a “fix”) to correct its 

orbit knowledge, although it is rare to 

go more than 1 hour. 

The USOS GNC system actually 

propagates three different orbit 

positions in memory—one based 

on measurements from GPS 

(SIGI) receiver 1, one based on 

measurements from GPS receiver 2, 

and one that is calculated by the 

Russian Segment Terminal Computer 

and transmitted to the GNC MDM. 

The software performs a comparison 

of the three estimates and will vote 

out the one that does not agree with 

the other two in order to isolate 

errors in the system. Normally, the 

three estimates will agree within a 

few tens of meters, and the system 

will automatically select GPS 1 if all 

three agree. See Figure 11.

GPS 1

SELECTED

STATE GPS 2 SELECTION

RS State

Figure 11. Selection of GPS estimates in the USOS GNC software.

Attitude Determination

Attitude (rotational position) 

determination is a more complex 

problem than orbit determination. 

Sensors are needed to determine the 

attitude at specific intervals as well as 

the changes between those times.

The US Segment also determines 

the attitude of the ISS using GPSs, 

but in a fundamentally different way 

than that in which orbital position is 

determined. The GPS antenna array 

is relatively large, and the distance 

between the antennas is fixed and 

known. The position of the antenna 

array in three-dimensional space can 

be roughly determined by the attitude 

processor within SIGI by using the 

phase difference (i.e., time delay) 

between GPS signals received by 

at least three of the four different 

antennas in the array. These fixes 

can be infrequent (i.e., more than an 

hour apart). Tracking angles from 

the USOS Ku-band communications 

antenna can also be used as a source 

of attitude information, although this 

is considered a backup to the GPS 

(see Chapter 13).

The US Segment has a pair of 

Rate Gyro Assemblies (RGAs) 

(Figure 12) mounted in the S0 truss 

to propagate attitude in between 

relatively infrequent position fixes. 

Each RGA consists of three ring laser 

gyros mounted at 90-degree angles 

to each other to sense rates about 

all three axes. Internally, the RGAs 

measure attitude changes 200 times 

per second; five times per second, 

that information is provided to the 

GNC flight software. The GNC 

flight software updates its attitude 

knowledge at the same rate using 

the attitude information to calculate 

attitude error, which is used by 

the attitude control function that is 

described later. 

20 cm

(8 in.)

Figure 12. ISS RGA. 

A complex attitude-determination filter 

in the GNC flight software combines 

the attitude fixes from GPS or the 

Ku-band antenna in concert with 

sensed rate changes and generates a 

highly accurate filtered attitude as well 

as estimates of RGA misalignment 

and gyro drift of the RGAs. With this 

information, the GNC flight software 

typically knows its attitude to 0.1 or 

0.2 degrees accuracy. 
128 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

The Russian Segment independently 

determines attitude using star 

mappers and its own set of gyros. 

Star mappers mounted on the SM 

take images of the sky and compare 

the patterns made by the stars in the 

image to a catalog of the star patterns 

stored in the software. By matching 

images to the catalog, software in 

the star mapper can determine the 

orientation of the star mapper itself. 

This information is processed by the 

Russian Segment Terminal Computer 

to determine the attitude. The Russian 

Segment also uses a gyroscope in 

the SM to determine changes in 

attitude. This system allows the 

Russian Segment to determine the 

attitude of the ISS independently and 

dissimilarly from the USOS systems. 

Both segments share, compare, and 

can use the attitude information from 

each other. This sharing, combined 

with the dissimilar system designs of 

each system, provides a significant 

advantage in redundancy, since 

major failures (e.g., power failures) 

are usually localized to either the 

Russian Segment or the US Segment. 

If the US Segment loses its attitude 

or rate information, it can easily and 

automatically switch to that being 

provided by the Russian Segment. 

The Russian Segment can similarly 

use the navigation information 

computed by the US Segment. 

As shown in Figure 13, the USOS 

GNC software carries three estimates 

of attitude and three estimates of rate 

when running at full redundancy, 

including the estimate delivered by 

the Russian Segment. The software 

compares each of the three estimates 

and will vote out a single estimate 

that is in error. 

GPS 1

or Ku

SELECTED

ATTITUDE SELECTION

RS State

GPS 2

or Ku

RGA 1

SELECTED

RATE SELECTION

RS RATE

RGA 2

Figure 13. Attitude selection algorithm in the US GNC software.

How does the 

International Space Station 

control its location?

The ISS uses a combination of 

small rocket thrusters located on 

the SM and Progress cargo vehicles 

on the Russian Segment as well as 

non-propulsive attitude hold devices 

(i.e., CMGs) on the US Segment 

to maintain attitude. Occasionally, 

the orbit may need to be raised or 

adjusted, which is done with rocket 

engines on the aft of the SM or 

those on the aft of a docked Progress 

cargo vehicle. 

The ISS has an elegant arrangement 

where the duties of attitude control 

are shared between the US Segment 

and the Russian Segment. Computers 

to manage the systems are divided 

between the segments and share data, 

and attitude control is handed over 

between the segments cooperatively, 

depending on operational demands. 

Besides operational needs to 

position the space station (such as 

maneuvering to a docking attitude), 

the MCS counteracts small but 

significant forces (over time) from 

the low-Earth orbit environment. 

Those forces include:

n Aerodynamic drag, primarily due 

to the large solar arrays. Even 

though the ISS is in space, its low 

orbit actually encounters a very 

thin portion of the atmosphere 

of the Earth. Overall drag causes 

the orbit to lose energy and the 

space station to drop to a lower 

altitude, requiring periodic 

reboosts to raise the orbit. 

Unequal drag on different parts 

of the vehicle also causes attitude 

torques (or rotational, twisting 

force) that tend to push it out of 

flight attitude, which needs to be 

constantly counteracted by the 

attitude control system. 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 129

n Gravity gradient forces. 

Gravitational force acts on an 

object as a proportion of square 

of the distance from the Earth. 

Parts of the space station that are 

nearer to the center of the Earth 

are attracted more than ones 

that are farther away. While on 

Earth, and for most satellites, the 

difference would be considered 

miniscule; the size of the ISS 

causes relatively significant 

gravity gradient torques in certain 

flight attitudes. Again, the attitude 

control system needs to constantly 

counter these torques to stay in 

attitude control. 

n Other minor forces, including 

solar radiation pressure (literally, 

pressure from light). 

At any instant in time, these forces 

are absolutely miniscule—e.g., the 

drag from the rarified atmosphere 

in low-Earth orbit is 100 times less 

than the force on the human hand 

when holding a sheet of paper. Over 

time, however, even this minisculebut-constant aerodynamic force will 

cause the ISS orbit to slowly drop, 

usually on the order of 25 to 50 m 

(82 to 164 ft) per day, which drives 

the need for occasional reboosts. 

These external forces will also act to 

try to push the ISS out of attitude and 

cause it to tumble; aerodynamic and 

gravity gradient forces, in particular, 

are not evenly distributed. This drives 

the need for attitude control devices. 

For the ISS, these devices are CMGs 

assisted by occasional thruster 

firings. Electrically powered CMGs 

are used for gently counteracting 

environmental forces most of the 

time, whereas propellant-consuming 

thrusters are used for maneuvering 

and desaturating the CMG system 

when required (discussed below). 

Controlling Attitude in 

Space—Control Moment 

Gyroscopes and Thrusters

Two general categories of activities 

require attitude control. One is 

regular day-to-day operations where 

the ISS is maintaining a LVLH 

attitude and a stable platform for 

other vehicle systems and payloads. 

During these operations, only 

small adjustments are needed to be 

applied by the control system to 

counter the tiny forces introduced 

by aerodynamic drag and gravity 

gradient forces. 

The other category is special 

operations, where control of the ISS 

attitude may require rapid rotational 

maneuvering of the ISS attitude, 

use of stronger methods of attitude 

control during rendezvous operations 

of visiting vehicles, reboost 

operations, or recovery from an 

unplanned loss of attitude control.

Two primary methods are employed 

to control the attitude of the ISS for 

these operations (Table 1). CMGs on 

the USOS MCS system perform fine 

attitude control using only electricity 

readily available from the Electrical 

Power System, and typically are fully 

in attitude control during day-to-day 

operations. Thrusters on the Russian 

MCS can be called upon to augment 

or take over attitude control from 

the CMGs during special operations. 

Although the thrusters offer more 

power, it comes at a cost of consuming 

propellant (which must be resupplied 

from Earth), increased operational 

complexity, and the potential to 

interfere with payloads dependent on a 

microgravity environment. 

Table 1. Comparison of CMGs and Thruster Control

Type of Control CMGs Thrusters

Advantages • Use only electricity.

• Can hold attitude tightly.

• No potential to damage 

solar arrays.

• Do not interfere with 

microgravity payloads. 

• More powerful, can perform 

larger maneuvers.

• More robust (can maintain 

attitude control when CMGs 

would be overwhelmed). 

Disadvantages • Limited power.

• May require augmentation 

by thrusters for larger 

maneuvers or tighter 

control. 

• Require resupply of propellant 

from Earth.

• Can require special positioning 

of solar arrays to avoid damage.

• Spent propellant can cause 

contamination, especially for 

windows. 

• Firing may interfere with 

microgravity payloads. 

The effectors of the USOS MCS 

system consist of four CMGs. The 

CMGs each consist of a 98 kg 

(216 lbs) steel flywheel, which is spun 

by an electric motor at a constant 

rate of 6600 revolutions per minute. 

The flywheel sits on two mechanical, 

lubricated spin bearings that are 

electrically driven to keep the CMG 

running at full speed. The flywheel 

and spin bearings are mounted on 
130 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

an electrically driven inner gimbal, 

which in turn is mounted completely 

inside an outer gimbal. Because 

of the inner/outer gimbal design, 

the spin axis of the flywheel can be 

oriented at any position within threedimensional space. 

A CMG (Figure 14) is a device 

that produces torque (a rotational, 

twisting force). A torque is generated 

on the space station by electrically 

driving the inner and outer gimbals 

and pushing or “gimbaling” the 

spinning wheel. Compared to the size 

of the ISS, the torque is surprisingly 

small, usually 10 to 30 N-m (7 to 22 

ft-lbs) depending on the velocity at 

which the gimbals are being driven 

by their motors. For a comparison, if 

a person could stand at the end of the 

space station truss, he or she could 

impart the same level of torque by 

simply pushing. 

Figure 14. A CMG prior to launch. The large box mounted on the left houses the power supplies and small computer that controls the CMG. 

The CMG measures approximately 130 x 130 x 130 cm (51 x 51 x 51 in.) and weighs 272 kg (600 lbs). 

Since the environment around the ISS 

consists of external forces that are 

much less than those encountered on 

Earth, the relatively low torque output 

of the CMGs is sufficient for all 

attitude control—except when large 

maneuvers need to be performed 

quickly. The ISS uses four CMGs, 

mounted on the Z1 truss segment, that 

work together in tandem under the 

command of the USOS GNC MDM 

flight computer. 

The MCS uses the CMGs to generate 

torque and correct the attitude when 

small external rotational forces act to 

push the space station out of its flight 

attitude. Applied over time, that torque 

is stored as momentum in the CMG 

system (momentum=torque multiplied 

by time). Since the gimbals of the 

CMGs can constantly be in motion 

and are powered electrically, they 

can provide a constant, fine attitude 

control that counteracts the small 

aerodynamic and gravity gradient 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 131

torques. Although CMGs provide 

excellent fine attitude control, they 

have a capability limited by physics 

as the CMGs gimbal. Generally, 

their momentum axes are pointed 

in different directions (Figure 15). 

As the CMGs provide torque and 

absorb momentum, the spin axes of 

the flywheels begin to align. When 

the spin axes of the four-CMG system 

line up, the system loses control and 

is referred to as saturated (Figure 16). 

The CMG system will become 

saturated relatively quickly for any 

significant torques (e.g., a small 

air vent overboard will saturate the 

CMGs within a few minutes) and they 

are normally incapable of performing 

an attitude maneuver of more than 

about 1 degree, unless the CMG 

maneuver is specially designed. 

Torque

CMGs Producing a Torque

CMGs Saturated

CMGs Producing a Torque

Figure 15. CMG system with spin axes well 

separated and able to react to external forces.

Torque

CMGs Producing a Torque

CMGs Saturated

CMGs Producing a Torque

Figure 16. CMG system with spin axes aligned. 

This CMG system is saturated and the wheels 

need to be repositioned (this will require thruster 

firings, also known as desaturations).

The number of CMGs (four) was 

determined by how much momentum 

would be required to maintain this 

fine control during normal dayto-day operations in momentum 

management (explained below). 

The ISS simply maintains its attitude 

during these periods as the crew lives 

and performs research in between 

events such as visiting vehicle 

arrivals and reboosts. The basic 

capability was to maintain momentum 

management control without firing 

thrusters to support microgravity 

research and conserve propellant 

over long periods of time (~30 days). 

Three CMGs were required to meet 

this minimum level of capability. 

A fourth CMG was added to 

introduce redundancy, so operations 

could continue uninterrupted in the 

event of a failure. 

In comparison, a thruster provides 

a translational force that acts as a 

torque when applied over a distance 

between the thruster itself and the 

center of mass of the space station. 

Thrusters are significantly more 

powerful sources of force and torque, 

and they control the attitude of the 

ISS more coarsely than the CMGs. 

Thrusters are used to perform large 

attitude maneuvers such as those 

required to reposition the vehicle 

attitude for dockings. Thrusters are 

also used to help control vehicle 

attitude when the CMGs become 

saturated. In a process called 

desaturation, the CMG gimbals are 

moved out of alignment while the 

thrusters fire to absorb the torque 

generated. Desaturation is an 

automatic software function on the 

ISS, where the USOS GNC MDMs 

compute a “desaturation request” 

(i.e., essentially a vector with desired 

momentum correction) and hand it 

off to the Russian Segment Terminal 

Computers. While the GNC MDM 

gimbals the four-CMG system to a 

lower momentum state, the Russian 

Segment Terminal Computer 

computes and fires thrusters on the 

Service Module and/or Progress 

vehicles to react to the CMG 

desaturation event and maintain the 

attitude of the ISS. 

In some cases, the CMG system 

may not be able to maintain attitude 

control for difficult attitude control 

situations such as an overboard vent, 

a problem in the GNC MDM or 

its software, or the loss of multiple 

CMGs due to an electrical failure. 

In these cases, software in the C&C 

MDM will automatically hand over 

attitude control to the Russian 

Segment thrusters or, in limited 

scenarios, the crew may perform the 

handover manually in response to a 

warning message. 

Although thrusters are powerful 

devices, they have disadvantages. 

Most obviously, they use propellant 

that needs to be replenished, and that 

must be launched from Earth. Several 

tons of propellant must be launched 

to the ISS, annually, using Russian 

cargo vehicles. 

Another major but less-obvious 

concern is the health of the ISS 

solar arrays. The ISS solar arrays 

are lightweight and were built to 

be deployed and unfurled on orbit. 

Because of this, the arrays and the 

structure that supports them are 

quite fragile. Imagine a large version 
132 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

of a model made of tissue paper 

and toothpicks. Thrusters generate 

exhaust, which can flex and fatigue 

the arrays or slowly build up on the 

panels, thereby decreasing electrical 

generation. When thrusters are fired, 

the ISS solar arrays often need to 

be parked in particular positions to 

avoid being damaged by the thrusters, 

which usually reduces the amount of 

available power. 

Finally, the firings from the thrusters 

are not conducive to a microgravity 

environment for many payloads. 

Because of this, CMGs are in attitude 

control 99% of the time, with control 

being handed to thrusters for special 

events only, or in contingency cases 

such as loss of CMG attitude control 

or unplanned CMG saturation. 

Having both CMGs and thrusters 

available and working is critical to 

maintaining attitude control. Without 

thrusters, large maneuvers could not 

be performed, the ISS stack could 

not recover from a loss of attitude 

control event, and the ISS stack could 

not be put into position to dock or 

capture a rendezvousing vehicle. 

Without CMGs available to hold 

attitude between these events, the 

thrusters on the ISS would exhaust 

their fuel supply in a few months. A 

minimum of two CMGs are required 

to perform attitude control; however, 

three CMGs are generally required 

to safely perform all attitude control 

functions. Individual CMGs can be 

replaced by a spacewalking astronaut 

with the assistance of the Space 

Station Remote Manipulator System 

(SSRMS) robotic arm. Two spare 

CMGs are carried externally on the 

ISS to replace failed gyros. 

Microgravity

Probably the most well-known environment the ISS provides is one that 

is unique to space—an environment in which objects are weightless. 

Researchers can remove the variable of gravitational influence within their 

investigations. For example, on Earth, combustion is driven by convection, 

where warm air rises and cold air sinks. Crystal structures grown in the 

weightlessness of space can often be grown larger and more pure. 

Extremely sensitive experiments such as crystal growth experiments or those 

involving liquid flow may be negatively impacted by firing of the ISS thrusters, 

or even by movement of the ISS crew. For these reasons, more sensitive 

experiments may be run in racks that have vibration isolation, are usually 

planned when the USOS CMGs are in attitude control and thruster firings are 

not planned, and may be conducted at night when the crew is sleeping.

US Segment Attitude Control

The control system of the US 

Segment attempts to control three 

different variables: the attitude (how 

many degrees out of the desired 

attitude is the ISS located); attitude 

rate (how fast is the ISS rotating); 

and momentum (how close are the 

CMGs to saturation and therefore 

losing attitude control without 

resorting to thrusters). How much 

each of these variables, or controller 

states, are weighted by the attitude 

control software depends on how 

the software is configured. For 

example, some software controllers 

are designed to hold attitude and 

attitude rate (i.e., how quickly the 

attitude is changing, in degrees per 

second) tightly, but at the expense 

of allowing momentum to build in 

the CMGs and therefore requiring 

thruster firings. This type of controller 

is used for dockings but is unsuitable 

for attitude control of more than a few 

hours because it uses propellant. A 

non-propulsive controller is desirable 

for most attitude control—i.e., over 

99% of the time. These controllers 

take advantage of the environment in 

which the ISS flies. 

External torques, and the associated 

momentum gain in the CMG system, 

often balance out over the course of 

an orbit. For example, as the solar 

arrays rotate, they can generate a 

torque in one direction at one part of 

an orbit, and then a corresponding 

torque in the other direction in 

another part of the orbit. The torques 

are conservative (i.e., they add up to 

zero) over a full orbit, with the CMGs 

providing the mechanism to store 

momentum on one side of the orbit 

by gimballing one direction, and then 

disperse the momentum on the other 

side of the orbit by gimballing the 

opposite direction. 

The CMGs also absorb small, 

unbalanced (on average) torques 

in orbit. Over the course of many 

hours, these unbalanced torques 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 133

would eventually saturate the CMG 

system and require thruster firings. 

By slightly changing the attitude of 

the ISS, however, the attitude control 

software can push the momentum 

state of the CMG system lower by 

manipulating the small aerodynamic 

and gravity gradient torques acting 

on the system. This software 

control mode is called “momentum 

management.” The controller keeps 

the momentum variable at the lowest 

while loosening up on the attitude and 

attitude rate constraints. 

While in momentum management, 

the ISS attitude will gently rock 

by several degrees over the course 

of an orbit as the software works 

to push the momentum state of the 

CMGs to zero. The advantage of 

momentum management control is 

that thruster firings are never needed 

unless a significant unexpected force 

such as a vent acts on the system. 

This saves propellant and preserves 

the microgravity environment for 

many of the ISS payloads. The 

disadvantage is that the attitude 

wobbles by several degrees, which is 

unsuitable for precision alignment of 

the ISS attitude required for vehicle 

dockings. Momentum management is 

also unsuitable for rejecting thruster 

plume disturbances from nearby 

vehicles, which is why it is not used 

for visiting vehicle capture operations 

performed with the SSRMS robotic 

arm. Finally, momentum management 

only works near certain attitudes in 

which external forces are balanced. 

These attitudes are called Torque 

Equilibrium Attitudes (TEAs). The 

most typically flown TEA is one that 

is usually within a few degrees of the 

ISS LVLH (0,0,0). 

A different control logic—referred 

to as “attitude hold”—is used for 

precision attitude alignment and 

disturbance rejection, or for attitudes 

that are not at the TEA. In attitude 

hold, the CMG system maintains 

the attitude precisely (within a few 

tenths of a degree) by prioritizing 

controlling the attitude and attitude 

rate control over keeping the total 

momentum constant. This greater 

stability allows the system to reject 

strong disturbances, thus making 

attitude hold suitable for vehicle 

dockings and robotic capture 

operations. CMG momentum can 

build rapidly in this mode since 

the attitude control software does 

not attempt to optimize the ISS 

attitude to control gravity gradient 

or aerodynamic torques, and the 

stack may not be at a TEA. In these 

cases, the system may saturate in 

minutes, and would require frequent 

desaturation firings of Russian 

Segment jets. 

A variation of the attitude hold 

logic is called the USOS Thruster 

Only (USTO). In USTO, the USOS 

software bypasses the CMG system 

and commands thruster firings of 

the Russian Segment directly by 

manipulating the software logic used 

for CMG desaturation firings. 

These attitude control concepts 

are implemented in the software in 

the form of controllers, which are 

loaded by the ground as mission 

needs dictate. These three types of 

controllers map directly to the above 

attitude control concepts:

n Momentum management 

controllers for use during quiescent 

orbit operations.

n Attitude hold controllers for 

fine control.

n Attitude hold controllers 

(USTO logic implemented) for 

direct USOS control of Russian 

Segment thruster firings. 

Russian Segment 

Attitude Control 

The Russian Segment performs 

attitude control using thrusters 

spread throughout the Russian 

Segment. The SM contains the 

original Russian Segment thruster 

package that is still in use today. 

Additionally, Progress vehicles 

docked to the aft port of the SM and 

the Nadir port of the DC-1 docking 

compartment have thrusters that 

are usually placed under control of 

the SM, when present. Although 

no longer in use, the European 

Automated Transfer Vehicle, when 

docked to the SM aft port, was also 

controlled by the SM.

The Progress and ATV thrusters 

are generally preferred to the SM 

thrusters because the distance 

between the thrusters and the center 

of mass of the ISS, or the moment 

arm, is large. As when using a lever, 

the longer the moment arm, the 

greater the mechanical advantage 

and the less a thruster needs to 

fire. Additionally, unlike the SM, 

the Progress and ATV are not 

permanently attached; therefore, 

they are unconstrained by lifetime 

usage limitations that affect the 

Zvezda thrusters, which have been 

in use since 2000. 
134 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

The terminal flight computer within 

the SM performs attitude control 

with thrusters when the Russian 

Segment is in attitude control, and 

responds to requests for desaturation 

thruster firings from the USOS GNC 

MDM when the US Segment is in 

attitude control. 

Control Modes

The US Segment and Russian 

Segment flight software jointly works 

together through the use of several 

attitude control software modes. 

The software mode depends on what 

is operationally being done and 

which segment is in attitude control. 

The most common modes are listed 

below (see also Table 2):

Table 2. US Segment/Russian Segment Control Mode Combinations

Configuration US Mode Russian Mode Notes Usage

Free Drift Free Drift Indicator or CMG/

Thruster Assist

No active attitude 

control.

Used immediately after docking while the 

docking interface is being made rigid.

CMG/Thruster 

Assist

CMG/Thruster 

Assist

CMG/Thruster 

Assist

US Segment controlling 

attitude with CMGs.

Momentum management for quiescent 

operations, US control for vehicle grapples 

and capture.

Thrusters Free Drift Thrusters Russian Segment 

Controlling with 

Thrusters.

Large attitude maneuvers, Russian Vehicle 

dockings, reboosts.

n Free Drift/Indicator—segment is 

not controlling attitude.

n CMG/Thruster Assist—US 

Segment controlling attitude 

with CMGs, Russian Segment 

supporting with CMG desaturation 

firings when commanded from the 

US Segment. 

n Thrusters—Russian Segment 

controlling with thrusters. 

Typically, the configuration of the 

MCS will be CMG/Thruster Assist 

during routine orbit operations, with 

the US Segment in attitude control 

using a momentum management 

controller. The software is jointly 

reconfigured by both MCC-H and 

MCC-M to do a dynamic operation. 

The example in Table 3 illustrates 

the procedure for configuring from 

day-to-day momentum management 

to a configuration to support reboost. 

Times are referenced to time of 

reboost burn ignition, or time of 

ignition (TIG), in minutes. TIG is 

used as a countdown for reboost 

burns, which helps Mission Control 

personnel sequence out activities 

required to perform the burn. 

Table 3. ISS Reboost Timeline

Time Center Action Notes

TIG - 40 min MCC-H/MCC-M Uplink prep commands through Tracking 

Data Relay Satellite

TIG - 30 min MCC-H Command handover to Russian Segment USOS Mode = Free Drift

Russian Mode = Thrusters

TIG - 25 min MCC-M Command reboost sequence to start

TIG - 20 min Attitude maneuver to reboost attitude Under Russian Segment automatic software 

control

TIG Reboost ignition Under Russian Segment automatic control

TIG + 10 min MCC-M Maneuver back to normal stage TEA attitude

TIG + 20 min MCC-H Command handover from Russian Segment USOS Mode = CMG/Thruster Assist

Russian Segment Mode = CMG/Thruster Assist

The US and Russian flight control 

teams jointly manage all of these 

operations by using a common set 

of flight procedures that are built 
SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS CHAPTER 7 135

and tested together. Flight directors 

and motion control flight controllers 

at each center jointly manage, 

over voice circuits, procedures and 

authorizations for commands. 

Assembling the Motion 

Control System

The ISS MCS has gone through 

several evolutions throughout the 

assembly sequence. Initial capability 

was provided with the launch of the 

Functional Cargo Block (FGB) with 

its basic propulsive control system 

used for attitude control from launch, 

by the addition of the Node 1 on 

Dec 6, 1998, and until arrival of the 

SM on July 26, 2000. Upon arrival of 

the SM, the FGB control system was 

permanently shut down and converted 

to propellant storage. 

During the next 7 months, the SM 

provided attitude determination 

and attitude control using thrusters, 

with orbit determination being 

done via ground-based radar. The 

USOS CMGs arrived with the Z1 

truss during Space Transportation 

System (STS)-92/ISS-3A in October, 

although the CMGs were inactive. 

The CMGs were activated and 

the first attitude control handover 

was performed to the USOS MCS 

following the arrival of the USOS 

Destiny Laboratory on February 10, 

2001, along with the necessary flight 

computers and software. The USOS 

MCS and CMGs have performed 

normal day-to-day attitude control 

since this first activation, with Russian 

thrusters engaged only every few 

weeks for larger attitude maneuvers, 

reboosts, or docking/capture of cargo 

or crew transport vehicles. 

The arrival of the last major 

assembly—the S0 truss on STS-110/

ISS-8A in April 2002—completed 

the ISS control system. The S0 

truss mounted the two RGA attitude 

rate sensor packages and four 

GPS antennas (with the SIGI GPS 

receivers launched earlier in the 

USOS Laboratory). This upgraded 

equipment, along with a software 

update to the GNC and C&C MDMs, 

allowed the US Segment to fully 

determine attitude, attitude rate, and 

orbits independent of the Russian 

Segment, thus greatly extending the 

redundancy of the ISS MCS.

This completed the initial system 

assembly. Although assembly 

and reconfiguration of the system 

continues in some respects, each 

Progress vehicle is used for auxiliary 

propulsive elements, primarily 

to provide reboost engines and 

augment roll control with thrusters. 

Additionally, software continues to 

be incrementally upgraded to take 

advantage of operational experience, 

such as using the Ku-band antenna to 

help determine attitude along with the 

GPS receivers. 

Control Moment 

Gyroscope Failures

The CMGs were the subject of a 

considerable engineering and test 

effort while under development 

because of their criticality, and the 

fact these mechanical devices must 

spin at a high speed for decades. 

The first CMGs used in space were 

developed for the Skylab Program, 

which used three CMGs. During the 

relatively short Skylab operational 

mission, one CMG suffered a spin 

bearing failure and was shut down, 

and a second was near failure. The 

ISS CMGs were direct descendants of 

the 1973 Skylab CMGs. NASA made 

improvements in the bearing design 

to increase the operational lifetime. 

Despite this effort, problems with 

the CMGs continued early in the ISS 

Program. The CMGs were activated 

on February 12, 2001, during 

STS-98/ISS-5A, after being launched 

late in 2000 and stored with only 

survival heaters active on the Z1 

truss. These CMGs were responsible 

for nearly all of the ISS attitude 

control after that time. 

On June 8, 2002, controllers in 

MCC-H noticed that, after little more 

than a year of operations, CMG-1 

vibrated as it spun. Over the next 

several hours, the vibrations worsened 

until one of the two mechanical spin 

bearings failed. It took more than an 

hour for the energy in the spinning 

wheel to dissipate, at which time one 

side of the bearing assembly became 

so hot it melted the ball bearings 

inside. The crew reported a sound, 

which astronaut Carl Walz described 

as “a pretty loud, audible noise. A 

kind of growling noise in the Node.” 

The CMGs are mounted in the Z1 

truss, which in turn is mounted to 

the zenith port of the Unity Node. As 

with all key elements of the ISS, the 

CMGs can be replaced (Figure 17).

After a great deal of concern over 

the health of the remaining three 

CMGs, especially during the stand 

down following the Space Shuttle 

Columbia accident in 2003, NASA 

replaced CMG-1 during STS-114/

ISS-LF1 in 2005 and returned 

the gyroscope to Earth. CMG-3 

exhibited similar issues shortly 

after CMG-1 was returned. CMG-3 

was eventually shut down and 
136 CHAPTER 7 SYSTEMS: MOTION CONTROL SYSTEM—NAVIGATOR OF THE HEAVENS

replaced, as well. A postmortem 

investigation indicated design issues 

within the spin bearing that caused 

the ball bearings to skid instead of 

roll, exacerbated by relatively high 

gimbal rate limits. 

The CMGs exhibited no additional 

signs of distress following software 

modifications to slow down the 

maximum rates of the gimbals from 

3 deg/s to 0.8 deg/s. Furthermore, the 

two spares stored on the ISS have an 

improved bearing design based on 

lessons learned from the failures of 

CMG-1 and CMG-3. 

Figure 17. Astronaut Dave Williams works to replace a CMG during STS-118/ISS 13A.1. 

Conclusion

Although the MCS can only fully 

support the ISS by combining the 

vastly different US Segment and 

Russian Segment systems, both 

systems complement each other 

well. The USOS system provides a 

smooth microgravity attitude control 

capability that minimizes the use 

of on-board propellant consumables, 

and the Russian Segment system 

provides the necessary thruster 

capabilities to handle reboosts and 

attitude control situations beyond 

the capabilities of the CMGs. 

As with the systems on orbit, flight 

controllers in both MCC-H and 

MCC-M work closely together to 

keep the complete ISS MCS in good 

health for the purpose of supporting 

a stable platform for both the crew 

and the research program. 


Chapter 8 Day in the Life:

Debris Avoidance—

Navigating 

the Occasionally 

Unfriendly Skies 

of Low-Earth Orbit
140 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

The potentially destructive nature of space debris. This photo (from a ground test) shows the damage done to a solid block of aluminum by a small 

7-g (0.2-oz) projectile traveling at 7 km/s (4.3 miles/s).

The low-Earth orbit environment 

in which the International Space 

Station (ISS) flies is, compared to 

anything on the Earth, a very empty 

place. But it is not completely empty. 

The detritus of more than 50 years of 

human activity in space encircles the 

Earth as a cloud of orbital debris—

a nearly invisible threat to every 

satellite in orbit, including the ISS. 

Orbital Debris—A Serious 

Threat to all Spacecraft

Similar to the way the ocean floors 

across the globe are the final resting 

place for shipwrecks from thousands 

of years of human seafaring, the 

remnants of more than 50 years of 

human activity in space has left bits 

and pieces of hardware that continue 

to orbit the Earth. 

This debris (popularly known as 

“space junk”) consists primarily of 

dead satellites, expended stages from 

rocket launches, and fragmentation 

from collisions, explosions, or other 

breakups of these initially large 

pieces of hardware—sometimes 

decades after their mission has 

ended. The size of the junk ranges 

from multi-ton satellites and rocket 

stages to small-piece parts of 

satellites such as nuts and bolts, 

and even paint chips. 

These objects all orbit the Earth at 

up to 28,000 km/h (17,500 miles/h) 

in various orbits, meaning that any 

encounter between them and an 

operational satellite such as the ISS 

will usually be at extremely high 

velocities and would result in a 

hypervelocity-impact collision. 

The effects of a collision on a 

satellite can range from minor to 

catastrophic, depending on the 

velocity and especially the size 

of the impacting object. Many 

instances of damage have occurred 

from collisions between operational 

spacecraft and space debris. 
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 141

For example, on Space Transportation 

System (STS)-93, a collision with 

a paint chip put a 10-mm (0.4-in.) 

crater into one of the windows of 

Space Shuttle Discovery, thus leading 

to its replacement, post mission. 

The ISS, having been in orbit since 

1998, bears the scars of many 

impacts, including a hole in the 

edge of a radiator panel on the P6 

truss segment (Figure 1), and a 

shattered portion of a solar array 

(Figure 2) that was caused by a piece 

of small debris.

~1 m

(~3 ft)

Figure 1. Damage to the Trailing Thermal 

Control Radiator on the P6 truss segment was 

noticed during a spacewalk in August 2016. 

Figure 2. Damage to space station solar array by space debris. 

Without question, the most dramatic 

event was the collision between the 

active Iridium 33 communications 

satellite and the abandoned Kosmos 

2251 military communications 

satellite. The 950-kg (2094-lb) 

Kosmos and 560-kg (1234-lb) Iridium 

collided at 42,120 km/h (26,173 

miles/h). This collision resulted in the 

complete destruction of both satellites, 

and generated more than 1,000 new 

pieces of space debris that were larger 

than 10 cm (4 in.) in diameter. 

The US Department of Defense 

(DoD) actively tracks (and helps 

NASA and the ISS avoid) objects as 

small as 10 cm (4 in.) in low-Earth 

orbit. Approximately 23,000 objects 

of this size, other than a few hundred 

active satellites, are currently in orbit 

and are classified as orbital debris. 

Based on ground-based sensors, 

examination of returned satellite 

parts, and statistical methods, 

scientists believe approximately 

500,000 objects that are greater 

than 1 cm (0.4 in.) are in orbit. 

The population of objects in recent 

years has increased due to events 

such as the Iridium/Kosmos collision 

described above. 

Hypervelocity Impacts

A hypervelocity impact releases a tremendous amount of energy for a given 

amount of mass, much more so than (for example) a bullet striking a target. 

Bullets travel on the order of 3500 km/h (2175 miles/h), and typically punch 

holes in targets. 

Relative velocities of two objects on a collision course in orbit are roughly 10 

times this much, and the collision for the bullet example would involve 100 

times as much energy. At this kind of impact velocity, the resulting release of 

energy is essentially an explosion.
142 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

Orbital Debris—Conjunctions 

and Relative Velocities

Although debris comes from many 

sources, most travel at a very high 

speed relative to the ISS, due to 

orbital mechanics. This chapter will 

examine a common debris source: 

spent rockets. 

Many communications satellites 

operate at a high altitude (37,000 km 

[22,991 miles]) that causes them to 

orbit at the same rate in which the 

Earth rotates. This process is termed 

geosynchronous. As a satellite travels 

to that altitude when first launched, 

a rocket stage is often used and then 

expended with an orbit that has a high 

point of many thousands of kilometers 

and a low point of a few hundred 

kilometers above the Earth. This 

particular elongated orbit is called a 

geosynchronous transfer orbit, and an 

orbit of this shape is more generally 

called an elliptical orbit. 

Oftentimes, rocket bodies left in 

these transfer orbits later explode or 

otherwise disintegrate into debris that 

travels in roughly the same elliptical 

orbit. Over time, atmospheric drag at 

the low point of the orbit gradually 

drops the high point of the orbit 

until the debris reenters the Earth’s 

atmosphere. The process can take 

decades or even centuries, depending 

on how much drag the object creates. 

Figure 3 shows an example of a piece 

of debris that is in an elliptical orbit 

and at a different orientation than that 

of the ISS. 

ISS

Debris

Conjunction

Figure 3. Conjunction with an object in an elliptical orbit. The ISS travels in a circular orbit at a lower 

altitude while the debris travels in an elliptical orbit. The lower portion of the debris’ orbit can cross the 

plane of the ISS.

In this elliptical orbit, an object 

travels quickly when closer to the 

Earth (for the transfer orbit described 

above, 35,600 km/h [22,000 miles/h]) 

and slower when far away from 

the Earth (for the transfer orbit, 

5,700 km/h [3600 miles/h]). In this 

orbit, it takes 10.5 hours for the object 

to complete an orbit of the Earth. 

In comparison, the ISS orbits in

a nearly circular orbit of 400 km 

(249 miles) and stays at about 

400 km (249 miles) above the Earth 

as it travels. The velocity is constant 

at 28,000 km/h (17,300 miles/h), 

and it takes the ISS 90 minutes to 

go around the Earth. 

The ISS and any given piece of 

debris will probably never cross 

paths. With 23,000 large objects 

being tracked in orbit, however, the 

ISS typically has a close approach 

every few days. For the example 

shown in Figure 3, a close approach 

would involve the ISS traveling 

28,000 km/h (17,300 miles/h), and 

the debris traveling 35,000 km/h 

(22,000 miles/h) in a different 

direction, due to the angle between 

the orbits. This close approach 

is called a conjunction. A great 

deal of effort goes into assessing 

the risk from this conjunction 

and protecting the ISS from a 

catastrophic collision. 

Protecting the International 

Space Station from 

Space Debris 

The ISS has been shielded for smaller 

pieces of orbital debris (up to 1 cm 

[0.4 in.]) and is the most heavily 

shielded spacecraft ever flown. The 

shielding generally consists of a metal 

outer bumper offset from the inner 

pressure shell, which is also known 

as a Whipple Shield (see Chapter 3). 

When debris strikes the outer bumper, 

the debris vaporizes and dissipates 

the kinetic energy of the space junk, 

pitting the bumper but leaving the 

inner pressure shell intact. 

The portions of the ISS most likely to 

incur a strike are the portions that face 

forward into the direction of flight 

when traveling in the normal local 

vertical/local horizontal attitude. For 

this reason, the shielding is the highest 

on the US Segment, which faces into 

the normal flight direction of the ISS. 
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 143

Space junk that is marginally above 

the 1-cm (0.4-in.) capability of the 

shielding but less than the 10-cm 

(3.9-in.) threshold that can be ground 

tracked may cause a penetration of 

the ISS hull, which can result in an 

overboard leak and depressurization. 

The crew has the tools, procedures, 

and training to arrest such a leak by 

locating and placing a patch over the 

interior hull if the hole can be found 

before the ISS stack pressure drops 

too low. In the most extreme case, the 

crew can close off a leaking module 

by closing the connecting hatches 

and isolating it, which may cause the 

loss of the module but would leave 

the crew members and their escape 

vehicles safe and intact. 

Protection against larger pieces 

is done by altering the orbit to 

actively avoiding the debris, as 

described below. 

Active Orbital Debris 

Tracking from the Ground 

and from Space

The first step in this protection is the 

tracking of debris by the US DoD 

Space Surveillance Network (SSN). 

The SSN uses radar and optical 

sensors, both on the ground and in 

space, that detect and track debris in 

orbit and build a catalog of objects 

in space along with their orbital 

characteristics. The SSN tracks and 

updates the orbital location of the 

debris as the debris changes orbit, 

due to atmospheric drag, or breaks 

apart. Figure 4 shows one spacescanning radar complex that is part 

of the SSN. 

Figure 4. Millstone/Haystack radar complex used to track orbital debris. The installation is located in Tyngsboro, Massachusetts. 

Currently, the SSN uses 29 optical 

and radar sensors to characterize space 

debris, and makes approximately 

400,000 measurements per day. The 

sensors are divided into dedicated 

sensors (used exclusively for space 

surveillance) and contributing/

collateral sensors (sometimes used for 

other purposes). 

These sensors are spread around the 

Earth to better cover possible orbital 
144 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

locations. Figure 5 shows a map of 

sensors currently used to maintain the 

catalog of objects in orbit. 

SHY

CLR

MAU

AMOS

BLE

JSpOC

SOC

CAV

EGL

DSC2-D

MIT/LL

GBII

SBSS

SAPH

RTS

DGC

ASC

THL

COD

FYL

Figure 5. Current space SSN sensor locations. Sensors are labeled by the name of the complex in which they are housed, which is sometimes (but not 

always) geographic location. 

These sensors fall into four categories:

1) Phased Array Radars: Radar 

systems that rely on an 

electronically steered beam. 

	 n BLE – Beale Air Force Base, 

California 

	 n COD – Cape Cod Air Force 

Station, Massachusetts

	 n CAV – Cavalier Air Force 

Station, North Dakota

	 n CLR – Clear Air Force Station, 

Alaska

	 n FYL – Fylingdales Royal Air 

Force Station, North York 

Moors. England

	 n THL – Thule Air Force Base, 

Greenland

	 n EGL – Eglin Air Force Base, 

Florida

	 n SHY – Eareckson Air Station, 

Shemya Island, Alaska 

2) Mechanical Radars: Radar 

systems that rely on a 

mechanically steered dish.

	 n ASC – Ascension Royal Air 

Force Station, Ascension Island 

	 n GBII – Globus II radar station, 

Vardo, Norway

	 n MIT/LL – MIT/Lincoln Labs, 

Massachusetts (includes 

Millstone and Haystack 

observatories)

	 n RTS – Reagan Test Site, 

Marshall Islands

3) Ground-based Telescopes:

	 n AMOS – Air Force Maui Optical 

and Supercomputing Site, Maui, 

Hawaii

Installations of the Ground-based 

Electro-Optimal Deep Space 

Surveillance system:

	 n SOC – Socorro, New Mexico

	 n MAU – Maui, Hawaii

	 n DGC – Diego Garcia Island

4) Space-based Optical: Sensors on 

satellites in Earth orbit.

	 n SBSS – Space-based Space 

Surveillance, satellite system 

operated by the US Air Force

	 n SAPH – Sapphire satellite 

system operated by the Canadian 

Armed Forces
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 145

Debris Screening

The DoD Joint Space Operations 

Center (JSpOC) at Vandenberg Air 

Force Base, California, performs an 

assessment of the orbit of the ISS 

against this catalog of debris every 

8 hours. In this assessment, the orbit 

of the ISS is projected out several 

days, along with tracked space 

debris that is orbiting such that it 

may come close to the ISS. When 

this assessment predicts a potential 

close approach between the ISS and a 

piece of space debris (usually within 

the following 72 hours), JSpOC will 

provide data on the close approach, 

including predicted miss distance 

and time of closest approach (TCA) 

to the Trajectory Operations Officer 

(TOPO) flight controller in Houston. 

The TOPO screens an imaginary box 

of space around the ISS (sometimes 

referred to as the “pizza box”) that is 

± 25 km (±15.5 miles) in the direction 

of motion, ± 25 km (±15.5 miles) 

perpendicular to the direction of 

motion, and ± 0.5 km (±0.3 miles) 

radially from the ISS as it flies in 

orbit. This is shown in Figure 6.

U (Radial)

V (Velocity Vector)

W (Out-of-Plane)

+25 km (+16 miles)

+25 km

(+16 miles)

+0.5 km

(+0.3 miles)

-.5 km

(-0.3 miles)

-25 km (-16 miles)

-25 km

(-16 miles)

U

V

W

Figure 6. The imaginary box (aka the pizza box) around the ISS.

If the predicted miss distance is

within this box, the TOPO will notify 

the flight control teams in Houston 

and Moscow of a potential collision 

hazard. TOPO will use tracking data 

on the object and the position of the 

ISS (see Chapter 7) to calculate a 

probability of collision (Pc) that is a 

mathematical representation of the 

likelihood of a collision between the 

ISS and an object during the close 

approach. The computation takes 

into account variables that impact 

the known orbits of the ISS and the 

target object, such as uncertainties in 

atmospheric drag and quality of radar 

tracks on the target. Just because an 

object can be detected by radar does 

not always mean the precise location 

can be pinpointed. For example, 

depending on the size or composition 

of an object, it might be barely 

detectable, meaning the radar may 

get glimpses of an object but not a 

clear view. The TOPO continuously 

refines the Pc of the object as the 

TCA approaches, iterating up to 

several times per shift, depending 

on the level of concern regarding the 

potential collision. 

JSpOC will also work with TOPO 

and the SSN on increasing coverage 

on a problem space object to better 

understand its orbit as required, 

especially if it becomes a threat to the 

ISS. Coverage can be increased by 

using more radars and/or telescopes 

to gather more data on the object. 

Coverage can be increased by 

tracking an object multiple times per 

day as it passes over various tracking 

sites when ordinarily it may only be 

tracked once every few days. 

Evaluating the Risk of a 

Potential Collision

Flight rules define four levels of 

concern and actions for orbital debris 

that will have a close approach and 

has a calculated Pc:

n Green: Pc less than 10-5 (less than 

1 in 100,000 chance of collision)—

no action required. 

n Yellow: Pc between 10-5 and 10-4

(Pc greater than 1 in 100,000 but 

less than 1 in 10,000)—a debris 

avoidance maneuver (DAM) 

should be attempted prior to TCA 

unless there is a major impact to 

the ISS operations (such as loss of 

a rendezvous opportunity with a 

cargo vehicle).

n Red: Pc between than 10-4 (Pc 

greater than 1 in 10,000) and 10-2

(1 in 100)—a DAM should be 

performed prior to TCA unless the 

burn itself will place the crew at 

greater risk. DAMs may also not be 
146 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

performed during the short 4-orbit 

rendezvous of Soyuz and Progress, 

the last 30 hours of the longer 

Soyuz 34-orbit rendezvous, or the 

final proximity operations of the 

Progress 34-orbit rendezvous. This 

is to protect for cases where the 

DAM would potentially prevent the 

rendezvous of the visiting Soyuz/

Progress to the ISS. 

n Black: Pc greater than 10-2 (Pc 

greater than 1 in 100). A DAM 

must be performed prior to TCA 

unless the burn is in the final 

minutes of a Soyuz or Progress 

docking operation. This is a brief 

window of exposure. 

The action levels provide a good 

example of risk management as it 

appears in flight rules. On a green 

conjunction, the risk is not zero. 

Rather, it is reasonably small—

1 in 100,000 chance of impact. 

Although the risk of collision could 

be driven closer to zero by moving 

the green line to, for example, a 1 in 

1,000,000 chance, it would also mean 

the ISS would need to perform far 

more debris avoidance burns, perhaps 

even weekly. 

Burns of this frequency would be 

unsupportable. Research on the 

ISS would be impacted, propellant 

would be depleted, and the orbit 

would change so often that some 

cargo missions would need to be 

delayed. The threshold chosen 

represents a balanced and accepted 

risk where it is as low as possible 

while still allowing the ISS to be 

useful as an orbiting laboratory. 

The yellow—and especially the red 

and black—thresholds, however, 

represent unacceptable risk to the 

crew and ISS, and are where the 

space station will actively move out 

of the way of debris. 

In the best circumstances, the 

conjunction is with a well-tracked 

object and the TOPO will have several 

days prior to the TCA to calculate 

multiple updates to the object, refine 

the Pc, and trend the conjunction. 

Sometimes, however, an object may 

be more difficult to predict. For 

example, a large flat piece of metal 

from an expended rocket stage in a 

low orbit has high atmospheric drag 

in one orientation, and low drag in 

another. Since it may be tumbling, the 

drag slowing it down and changing 

its orbit could vary and makes the 

TOPO’s job more difficult. This is the 

sort of situation in which additional 

tracking can help. 

As the conjunction nears, the Pc 

typically gets greener (as described 

in the next section) with additional 

tracking and less uncertainty because 

the orbit of the object becomes better 

understood and less time will elapse 

(and introduce prediction error) 

before the conjunction. For this 

reason, and because the maneuver 

can be disruptive to ongoing ISS 

operations, the general philosophy is 

to delay a DAM as long as possible 

to provide the TOPO the opportunity 

and data to ensure the necessity of 

that maneuver. In the end, it often 

comes down to the flight director 

making the best decision possible by 

balancing the impacts and risks per 

the flight rule, based on the available 

data and expertise of the TOPO.

Tracking and Evaluating 

Figure 7 shows the trend of a piece 

of debris (in this case, part of an 

exploded rocket upper stage) in 2013. 

The format of the table is exactly the 

same as that used by the TOPO as he 

or she works with the SSN to refine 

the Pc over time. 

In the Figure 7 example, data were 

first provided to MCC-H as an 

Orbital Conjunction Message 

(OCM) 68 hours prior to the TCA. 

Additional OCMs were provided 

every 4 to 6 hours as JSpOC, the 

TOPO, and the flight director 

continued to evaluate the risk posed 

by the object to the ISS. 

The first four OCMs do not include 

a Pc since several computations 

over time are required to generate 

an official Pc to collect data and 

provide an accurate assessment of 

the collision risk. As can be seen 

by examining the miss distances in 

early OCMs (1-4), the miss distances 

are changing relatively significantly 

due to uncertainty in the position 

of the object. 

Collision Avoidance History

NASA first implemented conjunction assessment on STS-26 in 1988 by 

using a simple 4 x 10 x 4 km (2.5 x 6.2 x 2.5 mile) football-shaped volume as 

a “keep out” zone around the Space Shuttle based on simple miss distance, 

which worked well for the relatively maneuverable shuttle. 

Prior to the ISS first element launch in 1998, NASA and the DoD 

implemented the higher-fidelity risk-based assessment to better understand 

when a burn was required and to avoid the operational and science impact 

of performing an unnecessary DAM.
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 147

OCM # TCA (hours) U (Radial)

(km/miles)

V (Downtrack)

(km/miles)

W (Cross track) 

(km/miles)

R (Spacing)

(km/miles)

Pc

1 68.9 1.06/0.66 45.90/24.46 -11.41/-7.07 47.31/29.33

2 62.6 1.02/0.63 43.70/27.09 -10.86/-6.73 45.04/27.92

3 58.3 -0.57/-0.35 -12.60/-7.81 3.10/1.92 12.99/8.05

4 54.8 -0.22/-0.14 -1.05/-0.65 0.24/0.15 1.10/0.68

5 49.8 0.93/0.58 44.48/27.58 -11.07/-6.86 45.85/28.43 2.1x10-5

6 46.4 1.47/0.91 70.57/43.75 -17.55/-10.88 72.74/45.10 1.6x10-5

7 42.0 2.73/1.70 203.32/126.06 -50.56/-31.34 209.53/129.91 0.0x100

8 38.6 2.73/1.70 210.20/130.32 -52.25/-32.40 216.52/134.24 0.0x100

9 34.6 2.25/1.40 272.34/168.85 -67.78/-42.02 280.66/174.01 0.0x100

Figure 7. Tracking of a sample conjunction. The information is arranged as follows:

Column 1: Orbital Conjunction Message (OCM) number. The OCM is the official message from JSpOC to Mission Control Center-Houston (MCC-H) on an 

impending potential collision. Multiple messages are generally received on a particular object over time, and are represented by individual rows. In this case, 

nine messages were received before the object was cleared. 

Column 2: Time remaining until TCA: The number of hours until the TCA between a tracked object and the ISS. 

Columns 3-5: Predicted miss distance between the object and the ISS, broken out by axes described in Figure 6. 

Column 6: Predicted overall miss distance between the object and the ISS. 

Column 7: Official Pc at the time the message was generated (color coded based on thresholds set in flight rules), as computed by the TOPO in MCC-H.

During this time period, the TOPO 

and JSpOC often work together to 

devote more observation time and 

assets of the network to help refine 

the understanding of the location 

and velocity of the object as it orbits 

the Earth, which is reflected in the 

later OCMs. 

When an official Pc was determined, 

it was for a yellow conjunction at 

49.5 hours before TCA on OCM 5. 

Yellow conjunctions can eventually 

result in a DAM if an object stays 

yellow closer to TCA; however, 

in general, additional tracking and 

reduction in uncertainty often clears 

an object. In this case, the Pc was 

calculated as zero and the object went 

green 42 hours prior to TCA. 

Unfortunately, some conjunctions 

stay yellow or become red as more 

tracking becomes available. Debris 

that has high atmospheric drag or is 

in an unusual orbit (such as a highly 

elliptical orbit) is less predictable, 

and some collision threats are not 

identified until late (less than a day 

before TCA). Figure 8 shows a 

conjunction that began as green and 

eventually developed into enough of a 

threat to require a DAM. 

OCM # TCA (hours) U (Radial)

(km/miles)

V (Downtrack)

(km/miles)

W (Cross track)

(km/miles)

R (Spacing)

(km/miles)

Pc

1 69.3 -0.19/-0.12 -7.26/-4.51 -9.93/-6.17 12.30/7.64 2.610-9

2 60.9 -0.18/-0.11 -11.28/-7.10 -15.41/-9.58 19.09/11.86 7.510-7

3 53.1 -0.18/-0.11 -2.55/-1.58 -3.48/-2.16 4.32/2.68 1.410-6

4 45.3 -0.22/-0.14 -1.33/-0.83 -1.82/-1.13 2.26/1.40 5.510-13

5 37.5 -0.32/-0.20 6.68/4.15 9.13/5.78 11.32/7.03 7.0x10-17

6 29.0 -0.14/-0.09 2.95/1.83 4.04/2.51 5.00/3.11 6.3x10-5

7 21.4 -0.07/-0.04 -0.72/-0.45 -0.98/-0.61 1.22/0.76 1.1x10-3

8 12.8 -0.16/-0.10 2.30/1.43 3.15/1.96 3.90/2.42 7.6x10-5

9 11.4 -0.09/-0.06 -0.88/-0.55 -1.19/-0.74 1.48/0.92 2.5x10-3

10 9.8 -0.04/-0.03 -0.04/-0.03 -0.05/-0.03 0.08/0.05 1.310-2

11 5.1 -0.01/-0.01 -0.66/-0.41 -0.91/-0.66 1.12/0.70 1.710-2

Figure 8. Development of a conjunction, which requires a maneuver. See Figure 7 for data definitions.

In these cases, a DAM is planned and, 

if necessary, executed. 
148 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

Debris Avoidance Maneuvers

DAMs are planned as a small orbitalraising (or reboost) maneuver. 

A reboost maneuver uses the small 

rocket thrusters on the aft of the ISS 

to push it slightly higher in orbit. 

The ISS is designed such that all 

propulsion is done by the Russian 

Segment. The core of the propulsion 

system is the Service Module, which 

is operationally controlled by Mission 

Control Center-Moscow (MCC-M). 

Small thrusters on the Progress 

resupply vehicles can be used for 

both reboost and attitude control, 

depending on the specific docking 

ports, whereas the propulsion system 

is under the control of MCC-M, the 

Service Module, and the Service 

Module computers. 

Although MCC-M actually controls 

and fires the rockets, MCC-H 

provides threat assessments based 

on JSpOC data. The control centers 

work together to keep the ISS in the 

correct orbit. 

Reboost maneuvers are already 

periodically scheduled to raise 

the orbit of the ISS, which decays 

naturally due to atmospheric drag. 

A DAM is the same thing, but is 

planned with flexibility in mind so the 

maneuvers can be executed in only a 

few hours, if necessary. 

DAM reboosts are relatively small. 

A DAM performed in 2012 fired 

the Service Module engines for 

54 seconds, which raised the 

altitude of the ISS by 1.5 km 

(0.9 miles). This “nudge” in the 

orbit is all that is required to clear 

a conjunction successfully and 

carry the ISS away from the future 

potential impact. These nudges are 

usually targeted to occur 2 hours 

and 20 minutes prior to a potential 

impact, which provides sufficient 

time in the new orbit to travel away 

from the point of collision before the 

close approach occurs. 

When the need to at least plan for 

a debris avoidance burn becomes 

apparent (typically ~30 hours before 

TCA for a conjunction that is not 

improving), the TOPO along with his 

or her counterparts at MCC-M will 

plan a DAM burn. The burn will be 

optimized to minimize the impact 

on the ISS operations (for example, 

if possible, to avoid periods where 

feathering the solar arrays and a 

power down would present a power 

challenge), to minimize impact to 

downstream planning of vehicles that 

will be docking to the space station 

or returning to Earth from the ISS 

in the coming months, and finally to 

place the ISS on a new trajectory that 

has been preemptively evaluated by 

JSpOC as clear and free of debris (at 

least for the next several days). 

Detailed execution planning is handed 

to MCC-M as soon as the TOPO 

has designed a DAM consisting of 

a specific burn magnitude, duration, 

and time. Engineers at MCC-M will 

build a software script that allows 

the computers in the Service Module 

to physically execute the burn. This 

script is referred to by its Russian 

moniker: cyclogram. 

The Russian software executes 

a series of cyclogram-defined 

commands on the Russian Segment 

automatically. Russian flight 

controllers at MCC-M will build 

the cyclogram on the ground, verify 

by running it on a software test bed 

with the same computers used on the 

space station, and uploading it for 

use on the actual reboost. It takes a 

day to complete this process if the 

cyclogram is being built from scratch. 

The cyclogram contains detailed 

commands that begin execution 

approximately 90 minutes prior to a 

debris avoidance burn, immediately 

after attitude control is handed over 

from the US Segment to the Russian 

Segment. The cyclogram will then 

configure the propulsion system to 

fire thrusters, maneuver the ISS to 

the reboost attitude (i.e., aim the 

main engines so that the thrust will 

increase the orbital altitude), and fire 

the engines at the appropriate time 

and for the appropriate duration. 

After the burn ends, flight controllers 

at MCC-M and MCC-H will work 

together to hand attitude control 

back over to its normal long-term 

configuration using the US Segment 

Control Moment Gyroscopes (CMGs). 

There are two kinds of DAMs—

a standard DAM and a predetermined 

DAM (PDAM)—each with its 

own cyclogram. 

A standard DAM is essentially 

identical to a planned reboost except 

that MCC-H builds the software load 

on an expedited schedule. Normal 

reboosts to counter atmospheric drag 

or to set up phasing for a visiting 

vehicle are calculated months in 

advance. A standard DAM requires 

approximately 24 hours to build and 

verify, but it has greater flexibility for 

selecting burn duration and choosing 

the vehicle that will conduct the 

reboost. For example, the Service 

Module itself can perform a reboost 

if a Progress is not docked to the aft 

of the Service Module or Docking 
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 149

Compartment-1 on the bottom of 

the ISS (which requires an attitude 

maneuver to point the Progress 

engines in the correct direction). 

A standard DAM also allows MCC-M 

and MCC-H to custom pick the burn 

duration to change the orbit velocity 

(also referred to as the delta-V). This 

can be helpful when shaping the orbit 

to account for where the ISS needs 

to rendezvous, and to undock cargo 

and crew delivery vehicles that are 

planned over the next few months. 

A PDAM is a “canned” burn plan 

with limited delta V options that 

is always ready and loaded in the 

Russian Segment. The PDAM is 

a capability that was first made 

available in 2012. Prior to that time, 

all DAMs were standard DAMs. The 

PDAM was developed in response to 

the increasing number of conjunctions 

that were occurring (due to the 

increase of orbital debris over the past 

decade) as well as the development 

time required for the standard DAM. 

Prior to the development of the 

PDAM capability, if a conjunction 

was detected between the ISS and a 

piece of debris within approximately 

24 hours, there was insufficient time 

to develop a cyclogram and maneuver 

the ISS out of the way. The crew and 

flight control team were left with 

simply isolating the crew members 

in their Soyuz vehicles as protection 

from the effects of an impact. 

PDAMs are pre-developed plans that 

permanently reside in the Service 

Module software and have burns 

available of 0.3, 0.5, 0.7, or 1.0 m/s 

(1.0, 1.6, 2.3 or 3.3 ft/s). MCC-H and 

MCC-M can select a burn magnitude 

that will best change the orbit to 

avoid a conjunction as well as keep 

the ISS in the proper position for 

later operations, such as rendezvous 

of crew and cargo vehicles that are 

weeks or months away. It is also 

possible that one burn magnitude 

may clear the ISS out of the path of 

the original debris, only to find it in 

the path of some other object. Having 

four options ensures that one solution 

can be found that will clear the path 

of all debris.

Because a PDAM is already built 

and on board the space station 

computers, a PDAM can be 

planned and executed with as few 

as 5.5 hours remaining until a 

conjunction will occur. The 5.5-hour 

minimum is driven by the time 

required to configure the solar arrays 

(3 hours) prior to the avoidance 

burn, which is typically done 2 hours 

and 20 minutes prior to the closest 

approach. The solar arrays need to 

be positioned in specific orientations 

to avoid being struck by the exhaust 

of the thrusters that are used for both 

the reboost and the attitude control. 

The 2-hour-and-20-minute burn 

point is driven by the need to travel 

for a short period of time in the new, 

slightly adjusted orbit to move away 

from the conjunction. 

Because the PDAM can be executed 

rapidly and cancelled late, and 

because most conjunctions become 

green as the time before closest 

approach decreases, the preferred 

strategy for debris avoidance is 

usually to wait out the conjunction 

and plan to do a PDAM at the latest 

possible time, if it is still required. 

The only downside to this strategy is 

that the burn magnitudes are limited 

to those in the canned burns. In some 

cases, MCC-H and MCC-M may 

elect to plan for a standard burn if 

a more tailored reboost would be 

beneficial from a trajectory point 

of view to preserve, for example, a 

particular rendezvous opportunity 

several weeks away. 

Predetermined Debris 

Avoidance Maneuver 

Execution

When a space debris threat continues 

to be yellow or red with less than 

24 hours remaining to TCA, or when 

JSpOC notifies MCC-H of a latenotice conjunction, PDAM planning 

goes into high gear to prepare the 

ISS for an escape maneuver. As 

previously discussed, the TOPO will 

select a candidate burn time (usually 

2 hours and 20 minutes prior to 

TCA), and the MCC-H flight director 

will approve the time and direct 

teams to plan for a burn. 

This planning will attempt to 

configure the space station systems 

(especially power and payload) as 

gracefully as possible based on how 

much time is available before the 

burn executes. Most of this planning 

centers around power availability, 

since (as in many thruster firings) the 

solar arrays are repositioned to best 

protect them from thruster firings 

rather than optimized for power 

generation. Generally, this means less 

power is available than had originally 

been planned and certain systems 

need to be turned off. With careful 

planning, certain allowances can be 

made—for example, an experiment 

that requires a few more hours to 

finish will be allowed to complete 

before being turned off. The more 
150 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

advanced warning available, the 

more time flight controllers have 

to work the intricate details of this 

power-down plan. 

When necessary, however, the 

ISS can execute a burn with as little 

as 3 hours’ notice (about 5 hours 

and 20 minutes before the 

conjunction if the burn is done at 

the standard 2 hours and 20 minutes). 

An emergency unplanned power 

down is normally required in order 

to perform a burn this quickly. This 

power down is a preplanned power 

down, which is always available 

but unrefined, and may result in 

noncritical systems being powered 

down rapidly, thus potentially 

impacting research on board. For this 

reason, the emergency power down is 

an option of last resort. 

Time Event Comments

Pre-burn Request additional Tracking and 

Data Relay Satellite (TDRS) time 

from space network

If necessary, MCC-H will request to fill gaps in TDRS satellite coverage 

of the ISS to provide command and telemetry links during critical periods 

leading up to the PDAM burn as well as the burn itself. 

TDRS satellite coverage is usually quite good, but there are often 10- to 

30-minute gaps in coverage while the satellite network is shared with other 

users. These gaps can often be negotiated with other users and filled to 

provide more time for MCC-H and MCC-M to command configurations in 

preparation for the reboost. 

Pre-burn Safe payload racks and other 

vehicle systems

Certain payload and vehicle systems are sensitive to thruster firings (for 

example, the treadmill needs to be fixed to the ISS structure and not in use 

during reboost burns). 

TIG – 2:40 ISS power down Power down the ISS systems to support the feathering of solar arrays. 

TIG – 2:40 Generate burn options If not already done, TOPO generates burn options and supply to JSpOC for 

debris screening and provides options to MCC-M. 

TIG – 2:25 Power up redundant navigation 

equipment

MCC-H powers up redundant rate gyro assemblies and enables US 

Segment accelerometers to support burn. 

Redundant gyros are brought up to protect against failures during the 

burn (in some cases, the burn may stop without the redundant equipment). 

The accelerometers in the US Segment are used by the Russian Segment 

to calculate the end of the burn. 

TIG – 2:25 Park and lock solar array joints Position solar arrays for propulsive support and reboost. Solar arrays are 

usually positioned in a way that minimizes the structural effects caused by 

thruster firings. 

TIG – 1:30 Select final burn option If not already done, TOPO selects and approves the final burn time based 

on JSpOC screening and provides the final burn option to MCC-M. 

TIG -1:30 Final go/no go for PDAM The MCC-H and MCC-M flight directors authorize execution of the debris 

avoidance burn. 

TIG – 1:20 MCC-H commanded handover 

of attitude control to the Russian 

Segment

MCC-H commands attitude control to handover from United States Onorbit Segment (USOS) non-propulsive CMG attitude control to Russian 

Segment thrusters attitude control. 

TIG – 1:00 MCC-M commands burn execution 

sequence initialization 

MCC-M will issue a command to begin the automatic burn sequence. 

This sequence will configure systems on the Russian Segment (including 

the propulsion and attitude control systems), maneuver the stack to burn 

attitude, and then execute the burn exactly 1 hour after the command is 

received. 

TIG Burn execution Under Russian Segment Service Module automatic control, several minutes 

in duration depending on configuration of propulsion system and engines 

used. The ISS is maneuvered back to attitude post burn. 

TIG + 00:40 MCC-H commanded handover back 

to the USOS

MCC-H commands attitude control back to USOS non-propulsive CMG 

attitude control. 

Post-burn Clean up MCC-H places solar arrays back in solar auto track to maximize power 

generation and repowers systems to restore normal operations. 
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 151

The following timeline is based on 

the time of ignition (TIG)—the time 

at which the PDAM burn would 

execute. Throughout the PDAM 

planning and execution process, 

TOPO continues to refine the Pc 

calculation as data from JSpOC 

become available. If an object 

manages to go green very late, the 

burn can be cancelled. Typically, 

this occurs before the final attitude 

control handover to avoid thruster 

firings, which may perturb the 

orbit (and potentially increase the 

probability of collision). 

Safe Haven

If MCC-H is notified of a 

conjunction very late, there may not 

be enough time to execute a burn. 

As mentioned previously, MCC-H 

and MCC-M must be notified no 

later than 5.5 hours before the TCA 

to configure the systems (primarily 

solar arrays), start the burn sequence 

on board the Russian Segment, and 

actually perform the burn. 

If insufficient time is available, 

“safe haven” procedures allow 

the ISS crew members to close 

hatches in the USOS, enter their 

respective Soyuz vehicles (which 

are used to transport crews to 

and from the ISS), and close the 

hatches in the Soyuz to be best 

set up for withstanding an impact 

and performing an emergency 

departure and deorbit, if required. 

Keeping hatches closed ensures 

that if a module is penetrated by 

an impact event, the loss of air is 

limited to that module and not the 

entire ISS volume. Keeping the 

crew members inside the Soyuz 

minimizes their exposure to an 

ISS depressurization that results 

from impact and has them prepositioned in the vehicle that can 

return them home if the ISS is 

significantly damaged. 

Safe haven was executed on 

several occasions earlier in the 

life of the ISS before the advent 

of PDAM, when only the nominal 

DAM was available and required 

a 24-hour notice. PDAM was 

developed specifically to avoid 

the safe haven scenario and has 

been largely successful, since 

notification of a conjunction by 

JSpOC with less than 6 hours 

remaining is extremely unusual. 

Frequency of the 

International Space Station 

Debris Avoidance Maneuvers

As of mid-2016, DAMs have been 

attempted 21 times (the first one in 

1999 was unsuccessful and did not 

burn). Further safe haven events 

(in 2009, 2011, 2012, and 2015) have 

taken place, three of which occurred 

prior to the creation of the PDAM in 

2012, which made them less likely. 

For comparison’s sake, in 2015, 

116 conjunctions fell within the 

pizza box. MCC-H actively worked 

these conjunctions, 111 of which 

eventually went green and did not 

require a DAM or PDAM. An actual 

impact with a tracked object, which 

would result in (at a minimum) 

significant damage to the ISS, has 

never occurred. Figure 9 shows the 

number of DAMs.

Year # DAM

2017 0

2016 0

2015 4

2014 5

2013 0

2012 3

2011 2

2010 1

2009 2

2008 1

2004-2007 0

2003 1

2002 1

2001 2

2000 1

1999 2

1998 0

Figure 9. DAMs by year through mid-2017.

The Orbital Debris 

Environment—

A Growing Problem 

The debris environment in the 

vicinity of the ISS has gotten worse 

over the past 15 years. According 

to the NASA Orbital Debris Office, 

more than one-third of the debris 

currently in orbit came from two 

events: the hypervelocity collision 

between the operational Iridium 33 

satellite and the abandoned Kosmos 

2251 satellite in 2009, recounted 

above; and, the intentional destruction 

of the Fengyun-1C weather satellite 

by China in 2007 with a missile 

during a defense test. The collision 

between Kosmos and Iridium alone 

produced more than 2000 pieces of 

trackable debris. 
152 CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT

A Close Call 

Captain Daniel C. Burbank, Expedition 30

Orbital debris penetrating the hull of our spacecraft 

is one of the “Big 3” threats that astronauts and flight 

directors worry about the most—along with fire and a 

toxic atmosphere. Orbital debris is a particularly insidious 

threat because there are hundreds of thousands of 

chunks of debris traveling around the Earth at enormous 

velocity, and most are too small to track with radar. 

Because of this, we essentially fly spacecraft in low-Earth 

orbit—in what pilots might euphemistically refer to as 

the “big sky, little airplane” theory of operation—where 

the likelihood of running into something is statistically 

extremely low. The difference between flying airplanes 

and flying spaceships is that things move MUCH faster in 

space than they do in the air, meaning the kinetic energy 

is exponentially higher. Something traveling in lowEarth orbit at a typical 28,000 km/hr (17,500 miles/hr) 

might travel at 100 times the speed of an airplane flying 

at 282 km/hr (175 miles/hr), but its energy (per given 

kilogram of mass) is 10,000 times greater. Although the 

odds are low that we will hit anything, the consequences 

of doing so are therefore potentially catastrophic.

The call came up from Houston late in the evening 

on Friday, March 23, 2012, that JSpOC was tracking 

a late-notice conjunction—space jargon for a shortnotice potential impact from orbital debris. The TCA 

was early the next morning. This hunk of debris was left 

over from a 2009 collision between an out-of-service 

Russian Kosmos satellite and an Iridium communication 

satellite. It was “draggy” (not very dense), thereby 

making its trajectory difficult to predict and track, 

which further limited the prediction accuracy. The way 

conjunctions usually work is that they are identified 

well in advance and, even if they start out red (high risk 

and/or high uncertainty), they gradually become yellow 

(moderate risk) and then green (essentially no risk) as the 

trajectories are refined. Even when they don’t turn green, 

the ground usually has plenty of time to plan an ISS or 

Progress engine burn, called a DAM, and nudge the 

space station away from the impending impact (this was 

before the Russian and American programs were able to 

implement the quicker PDAM process). In this case, the 

uncertainty stayed high and the exceptionally late notice 

Much of the debris from these events 

is actually above the altitude of the 

ISS. Figure 10 shows the density 

(number) of tracked objects present in 

a cubic kilometer of space at a given 

altitude. As is shown in Figure 10, 

the highest density of debris is at 

approximately 800 km (500 miles) 

altitude, and was the result of the 

Iridium and Fengyun events. 

Figure 10. Low-Earth orbit debris density (from http://www.unoosa.org/pdf/pres/stsc2011/tech-31.pdf, 

NASA report). The y-axis displays the density of objects in terms of number of objects per cubic kilometer 

while the x-axis shows the altitude. The collision between the Iridium and Cosmos satellite lead to a peak 

of about 5.5 x 10-8 particles per cubic kilometer at an altitude around 800 km (500 miles). 

Although the bulk of this debris is 

above the ISS orbit, it will descend 

over time due to atmospheric drag, 

and the number of conjunctions with 

the space station will increase. For 

these reasons, the flight control team 

continues to refine its tools available 

to assess and protect against threats 

from orbital debris. 
DAY IN THE LIFE: DEBRIS AVOIDANCE—NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT CHAPTER 8 153

of the conjunction meant it would have been impossible 

to push the ISS out of harm’s way. This has happened 

only four times during 18-year lifetime of the ISS.

So, in this case, Houston gave us the order early 

morning Saturday to configure the ISS for possible 

impact and subsequent abandonment. We were told 

to power down all the nonessential equipment, close 

the hatches between the various modules, shut down 

the intramodule ventilation, and then take shelter in our 

respective Soyuz spacecraft. The TCA was 6:38 a.m. 

The ground uplinked a “late-notice conjunction/safe 

haven actions” procedure that would guide us through 

the power downs and module isolation and tuck us 

safely away in our Soyuz spacecraft, ready to abandon 

ship, if necessary. This was an all-hands-on-deck effort 

where all six of the ISS crew members worked in tight 

coordination with the MCC flight controllers to safe 

the ISS. By closing the hatches between the modules, 

we gave the crews and MCCs a fighting chance of 

recovering the ISS by isolating any breached modules 

from the rest of the ISS volume. Compartmentalization 

is how the sailors and submariners refer to this, where 

damage to one portion of a ship is prevented from 

threatening other portions by keeping water-tight 

hatches secured. In our case, we weren’t worried about 

water coming in, but rather air going out. 

By 5:00 a.m., we started working the isolation/safe 

haven procedures beginning at the forward-most part of 

the ISS, carefully working our way aft toward the Soyuz 

spacecraft. One of the last things we did before entering 

our respective spacecraft and closing the hatches was to 

configure the ISS communication system for emergency 

mode, which would enable communication between the 

ground and the two Soyuz spacecraft. By 6:00 a.m., 

Anton [Shkaplerov], Anatoly [Ivanishin], and I were in 

our Soyuz and Don [Pettit], Andre [Kuipers], and Oleg 

[Kononenko] were in their Soyuz. We partially closed (to 

soft dock) our Soyuz hatches and then all sat quietly 

and waited for either a loud boom or [hopefully] the “all 

clear” call from Houston. Thankfully, 6:38:33 a.m. passed 

uneventfully and the ISS and its menacing interloper 

passed each other at a comfortable 16.5 km (10.2 miles) 

miss distance. We all floated out of our spacecraft, 

reconfigured the ISS hatches and systems, and enjoyed 

many more weeks of life and work aboard the ISS.

Conclusion

Despite a debris environment that 

has become more hostile over the 

decade and a half that ISS has been 

in orbit, Mission Control, NASA 

researchers, and JSpOC have 

correspondingly improved tools 

to protect the ISS and its crew. 

They have crafted methods that 

better track debris and characterize 

the threat from an identified 

conjunction with debris, and 

developed operational responses 

to help the ISS move into a safer 

orbit, rapidly, and avoid maneuvers 

unless absolutely required. 

As the population of debris in 

low-Earth orbit continues to worsen, 

these tools will continue to be 

refined to keep the ISS a safe and 

operationally useful laboratory. 

Chapter 9 Systems: 

Electrical Power 

System—The Power 

Behind It All
156 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

International Space Station solar arrays capture sunlight during STS-119/ISS-15A fly around. 

“Following the light of the sun, 

we left the Old World.”

– Christopher Columbus

Electrical power is the lifeblood 

of the International Space Station 

(ISS). Literally, it is the energy that 

keeps the ISS running. The ISS uses 

electrical power to operate the various 

systems that ultimately allow crew 

members residing on the space station 

and scientists across the globe to 

perform world-class research. In turn, 

the Electrical Power System (EPS) 

relies on those systems to provide 

command and control, to cool EPS 

devices, and to pinpoint the location 

of the sun to harvest its energy.

Previous NASA human spacecraft 

relied on consumables-based energy 

systems. Fuel cells used hydrogen 

and oxygen to produce power and, 

as a side benefit, water. This worked 

well for short-duration missions. 

For the long-duration mission of the 

ISS, resupplying these consumables 

would be cost prohibitive and 

would endanger the future of ISS 

operations, should the resupply be 

interrupted. Solar arrays and cells, 

along with batteries, proved to be 

viable power sources for satellites 

and were used in the Russian human 

space program—including the Mir 

space station. However, the energy 

demands of the ISS would require the 

largest solar power system ever (to 

date) to be designed, built on Earth, 

assembled in orbit, and operationally 

maintained for decades.

Many design decisions drove the 

overall architecture and operations 

of the EPS early in the development 

of the ISS. Large design differences 

exist between the Russian Segment 

(RS) and United States On-orbit 

Segment (USOS), though they have 

the capability to transfer power to 

each other. Even the voltage at which 

the EPS operates has large impacts 

on hardware design and actions 

necessary for crew and ISS safety. 

Multiple independent power sources 

provide redundancy for critical 

systems and allow power to be 

rerouted in the event of a failure. 

The USOS EPS can be divided and 

discussed in many ways, but it may 

be easiest to compare it to how most 

homes on Earth receive electrical 

power. Similar to terrestrial power 

plants, the Primary Power System, 

operating at high voltage, is where 

solar energy is converted to electrical 

power and stored in batteries for use 

during eclipse. A combination of 
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 157

mechanical joints are used to rotate 

the solar arrays and even entire 

truss elements to keep the large 

USOS solar arrays pointed at the 

sun. Similar to how transformers on 

utility poles near homes work, power 

is then converted to lower voltage 

in the Secondary Power System for 

use by end-user devices, or “loads,” 

such as computers and fans. A series 

of cables and power distribution 

units move power throughout the 

EPS and ultimately to users, as with 

high-tension power lines, buried 

cables, and even wiring inside homes. 

Finally, the EPS contains specific 

loads that support overall operations 

on board the ISS, including lights, 

switches, and extension cords.

In summary, the ISS solar arrays 

collect power during insolation, 

when the ISS is not in the shadow 

of the Earth. This power is supplied 

to equipment throughout the ISS 

and charges batteries for use during 

eclipse, when the Earth shadows 

the ISS from the sun. Power flows 

through various distribution control 

devices and switches to reach enduser loads. 

This chapter will discuss the 

hardware and process of converting 

sunlight into useable power and 

safely distributing it throughout the 

space station. Although many power 

systems used on the ISS are similar 

to those in terrestrial electrical 

networks and homes, the need for 

redundancy and the ability to be 

operated from far away in Mission 

Control require a number of critical 

design choices. The massive solar 

arrays on the ISS demand a great deal 

of interaction by the flight control 

team due to a number of constraints 

on the solar array operations, many 

of which were imposed after their 

design, including when and how 

other vehicles can dock. 

Background: 

Design Decisions

Distributed vs. Non-distributed 

Electrical Power System

The first ISS modules were designed 

with non-distributed EPSs. This means 

each module has a self-contained 

EPS that is able to generate, store, 

and distribute electrical power. Each 

module has its own solar arrays, 

batteries, distribution network, 

switches, etc. This structure was 

essential for early space station 

modules so that they could be 

essentially turnkey after launch, 

thus not requiring assembly or 

crew tending on orbit. The Russian 

Functional Cargo Block (FGB) and 

Service Module (SM) are based on 

designs used for the Mir space station, 

where non-distributed EPSs worked 

well. However, having each module 

outfitted with its own EPS adds mass, 

complexity, maintenance, and overall 

cost. As the ISS grew, new modules 

would potentially shadow the solar 

arrays of other modules, thereby 

causing loss of necessary power 

generation. In fact, deployment of 

the External Thermal Control System 

(ETCS) radiators (see Chapter 11) 

on the P1 and S1 truss segments 

physically interfered with the FGB 

solar array rotational envelope. This 

required the FGB solar arrays to 

be retracted, which greatly reduced 

their power-generation capabilities. 

The FGB then became dependent on 

power transfer from the USOS.

The USOS EPS and later RS modules 

were designed using a distributed 

EPS. Power is generated and stored by 

specifically designed power modules 

and then distributed to the rest of 

the ISS where it is needed. Having 

dedicated power modules reduces the 

mass required by having replicated 

power systems such as batteries and 

converters for each module. However, 

this warrants much larger solar arrays 

and batteries to meet the power 

demands of the ISS. These large solar 

arrays were placed farther from other 

modules, which allowed the arrays to 

be positioned to see the sun and avoid 

sunlight blockage from other modules. 

The design trade was that it would 

take multiple Space Shuttle missions 

over the course of years until the 

USOS Primary Power System would 

be fully assembled. This meant full 

capability and redundancy was not 

available until well into ISS assembly, 

which resulted in a limiting effect 

on the amount of science conducted 

on the ISS early in its lifetime. 

Additionally, this caused many 

changes in procedures and training for 

ground controllers and crew. Almost 

constant work was required to keep 

the operations team in sync with the 

current configuration.

Current, Voltage, and Mass

Going back to the beginning of the 

earliest uses of electrical power, 

arguments took place over the benefits 

and detriments between alternating 

current (AC) and direct current 

(DC). In the 1880s, this became a 

famous “battle” between Thomas 

Edison (promoting DC) and George 

Westinghouse, who held patents 

to Nikola Tesla’s work with AC. 

Terrestrially, AC won out due to 

cost and efficiency, with the United 

States using a 110 Volt AC system 

and the European standard 220 Volt 

AC. However, solar array and battery 

system designs naturally generate 

and store energy using DC. In fact, 

28 Volt DC systems have become an 

aerospace industry standard. However, 

it can be difficult to efficiently change 

the voltage in a DC system; and, 

as will be discussed later, the ISS 
158 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

DC-to-DC Converter Units (DDCUs) 

actually make use of AC to change 

voltage levels. The ISS also uses 

DC-to-AC inverters to provide US 

standard 110 Volt AC power to user 

loads in an effort to reduce cost and 

make use of commercial off-the-shelf 

(COTS) equipment.

As mentioned above, 28 Volt DC 

systems have become an aerospace 

standard, and this standard was used 

for the RS EPS. However, low-voltage 

DC systems require higher currents 

and therefore larger, heavier cables to 

meet user power demand. To reduce 

mass, especially in a distributed power 

system, the USOS was designed to use 

higher voltages, which would require 

lower currents and smaller cables. The 

USOS uses an approximately 160 Volt 

DC primary and an approximately 

124 Volt DC secondary system. 

Although this accomplished the 

goal of allowing smaller cabling to 

reduce mass, it also resulted in a few 

design impacts. As a new standard, 

user equipment had to be designed 

to either use the higher voltage or 

require additional support hardware 

in the form of power converters and 

inverters. Additionally, the higher 

voltage poses safety risks to both 

the hardware and the crew. Higher 

voltage presents a greater chance of 

electrical arcs, which could potentially 

cause damage to connections that 

are being mated (connected) or 

demated (disconnected). One result 

of this damage could be the release of 

molten metal, which might penetrate 

a spacesuit or cause physical harm to 

the crew in microgravity. Additionally, 

the higher voltage increases the 

electrical shock risk to the crew 

member when working with electrical 

connections. Therefore, safety 

requirements call for multiple levels of 

inhibits (i.e., steps to prevent electrical 

current flow, such as adding an open 

switch) to prevent exposing the crew 

and hardware to this high-voltage 

potential during electrical connector 

operations. Operationally, this requires 

removing power at higher levels, or 

“upstream,” in the EPS architecture 

and therefore powering down multiple 

pieces of equipment to replace one 

device. To relate this to the average 

home, it would be comparable to 

requiring the resident to turn off the 

room circuit breaker as well as the 

light switch when replacing a light 

bulb. Although this many levels 

provide additional protection against 

arcing and shock, it can add risk by 

unpowering perfectly good devices 

and removing redundancy.

Trip Coordination

Another overall design aspect of 

the EPS is current trip coordination. 

This is called a “safing function” 

because it places the hardware in 

a safe (unpowered) configuration 

while also trying to preserve as much 

functionality when faced with a 

malfunctioning piece of equipment. 

Electrical current sensors throughout 

the EPS monitor and report the 

amount of current flowing between 

electrical devices. When one of 

these sensors detects a higher-thanexpected current, automated actions 

called “trips” are taken to open 

switches or deactivate equipment 

to remove the potentially hazardous 

situation. Usually, the higher current 

is caused by an electrical short (e.g., 

electrical wires crossed or touching) 

in the hardware and could lead to 

an electrical fire if left uncorrected. 

This is identical to a fuse or circuit 

breaker in a house activating and 

removing power when too many 

devices are connected to one electrical 

socket or when one device has 

become damaged. Trips need to be 

fast—on the order of microseconds 

or milliseconds—to protect hardware 

and cabling from damage. If a lowerlevel device did not trip fast enough, 

the higher current draw would be 

seen by higher-level devices. If the 

high-level device trips, power would 

be removed from more equipment 

than necessary. Therefore, the trip 

times are fastest at the lowest levels 

and lengthen higher in the EPS 

architecture. However, some devices 

on the ISS (e.g., motors on larger 

pumps) have startup transients that 

require additional current for short 

durations. This additional current 

may be enough to trigger the EPS trip 

functions. Some EPS devices were 

designed to “current limit” prior to 

tripping to handle these situations, 

where necessary. Current limiting is 

a function where an EPS device can 

actually adjust both output voltage and 

current so that, on average, the level 

is safe in an attempt to manage total 

output power. Limiting the current 

prevents upstream EPS devices from 

seeing higher current draws, thus 

preventing trips, while allowing a 

short time for device startup transients. 

Usually, the current is limited for only 

hundredths of seconds. If the transient 

has not ended in that time, the trip 

function will remove power from 

“downstream” load(s).

Remote Control

A design goal of the ISS was to make 

as many systems as possible remote 

controllable. Although this created the 

need for a robust Command and Data 

Handling system (see Chapter 5), 

it allowed for mass savings (i.e., 

less physical switches) and overall 

control from the ground for times 

when the crew was not available. 

In turn, this allowed the crew to 

focus on scientific research instead 

of day-to-day ISS operations. Most 

USOS EPS devices have firmware 
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 159

controllers (small computers) that 

interface with the Command and Data 

Handling system to provide data and 

receive commands. These firmware 

controllers monitor current, voltage, 

and temperature sensors to provide 

insight into the health and function 

of the EPS. They also respond to 

commands from ground controllers, 

crew members, or automated software 

functions on board. These commands 

can open or close switches, turn 

automated functions on or off, or 

change the modes or set points 

that manage EPS operations. One 

downside is that the system had an 

increased dependence on computers 

to safe hardware. This is especially 

evident when certain computers 

control their own power switches. If 

one of those computers malfunctions, 

it may be necessary to go farther 

upstream in the EPS to remove 

power from the faulty computer, thus 

impacting other user loads. In fact, 

a significant part of a module may 

need to be powered down to change 

out the faulty computer. Although 

remote-control capabilities have 

proven beneficial for freeing up crew 

time and potentially saving the ISS 

if a crew is not available to respond 

to off-nominal situations, having 

practically no manual overrides in the 

EPS also has its detriments.

System Overview

Power Channels

The USOS EPS is divided into eight 

power channels: 1A, 1B, 2A, 2B, 3A, 

3B, 4A, and 4B. A power channel 

contains the equipment necessary 

to generate, store, and distribute 

power as an independent source. It 

also contains support equipment for 

command and control, cooling, and 

solar array pointing to keep the power 

channel functioning. The primary 

power equipment responsible for 

generating and storing electrical 

power is located on four PhotoVoltaic Modules (PVMs): the P4, 

P6, S4, and S6 truss segments. Each 

PVM supports two power channels. 

Hardware for channels 1 and 3 

is located on the starboard truss; 

hardware for channels 2 and 4 is 

located on the port truss. The two fully 

independent and redundant power 

channels are labeled A and B. Channel 

A runs on S4 and P4, whereas B is 

connected to S6 and P6 (Figure 1).

3B 1A

1B

S6

S4 P4

P6

4A 2B

3A 2A 4B

Assembly Complete US EPS

8 power channels (1A, 1B, 2A, 2B, 3A, 3B, 4A, 4B)

4 photovoltaic modules (S6, S4, P4, P6)

Power Channel Naming Convention

Odd numbers are starboard, even numbers are port

A panels are inboard, B panels are outboard

Figure 1. ISS PVMs and power channels. 

A subset of power channels—1A, 

1B, and 2B—are considered to be the 

core power channels. These channels 

provide power to some of the most 

important space station systems 

hardware such as critical avionics 

(e.g., computers and communications 

equipment), life support systems, and 

external and internal Thermal Control 

Systems. These core channels and the 

concept of electrical power domains 

greatly impact how redundancy of 

critical systems was designed and is 

maintained on the ISS. Operationally, 

it is important to note that these 

critical systems are unevenly 

distributed across these core channels. 

Channel 1A supports ETCS Loop A, 

while channel 1B powers one string 

of critical avionics. However, channel 

2B alone supports ETCS Loop B and 

one string of critical avionics. Due 

to this uneven distribution, loading 

on channel 2B is higher than the 

other core channels and takes more 

planning to keep it within energy 

balance when the ISS is in a powerconstrained configuration, such as one 

that occurs during vehicle dockings 

(e.g., requiring a solar array to be in a 

fixed position).

Domains and Redundancy

Even with the best designs, ISS 

hardware and systems can wear 

out and fail. Critical systems have 

backups and sometimes multiple 

backups to keep the space station 
160 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

safe and functioning, should such an 

event occur. Generically, the concept 

of providing backup capabilities is 

called “redundancy.” Redundancy can 

be implemented by having multiple 

systems that perform the same 

function, such as multiple radios or 

computers. For less-critical functions, 

redundancy might mean having one 

system that can be powered from 

different sources. 

When designing the overall 

redundancy of the ISS, engineers 

defined the USOS EPS as separated 

into two domains: the 1/4 domain 

and the 2/3 domain. The 1/4 domain 

is made up of power channels 1A, 

1B, 4A, and 4B; the 2/3 domain 

consists of power channels 2A, 

2B, 3A, and 3B. As noted above, 

critical ISS systems are split 

between channels 1A and 1B on 

the 1/4 domain and channel 2B 

on the 2/3 domain. However, not 

only are critical loads split between 

these domains, so are auxiliary and 

payload equipment. Two physical 

features define the power domains: 

cooling of associated EPS devices 

by different ETCS loops, and the 

placement of associated core power 

channels on opposite sides of the 

ISS (i.e., port and starboard). The 

ETCS Loop A, while powered by 

the 1/4 domain, provides cooling for 

critical 1/4 domain EPS hardware. 

Similarly, the ETCS Loop B, while 

powered by the 2/3 domain, provides 

cooling for critical 2/3 domain EPS 

hardware. Placing the core power 

channels on opposite sides of the 

ISS eliminates reliance of those 

channels on the same Solar Alpha 

Rotary Joint (SARJ) for solar 

pointing. Failure of a SARJ would 

greatly degrade the capability to 

orient half of the power channels 

for solar pointing, but would only 

affect the core channels of one power 

domain. However, redundancy was 

built into the SARJs themselves, 

and they can be controlled by either 

domain (see below).

Overall, redundancy of ISS systems 

is provided by identical redundant 

equipment (i.e., a prime and a 

backup) that are separately powered 

by one of the two power domains. 

However, some device power 

supplies were designed to have 

multiple inputs, meaning the same 

piece of hardware can be powered by 

the two different domains so that if 

one should fail, operation would not 

be interrupted. Dual power feeds are 

more common to payload equipment 

where power redundancy supports 

mission success for that unique 

payload hardware, versus separate 

fully redundant critical systems 

equipment required for ISS safety.

Off-nominal—Power Channel 

Cross-ties

Failure of a power channel can have 

wide-ranging impacts to both the 

ISS systems and the payloads. The 

USOS power system was designed 

to be able to electrically connect 

the primary power outputs of the 

channels, called “cross-tying,” to 

provide some flexibility in the face of 

a power channel loss. The channels 

can be tied together in a specific order 

using the Main Bus Switching Units 

(MBSUs), which will be discussed in 

more detail. 

Originally, the capability required that 

a power channel output be removed 

before another channel could be tied 

to additional downstream loads to 

prevent the two power channels from 

trying to power the same bus, which 

could potentially cause instability 

and additional failures. This would 

require the deactivation of all loads 

associated with the channel being 

shut down. Known as a “cold crosstie,” this capability works well 

when a channel shutdown/loss is 

unavoidable or unexpected. However, 

if a power channel was planned to be 

shut down, it would be beneficial to 

allow downstream loads to remain 

powered and seamlessly move them 

to a good power channel. 

The operations and engineering 

teams developed a process of using 

software and hardware already on 

board to perform a seamless power 

channel handover or “hot crosstie.” Depending on overall power 

demands, some loads on either 

channel may still need to be powered 

down to prevent overloading the good 

channel. The voltage set points of the 

suspect channel would be lowered 

within the Primary Power System 

control range by using software and 

firmware commands. The MBSU 

cross-tie function would then be used 

to electrically connect the suspect 

channel to a good channel—one 

operating at the nominal Primary 

Power System voltage—without 

the loss of all downstream loads. In 

other words, the solar array output of 

the suspect channel would be taken 

off-line and its batteries would be 

configured to discharge at a lower 

voltage than the batteries of the 

good channel. Therefore, when the 

suspect channel sees the nominal 

voltage level, its batteries will start 

charging, and the good channel will 

supply power to the downstream 

loads. The Primary Power System 

portion of the suspect channel can 

then be gracefully deactivated or 

configured to a dormant/keepalive configuration until required 

maintenance is completed.
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 161

Contingency—Jumpers

Whereas cross-tie functionality 

provides for the loss of a power 

channel, certain failures in the 

Secondary Power System or Thermal 

Control System would still remove 

power from critical ISS systems. As 

the ISS was assembled, the operations 

and engineering teams devised the use 

of physical connectors and cables to 

“jumper” around these failures, kind 

of like an electrical detour. Sometimes 

these jumpers make use of electrical 

connections that were originally 

intended for temporary use during 

ISS assembly (see Introduction). For 

example, the Lab-Truss Contingency 

Jumper provides secondary power 

from a DDCU inside the US 

Laboratory module to critical loads 

on the P1 or S1 truss segments. 

This capability originally existed to 

provide power to truss loads prior to 

the permanent ETCS activation, and 

can now be used if an ETCS loop 

fails. Other jumpers reroute power 

between DDCUs, potentially stealing 

power from payloads for critical 

systems (e.g., sacrificing science to 

maintain life support). 

Specific jumper cables and 

procedures have been designed for 

multiple failure scenarios. However, 

not all scenarios can be covered. 

The potential for a failure to cause 

the loss of a particular device that is 

needed for safety or mission success 

still exists. In these cases, the crew 

could use spare electrical wiring and 

a pin kit to build a new connection 

(see Chapter 16). A solution cannot be 

guaranteed, but the operations support 

officers and the engineering teams 

have often proven their ingenuity 

and creativity in the use of pin kits 

in the face of unexpected failures. 

The downside to any jumper is that 

the crew must take physical action to 

install it. This can pull the crew away 

from scientific research, create the 

need to wake the crew in the middle 

of the night, or, worst case, cause 

an extended duration of equipment 

loss if the crew is unavailable to 

install a jumper. When an external 

cooling pump failed in 2010 and 

again in 2013 (see Chapter 20), 

jumpers were used to provide power 

to redundant systems until a 

spacewalk could be performed. 

Contingency—Planning, Energy 

Balance, and Load Sheds

The solar array of each power channel 

can produce approximately 30 

kilowatts (kW) of power—or about 

three times the average household 

power consumption in the United 

States. However, once Primary 

Power System battery charging, 

housekeeping power (i.e., the power 

needed to operate the EPS devices 

themselves), and inefficiencies 

(i.e., energy lost, often in the form 

of heat, due to resistance in cables 

and during voltage conversions) are 

accounted for, each power channel 

can nominally supply about 12 kW of 

power to downstream loads. Higher 

loads, up to approximately 15 kW, 

can be supported for short durations 

at the risk of having an additional 

single-point failure cause an entire 

channel to trip off. Many factors 

can lower the power generated by a 

channel. The inability of solar arrays 

to track the sun, the ISS in an offnominal attitude, or Primary Power 

System failures or maintenance can 

all lower the power available from a 

power channel.

Power planning is one of the most 

work-intensive, ongoing operations 

for the Station Power, Articulation, 

Thermal, and Analysis (SPARTAN) 

flight controllers. Power planning 

includes determining the power 

availability and the load demand 

of each channel. Power availability 

is mainly driven by the solar 

array configurations and external 

environmental forces. During 

normal operations, the ISS solar 

array rotary joints are configured to 

track the sun as the vehicle moves 

along its orbit, thus maximizing 

the solar energy gathered for 

power production. However, due 

to multiple constraints, dynamic 

operations such as visiting vehicle 

arrival or departure and spacewalks 

may require the solar arrays to be 

fixed in specific positions called 

solar array “feathering.” Typically, 

at least one solar array feathering 

event happens weekly. When the 

solar arrays are not actively tracking 

the sun, power production can be 

greatly reduced to the point of not 

providing enough power to meet 

minimum power channel loads. Also, 

the natural occurrence of changing 

solar beta angle (see Chapter 7) 

affects the total power generation 

on the ISS. Low beta angles cause 

longer eclipse periods (i.e., where 

the arrays do not receive sunlight), 

which drove the design of the 

Primary Power System batteries. 

Eclipse periods are shorter at high 

beta angles; at their maximum value, 

the ISS is in continuous daylight for 

multiple days in a row. Although 

more sunlight might result in more 

power, it also impacts operations 

(e.g., the equipment can get too 

warm). If the Primary Power System 

batteries are not discharged, they 

can overcharge, thereby causing 

damage to the batteries. Or, they 

can develop a memory, meaning the 

full depth of discharge (i.e., time 
162 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

that a rechargeable battery can last 

on a single discharge) would not be 

available. Ground controllers must 

actively manage battery states of 

charge during high beta operations 

by reducing the current used to 

charge batteries and occasionally 

deactivating batteries to prevent 

them from overcharging. As a result, 

some of the power that is generated 

is wasted and cannot be used by the 

EPS. Annually, batteries must be 

reconditioned by taking each battery 

off-line and completely discharging 

it to remove any memory buildup 

and allowing the state of charge 

(SOC) software calculations to be 

updated. Additionally, the high 

inclination of the sun with respect to 

the orbit of the ISS can cause parts 

of the ISS structure to cast shadows 

across the arrays. This can reduce 

power-generation capability, cause 

changes in nominal heater control 

cycles (i.e., some items getting 

warmer or colder than normal), and 

potentially cause thermal stresses on 

hardware (see Longeron Shadowing, 

discussed below). ISS Program 

management has Groundrules 

and Constraints (see Chapter 1) 

that limit scheduling of dynamic 

events at high beta, due to these 

environmental effects of high beta 

and the solar array constraints often 

associated with dynamic operations. 

For example, visiting vehicles are 

generally not allowed to dock at 

these times of the year.

The SPARTAN team develops a 

weekly solar array plan that takes 

into consideration any solar array 

positioning requirements and 

determines a time-phased power 

availability for each power channel. 

This availability is then adjusted 

for any Primary Power System 

maintenance that is planned, such 

as battery reconditioning. At the 

same time, the SPARTAN team 

gathers inputs from control centers 

around the globe to develop a usage 

profile that includes the standard 

systems power requirement (i.e., the 

overhead to keep the ISS operating), 

dynamic events loading, and payload 

requirements. The power availability 

is then compared to the load profile 

to determine whether the power 

system will be balanced. The strictest 

definition of energy balance would 

have the Primary Power System 

batteries discharge and recharge 

match on each orbit. 

From a planning perspective, 

the operations team plans for the 

batteries to fully recharge each 

orbit and is limited to a maximum 

discharge down to 65% SOC to 

prevent excessive wear on the battery 

hardware and maintain contingency 

reserve power in case of a failure 

preventing a battery from recharging. 

Furthermore, this protects the 

vehicle from significant failures. For 

example, if a system failure that will 

take a few hours to fix occurs when 

the batteries only have 30% to 40% 

SOC, there is a higher chance the 

system will lose all power before a 

recovery. If the power availability 

is greater than or equal to the load 

profile, the system is considered to 

be in positive energy balance (i.e. 

generating more electricity than is 

being used). If the power availability 

is less than the load profile, the 

system is in negative energy 

balance. Positive energy balance 

will allow the batteries to recharge 

to the same point they started on 

the previous orbit—hopefully fully 

charged. Negative energy balance 

will prevent the batteries from fully 

charging each orbit and will cause 

the batteries to discharge further 

each orbit until they deplete their 

usable energy. Negative energy 

balance on the ISS is often caused 

by dynamic events that create the 

need for solar array feathering, thus 

reducing the power availability. If, 

during weekly planning, the initial 

comparison of power availability to 

the load profile shows the ISS will 

be in negative energy balance, the 

operations team will work through 

multiple options to correct the 

situation. Usually, the team will 

develop a manual powerdown plan. 

Through this plan, ground controllers 

will deactivate noncritical equipment 

for the duration of the energynegative timeframe, usually on the 

order of 2 to 8 hours. If a suitable 

powerdown cannot be found, it may 

be necessary to postpone an activity 

(e.g., dynamic event, payload, 

etc.) until power is available to 

support it. It may possible for the 

ISS to continue in negative energy 

balance during rare, high-priority, 

short-duration events. This would 

potentially cause additional wear 

of battery hardware and eat into the 

power available for contingencies. 

These cases are weighed against 

the risks of replanning the highpriority event (e.g., delaying the 

docking or spacewalk). All these 

operations are carefully defined in 

the flight rules, which detail under 

what conditions the batteries can be 

discharged below the nominal limits. 

The flight director will weigh these 

considerations when determining 

what level will be tolerated.
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 163

Primary Power System

As mentioned above, the Primary 

Power System (Figure 2) is the 

portion of the EPS that operates 

at a high voltage and includes the 

hardware needed to generate power 

during insolation, store and provide 

power for eclipse, and distribute 

power to the Secondary Power 

System. Most Primary Power System 

hardware is located on the PVMs 

associated with each power channel. 

The Primary Power System operating 

voltage range is 155 ± 22 Volts DC 

to provide flexibility and account for 

hardware degradation as the system 

ages. Usually, the solar arrays provide 

160 Volts DC during insolation, 

whereas the batteries provide 151 

Volts DC during eclipse.

SAW Array 

Strings SSU

ECU

DCSU

RPCM

BATT

RPCM

Blanket BGA

Blanket

Acronyms:

BATT Battery

BCDU Battery Charge/Discharge Unit

BGA Beta Gimbal Assembly

DCSU Direct Current Switching Unit

DDCU DC to DC Converter Unit

ECU Electronics Control Unit

MBSU Main Bus Switching Unit

PWR BUS Power Bus

RPCM Remote Power Controller Module

SAW Solar Array Wing

SARJ Solar Alpha Rotary Joint

SSU Sequential Shunt Unit

[CHT] American to Russian Converter Unit

SARJ

[CHT]s To

Another 

MBSU

From

Another

MBSU

From 

Another

Power 

Channel

MBSU

RPCM

PWR BUS

Users

RPCM

DDCU

DDCU DDCU

BATT BCDU

BATT BATT BCDU

BATT BATT BCDU

RPCM

PWR BUS

Users

RPCM

RPCM

PWR BUS

Users

RPCM RPCM

PWR BUS

Users

RPCM

Users Users

The System

Figure 2. Diagram of an ISS power channel. Power is generated in the SAW and then passed through the SSU in the BGA to the DCSU or back to the arrays 

if too much electricity is being generated. The DCSU sends the power either to the batteries for storage or to downstream loads. From the DCSU, the power 

passes through the SARJ to the MBSUs. Electricity from the MBSUs can then be fed to other MBSUs, DDCUs, or Remote Power Controllers.

Solar Arrays

Each USOS power channel has 

one Solar Array Wing (SAW) that 

contains the equipment necessary 

to deploy or retract the array, 

structurally support the array on 

orbit, and collect solar energy. Each 

SAW has two solar array blankets 

that contain 16,400 solar cells 

(32,800 cells per SAW). The cells 

are grouped together into strings 

that are combined to produce the 

voltage and current necessary for 

power channel operations. Each 

blanket also contains diodes between 

each string so that each string can 

be bypassed in the event the string 

is damaged or unable to produce 

power. A collapsible mast made up 

of longerons, battens, and cables 

is positioned between each blanket 

(Figures 3 and 4). 
164 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

Solar Array 

Blanket

Blanket Box 

(lower half)

Blanket Box 

(upper half)

Guidewire

Mechanisms Mast 

(partially extended, 

showing 2 bays) Mast Cannister 

(holds mast prior 

to deploy)

4.6 m

(15.0 ft)

4.6 m

(15.0 ft)

2.1 m

(16.9 ft)

Figure 3. Partially deployed solar array showing two bays extended (see also Figure 4). 

Upper 

Longeron

Rigid Batten 

Frame

Cable 

Diagonals

Flexible

Batten

Corner

Fitting

Elbow 

Fitting

Lower

Longeron

Figure 4. Solar array mast components. The longerons are collapsed when in the mast canister and 

then lock into place after extension.

When retracted, each blanket folds 

into a box that is 51 cm (20 in.) 

tall. The mast is collapsed into a 

canister that is 2 m (6.6 ft) tall. When 

deployed, each SAW is 35 m (115 ft) 

long. A series of cables and a motor 

are used to deploy, retract, and hold a 

SAW taut. Each SAW was deployed 

during the ISS assembly Space 

Shuttle mission that delivered the 

associated PVM (Figure 5). 

Figure 5. Deployment of ISS solar arrays, 

showing the beginning of deployment with a 

couple of bays deployed (top), partially deployed 

with 16 bays (middle) and fully extended with all 

32 bays extended (bottom). 

The P6 SAWs, channels 2B and 

4B, were retracted during the ISS 

assembly sequence when it was 

necessary to move the P6 truss 

segment from its temporary location 

on top of the Z1 truss. The P6 SAWs 

were then redeployed during the 

STS-120/ISS-10A mission. The team 

experienced a lot of difficulties in 

getting the solar array blankets to 

retract and fold neatly into their boxes. 

Although this proved ultimately 

successful with the assistance of 

extravehicular activity (EVA) crew 

members, one of the channel 4B solar 

array blankets was damaged during 

the redeploy and required contingency 

EVA repair using unplanned/built-
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 165

on-the-fly materials (see Chapter 18). 

Due to these difficulties, no further 

plans have been made to retract the 

USOS solar arrays. However, some 

EPS maintenance requirements 

(i.e., Sequential Shunt Unit [SSU] 

replacement) originally called for 

solar array retraction to safe electrical 

connections. With no way to “turn 

off” the sun, and with the retraction 

option essentially off the table, the 

operations community had to develop 

plans to perform these maintenance 

tasks with time-critical steps during 

limited eclipse periods. This is another 

example of the designer’s intentions 

being changed through the lessons 

learned by operating the ISS.

Sequential Shunt Units

The SSU is the primary power 

regulation device that controls SAW 

output. The SSU maintains its Primary 

Power System voltage set point 

(typically 160 Volts DC) by balancing 

the system demand with the number 

of connected array strings. Each array 

string can be individually connected 

or disconnected from the primary 

power bus. Array strings that are 

disconnected from the power system 

are shunted (shorted or rerouted back 

to the array). The output from the SSU 

is therefore the sum of all connected 

strings at any given time. The SSU 

also contains multiple safing functions 

that cause it to automatically shunt 

all array current, including output 

overvoltage (indicating that the SSU is 

not functioning correctly) and output 

undervoltage (indicating a possible 

electrical short downstream).

Batteries

The actual storage devices of the 

Primary Power System batteries are 

nickel hydrogen battery assemblies—

three per power channel. In early 

2017, the team began replacing 

the nickel-hydrogen batteries with 

lithium-ion batteries. The new 

batteries provide more energy storage 

in a smaller box, with one lithium-ion 

battery replacing two nickel-hydrogen 

batteries. The batteries store power 

throughout the entire orbit. Array 

power is used to charge the batteries 

during insolation. A portion of the 

stored battery energy is discharged 

to supply the ISS loads during 

eclipse. Energy from the batteries 

may also be used to supplement 

the power-generation function 

during insolation. For example, 

if the load on a power channel is 

temporarily higher than the solar 

array can supply due to overloading, 

shadows cast by other space station 

structure, solar arrays purposely 

not tracking the sun, or a failure, 

then the batteries will discharge in 

parallel with the solar array output 

to maintain sufficient power to 

downstream loads. If all batteries 

are fully operational on a channel 

(i.e., not undergoing maintenance), 

the USOS EPS is designed to only 

discharge down to 65% SOC to 

supply the nominal ISS power needs 

during the period of orbital eclipse 

and can then be fully charged during 

a single period of insolation. The 

additional battery capacity would 

be used to support loads if solar 

array input power were to be lost.

Battery Charge/Discharge Units

The Battery Charge/Discharge Units 

(BCDUs) control the charging and 

discharging of the power channel 

batteries. During insolation periods, 

the BCDUs will charge, and then 

maintain the batteries at their 

maximum SOC. The discharge unit 

converter is a bidirectional power 

converter that can regulate the current 

level for charging the battery and 

regulate the voltage level produced 

when discharging the batteries. 

Typically, the BCDUs are set to 

regulate the output voltage level 

to 151 Volts DC. When the SSU is 

producing power (set point of 160 

Volts DC), the BCDU will sense the 

output voltage above its set point 

and operate in a battery-charging or 

maintenance mode. When the SSU 

output voltage drops, the discharge 

unit will begin to reduce the batterycharging current; when the voltage 

drops below the BCDU set point, 

the BCDU will begin discharging 

the batteries to maintain power to 

downstream loads. This transition 

is automatic and happens without 

crew or ground interaction. BCDUs 

also provide backup power to the 

Primary Power System components 

of the other power channel on the 

same PVM. This power enables 

only command and control of these 

components, and cannot be used to 

supply power to the downstream 

loads of that channel.

Secondary Power System

Direct-Current-to-Direct-Current 

Converter Units

The DDCUs are the interface 

between the Primary Power System 

and the Secondary Power System. 

They convert the primary power 

range of 155 ± 22 Volts DC to 

the tightly regulated secondary 

voltage level of 124 ± 1.5 Volts 

DC. Numerous converter units are 

distributed throughout the USOS. 

In general, units are located in close 

proximity to the loads they power 

due to their operating at a lower 

voltage and higher current, which 

in turn requires larger cabling after 
166 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

conversion. The three types of 

DDCUs include: external, located on 

the truss segments; internal, located 

inside pressurized modules; and heat 

pipe units, located on the Z1 truss. 

Although multiple differences exist, 

the main distinguishing feature of 

these converter units are how they are 

cooled. External DDCUs (cooled by 

the ETCS loops) and internal DDCUs 

(cooled by the Internal Thermal 

Control System) (see Chapter 11) are 

each designed to output 6.25 kW of 

power. Heat pipe DDCUs are rated to 

output only 3 kW of power due to the 

limited cooling provided by the heat 

pipes (i.e., small radiators that rely on 

the release of heat during the phase 

change of liquid ammonia to gas 

instead of active pumps). 

External and heat pipe DDCUs 

share the same external housing 

(i.e., thermal insulation and 

micrometeoroid shielding), which 

is not required for the internal units. 

The DDCUs operate on a demandfeed basis, meaning they will try 

to feed any amount of downstream 

loads, up to their maximum output 

trip limits. As the current draw 

increases (i.e., more loads), the 

voltage on the output decreases. The 

converter unit senses this drop and 

increases its power output to maintain 

the set point. Similarly, as loads are 

turned off, the current decreases, 

thereby increasing the voltage. The 

DDCU will sense this increase and 

respond to by decreasing its output. 

Two DDCUs are configured in a 

parallel configuration in several 

locations. In this configuration, each 

one receives primary power from a 

different power channel; however, the 

outputs of the two units are merged 

together to allow up to 12.5 kW to 

feed downstream loads. As long as 

the load is not greater than 6.25 kW 

on a single DDCU, these DDCUs 

can be configured to balance loads 

between the two input channels. If 

one of the parallel convert units were 

to fail, the other could still support 

up to 6.25 kW of downstream loads. 

The DDCUs have multiple safing 

functions that will automatically 

deactivate the unit if off-nominal 

input/output currents, voltages, or 

temperatures are detected by onboard computers.

Power Distribution

Once power has been generated and 

stored, it needs to be routed to the 

DDCUs to be converted to secondary 

power levels. Then it should be 

further routed to downstream 

loads, where the crew and ground 

controllers can activate and deactivate 

individual loads. The power 

distribution devices handle all of this. 

Additionally, the power distribution 

devices provide a large part of the 

trip coordination safing function that 

was discussed earlier. This function is 

performed primarily by Remote Bus 

Isolators (RBIs) and Remote Power 

Controllers (RPCs).

Remote Bus Isolators

RBIs are bidirectional, 

electromechanical relays that provide 

electrical paths between electrical 

buses—i.e., bundles of wires. This 

bidirectional capability means 

power can flow either way, allowing 

different power sources such as 

the solar arrays, batteries, or other 

power channels to reach downstream 

loads. RBIs can be remotely opened 

or closed via command and have 

overcurrent safing trips for current 

flowing in either direction. The 

specific limits on the current are part 

of trip coordination and will vary 

depending on the location of the RBIs 

in the EPS architecture.

Remote Power Controllers

RPCs are solid-state power switches. 

They allow power to be transmitted 

one way to the downstream loads. 

RPCs of various output current 

ratings can be found across the 

ISS and are used to provide power 

directly to user loads. These are 

the most common switches used by 

the crew and ground controllers to 

activate or deactivate loads. RPCs 

are, in effect, circuit breakers—

similar to those in most households—

that can be remotely commanded 

open and closed.

Direct Current Switch Units

The Direct Current Switch Unit 

(DCSU) is the electrical distribution 

box for a primary power channel. 

It routes power between the solar 

arrays’ SSU input, BCDUs’ batteries, 

and to downstream MBSUs or 

DDCUs. It also provides fault 

protection between each of these 

devices. See Figure 6.

DCSUs are primarily an electrical 

bus with six RBI connections, seen 

in Figure 6. RBI 1 is the input power 

from the solar arrays or the SSU. 

RBIs 2, 3, and 4 are the feeds for 

charging or discharging the batteries, 

whereas RBIs 5 and 6 provide power 

to downstream loads.

The DCSU power supply has three 

possible inputs. A BCDU located on 

the opposite power channel of the 

same truss segment provides backup 

power. It can also receive power 

from the solar array and batteries of 

the channel, or by backfeeding power 

from another channel.
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 167

BCDU

BGA

SSU

DCSU RBI 2

BCDU – Battery Charge/Discharge Unit

BGA – Beta Gimbal Assembly

DDCU – Direct-Current-to-Direct-Current Conversion Unit

MBSU – Main Bus Switching Unit

RBI – Remote Bus Isolator

SSU – Sequential Shunt Unit

MBSU

RBI 1 RBI 6

RBI 5

RBI 3 RBI 4

BCDU BCDU

DDCU

Figure 6. DCSU distribution. Electricity comes in from the SSU through the BGA and, depending on the 

configuration of the RBI, is passed to BCDUs and downstream loads.

Main Bus Switching Units

The MBSUs are used to distribute 

primary power from the power 

channels to downstream DDCUs 

and other loads. They also provide 

the capability to cross-tie primary 

power channels to feed those 

DDCU loads in the event of a 

power channel failure or to restart 

a power channel. The S0 truss 

segment contains four MBSUs, 

each of which has input from 

two primary power channels and 

outputs to several DDCUs or 

USOS to RS power converters. 

See Figure 7.

From MBSU 4

RBI 6

Power Supply

DCSU – Direct Current Switching Unit

MBSU – Main Bus Switching Unit

RBI – Remote Bus Isolator

RBI 9

Internal

Cross-Tie

DCSU 1A

RBI 6

MBSU 4 

RBI 7

RBI 7 RBI 14

MBSU 

2 RBI 14

RBIs 2-5

to Loads

RBIs 10-13

RBI 6 to to Loads

MBSU 2 

Power Supply

RBI 1 RBI 8

DCSU 1B

RBI 6

Figure 7. Example MBSU #1 distribution showing how power can flow using the RBIs to feed 

different DCSUs.

The MBSUs provide a great deal

of flexibility and redundancy in the 

electrical system by allowing 

various power sources to be 

connected, or tied, to other channels. 

Each MBSU contains two electrical 

buses and 14 RBIs. RBIs 1 and 8 

are nominally the input power from 

primary power channels; however, 

they can be used to backfeed power 

to a primary power channel, if 

needed, following a power channel 

failure. Other RBIs (2 through 5 

and 10 through 13) are outputs to 

downstream loads. The ability to 

cross-tie the inputs to different buses 

is accomplished by closing RBIs that 

connect those power channel buses. 

The two buses internal to the MBSU 

can be cross-tied by closing RBI 9. 

Since RBIs 7 and 14 are connected 

to adjacent MBSUs, they can be 

cross-tied to other power channels. 

Although it would be technically 

possible to tie all downstream 

loads to one power channel, the 

channel would not have the power 

availability to actually power all of 

those loads. Similar to the DCSU 

power supply, the MBSU power 

supply has three possible inputs, 

which provides for a great deal of 

operational flexibility. Power can be 

provided upstream of RBIs 1 and 8, 

allowing either input power channel 

to supply an MBSU. Another MBSU 

can provide backup control power 

via RBI 6 to allow cross-tying as 

necessary if power was lost from 

both power channel inputs.
168 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

Power Buses

Power buses provide the physical 

mounting structure for Remote Power 

Control Modules (RPCMs) and 

provide access to command and data 

interfaces, power input and output 

connections, and cooling. They do 

not have any active components 

(i.e., no moving switches or gears) 

and only provide structural, thermal, 

power, and data support for RPCMs. 

The number of RPCMs in each 

power bus varies depending on 

power requirements in that particular 

location of the vehicle. Power buses 

were not designed to be replaceable 

and can be found both internally and 

externally on the ISS.

Remote Power Control Modules

The RPCMs are the interface 

between the EPS and all non-EPS 

equipment on board the ISS. Because 

RPCMs are the most numerous 

EPS devices on the ISS, and due to 

their direct interface to downstream 

loads, the crew and ground have 

the most interaction with these 

items. The distribution of secondary 

power to downstream loads can be 

controlled by opening and closing 

RPCs within the RPCMs. Protection 

of the EPS against downstream 

faults is accomplished by opening 

RPCs when too much current draw 

is detected. The RPCMs come in six 

different configurations, each with 

a different number of RPCs with 

different current ratings and currentlimiting capabilities. The type of 

RPCM used in any particular location 

depends upon the downstream load 

requirements. All RPCMs have the 

same housing and the same standard 

interface connectors, and can be 

located either externally or internally 

to the ISS.

Pointing Systems

To maximize the power generated by 

the solar arrays, the USOS EPS was 

designed with multiple articulating 

joints to allow the solar arrays to be 

rotated to point at and track the sun as 

the ISS orbits the Earth. Two separate 

kinds of rotary joints are used to 

position USOS solar arrays (Figure 8), 

due to the changing alpha and beta 

angles and the potential need to 

change ISS attitudes (see Chapter 7). 

SARJs

ß

ß

ß

ß

ßß

ß ß

α

α

BGAs

BGAs 

Rotation

SARJs 

Rotation

Figure 8. US Segment solar array angle rotation showing the rotation of the SARJ and the Beta Gimbal 

Assembly (BGA), as indicated. The BGAs allow the arrays to compensate for the β angle (see Chapter 

7, Figure 7), which changes slowly over the year. The SARJ nominally rotates 360° as the space station 

rotates around the Earth to always keep the solar cells facing the sun. This angle is called the “α” 

(alpha) angle. 

Solar Alpha Rotary Joints

The SARJs rotate the PVMs—entire 

truss segments—to provide alpha 

angle array pointing capability (i.e., 

when the ISS is in the nominal 

+XVV attitude). The port and 

starboard SARJs are located at the 

outboard end of the P3 and S3 truss 

segments, respectively, and provide 

360° continuous rotational capability 

to the segments outboard of P3 

and S3. The rotary joints normally 

complete one 360o revolution 

during each 90-minute orbit of the 

ISS around the Earth. Essentially, 

the SARJs are large gears rings 

with supporting bearings and drive 

motors. Each SARJ features two 

redundant control strings, one 

powered from each power domain. 

Each string consists of firmware 

controllers that include sensors to 

monitor the position and rotational 

speed of the SARJ, along with drive/

lock assemblies that house the motor, 

gear teeth, and locking racks used for 

positioning. See Figure 9.
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 169

UTA Inboard

Ring

Outboard

Ring

Figure 9. Photo of a SARJ. The SARJ consists of two rings, with a utility transfer assembly (UTA) on 

the axel and two drive/lock assemblies (not shown). The rings consist of teeth (see Chapter 18) that 

move like a bike chain on the gear sprocket. The drive/lock assembly is used to either turn the gear 

teeth or lock the ring in position. The UTA allows commands and telemetry as well as electricity to pass 

back and forth using a roller ball assembly, shown in Figure 10. 

A utility transfer assembly (UTA) is 

located at the center of each SARJ 

and provides the path for power and 

data transfer. The UTA has a roll ring 

structure, which consists of multiple 

stationary metal plates surrounded by 

rotating metal rings. Flexible metal 

rollers, called “flexures,” between 

each plate and ring maintain a 

continuous conducting path to pass 

electrical power or computer signals 

between the stationary plate and 

rotating ring. One plate-roller-ring 

set is required for each power or data 

connection that must pass through the 

rotating joint. These roll rings allow 

for 360o continuous rotation with 

seamless power and data conduction. 

See Figure 10.

Photo credit: McDonnel Douglas Image s07-17091

Stationary 

Plate 

Connection 

with Cable

Idlers

Stationary 

Plate

Flexures

Rotating Ring 

Connection

Rotating 

Ring 

Cable 

Passthroughs

Figure 10. Example roll ring. The gold stationary plate stays fixed while the outer section rotates. 

Part of a cable (black) is shown in one of the passthroughs on the inner stationary ring (the rotating ring 

connector is empty in this photo). Power or data is conducted through the metal flexures between the 

stationary and rotating rings to transfer electricity or data.

Photo: Courtesy of Robert C. Dempsey

Beta Gimbal Assemblies

The BGAs rotate individual SAWs 

to provide beta angle array pointing 

capability (i.e., when the ISS is in the 

nominal +XVV attitude). Normally, 

each BGA will rotate approximately 

±4o a day to compensate for the 

changing solar beta angle as the Earth 

orbits the sun. The BGAs provide the 

structural load path connecting the 

SAWs to the ISS truss structure while 

providing 360° rotational capabilities. 

They include roll rings for data 

and power transmission (similar to 

the SARJ UTA), a motor for SAW 

positioning, and two redundant 

anti-rotation latches for locking the 

BGA in specific positions. Software 

operates the BGA using multiple 

“modes.” The autotrack mode—the 

nominal mode—uses data from the 

Guidance, Navigation, and Control 

MDM on the relative positions of 

the ISS and the sun to calculate the 

angle that the BGAs should be moved 

to track the sun. The rate mode uses 
170 CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL

a commandable (i.e., set by the 

SPARTAN flight controller) velocity 

to rotate the array at a constant rate 

irrespective of the relative motion 

of the sun. Rate mode does not 

automatically track the sun, therefore 

reducing power generation. It is only 

used in special circumstances, such 

as verifying the rotational capability 

of the BGA or obtaining imagery of 

all sides of the SAW. The directed 

position mode uses a commandable 

position to fix the BGA at a specific 

angle. Once in position, a motor 

will hold the BGA at the command 

position by attempting to correct 

for any external forces (i.e., thruster 

plume impingement). In cases where 

visiting vehicles are docking, it is 

desirable to park the BGAs at a 

fixed position to minimize plume 

impingement but at the expense 

of generating power. However, in 

safety-critical situations (i.e., an 

EVA crew member working near 

the arrays), one of the anti-rotation 

latches can be used to mechanically 

inhibit BGA rotation. In manual free 

mode, the motor is disabled, thereby 

allowing free rotation of the gimbal 

assembly. This mode might be used 

following a BGA failure by allowing 

an EVA crew member to manually 

position the SAW for better power 

generation for repair.

Solar Array Constraints

The USOS solar arrays can be 

rotated into any position required 

to point at the sun—barring any 

shadowing from other hardware—

through the combined use of the 

SARJs and BGAs. After the ISS 

was completely designed, many 

constraints were applied to solar 

array positioning to protect the solar 

array hardware from damage. 

Thruster Plume Impingement—

Structural Loads and Array Erosion

Thrusters that control attitude on 

the ISS and visiting vehicles work 

by combusting fuel and oxidizer. 

The combustion products exit the 

thruster nozzle at a high speed, thus 

imparting a force on the vehicle in 

the opposite direction. The departing 

combustion products are known as 

a thruster plume. Thruster plume 

impacts, or impingement, on the 

USOS solar arrays, can have two 

effects—both negative. First, the 

thruster plume can impart a force on 

the solar array structure and cause 

bending and/or torsional loads. If 

these loads are too high, the solar 

array structure can be damaged. 

Second, if combustion products come 

in contact with solar cells, they can 

chemically or abrasively degrade the 

cells. This degradation would reduce 

the capability of the solar arrays 

to produce power. To combat the 

negative effects when the thrusters 

are firing, the USOS solar arrays are 

stopped and positioned facing edge 

on to, and as far as possible from, 

the thrusters. This reduces the forces 

imparted on the solar arrays and their 

exposure to combustion products. 

Many thruster plumes need to be 

avoided, especially when visiting 

vehicles arrive to or depart from the 

ISS, which creates a narrow range of 

acceptable locations for the USOS 

solar arrays. The less flexibility 

on solar array positions, the more 

power constrained the ISS, requiring 

load powerdowns to stay in energy 

balance. If the forces involved are 

high enough, the BGAs or SARJs 

(or both) may be mechanically locked 

into position to prevent inadvertent, 

perhaps plume-induced, rotation into 

a position that would risk damage to 

the solar array.

Longeron Shadowing

When the USOS solar arrays were 

deployed, some of the components 

combined to form four longerons that 

run the length the mast of each SAW. 

See Figure 4.

When a solar array is tracking the 

sun, each of the four longerons are 

exposed to sunlight. However, if 

the solar array is not tracking the 

sun (e.g., parked for thruster 

constraints) or if other equipment 

blocks the sun (i.e., during high 

beta), it is possible these longerons 

can become shadowed. Whether a 

longeron is in sunlight or shadow 

will change the temperature of the 

longeron and can cause it to expand 

(lengthen) or contract (shorten). If 

the longerons of a single array mast 

are unevenly shadowed (e.g., three 

longerons fully in the sun while one 

longeron is fully in shadow), this 

expansion and contraction can cause 

uneven tension and compression 

loads on the longerons. Analysis 

has shown that uneven shadowing 

for as few as 20 minutes can cause 

enough thermal loading differences 

to damage the mast.

When the constraints to prevent 

longeron shadowing and thruster 

plume impingement are combined, 

it can be very difficult to develop a 

solar array plan that protects solar 

array hardware while still producing 

enough power to meet the ISS needs.

These constraints came about mainly 

due to design changes from early 

space station concepts. The biggest 

design change that magnified these 

solar array constraints was the 

addition of Russia as an international 

partner. The USOS solar arrays were 

originally designed for the Space 

Station Freedom. When Russia joined 
SYSTEMS: ELECTRICAL POWER SYSTEM—THE POWER BEHIND IT ALL CHAPTER 9 171

the partnership, two major changes 

occurred in design modification from 

Space Station Freedom to the ISS that 

impacted the USOS solar arrays. First, 

the RS was added to the ISS design 

and included thrusters for vehicle 

attitude control. This eliminated 

the need for US Orbital Segment 

thrusters, which had been designed 

to limit plume impingement on the 

USOS solar arrays. The RS modules 

(and their associated attitude control 

thrusters) were based on elements 

of the Mir space station and did not 

take into consideration USOS solar 

array design or structural capabilities. 

Second, when Russia joined the 

ISS partnership, the inclination of 

the space station orbit was changed 

from 28o to 51.6o to make full use of 

Russian launch vehicle capabilities. 

This change in inclination also 

altered the beta angle range that the 

space station would see. At 51.6o 

inclination, the ISS would experience 

beta angles up to ±75o, which would 

cause times of no eclipses for days. 

In addition to exposing hardware to 

high temperatures at high beta angles, 

components of the ISS can cast 

shadows on other station equipment 

and thereby reduce solar power 

generation or create thermal gradients 

(i.e., longeron shadowing) that were 

not figured into the original design.

Another constraint that has been 

applied to the USOS solar arrays is 

their use in reducing (or increasing) 

atmospheric drag on the ISS. Even 

at the orbital altitude of the ISS, 

there is enough of an atmosphere for 

the large surface area of the USOS 

solar arrays to cause drag on the ISS, 

especially when facing the direction 

of motion. This drag, although small, 

adds up over time, thus lowering the 

ISS attitude and causing the need 

for reboosts (see Chapter 7). To 

combat this constraint, the software 

used to calculate solar array angles 

to track the sun allows for biases to 

be applied. Biasing the solar array 

position can turn it more edge on to 

the velocity vector to reduce drag. 

Of course, this also turns it away 

from the sun, thereby reducing power 

generation and potentially causing 

longeron shadowing. This constrains 

when and how much bias can be 

used. As the ISS software developed 

over time, this biasing strategy was 

automated, which subsequently 

reduced the workload for ground 

controllers. Although uncommon, 

this strategy has occasionally been 

reversed to increase drag on the 

ISS to meeting visiting vehicle 

phasing constraints, as discussed in 

Chapter 14 (i.e., being in the right 

place at the right time for rendezvous 

or departure) without needing to burn 

propellant to deboost the ISS.

Conclusion

Operating the largest orbital solar 

power platform has been challenging, 

yet highly successful. Many design 

decisions and design changes have 

driven the need for automated 

software control and sophisticated 

analysis tools. The SPARTAN team 

continuously plans and adjusts 

EPS configurations to protect the 

ISS hardware and maintain power 

availability to critical systems and 

scientific payloads. The team must 

also be ready to respond to system 

failures or maintenance by adjusting 

plans or rerouting power—or both. 

Working with the ISS Program and 

engineering experts, SPARTAN will 

continue to maintain the ISS EPS 

in support of the crew, scientific 

research, and ultimately exploration.

Chapter 10 Day in the Life:

Preparing for 

the Unexpected
174 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

A close-up of the Node 2 module (center), one of the areas where toxic ammonia can leak into the habitable volume of the International Space Station.

At 2:49 a.m. Central Standard 

Time, a red alarm illuminated the 

giant front wall display in Mission 

Control in Houston. The alert read: 

TOXIC ATMOSPHERE Node 2 LTL 

IFHX NH3 Leak Detected. 

The meaning was clear. Ammonia 

was apparently leaking into the 

Interface Heat Exchanger (IFHX) of 

the Low Temperature cooling Loop 

(LTL) in the Node 2 module.

“Flight, ETHOS, I expect the crew to 

be pressing in emergency response 

while I confirm,” said the flight 

controller from Environmental 

and Thermal Operating Systems 

(ETHOS). In other words, the crew 

needed to don oxygen masks to 

protect themselves from ammonia 

while ETHOS looked more closely at 

these data.

This was not a drill. When the red 

alarm appeared, the flight director 

turned her full attention to 

ETHOS. The words—unwelcome 

at any time from ETHOS—were 

especially jarring at an hour when the 

crew and the ground were humming 

along on a busy day of running 

experiments. Of the many failures 

for which the flight control team 

prepares, especially in simulations, 

this failure presents one of the most 

life-threatening situations, and one 

the team never wants to encounter on 

the actual vehicle. 

On January 14, 2015, this scenario 

happened on the International Space 

Station (ISS). Data on the ETHOS 

console indicated toxic ammonia 

could be bleeding in from the 

external loops, through the waterbased IFHX, and into the cabin (see 

Chapter 11). Software on the ISS 

immediately turned off the fans and 

closed the vents between all modules 

to prevent the spread of ammonia. 

At the sound of the alarm, crew 

members immediately began their 

memorized response of getting to 
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 175

the Russian Segment (considered a 

safe haven, since that segment does 

not have ammonia systems) and 

closed the hatch that connected to 

the United States On-orbit Segment 

(USOS). They took readings with a 

sensitive sensor to determine the level 

of ammonia in the cabin. The flight 

control team—especially the flight 

director, ETHOS, and the capsule 

communicator (CAPCOM [a holdover 

term from the early days of the space 

program])—waited anxiously for the 

results while they looked for clues 

in the data to see how much, if any, 

ammonia was entering the cabin. 

Already, the flight director anticipated 

multiple paths that the crew and 

ground would take, depending on the 

information received. 

No ammonia was detected in the 

cabin of the Russian Segment. 

At the same time, flight control 

team members looked at multiple 

indications in their data and did not 

see the expected confirming cues of 

a real leak. In fact, it was starting 

to look as if an unusual computer 

problem was providing incorrect 

readings, resulting in a false alarm. 

After looking carefully at the various 

indications and starting up an 

internal thermal loop pump, the team 

verified that no ammonia had leaked 

into the space station. The crew 

was not in danger. After 9 hours, 

the flight control team allowed 

the crew back inside the USOS. 

However, during the “false ammonia 

event,” as it came to be called, 

the team’s vigilance, discipline, 

and confidence came through. 

No panicking. Only measured 

responses to quickly exchange 

information and instructions. 

Hearts were pumping rapidly, yet 

onlookers would have noticed little 

difference from any other day.

A key to the success of the ISS 

Program is that it is operated by 

thoroughly trained, well-prepared, 

competent flight controllers. The 

above example is just one of many 

where the team is unexpectedly 

thrust into a dangerous situation 

that can put the crew at risk or 

jeopardize the success of the 

mission. Both the flight controllers 

and the crews, often together, 

take part in simulations. Intense 

scenarios are rehearsed over and 

over again so that when a real 

failure occurs, the appropriate 

reaction has become second nature. 

After these types of simulations, 

team members might figure out a 

better way to do something, and 

then tuck that additional knowledge 

into their “back pocket” in the 

event of a future failure. Perhaps 

the most famous example of this 

occurred following a simulation 

in the Apollo Program. After the 

instructor team disabled the main 

spacecraft, the flight controllers 

began thinking about using the lunar 

module as a lifeboat. When the 

Apollo 13 spacecraft was damaged 

significantly by an exploding 

oxygen tank, the flight control team 

already had some rough ideas as 

to what they might do. Since the 

scenario was not considered likely 

owing to all the safety precautions, 

the team had not developed detailed 

procedures. However, the ideas 

were there.

This chapter takes the reader into 

parts of a simulation to illustrate how 

the process really works. Material 

from Chapters 11 and 19 are heavily 

referenced in this section. 

Training

By the time a flight controller is ready 

to sit in the Front Control Room, he 

or she has already undergone years 

of training. Generally, the team is 

made up of engineers. Positions and 

degrees are highly correlated (e.g., 

an electrical engineer supports the 

power systems, a computer scientist 

might support the computer systems); 

however, this configuration is not 

strictly required. Math and English 

majors, and even astronomers, serve 

as flight controllers. Initial training 

provides general knowledge of 

spaceflight operations, the vehicle, 

visiting spacecraft, the NASA 

organization, how to work with 

international partners, and even how 

to conduct meetings. Flight controller 

trainees participate in computerbased training and classroom 

lessons, as well as read manuals 

and instruction books. After initial 

technical expertise is achieved, the 

flight controller in training takes 

lessons on a Flight Controller Part 

Task Trainer (Figure 1). These small 

simulators mimic the telemetry 

generated for an individual system 

in a stand-alone fashion. A Station 

Power, ARticulation, Thermal, and 

ANalysis (SPARTAN) trainee, for 

example, will focus exclusively on 

power system displays and telemetry. 

This allows the student to see how 

his or her system will respond to 

commands or failures. For example, 

the trainee may execute a procedure 

while seeing how the real vehicle 

(i.e., the ISS) will react. 

Once the basic system knowledge is 

mastered, the flight controller starts 

supporting mini simulations (mini 

sims) as a team (Figure 2). In a mini 

sim, most of the ISS core functions 
176 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

are simulated by computers. The 

team works through various short 

scenarios (usually failures) to learn 

how to communicate crisply, resolve 

problems quickly, and to determine 

how to resume a particular task 

or mission. For example, a power 

failure in the electrical system 

will unpower equipment used by 

all the other systems. In the mini 

sim, the team will learn to identify 

the signature and communicate a 

recovery plan with the flight director, 

who might actually be an instructor 

playing the role.

Personal photo courtesy of Robert Dempsey

Figure 1. A student using the Part Task Trainer simulator. The student’s displays and data will mimic 

the real ISS in his specific system. 

Personal photo courtesy of Robert Dempsey

Figure 2. A team of operators practice working as a team in a mini sim. The instructor (far left) runs the simulation while also playing the role of the flight 

director, CAPCOM, ISS crew, and international partners. 

After mastering this, the students will

support full integrated simulations, 

where the purpose is to stay on the 

timeline as everything possible fails—

on purpose. While operators rarely 

see the same level of failures on the 
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 177

real vehicle, this training teaches the 

flight controllers how to work as a 

team to solve problems often never 

anticipated, and how to work under 

pressure. While the flight controllers 

will learn the signature and responses 

of specific failures, the simulations 

also train them to approach a problem, 

should they not understand the 

signature they are seeing. More often 

than not, real failures in space are not 

anticipated or completely understood 

when first encountered. In the 

ammonia leak case discussed above, 

the failure that caused the signature 

was never anticipated. In fact, it was 

believed to be a failure mode that was 

not even credible or likely. Therefore, 

the team had to decipher the unusual 

signature in their data and figure out 

what to do in real time. 

An instructor, a senior flight 

controller in the group, or the 

student’s manager will evaluate 

each student through every phase. 

Several key areas are reviewed. One 

area is that of problem recognition. 

Identifying a failure and its impacts, 

especially within another system, can 

be difficult with complex systems 

and a large amount of data. Known 

failures have clear alarms, but what 

could have caused a box to fail may 

require some sleuthing. Other areas 

include mission cognizance (how the 

flight controller fits the failure into 

the bigger picture), communications, 

console management (how team 

members organize their data, logs, 

tools, and displays), and team 

interactions (either with other flight 

controllers or their own back room 

support). Even the student’s attitude 

is evaluated since someone who gets 

easily stressed or discouraged is not a 

good person to have on the team. 

After successfully completing 

the simulations and passing an 

evaluation by the flight director, the 

flight controller begins sitting on 

console under the watchful eye of an 

experienced operator in what is called 

on-the-job training. When the flight 

controller is considered ready, the 

“training wheels” are removed and he 

or she is certified as an operator—i.e., 

the first level of certification. That 

person can perform routine duties on 

console and respond in an emergency. 

For all systems except ETHOS, 

this generally means verifying that 

the software has reconfigured the 

systems automatically in response 

to the failure and then notifying 

an expert of the situation to obtain 

further direction. For ETHOS, the 

operator also supports the three 

big emergency responses on the 

ISS—fire, atmosphere leak, and 

toxic chemical spill—by leading 

the crew and flight control team 

through the associated procedures 

(see Chapter 19). For serious failures 

or complex operations, a more-senior 

controller (i.e., a specialist) who has 

undergone additional training and 

certification will support the console. 

Since training is so critical to the 

success of operations, the trainers 

(i.e., instructors) are part of the 

operations group and even support the 

console positions. This blending of 

operator/specialist/instructor ensures 

training is as accurate as possible. 

Once certified, flight controllers, 

instructors, and flight directors all 

must continue to perform proficiency 

training and evaluation to ensure they 

remain at peak performance levels. 

Flight directors are generally selected 

from seasoned flight controllers. As of 

December 2015, 91 individuals have 

been certified NASA flight directors.

After all the generic training is 

complete, the controllers may be 

assigned to specific missions, such 

as an assembly mission (during the 

Space Shuttle era), a visiting vehicle 

(Soyuz or cargo flight), a software 

uplink, or a spacewalk. The assigned 

team will generally conduct flightspecific simulations in that unique 

timeline or activity. Complexity of 

the timeline determines the number 

of simulations, with the shuttle 

assembly missions having been on 

the high end with about a dozen, not 

counting numerous ascent and entry 

simulations with the crew.

To illustrate the nature of this critical 

training, this chapter walks the 

reader through parts of a particular 

training session. The following is the 

transcript of real voice loop data in 

the Mission Control Center (MCC) 

recorded on April 24, 2013, during a 

generic simulation. 

Approximately 1 hour prior to the 

start of the event reflected in this 

transcript, the US Lab 1 Multiplexer/

DeMultiplexer (LA-1 MDM) 

experienced a failure such that it 

could no longer pass data to the 

Primary Command and Control 

MDM (see Chapter 5). Many impacts 

to the loss of communication to the 

LA-1 MDM occurred. A particularly 

important impact was that almost 

all insight into the performance of 

the LTL, which provided cooling 

to critical internal systems within 

the Laboratory Module, was lost 

(see Chapter 11). The Lab thermal 

system can be operated in dual mode 

or single loop. In dual mode, the 

LTL and the Moderate Temperature 

Loop (MTL) operate independently, 

each with its own pump. In single 

loop, the two segments are joined, 
178 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

and one pump—either the Moderate 

Temperature (MT) or the Low 

Temperature (LT)—pushes fluid 

around the entire system, which 

is called Single MT or Single LT, 

respectively. This is significant 

because, at the time of the failure, 

the US Lab internal active Thermal 

Control System (TCS) was in Single 

LT mode, meaning one water pump 

on the LTL was performing all of 

the heat transport of cooling water 

to US Lab systems. The LTL pump 

remains running in the event of an 

LA-1 MDM failure as several key 

pump performance parameters are 

being reported to and controlled by 

a different MDM. However, loop 

pressure, flow, temperatures and, 

most importantly, pump accumulator 

quantities, are lost. The pump 

accumulator quantity is especially 

important because a sudden decrease 

in accumulator quantity indicates 

that cooling water is leaking out of 

the system. If the leak is not stopped, 

enough water will be lost to cause 

the cooling loop to fail and critical 

equipment to overheat. A sudden 

increase in accumulator quantity 

indicates that another fluid is being 

injected into the system. Given the 

way in which the internal cooling 

loop is plumbed, the only possible 

fluid that could be injected into 

the system is the 100% anhydrous 

ammonia that is used as a coolant for 

ISS external systems. The ammonia 

and water come into thermal contact 

to exchange heat, but are kept 

separate from each other at the 

IFHX (see Chapter 11). This grade 

of ammonia is fatal to humans, even 

in small quantities. Also, one of two 

redundant Internal Audio Controllers 

(IACs), which route all on-board 

voices to different destinations, 

failed prior to the simulation start in 

what is known as an initial condition 

of the simulation. Another initial 

condition was that the External 

TCS (ETCS) Loop B experienced 

a transient failure, which shut the 

pump down.

Communications

One of the most critical skills that a 

flight control team needs to exercise 

is communication. Owing to the 

complicated, often time-critical 

nature of spaceflight, a specific 

shorthand and cadence was developed 

to facilitate communication between 

the various controllers, the flight 

director, and the crew. Flight 

controllers in Mission Control 

communicate over loops, which 

is nothing but a dedicated phone 

line, so to speak, between parties. 

Typically, each person must listen 

to more than a dozen of these voice 

loops at the same time. Using a 

headset, a flight controller plugs 

into the system to hear the calls that 

are defined on a computer panel. 

There are literally thousands of 

loops from which to choose, but 

each person usually monitors only 

a small subset. Conversations can 

occur simultaneously on all the 

loops during busy times. Sometimes 

the flight controller needs to follow 

along with only a few, but at other 

times he or she may need to directly 

participate in the discussion. Learning 

to process all these simultaneous 

conversations is a key skill the flight 

controllers have to master.

Calls between controllers begin 

with the name of the person being 

called, followed by the position 

that is making the call. For 

example, “SPARTAN, CRONUS 

on SYS COORD” indicates that 

the SPARTAN controller is calling 

Communications Rf Onboard 

Network Utilization Specialist 

(CRONUS) on the voice loop 

called SYS COORD, which stands 

for Systems Coordination. When 

CRONUS hears this, he or she will 

talk directly to SPARTAN. The most 

critical loop is the FLIGHT loop, 

which is owned by the flight director. 

In a real sense, this is the “king” of 

loops and everyone in every control 

center around the globe always has 

to monitor this critical loop. The 

only other special loop is the Spaceto-Ground (S/G) loop. Only the 

CAPCOM talks to the astronauts on 

this loop. Since an astronaut’s time 

is so critical and communication can 

be limited, everyone is required to 

stop talking during a call from the 

CAPCOM to the astronauts, or vice 

versa. This prevents the ground from 

talking over and therefore missing 

an important item, or making it 

necessary for the crew members to 

repeat themselves.

A key part of this communication 

training is to learn how to talk 

concisely. Unlike an office meeting 

where employees can take all the time 

necessary, discussions in Mission 

Control are usually time critical. If 

the discussions are not time critical, 

they are still kept to a minimum 

since everyone is monitoring 

multiple loops. Another way to keep 

communications crisp is to add a brief 

phrase to explain why the person is 

calling. This is indicated by stating 

“for” followed by what the call is 

about, thus allowing the receiver 

to prioritize and prepare for the 

discussion. Following is an example 

of a simple exchange during that 

simulation. NOTE: The transcript 

has been edited for readability. The 
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 179

italicized information within the 

square brackets helps explain or 

clarify what is going on or what is 

meant by a particular acronym, word, 

or statement, but it is not part of the 

actual transcript.

CRONUS: FLIGHT, CRONUS, for the 

IAC. [This is CRONUS calling the flight 

director about the previously failed IAC. 

Since the FLIGHT loop is the key loop, 

its name generally does not need to 

be used.]

FLIGHT: CRONUS, FLIGHT. [The flight 

director is acknowledging the call and 

indicating that she is ready to talk to the 

CRONUS operator.]

CRONUS: Yes, FLIGHT, so when we 

saw the IAC failure, we were initially on 

IAC 2. Audio FDIR [Failure Detection 

Isolation Recovery, an automated 

recovery algorithm, see Chapter 5]

swapped us over to IAC 1. That swap 

was not successful, and then it brought 

us back up on IAC 2. So in order to 

clean up and recover voice, I ran 

Ground Avionics procedure 2.311, just 

blocks 1 and 2 which basically covers 

inhibiting Audio FDIR and reconfiguring 

[voice loop configuration] calls. I’d 

like to continue to press through that 

procedure. Normally you’d run this 

procedure to power up the failed IAC 

and check it out but since we started 

up on IAC 2 and it looks healthy, since 

we are back on IAC 2 now, I’d like to 

actually power up IAC 1, which is the 

one we weren’t able to recover on, and 

see if I can see any issues with that.

FLIGHT: Ok, I concur, you’re go.

CRONUS: Copy. [Shorthand for “I hear 

and understand you.”]

SPARTAN: FLIGHT, SPARTAN, for 

status.

FLIGHT: SPARTAN, FLIGHT. [i.e., “Go 

ahead, I’m listening.”]

SPARTAN: FLIGHT, the pump is back 

up and running. At this point I am 

ready to re-integrate the interface heat 

exchangers [the automated response 

from an external pump failure is to 

isolate the external ammonia loop from 

the heat exchangers that transport heat 

from the internal water cooling loops 

in the various modules to the external 

ammonia loops], beginning with 

Node 2, Node 3, IPs [referring to the 

Japanese and European ISS modules], 

then Lab.

FLIGHT: I’m sorry, say again, pump is 

running, then what?

SPARTAN: The loop Bravo pump is 

up and running, at this point I am 

ready to re-integrate the interface heat 

exchangers, beginning with Node 2, 

going to Node 3, then the IPs, then 

the Lab.

ETHOS: And FLIGHT, ETHOS, I copy, 

and whenever the heat exchangers 

are re-integrated a lot of times we get 

a little bit of overshoot, and there’s a 

potential for some undertemp [i.e., too 

cool] messages on the board but that 

should level off pretty quickly. There’ll 

be no action [by crew or ground] for 

those once we are integrated.

FLIGHT: Copy. 

[Shortly after SPARTAN completed his 

commanding, a caution-and-warning 

message was displayed to the ground 

and the crew about an undertemp in 

the TCS]

ETHOS: And FLIGHT, ETHOS that 

enabled caution was what I was talking 

about, no action for the crew.

CAPCOM [on the S/G-1 loop]: Station, 

Houston, on 1, no action for the TCS 

caution. That was expected. 

ISS CREW [on the S/G-1 loop]: 

Copy Houston, no action for the TCS 

caution, thanks. 

The People Behind 

The Curtain

The simulator—basically a series 

of computers that can emulate the 

behavior of ISS systems and the 

space environment—is a powerful 

tool. When a student is in the training 

control room, the data on his or her 

computer screen or console will 

look exactly like it would if it were 

the actual space station in orbit. 

SPARTAN, for example, can watch 

the solar arrays rotate as sunlight is 

converted to electricity and routed 

around the ISS until the station 

orbits into the Earth’s shadow and 

the batteries begin supplying all the 

power needed. With the flick of a 

wrist, the simulation team can fail a 

bus or converter. However, the key 

to the simulation is the training team 

that operates it. This team is led by 

the Chief Training Officer (CTO), 

who is essentially the flight director 

of the training world. 

Scenarios developed by the training 

team depend on the type of simulation 

being conducted. As the name 

implies, generic simulations focus 

on general skills of the team—i.e., 

communication, coordination, and 

problem resolution. In these types of 

simulations, the training team will 

induce a failure that impacts multiple 

systems. For example, a power bus 

may fail, which can affect every other 

group. Due to the robust redundancy 

of most ISS systems, these types 

of failures usually result in the 

flight control team learning how to 

reconfigure the operating systems 

(e.g., activating the redundant unit), 

troubleshoot the failed one, and 

recover the failed system, if possible 

(e.g., reboot the computer if that 

is the issue). At all times, the team 

must try to keep the planned events 
180 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

(e.g., the spacewalk) continuing as 

scheduled. Flight-specific simulations 

are focused on a particular upcoming 

event wherein the actual team 

members who will execute the event 

train together. Generic simulations 

are populated with people at various 

levels of training.

Personal photo courtesy of Robert Dempsey

Figure 3. The training team, led by CTO William Frank (green shirt) in their own Mission Control-like facility. A computer generates the fake ISS data that the 

flight controllers see in Mission Control. The training team is also looking at these fake data. However, unlike the flight controllers, the instructors can inject 

failures into the simulation at the stroke a mouse click. For example, they can make a pump suddenly overheat and fail, or make a computer start generating 

erroneous messages. 

Failure scenarios can become fairly 

complicated. One or two system 

failures may not be much of an 

impact to the operations; however, 

they can combine to cause significant 

constraints or vulnerabilities to an 

additional failure. For example, 

consider a module that has two 

internal thermal control loops and 

two power strings: A and B. Thermal 

pump A is on power string A; thermal 

pump B is on power string B. If 

power string A fails, string B is used. 

Now, thermal pump B becomes more 

critical. Should anything happen with 

the thermal loop (e.g., the pump fails) 

or if power string B is interrupted, all 

cooling to that module will be lost. In 

this type of scenario, the team will try 

to anticipate the next-worse failure 

after the first failure. Thus, when 

string A goes down, the team will try 

to anticipate what to do to best protect 

the vehicle for the next failure. In this 

example, the team might get a power 

jumper ready to reactivate pump A by 

plugging it into the B system.

The training team spends a significant 

amount of time learning the systems, 

the timeline, and the objectives in 

preparation for a simulation. This 

research may involve going into the 

simulator, testing failures, and seeing 

how the software responds. Not 

only does this help lead to a realistic 

simulation, on many occasion real 

software bugs have been caught 

before being loaded onto the actual 

vehicle. Several weeks in advance 

of a simulation, the CTO will lead 

development of a script for the run. 

The script defines what failures will 

occur, and when and what the training 

team anticipates the flight control 

team will do in response. Sometimes, 

however, the flight control team will 

make a decision, either in error or 

on purpose, and choose a different 

response than anticipated. In this 

case, the training team will conduct 
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 181

the rest of the simulation “on the 

fly,” adapting to the team. In cases 

where the flight control team has not 

realized the impacts of some failures, 

the CTO will call for inserting that 

very failure for the purpose of driving 

home the lesson of missing these 

types of cases. Such was the case 

on the April 24 simulation, when 

the CTO decided to drive home the 

criticality of the problem with the 

LA-1 MDM that the inexperienced 

flight controllers were missing.

The training team will continue to 

stack failures to force the team to 

think of options and prepare for 

the next failure. In a simulation 

(Figure 3), another failure will 

always occur. By being constantly 

hit with numerous failures, the 

flight controllers can see how the 

interconnectedness of the systems 

works. Students also become 

confident and comfortable around 

the failures so that when they happen 

on the real vehicle, they can say, “I 

know this.” 

ETHOS: [ETHOS is leading the team in 

procedure 4.111 ECLSS (Environmental 

Control and Life Support System)/

ITCS (Internal Thermal Control 

System)/PTCS (Passive Thermal 

Control System) RECONFIGURATION 

FOR LAB1 MDM TRANSITION OR 

FAILURE.] In my mind the next critical 

item would be step 2.3, moding my Lab 

ITCS [Internal TCS] to Single MT [the 

MT loop running with a single pump] 

because in the current state right now 

we’re basically buying into the risk of 

a next failure, we don’t have any leak 

detection, for both ammonia and water 

leak detection.

FLIGHT: Ok, so do you want to go 

ahead and execute that step before you 

assess the LA-1 MDM failure?

ETHOS: FLIGHT I don’t think the 

conversation will take too long, about 

our forward path, whether we just 

troubleshoot really quick or stay in this 

configuration. 

FLIGHT: Alright, you have a couple 

minutes.

ETHOS: Copy FLIGHT.

CRONUS: FLIGHT, CRONUS, for IACs.

FLIGHT: CRONUS, FLIGHT.

CRONUS: Yeah FLIGHT my command 

was not successful so I’ve powered off 

IAC 1, and I’m thinking about why we 

got that signature when we powered 

it up.

FLIGHT: Ok, ETHOS and CRONUS, 

LA-1 MDM, you guys are talking about 

it, so what’s the thought on it?

ETHOS: Alright FLIGHT, so, yes, I 

have discussed this a little bit with my 

specialist as well, and I tagged up with 

CRONUS, and my recommendation 

right now is that we hold off on any 

type of trying to regain the LA-1 MDM 

right now and I will just put the rest 

of my steps per that 4.111 procedure 

in work. My rationale here is that 

my Lab P6 CCAA [Laboratory Port 6 

Common Cabin Air assembly], the one 

that’s associated with this MDM is 

still running, however I have no insight 

into it, if we do the troubleshooting it 

would take my CCAA back down and if 

we’re not successful with it that CCAA 

down. That currently is the CCAA that 

is having condensate collection and 

we normally like to dry out our CCAAs 

before we shut them down. So after I 

configure all my stuff to safe with the 

LA-1 down, I would work a plan to 

try and swap that condensate over to 

another module, most likely we’d like 

the condensate to condense in Node 

3. So, those are the actions I’d look for, 

and swapping the condensate takes a 

little while. So, there’s that action, as 

well as, we’d eventually like to do that 

anyway, to get on our S6 CCAA to have 

good insight into it. 

FLIGHT: Ok, understand. 

CRONUS: FLIGHT, CRONUS.

FLIGHT: Ok, so at that point ETHOS, 

when you do all that reconfiguration, 

you’d like to CRONUS to do the LA-1 

MDM troubleshooting?

ETHOS: Yeah, as soon as we get 

condensation, and we’re comfortable, 

making sure that that CCAA is dry.

FLIGHT: Ok, understand.

ETHOS: As far as impacts, if for some 

reason we get forced our hand we can 

do it earlier, it’s not the worst thing in 

the world, but..

FLIGHT: And so, what’s the estimate 

time for that? A shift, two shifts, how 

much time do you need for all that?

ETHOS: I would say at least the rest 

of my shift and [the next] shift FLIGHT, 

and if we can withstand holding off any 

troubleshooting till tomorrow that would 

be plenty of time to make sure we’re 

dried out on that Lab CCAA.

FLIGHT: Ok, CRONUS, your input?

CRONUS: Yeah, FLIGHT, CRONUS, I 

concur with ETHOS’s recommendation. 

There isn’t a rush to powercycle 

[rebooting a computer often can 

recover it just as on the ground with 

a laptop or desktop] the LA-1 MDM. 

We need to look at it a little bit more 

obviously we don’t want to be running 

in this configuration with the MDM 

in Min Ops without any insight into it 

indefinitely, but if it, we’re definitely 

fine with it staying here in order for him 

to get into configuration. [Min Ops, or 

Minimum Operations, is a mode of the 

MDM that keeps it running some basic 

functions even though it is not receiving 

direction from the computer above it.]
182 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

FLIGHT: Ok, in the meantime do you 

already know what your troubleshooting 

plan would be, or...

CRONUS: Yeah FLIGHT with it being 

loss of comm [meaning the Internal 

MDM cannot talk to the LA-1 MDM]

the only thing we can do is to try to 

power cycle the MDM. I don’t have the 

specific procedures for you yet but I 

can get those for you if you’d like and 

put the whole plan together in a flight 

note [a text document that can be read 

and reviewed by the entire team].

FLIGHT: Yeah let’s go ahead and get 

that in work so that you have another 

shift to take a look at it.

CRONUS: Wilco. [Short for “will 

comply.”]

The Emergency

The team works through various 

failures for several hours (Figure 4). 

Each failure represents a singular 

problem for that particular flight 

controller and his or her system. The 

flight director, however, keeps track of 

all the failures and pays close attention 

to the overall picture with the goal 

of trying to complete the planned 

activities with minimal impact. While 

each controller may be dealing with 

one or two individual problems, the 

flight director is tracking issues with 

six to nine systems. Flight’s role has 

often been compared to the Chinese 

acrobat balancing spinning plates on 

long sticks. However, as challenging 

as these individual failures are, 

the most-critical issues facing the 

team are these emergencies: fire, 

rapid depress, and toxic atmosphere 

(see Chapter 19). Therefore, the 

trainers frequently push the team 

further with a major emergency, 

often after an exhausting round of 

system failures. After several hours, 

the situation turned very serious 

when an emergency alarm—TOXIC 

ATMOSPHERE – MANUAL 

ALARM – LAB—appeared, in red, 

on the big caution-and-warning 

display in the front of the control 

room. This meant the crew detected a 

toxic spill, possibly ammonia, in the 

Laboratory module.

ETHOS: FLIGHT, ETHOS, I see the 

toxic atmosphere alarm.

CAPCOM [on the S/G-1 loop]: Station, 

Houston, on 1, we see a manual 

toxic atmosphere alarm, can we get a 

status when you can? [No response 

from the crew.]

ETHOS: FLIGHT, ETHOS.

FLIGHT: ETHOS?

ETHOS: Like I said my Lab ITCS due 

to the LA-1 MDM, I have lost insight 

into any type of potential ammonia 

leak. In this case FLIGHT I’d expect 

that the crew is doing their emergency 

response but for the team here on 

the ground we’re going into EMER1 [the initial emergency response 

procedures, also known as the “Red 

Book”] procedure 3.3.

CAPCOM [on the S/G-1 loop]: Station, 

Houston, Space to Ground 1, we 

assume you have pressed the manual 

alarm button for an ammonia release, 

and we are in 3.3, Emergency 3 

decimal 3, for ammonia release. That 

is our assumption.

CRONUS: FLIGHT, CRONUS.

FLIGHT: CRONUS, FLIGHT.

CRONUS: I’d like to get a go for 

emergency comm config [shorthand 

for communications configuration, this 

procedure ensures that all voice loops 

can be heard in as many ISS modules 

as possible].

FLIGHT: You’re go.

CRONUS: In addition I’m going to 

work on bringing up the PTR [Port 

Thermal Radiator] MDM as SPARTAN 

could need it for emergency response. 

[The PTR MDM is required if the 

SPARTAN has to lock the arrays in a 

specific position.]

FLIGHT: Concur.

ETHOS: FLIGHT, ETHOS.

FLIGHT: Go.

SPARTAN: SPARTAN concurs.

ETHOS: FLIGHT, ETHOS.

FLIGHT: Go ahead.

ETHOS: There’s an action I want to 

do anyway but I’d like a go to transition 

my Lab ITCS to Dual [mode]. I’ll get 

better insight.

FLIGHT: You’re go.

ETHOS: Copy FLIGHT.

FLIGHT: Ok, let’s see, GC, you can go 

ahead and call Spacecraft Emergency. 

[This is a protocol that the Ground 

Controller (GC), who is responsible 

for the MCC infrastructure as well as 

interface to the NASA Space Network, 

invokes with the Space Network to 

make sure the ISS gets all available 

satellite communications assets 

and bumps other users from using 

those assets.]

GC: FLIGHT, GC, I copy.

CRONUS: FLIGHT, CRONUS, 

emergency comm config is in place.

FLIGHT: Copy.

ETHOS: And FLIGHT, ETHOS, I do 

see a positive DP/DT [shorthand for 

delta atmospheric pressure increasing 

over delta time, meaning something is 

coming into the pressurized volume] 
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 183

Figure 4. A team of operators performs a simulation (different than the one discussed in the text) under the direction of Flight Director Courtenay McMillan 

(Tranquility Flight, bottom left). The simulation control room, formerly used for conducting Space Shuttle missions, is set up exactly like the main ISS flight 

control room (see Introduction). 

into the cabin, so this is an ammonia 

leak, it is leaking into the US Segment.

GC: Two minutes to a TDRS handover. 

[This means that link with the Tracking 

and Data Relay Satellite (TDRS) is 

swapping from one satellite to another 

as the ISS orbits the Earth, and there 

will be a brief loss of communications 

until the radio link is established on the 

other satellite. During an emergency, 

it is critical for the team to understand 

when the ground does or does not have 

a communication link with the ISS.]

ADCO: FLIGHT, ADCO per rule B2-359 

we need to enable auto-handover 

to the Russians. [The Attitude 

Determination and Control Officer 

(ADCO) is quoting a flight rule that 

indicates that if there is a chance the 

gryoscopes will not be able to maintain 

the control of the ISS, “auto handover” 

should be enabled. Auto handover 

is the process by which the US and 

Russian attitude control systems can 

take and give control to each segment. 

In the case of an ammonia leak into 

the cabin, an action that the team can 

take to mitigate danger to the crew is to 

vent the ammonia in the external loops 

overboard, which is a sufficiently large 

enough propulsive force on the ISS that 

the US control moment gyroscopes 

cannot maintain attitude control and, 

therefore, Russian thruster control 
184 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

“Well that can’t be right . . .” 

Captain Barry “Butch” Wilmore, Expedition 41 and 42

“It was January 14, 2015. There I was in the corner of 

Node 2, completely focused on the highly classified and 

highly volatile secret government experiment attached 

to the Maintenance Work Station before me, when all 

of a sudden . . .” 

If I were writing a novel or memoir, I might take the liberty 

to embellish the details a bit, as I did in the preceding 

sentence. Instead of working on a “highly volatile secret 

government experiment,” however, I was floating in the 

overhead of Node 2, digging through a 1.0 cargo transfer 

bag where my excess clothing was stored, trying to find 

some clean skivvies—that’s Navy speak for underwear—

when all of a sudden . . .

OK, it wasn’t sudden either. It was just the emergency 

warning tone. I say “just” because we’d had several of 

them in the preceding days. All of the warnings turned 

out to be false alarms as several of the highly sensitive 

sensors, which detect smoke in both the Russian 

Segment and Node 3, had annunciated. None of them 

had actually been smoke or fire—just dust kicked up by 

work that was taking place in the vicinity of the sensors.

As the current station commander, I reminded the crew 

that one false alarm, or even several, does not mean that 

the next one will be false too. We had to maintain our 

vigilance and treat every emergency as real, and keep 

stepping through our memorized procedures. With this in 

mind, when the tone annunciated waaank whoop waaank

(it’s difficult to describe a tone on paper), I stuffed my 

skivvie bag back into my clothing cargo transfer bag and 

quickly floated to the emergency panel, where I expected 

to see another “Fire” caution light. The only other lights 

are: “∆P/∆T”, which is short for cabin depress or leak; and 

“TOX”, which is short for an ammonia leak (Chapter 19).

On Earth, a bit of ammonia in cleaning solution disinfects 

and helps get rid of tough kitchen stains, leaving that 

clean smell. The ammonia on station, however, interacts 

with water loops, which cycle inside of station and 

pick up heat. The loops then transfer that heat into 

the ammonia that flows to radiators on the outside of 

station, which dispel the heat into the vacuum of space 

(Chapter 11). The smell of ammonia, which should be 

outside the station, means it has found its way inside 

the station. Even brief exposure could mean returning 

to Earth as special cargo rather than as a crew member. 

Thus, when I finally focused on the emergency panel and 

saw “TOX” illuminated, my initial thought was, “Well, that 

can’t be right. We’ve never had that emergency on the 

ISS because that means . . . ammonia!” That thought 

lasted about a nanosecond as the next thing I knew I was 

yelling, “Masks!” 

Without any of us even being aware, the training we’d 

gone over and over and over for years kicked in. Russians 

don’t use ammonia to dispel heat, so if we could get there 

and close the hatch, we could isolate ourselves from the 

potential toxic environment brewing in the US Segment. 

With protective mask in place, I grabbed two of my 

incapacitated crew members, quickly put masks on them, 

strapped them to my back, and continued translating 

toward the Russian Segment . . . 

OK, I didn’t do that either. Each crew member immediately 

donned protective masks and began translating 

toward the Russian Segment, thus implementing the 

memorized response.

Via procedure, I ensured all personnel were on the 

Russian side of the Node 1 Aft Hatch before beginning 

the process of closing the hatch and thereby isolating 

ourselves from the US On-orbit Segment. As I locked 

the hatch closed, I remember peering through the small 

window in the center of the hatch and thinking, “I wonder 

if we’ll ever go back in there again.”
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 185

is required. As part of the normal 

process of using the powerful Russian 

thrusters, the US Solar Alpha Rotary 

Joints (SARJs) need to be locked into 

a specific position to prevent structural 

damage to the large arrays.]

SPARTAN: FLIGHT, SPARTAN I’ll need 

to park my SARJs. 

FLIGHT: You’re go to park SARJs.

ETHOS: FLIGHT, ETHOS. [Looking for 

a status.]

ETHOS: FLIGHT, ETHOS my Lab ITCS 

is currently trying to transition to dual, 

I would have expected it to come back 

up already in Dual by now but that 

didn’t work. I’m still assessing why that 

is, but for the crew, it is the ammonia 

response in 3.3, they’ll be taking 

readings in the [Russian Segment] and 

they’ll be reporting that in step 8. If 

concentrations are high... and FLIGHT 

I see that warning [an additional red 

warning alarm appeared on the screen], 

that’s from the Lab ITCS, that transition 

didn’t work. I’ll troubleshoot that in a 

second, but for the crew, they should 

be calling, like I said, in step 8, their 

readings. If it’s high basically they’re 

going to go to step 9 and they’re going 

to go to the Soyuz and try to establish 

a clean zone in the Soyuz. If it is low, 

they’re going to go to step 18, and 

they’re basically going to try to wait, 

about 2 and a half hours, until they 

can scrub all that, and they’ll take 

continual readings...

FLIGHT: Copy.

SPARTAN: FLIGHT, SPARTAN, 

SARJs locked.

FLIGHT: Copy, SARJs locked.

ADCO: And FLIGHT, ADCO, auto 

handover to the Russians is enabled. 

[This means that if the USOS loses the 

Control Moment Gyro attitude control 

of the station, the Russian thrusters will 

automatically take over controlling the 

vehicle orientation.]

FLIGHT: Copy.

[FLIGHT confirmed this configuration 

with the Russian shift flight director on 

the MCC-M to MCC-H coordination 

loop. The Russian flight control takes 

part in the training as well.]

CAPCOM [on the S/G-1 loop]: 

Station, Houston, Space to Ground 1, 

for a status.

FLIGHT: CRONUS, FLIGHT.

CRONUS: FLIGHT, CRONUS.

FLIGHT: Are public calls good for the 

crew to call down?

CRONUS: Good on the Russian 

Segment, yes.

FLIGHT: Ok.

CAPCOM [on the S/G-1 loop]: 

Station, Houston, Space to Ground 1, 

for a status.

SPARTAN: FLIGHT, SPARTAN, for 

interface heat exchangers.

FLIGHT: Go ahead.

SPARTAN: FLIGHT since we cannot 

determine which side the leak is on I 

can close both sets of interface heat 

exchangers. This would remove heat 

rejection from all modules. [By shutting 

down the pumps, there will be less 

pressure potentially pushing ammonia 

into the cabin since the team is not sure 

where the leak is located; however, this 

means the thermal loops will not be 

able to remove heat from the systems.]

FLIGHT: Ok.

ETHOS: FLIGHT, ETHOS.

FLIGHT: ETHOS, FLIGHT.

ETHOS: That’s going to remove 

cooling, like he said, so let me try one 

more command to go to Single MT, 

to see if I can pick this back up and 

determine which side the leak is on.

FLIGHT: Alright, so...

ETHOS: And if not I think that would be 

the forward action to bypass those.

FLIGHT: Alright, you probably have 

a minute or so. I don’t want to 

spend time.

CAPCOM [on the SG-1 loop]: Station, 

Houston, Space to Ground 1, for a 

status.

ETHOS: FLIGHT, ETHOS, I successfully 

went over to single MT, and I’m taking a 

look at my data to assess to see where 

this leak might be.

CAPCOM [on the S/G-1 loop]: Station, 

Houston, Space to Ground 1, status.

ETHOS: FLIGHT, ETHOS.

FLIGHT: Status?

ETHOS: Yes FLIGHT, I swapped over to 

Single MT, now I have insight into the 

entire Lab system, its one loop...

FLIGHT: Can you confirm by pressures 

that they’ve closed the hatch between 

the two segments?

ETHOS: Yes FLIGHT let me 

confirm that.

ETHOS: FLIGHT, ETHOS, I cannot 

confirm that hatch closure between 

Russian Segment and US Segment 

right now, the pressures on the Russian 

Segment are very close to an in-family 

with the US Segment. 

FLIGHT: Ok.

FLIGHT: All right so ETHOS you see 

the quantities in the accumulator 

increasing...
186 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

ETHOS: That’s right FLIGHT and 

because it’s a single loop I still cannot 

tell if it is associated with Loop Alpha 

or Loop Bravo. I recommend that 

just isolate those and vent those 

ETCS loops. [The flight controllers 

use the phonetic alphabet to prevent 

misunderstandings. Here ‘A’ and ‘B’ are 

called Alpha and Bravo.]

CAPCOM [on the S/G-1 loop]: Station, 

Houston, Space to Ground 1, for a 

status, when available.

ETHOS: And that procedure FLIGHT 

only has paths where we go to Dual 

and I figure out which loop it is on. 

I’m still... I don’t know if we have a... 

I’m taking a look at my procedures 

to see if we have one that covers this 

specific case...

FLIGHT: Can we even get back to 

Dual?

ETHOS: Let me think about that 

FLIGHT.

GLAVNI [This is the spacecraft 

communicator in MCC-Moscow, 

translated into English, on the S/G-1 

loop]: Station, this is Mission Control 

Moscow on Space to Ground 1, can 

you read us?

GC: FLIGHT, GC.

FLIGHT: GC, FLIGHT.

GC: FLIGHT the gaps have been filled 

for the next 24 hours. [This means that 

any gaps in the planned communication 

schedule with the ISS using the TDRS 

network have been filled but are forcing 

other users of the system off due to the 

spacecraft emergency.]

SPARTAN: FLIGHT, SPARTAN, Lab 

interface heat exchangers bypassed 

and isolated.

FLIGHT: Copy.

ETHOS: FLIGHT, ETHOS.

FLIGHT: ETHOS, FLIGHT.

ETHOS: In the current situation 

that I can’t tell which ETCS loop it’s 

associated with I would recommend 

venting both loops. I’m basically 

doing this to try to keep the structural 

integrity of the Station. We do have 

PPR [Positive Pressure Relief, which 

kicks off when the internal pressure 

of the ISS is too high, vents some 

atmosphere overboard. However, this 

venting can produce a thrusting force 

that can cause the ISS to tumble out 

of control. This is why ADCO wants 

to make sure the Russian Segment’s 

power thrusters are ready to take 

control via auto handover]. However, we 

will hit that in about 30 minutes or so, 

there is one thing I could do I could try 

and mode back to Dual, I would expect 

it to work but of course it failed the 

first time too and I’m not exactly sure 

what caused that, if it is LA-1 induced, 

however I would think that it would 

still mode to Dual. Now that we are in 

Single MT it might work again.

FLIGHT: Once we get to Dual can 

we actually vent both loops from 

that configuration with LA-1 MDM 

not available?

ETHOS: That would be a SPARTAN’s 

call, if LA-1 affects that, I don’t believe 

it does.

SPARTAN: It does not, FLIGHT.

ETHOS: Going to Dual, FLIGHT, 

would just let us know which one it’s 

associated with.

FLIGHT: Does it matter at this point? 

Which one it is?

ETHOS: FLIGHT when you vent an 

ETCS loop you can’t regain it so we’re 

basically calling it quits on the ETCS 

loops and basically all the US Segment. 

We do have a ton of ammonia in there 

anyway so I’m just worried about safing 

the situation right now, so that’s why I 

would recommend venting both loops, 

since I cannot tell.

SPARTAN: And SPARTAN concurs 

with that.

FLIGHT: All right how many commands 

is it to go back to Dual?

ETHOS: Two.

FLIGHT: All right send us back to Dual.

ETHOS: Copy FLIGHT I’ll put it in work.

FLIGHT: Quickly.

FLIGHT: SPARTAN do you have 

anything to suggest which loop you 

want to vent? First, anyway?

SPARTAN: And FLIGHT I have no 

insight into this. From a venting 

standpoint, both loops are redundant; 

we would just need to pick the right 

loop to vent. Once we vent the loop it 

cannot be...

FLIGHT: Ok, understand.

FLIGHT: ATAs [Ammonia Tank 

Assemblies, which can be used to refill 

a cooling loop] on orbit, right? We have 

ATAs on orbit?

SPARTAN: We do have the ATAs, 

FLIGHT.

FLIGHT: I’m more worried about 

keeping the USOS intact and not 

having to...

SPARTAN: During the venting process 

I would be isolating the ATAs and 

then venting everything in the lines 

of the ETCS system. The reason that 

those lines would be damaged at 

that point is that the lines were never 

intended to bring water through them, 

so bringing the water through them, 

the ETCS lines, could cause permanent 

damage to them.

FLIGHT: Copy.
DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED CHAPTER 10 187

FLIGHT: Alright you have your 

procedure ready?

SPARTAN: I do FLIGHT I’m in 9.19 

and 9.20, Loop A, Loop B. I do have 

one step to park the TRRJ [Thermal 

Radiator Rotary Joint, which positions 

the external ammonia radiators] for 

structural integrity...

FLIGHT: Why don’t you go ahead and 

do that.

SPARTAN: Copy.

FLIGHT: And CRONUS you have PTR 

back up?

CRONUS: I do FLIGHT.

ETHOS: FLIGHT, ETHOS.

FLIGHT: ETHOS?

ETHOS: Okay FLIGHT we are currently 

moding over to Dual, I will let you know 

how that goes, additionally I’m still 

looking at my pressures on Russian 

versus US segments, I still see the 

Russian Segment pressure increasing, 

and I have verified that we have good 

IMV [InterModule Ventilation] closure, 

between the two vehicles, so that’s 

indicative to me that the hatch is still 

open.

FLIGHT: Okay let’s make a call to the 

crew to tell them that we are expecting 

them in the Russian Segment with the 

hatch between the US and Russian 

Segment closed, they should be 

in 3.3 in step 8 to call down those 

CMS readings [Chip Measurement 

System, which can detect airborne 

concentration of ammonia].

CAPCOM [on the S/G-1 loop]: 

Station, Houston on Space to Ground 

1, we are expecting you in 3.3 for 

ammonia release and we are waiting 

for your readings on step 8. We are 

also expecting you to be isolated in 

the Russian Segment with the hatch 

closed between the Russian and the 

US Segment. 

ETHOS: FLIGHT, ETHOS for ITCS 

status.

FLIGHT: Go ahead.

ETHOS: FLIGHT I got the Mode 

Unknown again, so I’m not....there’s 

no way I can... I can’t tell... I cannot 

basically put this into Dual loop mode, 

I’m missing something FLIGHT, the 

LA-1 MDM one of my valves is not 

transitioning over, so there’s no way 

I can actually split apart. So right 

now I recommend venting both ETCS 

loops. We do see it coming into the US 

Segment, and from what I can tell it’s 

going to be the entire station with equal 

pressures across the stack. Since we 

have not heard from the crew I’m pretty 

worried about the safety there so I’m 

going to stand down on any type of 

ITCS configurations and I’m going think 

about where I’m going to go to try to 

recover crew.

FLIGHT: SPARTAN, you’re go to vent.

SPARTAN: Vent both loops FLIGHT?

FLIGHT: Vent both loops, yes.

SPARTAN: Copy.

ETHOS: FLIGHT, since we haven’t 

heard from the crew at all too I’d like to 

go ahead and call the entire team into 

looking at anything in their systems that 

might give us an idea of where the crew 

might be... if there’s any movement or 

activity at all on Station.

SPARTAN: And FLIGHT, SPARTAN, just 

to let you know, my next command for 

both loops will vent the loops.

FLIGHT: Ok, you’re go.

SPARTAN: And FLIGHT, SPARTAN, for 

the team, both Loop Alpha and Loop 

Bravo are currently venting.

FLIGHT: Copy, external loops venting.

After some additional time working 

through the scenario, the call that 

brings relief to the hard working team 

is made.

CTO: FLIGHT, CTO, on your loop.

FLIGHT: CTO, FLIGHT.

CTO: Yes ma’am I’d like to call the sim 

here. 15 minutes, let everybody take a 

break, come back at 3:30.

FLIGHT: Copy, 3:30.

The Debrief

When a simulation ends, the team 

members almost always breathe a 

sigh of relief. For a number of hours, 

the team has been running at top 

speed, diagnosing failures, recovering 

systems, and pressing ahead on the 

timeline. But even when the sim 

ends, the work is not over. The last 

thing the team does is perform a 

self-critique—called a debrief—led 

by FLIGHT and the CTO. During 

debrief, the team will review the 

major events, this time with the 

training team explaining what was 

really going on. What did the flight 

control team members do wrong? 

What could they do better next time? 

In general, how did they do in terms 

of problem recognition, mission 

cognizance, communications, and 

team management, and how was their 

attitude? Although each individual 

flight controller strives to improve his 

or her performance, these simulations 

often result in a better way to 

coordinate, perhaps even including 

changes to flight rules or procedures.

In the simulation from April 24, the 

failure that initially appeared minor 

but played a major role in the rest 
188 CHAPTER 10 DAY IN THE LIFE: PREPARING FOR THE UNEXPECTED

of the sim was an issue with the 

LA-1 MDM. It had not completely 

died, but instead was still operating; 

however, the computer circuit 

that allowed it to talk to its bus 

controller—i.e., the Internal MDM 

(see Chapter 5)—was not operating. 

Thus, the LA-1 MDM still tried to 

control its pumps and valves, but 

the rest of the system could not talk 

to it. This MDM managed the LTL 

accumulator quantity. Normally, 

if the liquid in that accumulator 

increases, it means water from the 

other loop or from the ammonia line 

is leaking into the system. Yet, those 

data could not be reported because 

of the communication failure with 

the Internal MDM. However, in 

this sim case, those data could not 

trigger an automated alarm. The 

crew smelled the ammonia and 

pressed the manual alarm. Since the 

flight control team failed to fully 

recognize the configuration and the 

full implications, the CTO decided 

to change the sim plan and insert an 

ammonia leak. By the time a person 

smells ammonia, there is a significant 

chance it is too late because of the 

toxicity. Since the crew is well trained 

to perform a memorized response, 

indication that the hatches were not 

in their expected sealed position 

followed by the lack of response by 

the crew when called did not bode 

well. Yet, no one on the flight control 

team acknowledged that fact.

Furthermore, the LA-1 MDM controls 

the Loop Crossover Assembly 

(see Chapter 11), which allows the 

thermal loops to be separated into 

two independent loops (i.e., dual). 

Since the flight controller did not 

recognize this issue, the attempts to 

transition to dual mode were failing. 

The team lost precious time since this 

transition was never going to succeed. 

In some areas, team coordination 

and communications during this 

simulation worked well. ETHOS, 

SPARTAN, CRONUS, and ADCO 

worked very well with regard to the 

solar arrays. They realized that if 

the loops were vented, the ISS could 

lose gyro control and would need 

to hand over to the power attitude 

thrusters of the Russian Segment. 

Before this could be done, the massive 

solar arrays had to be put into a safe 

configuration. This, in turn, required 

the PTR MDM to be recovered. 

Although the team did everything 

in its power to save the crew, this 

simulation drove home that mistakes 

and failures can put crew members at 

risk or get them killed. Simulations 

such as this emphasize the need 

for vigilance, responsibility, and 

competence to the flight controllers. 

Lives are in their hands, and this can 

never be forgotten—not even for a 

moment. The team repeated many 

additional simulations so that when 

faced with a critical event, such as 

the one that occurred in January 

2015, the same mistakes would not 

happen again.

Why NASA Trains

The integrated simulation is the 

capstone training event for every 

flight controller. A flight controller 

must demonstrate technical expertise 

for his or her system before 

participating in a simulation. Yet, 

the simulation is where the flight 

controllers come together as a team. 

By performing simulations prior to 

the actual event, teams have been 

able to avoid numerous problems in 

space. Teams that had been drilled 

over and over again by the instructors 

were better able to handle a given 

problem, as was the case that early 

morning in January 2015. The team 

had practiced ammonia releases many 

times. What happened on the ISS that 

day was not a real ammonia leak, but 

rather a computer failure—one that 

had heretofore not been known as a 

possibility. The team had to figure 

out what was going on. However, 

the most critical actions—to save the 

crew and vehicle—were virtually 

reflexive. While the flight controllers 

and the flight director often lay awake 

at night hoping such a day will never 

come, they know that if it does, they 

will be prepared.


Chapter 11 Systems: 

Thermal Control—

the “Circulatory System” 

of the International 

Space Station
192 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

A picture of the International Space Station (ISS) showing the largest and most visible portions of the Thermal Control System: the radiator panels. Four white 

radiators project down in the photo, and provide dedicated cooling to the ISS Electrical Power System. Two sets of three larger radiators project upward in 

the image, and provide cooling to all the other systems on the ISS. Fluid lines loop through ISS systems, and the coolant within collects heat from computers, 

electronics, air conditioners, and other mechanical systems around the ISS. That heated coolant then flows through the radiators where the heat is rejected 

into space, and the coolant, returned to its starting temperature, runs though the same cycle again.

Other chapters have explored the 

“brains” of the International Space 

Station (ISS), the “lungs,” the ability 

to “see,” “hear,” and “speak,” and 

even how its energy is generated. 

Equally important is the “circulatory 

system” of the space station. As 

the ISS orbits the Earth, it spends 

roughly half of each orbit in daylight 

and half in darkness. Beyond the 

Earth’s atmosphere is a harsh thermal 

environment. When equipment in 

space is exposed to direct sunlight—

without the protection of the Earth’s 

atmosphere—solar radiation can 

cause severe heating, thereby rapidly 

increasing temperatures up to 

150°C (302°F). When equipment is 

exposed to the vast darkness of space, 

temperatures plunge sometimes 

as deeply as -130°C (-202°F). The 

Thermal Control Systems (TCSs) 

of the ISS perform two important, 

but seemingly opposite, functions. 

Fluid systems both inside and outside 

the vehicle act as a circulatory 

system, picking up excess heat 

from around the vehicle and then 

rejecting that heat overboard, thus 

maintaining equipment at proper 

working temperatures. These fluid 

systems are called Active TCSs 

(ATCSs), and there are several 

variations of active thermal systems 

on the ISS. Conversely, heaters 

installed throughout the vehicle 

protect equipment from freezing in 

the deeply cold periods of darkness 

during each orbit. These heater 

systems are known as Passive TCSs 

(PTCSs), and such systems are used 

on almost every segment of the ISS. 

For many years over the course of its 

history, the ISS could experience both 

of these extremes simultaneously. 

In the early years of assembly, the 

ISS flew what was known as a solar 

inertial attitude (X-Perpendicular 

Out of Plane). The orientation of 

the vehicle was such that one side 

faced the sun throughout the daytime 

periods while the opposite side faced 

deep space. Therefore, the opposing 

sides of the ISS were exposed 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 193

to opposing thermal extremes 

throughout the daytime portion of 

each orbit (see Chapter 7). This 

attitude was necessary for dynamic 

stability and power generation but 

caused thermal stress on the vehicle. 

Portions of the ISS facing the Earth 

experienced a middle ground in this 

realm of extremes. The Earth radiates 

heat better than deep space while 

providing only a fraction of the heat 

of the sun, thus the portion of the ISS 

that faces Earth achieves a goldilocks 

middle-ground temperature of not 

too hot and not too cold. The thermal 

systems on the ISS were designed 

to protect it from these extreme 

thermal environments while keeping 

the astronauts in comfortable, shirtsleeve surroundings.

Convection—Gravity’s Cooling Mechanism

Of the three primary mechanisms of heat transfer—conduction, convection, 

and radiation—convection is intuitively understood by most people based on 

their experiences on Earth. Hot air rises through convection, taking heat with 

it. For example, when placing a hand above a hot cup of coffee, a person can 

feel the rising warmth as the coffee cools. Convective heat transfer occurs 

when a fluid (air would be a fluid in this instance) is heated and becomes less 

dense. In a gravity environment, a warmer, less-dense fluid rises through the 

cooler fluid above it because the less-dense fluid is “lighter” than the colder, 

denser fluid. This free convection is responsible for the weather patterns 

on Earth, the flight of hot air balloons, and the usefulness of old-fashioned 

radiators. Without gravity, however, air will get hot and expand but will stay 

exactly where it is. This occurs because things are not “light” or “heavy” 

when there is no gravity. Without gravity, hot air will not rise. On Earth, if a 

computer is generating a lot of heat, it can be placed on a table, uncovered, 

and free convection will allow the heat to float up and away, thus keeping the 

computer from overheating. Inside the ISS, that same computer left floating 

in the middle of a module would simply heat the air around it, creating a 

bubble of heat surrounding the computer. On the ISS, a little more effort is 

required to keep that computer from baking itself. A fan can be used to blow 

the hot air away from the computer (which is known as forced convection), 

but the heat is simply being moved around to some other pocket of air. The 

heat will need to be removed altogether or all the air in the ISS will eventually 

get too hot. Computers outside the ISS pose yet another challenge since, 

beyond gravity, the other important part of convection is the air that carries 

the heat away. Computers outside the ISS are not surrounded by air. They 

are in the vacuum of space; therefore, a fan cannot help with cooling. 

Convection is not possible without some type of gas such as air or a liquid. 

Conduction is the process in which heat is transferred from something that is 

warm to something that is cool through direct contact. The ISS systems use 

conduction to carry unwanted heat from objects such as computers into fluid 

systems, which then carry the heat away from the heat-generating equipment 

and send that warm fluid flow through radiators, using radiation to release 

that heat into space.

Beyond the extremes of space itself, 

the ISS also requires a cooling 

process to maintain its many systems 

at operational temperatures. As on 

Earth, electronics and machines 

generate heat. In the gravity 

environment on Earth, system 

designers frequently use convective 

heat transfer in designing cooling 

systems, where warm air rises and 

moves away from the equipment 

to remove heat from machines. 

Thermal systems on the ISS rely on 

conduction, where heat is transferred 

from one substance to another 

through direct contact to provide 

cooling to heat-generating equipment, 

followed by radiation of that heat into 

space. (See sidebar: Convection—

Gravity’s Cooling Mechanism.) 

A particularly critical symbiosis 

exists among the Command and 

Data Handling, the Electrical Power 

System (EPS), and the TCS. The TCS 

is powered by the EPS, controlled by 

the software in Command and Data 

Handling and, in turn, cools both to 

keep them functioning. Every other 

system on the ISS is equally reliant on 

these three core systems in one way 

or another, creating an interconnected 

web of dependencies that have to be 

carefully managed in both normal 

operations and failure scenarios. 

The TCSs on the ISS are comprised 

of a number of subsystems, all 

working together to maintain the 

various structures and components of 

the space station at the temperatures 

required for operation and survival. 

Most of those systems arrived in 

orbit as part of modules or structures 

installed during ISS assembly 

missions of the Space Shuttle (see 

Introduction). One by one, each 
194 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

subsystem was integrated into the 

whole as the station itself was built. 

As such, the story of the TCS on 

the ISS parallels the story of the 

ISS assembly. This chapter offers a 

review of each different subsystem as 

summarized here:

n PTCSs

n Heaters

n Insulation

n Coatings 

n ATCSs

n General

n Pumps

n Heat exchangers

n Valves

n Accumulators and 

pressure systems

n External

n Internal

The PTCSs arrived with the first 

and last pieces of the ISS, and every 

segment along the way, and are 

discussed first. The ATCSs, both the 

ammonia-based fluid systems and 

the water-based fluid systems, are 

discussed next, initially summarizing 

the generic features of all such 

systems. Ammonia-based systems 

are used on the exterior of the ISS 

to move heat to radiators and release 

it into space. These ammonia-based 

systems are called External TCSs 

(ETCSs) and are used in a number 

of distinct applications even though 

they are of similar design. Waterbased systems are used on the 

interior of the ISS to collect all of 

the heat generated by activity on the 

ISS from computers, experiments, 

and crew members, and to carry it to 

the ETCSs to be radiated overboard. 

The water-based systems are known 

as Internal TCSs (ITCSs) and can 

be found in each module on the 

US Segment, always in similar yet 

unique configurations. 

Passive Thermal Control 

Systems

A portion of the PTCS was the first 

ISS thermal subsystem that was 

launched into orbit. In this context, 

passive means thermal systems 

that do not use pumps and cooling 

fluids. The most basic form of a 

passive thermal system is insulation, 

which provides the same function 

as putting on a coat. Multilayer 

insulation consists of layers of thin 

aluminum and white cloth, 3.2 to 

6.4 mm (0.125 to 0.25 in.) thick, 

that help trap heat. Another type of 

passive system is paint. To protect 

against the intense sunlight, areas 

may be painted white to reflect as 

much heating radiation as possible, 

or painted black to absorb heat to 

provide warmth. Heat pipes are used 

in several places on the outside of 

the ISS, usually to provide passive 

cooling of electronics mounted on 

the outside of the space station. 

A heat pipe is a hollow tube with 

ammonia inside. Several tubes will 

be aligned together such that one 

end of the pipes is in contact with 

the warm electronics, and the other 

end of the pipes is mounted a short 

distance away from the heat source. 

When the heat from the electronics 

is transferred to the ammonia in the 

tubes, the ammonia turns to vapor. 

When the ammonia vapor comes 

in contact with the cool end of the 

pipes, it releases the transferred heat 

and condenses back into a liquid, 

flowing back along the pipe to the 

warm end again to repeat the process. 

Heat pipes provide a simple and 

effective way to move heat away 

from electronics without the need 

for mechanisms that may require 

maintenance over time. 

The final passive thermal system uses 

small heaters to keep hardware warm. 

When the Node 1 and Pressurized 

Mating Adapter 1 modules launched 

in the payload bay of the Space 

Shuttle Endeavour on December 4, 

1998, they took with them the first 

sets of heaters installed on the inside 

of the shell on most ISS pressurized 

modules (see Chapter 3). These 

heaters were designed to protect 

the inside of pressurized structures 

from condensation. Condensation 

is possible on the inside due to the 

respiration of the astronauts. During 

pre-launch processing, each module 

of the ISS was pressurized with clean, 

dry air. On orbit, each module was 

exposed to slightly more humid air 

once it was attached to the station. In 

the same way water collects on the 

cold outer surface of a glass of ice 

water on a humid day on Earth, the 

water vapor in the air on the ISS is 

liable to condense on any especially 

cold surface. The dew point on the 

ISS (i.e., the temperature at which the 

water vapor in air will condense into 

liquid water) is usually kept in the 

6°C to 8°C (42°F to 46°F) range. The 

outer walls of the space station, being 

the coldest surfaces in the pressurized 

sections of the ISS, are prone to drop 

below those dew point temperatures; 

therefore, heater patches consisting 

of nickel chrome wire embedded 

in patches of silicon rubber are 

spaced around the pressure shell of 

most modules on the US Segment 

to ensure surface temperatures are 

warm enough to avoid water pooling. 

Several types of passive thermal 

systems are shown in Figure 1.

Condensation on the ISS needs to 

be prevented for a couple of good 

reasons, beginning with safety 

concerns. Water allowed to collect 

as condensation on the walls of the 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 195

space station could become freefloating water, which could cause 

irreparable damage if it came into 

contact with station electronics. 

Additionally, condensation can cause 

corrosion of metal structures in the 

form of rust. Corrosion can lead to 

small holes in the critical shell of the 

ISS or make the ISS more susceptible 

to structural fatigue under dynamic 

stresses that occur due to normal 

thermal cycling as the space station 

orbits the Earth or during propulsive 

events such as vehicle reboosts 

(see Chapters 7 and 8).

Multilayer 

Insulation Anodized

Coating

Heaters

(bonded to the 

inside of the LAB 

pressure shell)

Figure 1. Various examples of PTCS are seen in this photograph of the Z1 truss connection to the Laboratory Module. The silver-like anodized coating of the 

modules helps reflect sunlight. Heaters (not visible) are bonded to the interior side of the pressure shell to keep it from getting too cold. Fluid connectors are 

wrapped in multilayer insulation to keep the temperature of the fluids within operational ranges. 

Active Thermal Control 

Systems—General

Passive systems are effective for 

keeping particular areas at the right 

temperature; however, sometimes 

large quantities of heat need to be 

moved from one area to another or 

removed from the system altogether. 

Active systems are required when heat 

needs to be moved from its source to 

a different location where it can be 

expelled. The ISS has three types of 

active thermal systems: one internal 

and two external. A third external was 

available temporarily. This section 

describes the common characteristics 

of these active systems.

Every ATCS on the ISS is a closedloop system, with fluid lines 

connecting heat “loads” (i.e., the 

equipment that needs to be cooled) 

to heat rejection points. This is 

exactly the same way a building or 

automobile air conditioner works. In 

an air conditioner, air moves over a 

tube filled with cold liquid so the heat 

transfers to the coolant. The nowwarm liquid passes through tubes 

on the outside of the unit so that the 

heat can be absorbed by the outside 

air. In the ITCS, the heat loads are 

individual pieces of equipment such 

as computers, air conditioners, water 

processors, and experiments. Fluid 

lines pass close by these loads to 
196 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

absorb some of the heat generated 

by the load, thereby warming the 

fluid. The point in an active thermal 

system where heat leaves the loop is 

referred to as the heat rejection point. 

The heat rejection point for the ITCS 

loops is an Interface Heat Exchanger 

(IFHX), which provides a connection 

point between the ITCS inside the 

ISS and the ETCS outside of the ISS 

(Figure 2). In a heat exchanger, a 

warm fluid passes by a colder fluid, 

thus allowing heat to be rejected 

from the hot side to the cold side. 

In the ETCS, the heat exchanger 

provides the heat load, and the heat 

rejection points for the ETCS are 

radiators that radiate heat into space. 

Pump hardware in each type of loop 

circulates the coolant (either water or 

ammonia) through the cooling loop. 

Each cooling loop has a number of 

sensors, valves, and controllers to 

maintain desired loop temperatures 

and monitor for problems in loop 

operation. The cooling loops inside 

and outside the ISS use many 

common components, but the 

details of how those components are 

designed or configured differs based 

on the specific needs of the cooling 

application, as discussed in the 

following sections.

Bypass Valve

Isolation Valve

From 

Radiator

Bleed Line

Three Way 

Mixing Valve

Outlet Flow

Bypass 

Flow

Inlet Flow

Pump

To

Radiator

Interface

Heat Exchanger

M

Heat

Loads

Figure 2. A schematic of an ATCS. Warm water (red) flow starts at the pump in the lower right of the diagram. Coolant passes into the IFHX where it will 

pass heat to the colder ammonia (blue then yellow) inside the heat exchanger. The now-cooled water (pink then blue) flows back to the loads to pick up 

more heat. The Three Way Mixing Valve (TWMV) is adjusted to regulate the temperature of the fluid going to the loads at the upper right of the diagram. 

Some warm fluid can be pulled directly into the TWMV, bypassing the heat exchanger, to make sure the fluid going to the loads is not too cold. On the 

left of the diagram, cold ammonia (light blue) comes into the heat exchanger from the radiators. Inside the heat exchanger, the ammonia picks up heat 

from the water such that it leaves the IFHX warmer (yellow) and returns to the external pump (not shown), which will push it back to the radiators again. 

A bypass valve will divert the flow of ammonia away from the heat exchanger when it is not being used. An isolation valve, in conjunction with the bypass 

valve, can be used to isolate the heat exchanger and prevent colder-than-normal ammonia from reaching the center of the heat exchanger. This might 

be needed during repair work, for example. The heat exchanger cannot be completely isolated from the ammonia side of the system due to the presence 

of what is known as a bleed line. When a heat exchanger is isolated, there is a risk that the ammonia remaining in the heat exchanger could get hot and 

increase in pressure. The bleed line provides a pressure relief capability, allowing ammonia to safely escape the heat exchanger if it heats up. The “M” in 

a circle over some valves indicates a manual override, which means an astronaut could adjust that valve if, for some reason, the computer control was 

not working properly. See also Figure 2 in Chapter 20.

Each fluid loop on the ISS uses a 

Three Way Mixing Valve (TWMV) 

to control loop temperature, as shown 

in Figure 2. These three-way valves 

are similar to a single-handle faucet 

control at a kitchen sink. As with 

kitchen faucets, these three-way 

valves have two sources of liquid 

that are blended together into one 

outlet. One source of coolant flow at 

TWMV comes from the heat rejection 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 197

point in the loop and provides the 

coldest fluid in the loop. This source 

is comparable to the water coming 

from the water main into the kitchen. 

The second source comes from a 

line that bypassed the heat rejection 

point and is still warm. This source 

is similar to the water coming from 

the water heater, but instead of being 

intentionally warmed, it is warm 

from the heat loads on the ISS. The 

two sources are known as the return 

line and the bypass line, respectively, 

and the valve position determines 

how much of the warm bypass line 

coolant is added to the cold return 

line coolant in the outlet line. In 

the three external cooling loops, 

these valves are called Flow Control 

Valves (FCVs). Three-way valves are 

also used to provide control of loop 

pressure at some points in the ITCS, 

as will be discussed later in the ITCS 

section of this chapter.

The active systems use one or 

more accumulators to manage loop 

pressures. Accumulators serve three 

purposes in ISS fluid loops: they 

allow for thermal contraction and 

expansion of the cooling fluid, ensure 

sufficient pressure at the inlet to each 

fluid system pump, and provide a 

small amount of makeup fluid in the 

event of a fluid leak. An accumulator 

is a small tank with a compressible 

metal bellows inside (Figure 3). A 

bellows is an accordion-like container 

that is able to expand and contract 

freely. On the ISS, the tank usually 

contains the cooling fluid and the 

bellows contains nitrogen at a desired 

pressure. Since the bellows is free to 

expand and contract, the pressure of 

the coolant will match the pressure of 

the nitrogen; therefore, the nitrogen 

pressure is used to control and 

maintain the pressure of an entire 

cooling loop, through the accumulator. 

Ammonia

Bellows

expanded Bellows

compressed

Nitrogen Gas

Ammonia

Figure 3. The accumulator for the Pump Flow Control Subassembly is illustrated, but the other TCS 

accumulators work on the same principles. Fluid (in this case, ammonia) is in the tank surrounding the 

orange bellows, which can expand and contract. Nitrogen gas within the bellows provides pressure 

on the bellows, which in turn applies pressure to the ammonia to help ensure it can move around the 

system properly.

After detailed engineering analysis,

NASA chose ammonia as the coolant 

for the ATCSs on the exterior of the 

space station for several reasons: 

ammonia has a lower density 

than many other commercially 

available coolants and can therefore 

be launched in great quantity at 

dramatically reduced launch costs; 

it has a low viscosity so it requires 

little power for pumps to circulate 

the ammonia through cooling 

loops; and ammonia remains liquid 

down to -78°C (-108°F), which is 

important in the extreme cold of 

the ISS external environment. On 

the downside, ammonia is toxic to 

humans; therefore, the possibility 

of this dangerous chemical leaking 

into the pressurized cabin is one of 

the three major emergency responses 

discussed in Chapter 19.

Active Thermal Control—

External Thermal Cooling 

Systems

The ETCS expanded significantly 

throughout construction of the space 

station, though the fundamental 

design of the system remained the 

same. These systems have been 

critical to human presence on the ISS. 

Without the ability to reject heat from 

the interior of the ISS overboard, 

the many systems inside the station 

cannot operate for long without the 

air becoming unbearably hot. The 

challenge during assembly of the ISS 

was that the large, permanent ETCS 

loops would not arrive until the latter 

half of the construction sequence. 

The ammonia loops arrived already 

integrated into the truss segments that 

make up the backbone of the ISS, 

providing structure and infrastructure 

for power to flow from the outboard 

solar arrays into the central core of 

the station. Many of the habitable 

modules of the ISS arrived years 

before the truss was completed, but 

they could not be fully activated until 

the permanent thermal and power 

systems arrived with the trusses. The 

assembly sequence was altered to 

provide one truss segment, P6, early 

in the sequence, with a pair of solar 
198 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

arrays and two pairs of ammonia 

loops, thus providing power and 

cooling to the evolving space station 

much earlier than originally designed. 

This was done to expedite human 

presence on the ISS and begin the ISS 

research program.

The P6 truss segment was outfitted 

with two cooling loops to provide 

cooling to the habitable modules, 

specifically to support the ITCS and 

allow for early activation of interior 

systems. The augmented P6 truss was 

installed on the zenith face of the ISS 

during STS-97/ISS-4A in late 2000, 

during the third ISS assembly flight 

of the Space Shuttle. The additional 

cooling loops were known as the 

Early External TCS (EETCS). Along 

with the 2B and 4B solar arrays 

and associated power channels, 

the EETCS allowed for a complete 

activation of the Laboratory Module 

(LAB) systems once the LAB was 

installed on STS-98/ISS-5A in 2001. 

See Figure 4. The P6 truss stayed 

in this location while the remainder 

of the ISS was built around it. The 

early external cooling system was 

deactivated with the arrival of the 

remaining truss segments in 2006 

and 2007 and the activation of 

the permanent ETCS. Ultimately, 

the P6 truss was relocated to its 

design location as an outboard truss 

segment, though not without incident 

(see Chapter 18). Power channels 2B 

and 4B and their associated cooling 

loops are again active; however, 

the EETCS is permanently retired, 

and provides spare parts for eight 

of the cooling loops on the ISS. 

The permanent system shares many 

common features with the EETCS, 

which would later play yet another 

role, as detailed in this chapter. 

The final configuration of the ISS 

includes two types of ETCSs. Loops 

A and B form a redundant pair 

of loops that provide cooling for 

the core of the ISS. Eight smaller 

ammonia loops, known as the 

PhotoVoltaic TCS (PVTCS), each 

service one channel of the electrical 

system, and are named for the power 

channel they support (e.g., PVTCS 

1B for the 1B power channel). (See 

also Chapter 9.) 

Starboard 

Radiator Trailing 

Radiator

PhotoVoltaic 

Radiator

Figure 4. Picture of the early space station after STS-98/ISS-5A. The P6 module with its set of arrays and the EETCS was temporarily attached to the Z1 truss. 

Two radiators labeled the trailing EETCS (since it pointed aft) and starboard (since it pointed starboard) provided cooling for the entire US On-orbit Segment. The 

PhotoVoltaic system on P6 has its own TCS called the PhotoVoltaic TCS with a forward-pointing radiator called simply the “PVR” (PhotoVoltaic Radiator), which 

provides cooling to electrical power generation and storage systems on the element. 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 199

External Thermal Control 

Systems—Temperature Control 

As mentioned earlier in the chapter, 

FCVs are the three-way valves 

that provide temperature control in 

external thermal loops on the ISS. In 

the ETCS, the FCV must maintain 

loop temperature within a fairly tight 

tolerance (around 4°C [39°F]) to 

provide ammonia sufficiently cold to 

draw heat from the heat exchanger, 

but also sufficiently warm to avoid 

freezing the water on the ITCS side 

of the heat exchanger. In comparison, 

the PVTCS FCV simply moves 

all the way to return flow (i.e., full 

cool, also known as “open”) if the 

ammonia from the EPS batteries is 

too warm, and then moves all the 

way to bypass flow (i.e., full hot, also 

known as “closed”) when ammonia 

from the EPS batteries is too cool. 

Thus, the FCV in the ETCS has much 

finer control algorithms than the one 

in the PVTCS.

External Thermal Control 

Systems—Pumps and 

Accumulators 

In a PVTCS, the pump is within the 

Pump and Flow Control Subassembly 

(PFCS), which provides ammonia 

circulation and control of the loop 

temperature and pressure. The PFCS 

contains the following: two pumps; 

the FCV to control loop temperature; 

a fluid accumulator to control loop 

pressure; a suite of sensors to monitor 

temperature, pressure, flow, and 

ammonia quantity; and an electronics 

unit to control all mechanisms on the 

loop. See Figure 5. 

Accumulator

Pump

Flow

Control

Valve

Pump

Pump and Flow Control Subassembly

Radiator

S4, P4, S6 or P6 Truss

Cooled Ammonia

Warmed Ammonia

Ammonia Supply

Nitrogen

On-orbit Replaceable Unit

Location on ISS

Electrical System 

Hardware

Figure 5. A simplified schematic of the PhotoVoltaic Thermal Control System. Redundant pumps (green) 

push cool ammonia (blue) to the electrical power generation and storage systems. The electrical systems 

are cooled by the ammonia absorbing the heat (red). The warm ammonia passes through a radiator 

where the heat is transmitted to space. The cooled ammonia (blue) returns to the Pump and Flow Control 

Subassembly to repeat the cycle. An accumulator maintains the pressure on the fluid line when the liquid 

expands or contracts as temperatures vary during an orbit around the Earth and throughout the year. A 

flow control valve allows mixing of warm and cool fluid to adjust the temperature of the loop. 

The accumulators serve two purposes 

in the PVTCS. Since ammonia is 

incompressible, rapid heating causes 

the fluid to expand quickly. If there 

is no method to accommodate that 

expansion, line pressures can quickly 

exceed the capacity of the fluid 

lines, which leads to burst lines. 

This is of particular concern in the 

PVTCSs, which were filled with 

ammonia coolant when launched, 

and were exposed to extreme thermal 

environments once they reached orbit 

but before they were activated. The 

first purpose is to provide room for 

ammonia to expand when it gets hot. 

The second purpose is to provide 

ammonia to compensate for a small 

amount of leakage from the system 

over time.

The PFCS pumps in the PVTCS 

and the EETCS are run by a threephase 120 volts (direct current) 

brushless pump motor and were 

set to operate at 13,580 revolutions 

per minute (rpm) to provide an 

average ammonia flow rate of 

862 kg/hr (1900 lb/hr). The PVTCS 

are comparatively small and simple 

loops, with fairly short lines and no 

parallel flow paths, thus requiring 

much less pumping power than 

would ultimately be needed for 

the much larger and more complex 

ETCS. By comparison, the ETCS 

pump provides an average flow rate 

of between 3175 and 4309 kg/hr 

(7000 and 9500 lb/hr). The ETCS 

pump capacity is discussed later 

in this chapter. Each PVTCS and 

EETCS loop contains two identical 

pumps in case one fails. However, 

there is only one FCV per loop, 

since valves are generally more 

reliable than pumps.
200 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

S1 or P1 Truss

Habitable 

Modules

S0 

Truss

Accumulator

Flow

Control

Valve Pump

Nitrogen 

Tank Assembly

Ammonia 

Tank Assembly

Pump 

Module

Radiators

Cooled Ammonia

Warmed Ammonia

Ammonia Supply

Nitrogen

On-orbit Replaceable Unit

Location on ISS

Interface 

Heat Exchangers

Electrical System 

Hardware

Thermal

Radiator

Rotator

Joint

Nitrogen

Tank Ammonia Tanks

NH3

NH3

N2

Figure 6. A simplified schematic showing the major components and flow paths of the External Thermal Control System (ETCS). The ETCS is very similar to 

the PhotoVoltaic Thermal Control System shown in Figure 5. Starting in the pump module, a pump (green) pushes cool ammonia (blue) to either the electrical 

distribution systems on the exterior of the ISS or heat exchangers on the habitable modules where heat is picked up from the Internal Thermal Control System 

(discussed below and shown in Figure 10). The warm ammonia (red) passes through a rotating mechanism called the Thermal Radiator Rotator Joint to 

radiators where the heat is transmitted to space. The cooled ammonia (blue) returns to the pump module to repeat the cycle. A flow control valve in the pump 

module allows mixing of warm and cool fluid to adjust the temperature of the loop. An Ammonia Tank Assembly (ATA) performs the role of an accumulator, 

maintaining the pressure on the fluid line as the liquid expands or contracts through the orbit or year. Unlike the PVTCS, the ETCS has a replenishable 

nitrogen tank to maintain pressure at the ATA. A fixed-pressure accumulator in the pump module is too small to maintain loop pressures year round, but can 

maintain stable pressure for short periods if the ATA/NTA combination is unavailable. 

The ETCS pump is located within an 

assembly called the pump module, 

which consists of a Pump and Control 

Valve Package, an accumulator, 

several valves, and a suite of sensors 

to monitor temperature, pressure, flow 

rate, and ammonia quantity (Figure 6). 

The pump and control valve package 

contains a pump, an FCV, sensors to 

monitor temperature and flow rate, 

and a firmware controller to control 

the pump and FCV. Each ETCS loop 

has one pump module, located in 

the S1 truss segment for Loop A and 

the P1 truss segment for Loop B. In 

August 2010 and December 2013, 

the pump module on Loop A failed, 

cutting off half the cooling and 

leaving the station one failure away 

(on Loop B) from losing all cooling. 

Without cooling, the equipment would 

overheat and ultimately fail. Since 

most of the critical systems have two 

identical instances to provide for 

redundancy, the failure of one loop 

meant half of these systems had to be 

shut down. If the other loop failed, 

or if any of the redundant equipment 

that it cooled broke, the station would 

no longer be viable for supporting 

the crew. The crew conducted three 

emergency spacewalks later that 

month to restore functionality (See 

Chapter 20).

As with the PVTCS, the accumulator 

in the pump module accommodates 

thermal expansion and contraction 

of ammonia within the pump 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 201

module when the ETCS is dormant. 

Pressure control of the ETCS loops 

during operation is provided by a 

combination of a Nitrogen Tank 

Assembly (NTA) and an Ammonia 

Tank Assembly (ATA), which 

together act as a large ammonia 

accumulator for each ETCS Loop.

The ETCS contains 118 L (31 gal.) 

in each of two loops. As mentioned 

above, any segment of fluid line filled 

with ammonia must have access to 

a pressure relief mechanism, usually 

an accumulator or a mechanical 

pressure relief valve, to ensure that 

rapid ammonia temperature increases 

do not cause overpressurization, 

which could burst lines. Because the 

ETCS loops were launched to orbit 

in many sections across several flight 

elements, each section was filled 

with nitrogen rather than ammonia. 

Using inert nitrogen, which does not 

respond to temperature extremes with 

the same pressure changes to which 

ammonia is susceptible, prevented 

the need for additional accumulators 

throughout the system. Once the 

entire system had been assembled 

on the ISS in 2006, the nitrogen was 

vented and the system was filled with 

ammonia just prior to activation. This 

strategy allowed all of the ammonia 

to be contained in a set of ammonia 

tanks for launch and installation; 

therefore, the cost of overpressure 

protection was limited to the design 

of those ammonia tanks, which were 

then incorporated into the ETCS as 

part of the ATA. 

The ATA is a box that measures 

approximately 175 x 102 x 137 cm 

(69 x 40 x 54 in.). The box consists 

of the following: two ammonia tanks; 

an isolation valve for each tank; 

pressure, temperature, and quantity 

sensors for each tank; the plumbing 

needed to connect the ATA to the 

rest of the ETCS; and a vent valve 

on a line connected to both tanks. 

Each ATA holds 397 L (105 gal.) of 

ammonia. Each of the ATA ammonia 

tanks includes a bellows filled with 

pressurized nitrogen, such that each 

tank is able to act as an accumulator, 

accommodating thermal expansion 

and contraction of the ammonia, 

pressurizing the loop for optimal 

pump performance, and providing 

ammonia to make up for leakage 

over time. The nitrogen side of the 

ATA is connected to the NTA, a 

box that measures approximately 

152 x 91 x 76 cm (60 x 36 x 30 in.) 

and consists of a nitrogen tank, 

pressure and temperature sensors, 

a Gas Pressure Regulating Valve 

(GPRV), and two isolation valves. 

The plumbing in the NTA connects 

the nitrogen tank to the GPRV. The 

plumbing then splits into two lines 

(one connecting to each tank in the 

ATA), each with an isolation valve 

that can cut off the NTA from the 

associated ATA tank. 

The PVTCS accumulators have a 

fixed charge of nitrogen that cannot 

be changed or replenished, whereas 

the nitrogen pressure in the ATA can 

be adjusted using the GPRV in the 

NTA. The GPRV is a combination of 

four separate valves that can be used 

to increase or decrease the pressure 

of the nitrogen that is fed to the ATA 

tanks. Therefore, the GPRV is used to 

add or remove nitrogen to increase or 

decrease, respectively, the pressure in 

the ammonia lines as needed. 

Whereas the EETCS was a temporary 

and fairly simple system with pumps 

that operated at a fixed speed, the 

ETCS pump operates at variable 

speeds so that its capability could 

be adjusted as additional lines were 

added to the system over time. 

When the ETCS was first activated, 

it connected only to the heat 

exchangers on the LAB. Over time, 

as additional modules were added 

to the ISS, additional ETCS lines 

were added to provide access to the 

heat exchangers on those modules, 

which required additional capability 

from the pump. The ETCS pumps 

can operate between 11,250 and 

18,000 rpm, as required to provide 

a system flow rate of 3,719 to 

4,037 kg/hr (8200 to 8900 lb/hr).

External Thermal Control 

Systems—Heat Exchangers

As seen in Figure 2, an IFHX is 

an assembly that consists of a heat 

exchanger core, two valves, three 

heaters with associated temperature 

sensors (not shown), and four fluid 

connectors to connect the heat 

exchanger to water inlet and outlet 

lines and ammonia inlet and outlet 

lines. The heat exchanger core uses 

a counterflow configuration, with 

ammonia and water that flow in 

opposite directions in adjacent layers. 

Each layer uses a ruffled fin material 

(i.e., stainless steel for the ammonia 

layers and nickel for the water layers) 

separated by a stainless steel parting 

sheet to keep the fluids separated. 

The ruffled fins help hold the parting 

sheets together and provide additional 

surface area to increase heat transfer. 

There are two heat exchanger core 

configurations: one rated to transfer 

up to 14 kW of heat; the other rated 

for up to 12 kW of heat transfer. Of 

the 10 heat exchangers on the ISS, 

eight are the 14 kW design and two 

are the 12 kW design. Chapter 4 

discusses some of the challenges of 

working with the heat exchanger units 

on the Node 3 module.
202 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

The three-way valve in the heat 

exchanger assembly provides the 

ability to divert ammonia flow such 

that it bypasses the heat exchanger 

core. This valve is called a bypass 

valve (Figure 2). When the ETCS 

loop is off, this valve is adjusted to 

allow the ammonia flow to bypass 

the heat exchanger so that when 

the loop starts up, the super-cold 

ammonia will not be able to remove 

too much heat from the internal 

system. Although it sounds desirable 

to reject as much heat as possible, 

there is a point where things can get 

too cold. Because water expands as 

it freezes, the heat exchanger is not 

allowed to reach the freezing point 

of water. Otherwise, the frozen water 

will expand such that it ruptures the 

stainless steel parting sheet and then 

contracts as it thaws, leaving a hole 

for ammonia to leak through and 

into the cabin. An Isolation Valve—a 

two-way (i.e., two-position) valve 

that can be closed to isolate the heat 

exchanger core from ammonia flow—

helps prevent the water from freezing 

in the IFHX. The ETCS ammonia 

is kept at a temperature of about 

3.3°C (~37.9°F). If the temperature 

drops below that level, software in 

the system will automatically stop 

ammonia flow and configure these 

valves to bypass and isolate the 

ammonia side of the IFHX. When 

a heat exchanger is bypassed and 

isolated, it is hydraulically locked 

such that any sudden temperature 

increases within the ammonia will 

put the heat exchanger at risk of 

overpressurization. As another check 

to prevent overpressurization, the 

heat exchanger has a small ammonia 

fluid line, called a bleed line, which 

connects the ammonia inlet close 

to the heat exchanger core with the 

ammonia outlet outside the isolation 

valve. Some ammonia can escape 

through this line if pressure gets too 

high inside the isolated IFHX core.

Heaters attached to the heat 

exchanger core and the water inlet 

and outlet lines are designed to 

prevent freezing of the water side 

of the heat exchanger. Additional 

safety checks in the ETCS software 

help detect issues and prevent the 

heat exchanger from freezing. The 

first response was detailed above: if 

the ammonia temperature drops to 

about 1.1°C (34°F), the ETCS pump 

will automatically shut down and the 

heat exchanger will be bypassed and 

isolated to prevent cold ammonia 

from entering the heat exchanger. The 

second and third checks monitor the 

quantity of fluid in the internal system 

pump accumulator. If the quantity of 

water measured in the accumulator 

begins to rise, the only source of 

fluid would be ammonia leaking 

into the water. Therefore, if the 

accumulator quantities in the ITCS 

go above a threshold, the pumps will 

be shut down to help prevent pushing 

ammonia into the cabin. As discussed 

in Chapter 19, the case of toxic 

ammonia leaking into the crew cabin 

is one of the three critical emergency 

events for which the crew and ground 

regularly train (see also Chapter 10).

External Thermal Control Systems—

Loads and Radiators

The final component included in all 

the external thermal systems is the 

heat rejection point: the radiators. 

Although there are two types of 

radiators, they work the same way by 

providing radiative heat transfer from 

ammonia loops on the ISS. One type 

is known as a PhotoVoltaic Radiator 

(PVR), which is installed in the eight 

PVTCSs. The second type is known 

as the Heat Rejection Subsystem 

(HRS) or, more commonly, the ETCS 

radiators. Both types of radiators 

consist of a base panel connected to a 

series of radiator panels that are hinged 

together, accordion-style, such that 

they can be deployed (i.e., straightened 

out, end to end) or retracted (folded 

back together, face to face) (Figure 7). 

Each radiator was fully retracted at 

launch and has an automated deploy/

retract capability with a manual 

override that can be controlled by a 

spacewalking astronaut. 

The P6 truss segment houses a total 

of three radiators. One radiator, 

known simply as the 2B/4B PVR, 

faced forward to be shared between 

the two PVTCS loops. The remaining 

two radiators were shared between 

the two EETCS loops. One radiator 

faced aft and therefore is still known 

as the Trailing Thermal Control 

Radiator (TTCR). The other radiator 

faced starboard in the original 

P6 location, and is known as the 

Starboard Thermal Control Radiator. 

Note: Now that the outboard truss 

segments rotate 360° to support 

solar array pointing, neither name is 

accurate. See also Figure 4.

The PVR radiator type is always 

shared between two independent 

loops and has seven radiator panels. 

The seven panels together can reject 

from 9.5 to 14 kW of heat, depending 

on the thermal environment. This 

is equivalent to the capacity of the 

air conditioner in an average house 

in the southern United States. The 

inside of each radiator panel is a 

honeycomb made from aluminum 

sheeting, with that honeycomb 

sandwiched between two 0.254 mm 

(0.010 in.) sheets of aluminum that 

are then coated with either silver 

or white coating to ensure optimal 

reflectivity. Each panel has 24 

stainless steel tubes that measure 

0.17 cm (0.067 in.)—12 tubes for 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 203

each of the two loops sharing the 

radiator—to carry ammonia across 

the radiator panel. Ammonia flows 

down one side of a PVR/TCR 

radiator through the tubes running 

through the panels and then back 

up tubes on the opposite end of the 

panels. The tubes along the ends of 

the panels are connected from one 

panel to the next with flexible hoses 

where the panels hinge together so 

that ammonia can get all the way to 

the last panel. Heat from the warm 

ammonia radiates into the coldness 

of space as the fluid moves along the 

large radiator panels.

Figure 7. Deployment of the PhotoVoltaic 

Radiator on the P3 truss during STS-115/ISS12A in September 2006. The sequence from top 

to bottom shows the radiator unfolding from the 

compact launch configuration to its fully extended 

length, approximately 12.53 m (~493.4 in.). 

Each of the seven radiator panels is approximately 

3.12 x 1.79 x 0.02 m (~124 x 70.6 x 0.69 in.), 

or about the size of two queen-sized mattresses 

placed next to one another.

In the EETCS, ammonia flowed

from the PFCS through the P6 lines 

to Z1, through the Z1 lines to the aft 

end of the LAB where it joined the 

fluid lines on the LAB Aft Endcone, 

and through the heat exchanger to 

collect heat. The warmed ammonia 

then flowed back through Z1 and 

P6, this time all the way up to the 

radiators. The flow from each EETCS 

loop split, some flowing through the 

TTCR and some flowing through 

the Starboard Thermal Control 

Radiator. Some of the flow bypassed 

both of the radiators to provide 

warm ammonia to the FCV in the 

PFCS, which performed temperature 

regulation. Most flow from the 

heat exchanger flowed through the 

radiators to provide cold ammonia 

to the FCV, which then merged the 

warm and cold ammonia to achieve 

the desired temperature for ammonia 

to return to the pump, where it started 

the journey again. 

The PVTCS follows the same basic 

path, except that all heat loads are 

contained on one truss so the loops 

never leave that truss segment. 

Ammonia flows from the PFCS to the 

batteries and other control equipment 

that require cooling, then both 

PVTCS loops flow through the single 

PVR to the PFCS. If the electrical 

equipment is cool enough to not 

require cooling at that moment, the 

FCV flow will bypass the radiators 

and go directly to the pump where it 

starts the loop again.

The ETCS radiators are functionally 

the same as the EETCS/PVTCS 

radiators, though far larger and 

somewhat more complex. Each 

Heat Rejection System radiator 

has eight panels, each measuring 

3.4 x 2.7 m (131.25 x 107.00 in.), 

or a bit bigger than two king-size 

mattresses placed side by side. 

Together, the eight panels that make 

up one HRS radiator can reject up 

to 11.67 kW. The HRS radiator 

panels are built in much the same 

way as PVR types. Ammonia flows 

through the radiators the same way, 

though the HRS panels have only 

22 stainless steel tubes to carry 

ammonia across the radiator with 

each tube—about double the size of 

those in the PVR radiators at 0.32 cm 

(0.13 in.) in diameter. Each HRS 

radiator is used by only one ETCS 

loop, but each has two independent 

flow paths, thus allowing some 

flexibility of cooling capability. The 

22 tubes that run across each radiator 

panel are distributed between the 

two independent flow paths in an 

alternating pattern. Each ETCS loop 

has three HRS radiators installed 

side by side on a large rotating 

plate called a Radiator Beam Truss 

Structure, as shown in Figure 8. 

Three radiators provide a total of six 

radiator flow paths for a combined 

heat rejection capability of up to 

35 kW for each ETCS loop. The 

radiator flow paths were filled with 

nitrogen for launch and installation, 

and the cooling capability has proven 
204 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

greater than the need. Therefore, 

some of the flow paths still have their 

original nitrogen fill and have not yet 

been used. 

Figure 8. A major component of the ETCS as seen from the Space Shuttle. The left image shows the port and starboard radiator beams (three radiators per 

beam, with each radiator consisting of eight panels). On the right is a close-up of the Radiator Beam Truss Structure that is rotated by the Thermal Radiator 

Rotary Joint to maximize heat rejection. 

Though the EETCS radiators on

the P6 truss were fixed, each set of 

ETCS radiators can be rotated to 

improve heat rejection by positioning 

the radiator beam so that its three 

radiators are in an edge-to-sun 

position. This rotation is accomplished 

via the Thermal Radiator Rotary 

Joint (TRRJ) (Figure 8), which uses 

many of the same components as 

the Solar Array Rotary Joint (SARJ) 

described in Chapter 9. As with the 

SARJ, the TRRJ consists of a pair 

of drive/lock assemblies and a pair 

of rotary joint motor controllers 

(see Chapter 9). Unlike the SARJ, 

the TRRJ has a limited rotational 

capability because it is impractical to 

use fluid connectors that have a full 

360 degrees of rotation. Instead, the 

fluid hose rotary coupler provides 

fluid connections from one end 

of the TRRJ to the other, and the 

hoses within the fluid hose rotary 

coupler limit rotation to 210 total 

degrees of rotation, 105 degrees in 

each direction. The TRRJ interface 

is also much smaller than the SARJ 

interface. Whereas the SARJ rings 

are as large as the truss segment that 

houses it (i.e., large enough for a 

person to stand inside), the TRRJ is 

a fairly compact cylinder installed 

in the center of the S1 and P1 truss 

segments. Also, unlike the SARJ, 

the TRRJ generally does not need to 

rotate very much and can be left in 

the same position, changing only for 

specific attitude changes or certain 

solar beta angles (see Chapter 7).

The primary purpose of all three 

external systems is to cool the 

heat exchangers that provide heat 

transfer from pressurized modules. 

However, the ETCS also supports 

several EPS components that are 

located on the truss segments. These 

electrical components are mounted 

on an interface known as a coldplate, 

which both connects the component 

to the truss and provides an interface 

for ETCS cooling (Figure 9). Each 

coldplate is a broad plate with narrowset fins extending from it. Those fins 

interleave with fins extending from 

the electrical component such that 

heat from the electrical component 

fins radiates to the coldplate fins. This 

finned plate is bonded to a stainless 

steel flow plate, which is sealed to 

allow ammonia flow through the unit 

to pick up heat transferred through 

the aluminum fins. Each ETCS loop 

provides cooling to five electrical 

components in addition to five heat 

exchangers. Though the heat load from 

the electrical components is a small 

fraction of the heat load from the heat 

exchanger, the electrical components 

are fully dependent on ETCS cooling 

to function at full capacity. 

Water

in

Water

out

Heat

Coldplate

Hardware

Figure 9. A schematic 

showing how a coldplate 

works. Cold liquid 

flows in from the left 

side and picks up 

heat generated by the 

attached hardware. The 

warmed liquid then flows 

out toward the radiators. 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 205

Active Thermal Control—

Internal Cooling Loops

The equipment in the various ISS 

pressurized modules is cooled by 

the ITCSs, which function similarly 

to the external systems. Each major 

module—LAB, Node 2, Node 3, 

Japanese Experiment Module, and 

Columbus Module—has a separate 

ITCS. Equipment in the airlock 

is cooled by the LAB ITCS. The 

internal cooling system in each 

of these modules performs the 

same function and has roughly the 

same design even though there are 

differences in each module due 

mainly to differing needs, but also 

because of slightly different design 

approaches among the contractors 

who provided the systems. This 

section will focus on the LAB ITCS 

as an illustration of the ISS ITCS, 

then touch on the differences among 

the systems in the different modules. 

Water is used in the loops inside the 

ISS; ammonia is used in the cooling 

loops external to the ISS. Since water 

provides high thermal capacity (i.e., it 

is able to absorb a great deal of heat) 

with low viscosity (i.e., flows easily 

without requiring powerful pumps) 

and is not harmful to humans, it was 

a straightforward choice for internal 

cooling systems that operate at 

moderate temperatures.

When the International Space Station 

Needed a Plumber

In 2004, the 2B PVTCS developed a small leak. The leak was slow 

enough that it was tolerated. However, in 2012, the rate of leakage greatly 

accelerated and it was possibly increasing exponentially fast. At that rate, 

the loop would exhaust its ammonia supply fairly quickly. Fortunately, a 

spare, dormant system—the EETCS—was available. The operations team 

quickly developed a contingency spacewalk to replumb the ammonia 

flow from 2B through the TTCR of the EETCS. This was accomplished 

during an extravehicular activity (EVA) when the crew put in two fluid line 

hoses to connect the two systems. The TTCR had been retracted after it 

had been decommissioned, so it also had to be redeployed manually by 

the spacewalking astronauts. Although this did not stop the leak, it did 

show that the leak was not due to a hole in any of the myriad little tubes 

inside the radiator panel, which would be extremely hard to repair, if at all. 

In May 2013, the rate had again increased when ISS Commander Chris 

Hadfield noticed ice flakes coming from the port truss while performing an 

EVA. At the new rate, the loop would potentially be unable to sustain cooling 

in 24 to 48 hours. Once again, the operations team quickly put together a 

spacewalk within 48 hours to replace the pump assembly, which ultimately 

fixed the leaking system. In November 2015, the jumpers were removed and 

the cooling system returned to its nominal configuration. In a follow-on EVA 

in August 2016, the TTCR was retracted again and returned to a dormant 

storage configuration until it may be needed in the future.

The LAB ITCS, shown in Figure 10, 

is a water loop system that can 

be configured as two independent 

loops or as one combined loop, thus 

providing redundancy and flexibility 

in operations. When configured as 

two separate loops, each loop has a 

pump assembly, a number of valves, 

and water lines passing through the 

LAB pressure shell to reach the IFHX 

where heat is passed from the ITCS 

to the external system. In each loop 

configuration, warm water flows 

through the pump and is then sent 

to the heat exchangers for cooling. 

The cooled water flow then splits 

across many parallel paths to reach 

the equipment in racks throughout the 

module, is warmed by that equipment 

using coldplates, and returns to the 

pump to start the circuit again. Along 

that circular path, valves control how 

much water flows through different 

paths, thereby controlling loop and 

equipment temperatures and loop 

pressures. The ITCS has only three 

types of valves, though valves of 

the same type serve several different 

functions throughout each loop. 

Each of the independent loops has a 

three-way valve that moderates flow 

between the racks of equipment that 

need cooling, and a line that bypasses 

those racks. This valve, called the 

System Flow Control Assembly 

Modulation Valve, provides a 

constant differential pressure across 

the system. Each loop also contains a 

pump shutoff valve that provides the 

ability to isolate a pump from water 

flow when the pump is not in use. 

Each loop also has a three-way valve 

controlling the water flow through 

a heat exchanger, thus controlling 

the temperature of the loop (i.e., 

more flow to the heat exchanger for 

a colder loop, less flow to the heat 

exchanger for a warmer loop). A unit 
206 CHAPTER 11 SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION

called the Nitrogen Introduction 

Assembly contains two separate 

two-way valves used to control loop 

pressure at the pump. The first, called 

the Nitrogen Introduction Assembly 

Introduction Valve, provides access to 

the ISS nitrogen system to maintain 

or increase the loop pressure via an 

accumulator in the pump package 

of each loop. The other, called the 

Nitrogen Introduction Assembly Vent 

Valve, allows the nitrogen in each 

ITCS accumulator to be vented into 

the cabin to reduce loop pressure.

M

M

Three Way 

Mixing Valve

Low Temperature Loop

Moderate 

Temperature Loop

Pump Package

Assembly

Heat

Loads

Interface

Heat Exchanger

Three Way 

Mixing Valve

Regenerative

Three Way 

Mixing Valve

Pump 

Package

Assembly

Heat

Loads

Interface

Heat Exchanger

Loop

Crossover

Assembly

System Flow 

Control

Assembly

System Flow 

Control

Assembly

M

Figure 10. Schematic of the LAB Internal Thermal Control System. In the LTL, cold water (dark blue) 

comes out of the IFHX and, if needed to adjust the temperature, mixes with warm water (purple) at 

the TWMV. The adjusted water flows to the heat loads. It returns through the System Flow Control 

Assembly, which regulates flow through the loads and the flow bypassing the loads to ensure steady 

flow rates throughout the system. After leaving the System Flow Control Assembly, flow proceeds 

via the Pump Package Assembly to the heat exchanger to reject the heat that the water has picked 

up. The MTL behaves the same way, cooling hardware that operates at higher temperatures. In 

contingency cases, the Loop Crossover Assembly can be opened between the loops to create one 

big loop using only one of the two Pump Package Assemblies. In the big loop configuration, the 

Regenerative TWMV allows warm water at the outlet of the MTL pump to warm the water flowing 

toward the MTL heat loads to ensure the MTL coolant is at the right temperature for the warmer 

loads. Not all modules in the US On-orbit Segment have crossover assemblies. 

The two ITCS loops in the LAB

operate at different temperatures to 

support different cooling needs in 

various systems. The colder of the 

two, known as the Low Temperature 

Loop (LTL), operates at 9.4 ̊C 

(48.9 ̊F) whereas the Moderate 

Temperature Loop (MTL) operates 

at 17.2 ̊C (63.0 ̊F). These control 

temperatures are optimized for 

the cooling of different equipment 

in the LAB, but each TWMV is 

capable of controlling to a broad 

range of temperatures, limited by 

the capability of the heat exchanger 

that is providing the cooling and 

the heat provided by the equipment 

being cooled. The LTL services 

mostly the environmental and 

life support systems equipment 

and payload racks that require 

cooling to lower temperatures. 

The MTL services mostly avionics 

and electronics across a variety of 

systems. The dew point on the ISS 

is kept in the 8°C to 10°C (46°F to 

50°F) range, meaning that water 

will condense on any surface colder 

than those temperatures. For that 

reason, the LTL lines are covered 

in thick insulation to prevent any 

moisture collection. Since the MTL 

operates at temperatures above the 

dew point, the MTL fluid lines are 

uninsulated. A pair of 8-port valves, 

together called the Loop Crossover 

Assembly, allow the two ITCS loops 

to be connected in series such that 

one pump can provide flow to a 

single, larger loop. This mode can 

be used if there is a problem with 

one of the pumps. In the single loop 

configuration, water flows through 

the LTL loads and then through the 

MTL loads. The water temperature 

at the outlet of the LTL loads is not 

usually warm enough to ensure that 

the fluid lines will remain above the 

ISS dew point; therefore, the water 

must be warmed before flowing 

into uninsulated MTL fluid lines. A 

water-to-water heat exchanger, called 

the Regenerative Heat Exchanger, 

transfers heat from the warmest water 

in the system at the outlet of the 

MTL, to the cooler water at the outlet 

of the LTL to ensure water moving 

from the LTL lines to the uninsulated 

MTL lines is warmer than the ISS 

dew point. A three-way valve known 

as the Regenerative TWMV controls 

how much of the warmest MTL water 

passes through the Regenerative Heat 

Exchanger to control the resultant 

temperature of the water flowing out 

of the LTL and into the MTL. In the 

first years of LAB ITCS operation, 

the system was run as two separate 

loops, known as the dual-loop 

configuration. After an MTL pump 

failure in 2003, the ISS thermal 

community decided to preserve 

operational life on all remaining 

pumps by operating the ITCS in the 
SYSTEMS: THERMAL CONTROL—THE “CIRCUL ATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION CHAPTER 11 207

single-loop configuration. Operating 

in this fashion means only one pump 

is running at a given time, and is 

therefore experiencing wear and tear. 

Heat is removed from some of the 

hardware using coldplates, as shown 

in Figure 9. A rack can house several 

coldplates, in which case the whole 

rack is treated as one heat load 

with a rack FCV that functions in 

the same way as TWMVs to allow 

for temperatures to be adjusted, 

depending on the need of what is in 

the rack (Figure 10). 

Conclusion

The thermal environment of space 

is extremely challenging to manage. 

The ISS has multiple thermal systems 

to help keep the space station from 

getting too hot or too cold. The 

systems employed on the ISS are 

actually similar to those used in 

terrestrial buildings. Fiberglass 

insulation in the walls or paint on 

a house are examples of passive 

thermal systems used every day. 

Heaters are also employed on the 

station and in the home to prevent 

areas from getting too cold. Most 

buildings and homes in hot climates 

have air conditioning, where heat 

is transferred to a fluid that, in turn, 

is radiated outside of the vehicle 

or building. One major difference 

exists between terrestrial heating and 

cooling systems and those employed 

on the ISS: when an air conditioner 

on Earth fails, a repairman can 

order parts and come fix it. When 

cooling fails on the ISS, every other 

system—from power generation, to 

computer controls, to the astronauts 

themselves—are put in jeopardy. 

Only the materials that are already 

in space can be used to make the 

repair. In the end, the ultimate goal 

of both Earth-based systems and the 

ISS thermal systems is the same: 

to keep the structure and occupants 

safe and comfortable inside. The 

engineering challenge with the ISS 

was to have a thermal system that 

worked in the extremes of the space 

environment, worked with the first 

elements of the ISS, and was able 

to adapt as the structure grew and 

matured. The flight control team 

carefully watches and manages the 

various cooling loops as the heat 

loads (e.g., different experiments 

or numbers of astronauts) vary and 

as the space station orbit changes 

(e.g., when the beta angle gets above 

60 degrees). The flight control team 

has also had to deal with significant 

failures in the system, such as when 

the pump that controlled ETCS 

Loop A failed, essentially removing 

half of the ISS-critical systems. Or 

when the FCV in the ETCS failed, 

which removed the ground’s ability 

to control the loop temperature and 

thus provide adequate cooling to 

other ISS systems. Any number of 

failures elsewhere on the ISS could 

have meant the loss of the crew 

or spacecraft (for more details, 

see Chapter 20). As with so many 

aspects of life in space, something 

taken for granted most of the time 

on Earth requires thoughtful design 

and focused attention to detail in 

operation to enable humans to live 

in the utter darkness and extreme 

brilliance of space.

Chapter 12 Day in the Life:

Empty House—

Decrewing 

the International 

Space Station
210 CHAPTER 12 DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION

Lights out. An empty US Laboratory module. 

As discussed in other chapters, 

the International Space Station 

(ISS) was largely designed to 

be controlled by operators from 

the ground. This would allow 

crew members to focus their time 

on scientific research and not the 

“humdrum” daily activities required 

to keep the scientific laboratory 

running. However, many tasks require 

crew insight and hands-on actions, 

especially in the cases of repairing 

failed equipment and responding to 

emergency events.

What would it mean if, for some 

reason, all of the ISS crew members 

needed to return to Earth? Would all 

scientific research stop? Could the ISS 

even survive without a crew, and for 

how long? In August 2011, the ISS 

Program was asked these questions. 

On August 24, 2011, the Progress 

vehicle number 44P (i.e., the 44th 

Progress resupply vehicle in the ISS 

Program) was lost due to a problem 

in the engine of the Soyuz U rocket’s 

third stage. Although the loss of 

supplies being carried on a supply 

vehicle, such as Progress, would 

impact operations, the ISS Program 

continuously plans consumables to 

overcome the loss of at least one 

resupply mission (see also Chapters 1 

and 14). The bigger impact to this 

loss was the similarity of the third 

stage of the Soyuz U rocket used 

to launch Progress cargo vehicles 

and the third stage of the Soyuz FG 

rocket used to launch Soyuz crewed 

vehicles. Immediately following 

the Soyuz U third stage failure, 

Roscosmos State Corporation for 

Space Activities—the government 

body that oversees Russia’s space 

program—started an investigation 

into the cause. However, it was 

unknown how long the investigation 

would last and whether any corrective 

actions would need to be taken on the 

Soyuz U and Soyuz FG rockets.

Until the Soyuz U third stage 

failure was understood, the safety 

of launching new crews remained 

unclear. The crew on board the ISS 

was safe. However, Soyuz return 

vehicles have a limited lifetime. This 

presented the potential of needing to 
DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION CHAPTER 12 211

return the current crew to Earth prior 

to the arrival of a new crew, thus 

decrewing the ISS and leaving it an 

empty house.

The ISS Program and operators 

around the world began a thorough, 

time-limited review of space 

station operations to determine any 

changes to vehicle configuration or 

ground systems needed to keep the 

ISS operational during a potential 

decrewing of unknown duration. 

This chapter outlines the history of 

potential ISS decrewing discussions, 

how the 2011 event response was 

developed, and the systems and 

operations changes that would have 

been enacted in the event the ISS 

was decrewed.

History

Decrewing the ISS was not a new 

concept. The potential had existed 

ever since the first crew docked to 

the space station. In the early days, 

if a crew member became so ill that 

he or she had to return to the ground 

for immediate medical treatment, 

then the entire crew might have been 

forced to leave the ISS. With the 

advent of six-crew operations, it is 

more likely that at least one crew of 

three can remain on board. However, 

the ISS could become uninhabitable 

due to an off-nominal situation such 

as fire, depressurization, or major 

systems failure. These unlikely 

scenarios would not allow much 

time for preparation. With crew 

member safety being of the highest 

importance, the crew return vehicles 

will act as lifeboats to bring them 

home. Following an emergency, 

the ISS would be maintained and 

hopefully fully recovered in a besteffort capability using the technical 

expertise that NASA and its partners 

have developed over years of 

spaceflight experience.

Planned decrewing of the ISS had 

also been discussed and documented 

multiple times. Early in the program, 

the planning of crew rotations 

sometimes ran into issues with the 

logistics of launch vehicle processing, 

meaning that the potential need 

for one crew to return before a 

replacement arrived existed, but 

it never actually occurred. At that 

time, the small-but-growing space 

station had been operated uncrewed 

for its first 2 years. Decrewing the 

ISS dealt a major impact to assembly 

operations and scientific research 

since crew members were required 

to perform many of these operations. 

However, decrewing was not thought 

to be a major concern for the overall 

survival of the station itself due 

to the design goal of being remote 

controlled. Over the years, barring 

any issues with vehicle upgrades or 

accidents, this planning became a 

well-oiled machine and is no longer 

much of a concern. Decrewing the 

ISS was also a topic following the 

Space Shuttle Columbia accident. 

The shuttles provided the capability 

to launch and return crew members, 

and deliver large quantities of 

consumables to the ISS. The Space 

Shuttle Program performed a lengthy 

investigation and recovery effort; 

thus, the ISS partnership was able 

to keep the ISS staffed by reducing 

crew size and relying on Russian 

capabilities to launch astronauts 

and supplies. At the time of the 

Progress 44P accident in 2011, which 

followed the retirement of the Space 

Shuttle fleet, no alternative to the 

Russian Soyuz crewed spacecraft to 

launch or return astronauts existed.

The outcome of many of these 

discussions were documented in 

operational products, including 

procedures and Flight Rules. 

These products would be used 

and built upon to develop an 

operational philosophy for a 

decrewed space station.

Framing the Discussion

In many ways, it was up to the 

operations teams to determine how to 

continue operating without a crew on 

board. But first, the operations team 

and the ISS Program developed a set 

of priorities to drive the discussion 

and decisions that would result in the 

decrewed space station configuration.

The high-level priorities, in order, 

were:

1. Keep the ISS safely operating until 

a crew could return, and beyond.

2. Prevent the loss of critical 

hardware and maximize critical 

system redundancy. This 

included performing preventative 

maintenance on systems whose 

expected lifetime would expire 

before a crew would return, and 

potentially using temporary power 

or data extension cables to increase 

flexibility following failures.

3. Prevent loss of scientific data, 

and consider delaying the start 

of new scientific research that 

would be lost if the crew was not 

available to finish it.

4. Optimize the ISS configuration 

to allow for an efficient return of 

a new crew.

5. Continue scientific research 

that could be controlled from 

the ground.
212 CHAPTER 12 DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION

Once these priorities were agreed 

to and established, the combined 

operations, engineering, and program 

teams set out to determine the best 

ISS configuration for decrewed 

operations. A lead flight director was 

assigned to integrate the operational 

aspects, develop a review schedule, 

and outline expectations for the team.

At a high level, the team focused 

on the time available and actions 

required prior to decrewing, 

establishing the ISS and ground 

systems configuration, the operations 

plan (including emergency response) 

during decrewed operations, and 

developing a plan to recrew the ISS 

once the launch vehicle safety was 

reassured. A notional schedule (see 

Figure 1) was pulled together. This 

schedule outlined the 12 weeks that 

were available for the assessment. 

If, in the future, the potential to 

decrew the ISS arises again, a similar 

schedule would be used.

S M T W T F S

4 5 6 7 8 9 10

6 7 8 9 10 11 12

2 3 4 5 6 7 8 

9 10 11 12 13 14 15

16 17 18 19 20 21 22

23 24 25 26 27 28 29

30 31 1 2 3 4 5 

11 12 13 14 15 16 17

13 14 15 16 17 18 19

18 19 20 21 22 23 24

25 26 27 28 29 30 1

Today

45P Dock

28S Dock

27S Undock

IMMT

Go/No Go Decrewing Prep

42P Undock Unmanned 

Sim (TBR)

Prelim Recs

Final Recs

Prelim Config

26S Undock

Final Config

Plan 

Approval

SEPT

OCT

NOV

Figure 1. Initial schedule for the 2011 ISS decrewing assessment. In the schedule, IMMT refers to the ISS Mission Management Team (see Introduction), 

27S and 28S refer to the 28th and 29th crewed expeditions, respectively, and TBR indicates the date is To Be Reviewed.

This timeframe allowed approximately

1 month to develop the recommended 

configuration. Once complete, the 

recommendation would be taken 

to the ISS Program for review and, 

hopefully, approval. One month 

prior to decrewing the space station, 

the ISS Mission Management Team 

(see also Introduction) would give 

final approval to implement the 

decrew configuration, which the team 

estimated would take 4 weeks of 

non-dedicated crew time—meaning 

the crew would continue scientific 

research, as well.

Using these priorities, areas of focus, 

and schedule, the team divided into 

multiple groups to quickly assess 

the actions required. These groups 

jointly reviewed overall status 

biweekly, looking for concurrence 

on recommendations and requesting 

any assistance needed. The lead 

flight director then officially reported 

the status to the ISS Program 

management on a weekly basis.
DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION CHAPTER 12 213

System Changes

Using the priorities established 

above, the decrewed ISS 

configuration was developed to 

ensure the station would continue 

to fly safely and perform scientific 

research. Although there would not 

be a crew on board to respond to 

emergency situations or repair broken 

equipment, many of the decrewing 

actions dealt with minimizing 

the potential for these events or 

increasing the ground operators’ 

ability to handle these situations.

The already-docked Progress vehicle, 

42P, would be configured so that 

it could be undocked remotely by 

the Russian flight control team, if 

needed, yet continue to provide the 

ability to perform debris avoidance 

maneuvers (see Chapter 8). Similar 

to the Soyuz vehicle, this Progress 

had limited lifetime and would need 

to be undocked before posing a 

risk to the ISS, or before it would 

be unable to complete its mission. 

Also, undocking the Progress once 

its resources were expended would 

provide an additional open docking 

port for either a new Progress full of 

supplies or a redundant docking port 

for a returning crew. The most critical 

step in this preparation would be to 

have the crew remove the clamps that 

helped hold the vehicles together. 

Prior to its undocking, the ISS would 

be reboosted to a higher altitude 

to make use of available Progress 

propellant and prolong the orbital 

lifetime of the ISS in the event of a 

major delay of fuel resupply.

Although the ISS has been designed 

to minimize the risk of an on-board 

fire, there is still the low likelihood 

that one could occur (see also 

Chapter 19). Since the crew would 

not be available to fight a fire, the 

risk would be further minimized 

by powering down non-essential 

equipment (based on priorities). This 

non-essential equipment includes 

crew-tended payloads and crewsupport equipment such as the toilet.

The crew also responds to ISS 

rapid depressurization emergencies 

potentially caused by orbital debris 

impacts by closing hatches between 

modules, which will hopefully isolate 

the leak to a single module. Initially, 

the team believed the best decrew 

configuration would be to isolate 

each module. Therefore, if a module 

started to depressurize, only that 

module would be affected. However, 

analysis of the isolated configuration 

for longer durations showed that 

a potentially large variation in 

pressure and temperature would 

occur between the modules. To keep 

the atmosphere of the ISS within 

temperature and pressure limitations, 

it would be best to keep air moving 

between the modules. The decrew 

configuration would have the crew 

close hatches prior to leaving, but 

Intermodular Ventilation (IMV) (see 

Chapter 19) would be left enabled, 

meaning vent ports and fans between 

modules would be left open and 

blowing. In the event of a depress, 

automatic software would deactivate 

the fans and close the vent ports, 

thereby isolating all of the modules. 

Leaving IMV enabled would 

assist with maintaining a uniform 

atmosphere between modules and 

could assist in some emergency 

events (see below).

Humidity levels in the ISS 

atmosphere were another concern. 

Normally, water is added to the ISS 

atmosphere as the crew exhales and 

perspires. Humidity is removed 

from the atmosphere by the ISS 

Thermal Control System (TCS) to 

keep the crew comfortable, prevent 

condensation from damaging the 

equipment, and add to recycled 

water stores. This water is sent to 

the Regenerative Environmental 

Control and Life Support System 

(ECLSS) (see Chapter 19) for 

recycling. However, little to no water 

would be added to the atmosphere 

without a crew on board, and there 

was no safe controllable way for 

ground controllers to release water to 

increase humidity. Low humidity is a 

concern to the ISS critical electronics 

as it can lead to the buildup of static 

electrical charges. These static 

charges could potentially cause 

electrical arcs that would damage 

critical systems. These arcs would 

be similar to the shocks that can 

be felt when touching a metal door 

handle on a cold, dry winter day on 

Earth. To prevent drying out the ISS 

atmosphere too much prior to the 

crew leaving, the internal cooling 

loop temperatures would be raised 

to stop condensing water out of the 

atmosphere. The Environmental 

and Thermal Operating Systems 

(ETHOS) officer would need to 

actively monitor the fine balance 

of maintaining enough humidity in 

the atmosphere while preventing 

condensation on cooler surfaces. It 

is important to note that the ISS did 

not have a humidity sensor; thus, all 

of the information ETHOS would use 

for this monitoring would be based 

on temperature data and analysis. 

If the analysis was wrong and the 

atmosphere dried out, the ground 

team would not be able to recover the 

correct humidity levels.
214 CHAPTER 12 DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION

Preparing to Abandon Ship 

Colonel Mike Fossum, Commander, Expedition 29

The crew of Expedition 28 was following the launch 

of the 44th Progress resupply vehicle (44P) with great 

interest because we knew the ship would bring not 

only necessary supplies, but also fresh food and care 

packages from home. When we heard about the launch 

failure, the crew huddled together to discuss the events. 

We were initially disappointed in the lost supplies; 

however, within a few minutes, we realized the booster 

used to get the Progress cargo ship into orbit was 

very similar to the one used to launch humans on the 

Soyuz spacecraft. The investigation of a rocket failure 

that scattered debris across many hundreds of miles 

was going to take time. Perhaps a lot of time. We knew 

immediately this might mean our stay on the ISS could 

be extended for as long as the on-orbit lifetime of our 

Soyuz spacecraft would allow. And it could mean we 

would be forced to leave before the next crew arrived. 

The ISS—an amazing orbiting laboratory representing 

the hopes and dreams of 15 partner nations—could 

be without a crew for the first time since Expedition 1 

began in 2000. The enormity of the situation quickly 

became clear. We had a new mission: Steel ourselves 

for a longer-than-intended stay, prepare the space 

station for operations without a crew on board, and do 

whatever we could to help prepare the next crew to take 

control of the ship with little to no handover time.

Figure 2. Astronaut Mike Fossum installs an electrical bypass jumper to 

provide a redundandt power feed for the MBSU-1 in case the ISS had to 

be left uncrewed. 

Maintaining the viability of the 

Regenerative ECLSS (see Chapter 

19) was a major concern for the 

team. Although the Regenerative 

ECLSS is an engineering marvel 

that consistently recycles a large 

majority of the water on the ISS and 

provides clean drinking water and 

breathing oxygen, it is still a new 

technology that can be temperamental 

and require manual input to keep 

it running. Additionally, part of the 

closed-loop ECLSS is the crew. 

They inhale oxygen and drink water 

that is provided by the system. In 

turn, they exhale carbon dioxide 

and produce water in the form of 

perspiration and urine, which is 

taken into the system for cleaning. 

Without a crew on board, this closed 

loop is broken. One option for the 

decrewed configuration would be to 

deactivate the Regenerative ECLSS 

and let it sit idle after draining out 

the fluids or leaving the fluids (e.g., 

water or urine) stagnant. Removing 

all fluid from the system would be 

time consuming and difficult, and 

success could not be guaranteed. 

Additionally, the engineering team 

was concerned that parts would 

become damaged and need to be 

replaced if the Regenerative ECLSS 

was dried out, potentially leading to a 

long period of fine tuning the system 

to get it running again. If fluid was 
DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION CHAPTER 12 215

left stagnant, microbial growth and 

chemical changes to the fluid could 

occur. Think about the drains and 

water lines of a house that has been 

sitting vacant for an unknown amount 

of time. However, the Regenerative 

ECLSS was designed with multiple 

recirculation loops internal to 

processing equipment. These loops 

were included to allow for start-up 

transients or failures where the output 

of the system did not meet quality 

standards. In these cases, the output 

would be rerouted back to the input 

and sent through the system again, 

in an attempt to continue to further 

clean the water (see Chapter 19). 

The ETHOS controllers would 

periodically use these recirculation 

loops to move water through the 

Regenerative ECLSS for the duration 

of a decrewed configuration. This 

would keep the system running and 

prevent stagnant fluid concerns.

Prior to decrewing, the crew would 

install multiple electrical power and 

thermal cooling jumpers to maximize 

critical system redundancy. At the 

time of the Progress 44P accident, 

the firmware controller for Main 

Bus Switching Unit (MBSU) (see 

Chapter 9) 1 was degraded. A jumper 

would provide power from a pair of 

parallel internal Direct-Current-toDirect-Current Converter Units, since 

this increased the risk of MBSU 1 

Emotions on board ran the gamut. Members of the 

Expedition 27-28 crew were supposed to head home in a 

couple of weeks, but immediately started hearing rumors 

of a 2-month extension. Some were happy about having a 

longer stay, but some had already started thinking about 

returning to the delights of hot showers, real food, and 

loving families. I told my family that they would hear a lot 

of rumors, but don’t expect me home for Thanksgiving, 

Christmas, or New Years. Although nobody could know for 

sure, I figured it was better to just set the expectation early 

for both my family and myself.

Meanwhile, the ground team, led by Flight Director Scott 

Stover, started working the plans for us to prepare the ISS 

in case we needed to leave it without a crew on board. 

The ISS is an amazing ship, but it was intended to be 

operated with a crew to help keep it running and recover 

critical systems in the event of failures. Our workdays 

accomplishing the myriad of science objectives became 

interspersed with just-in-case activities, such as running 

electrical jumper cables as thick as your forearm to provide 

a secondary source of power in case a critical electrical 

component failed (Figure 2). We went about these tasks 

with the grim realization that we could not protect for every 

possible thing that could go wrong. Without a crew on 

board, we were at risk of losing the ISS.

While the specialists were working in Houston, Moscow, 

and around the planet to figure out how to protect the 

vehicle, we started thinking about how to help prepare 

the next crew members to be successful when they 

finally arrived. Our preflight training is very good, but 

many details associated with living and working on the 

Space Station are impossible to simulate and train on the 

ground. Under normal crew rotation schedules, we hand 

over those “tricks of the trade” during the 2 to 4 months, 

which we overlap on the ISS. By the time the senior crew 

departs, the junior crew is ready to take the lead, then 

train the incoming new crew. Knowing we would not 

have the benefit of significant (if any) handover training 

time, we started recording videos to show the new guys 

how to get the job done. This included a wide variety of 

activities such as compressing/sealing nasty wet trash 

bags, cleaning hard-to-access filters, and configuring the 

confusing pulmonary function test equipment. By the end, 

we sent down more than 22 hours of instructional videos.

In the end, everything worked out very well. The Expedition 

27-28 crew returned home with only a 1-week delay. 

As the Commander of Expedition 29, I knew we were 

shorthanded for a couple of months; however, were ready 

when the crew of Expedition 29-30 (Dan Burbank, Anton 

Shkaplerov, and Anatoly Ivanishin) arrived on Soyuz 28. 

We didn’t sleep much during our 6 days of sharing the ISS, 

but thanks to the excellent preparation from the ground 

team and the crew’s dedication to extra training and video 

reviews, they were ready to take charge as we closed the 

hatch and headed home. Our homecoming was delayed 

only a week, and I arrived home to my family just in time 

for Thanksgiving. And a joyous homecoming it was!
216 CHAPTER 12 DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION

failure and loss of power to half of 

the critical computers and cooling 

equipment on the ISS. A jumper 

could provide power from either 

MBSU 1 or MBSU 4 to these critical 

components. Additionally, critical 

power and computer equipment in 

both the Laboratory Module and 

Node 3 is nominally cooled by the 

Moderate Temperature Loop (MTL) 

of that module (see Chapter 11). In 

the event of an MTL leak during 

crewed operations, the crew would 

jumper critical equipment so that 

that it could be cooled by the 

Low Temperature Loop (LTL). 

For decrewing, half of the critical 

equipment would be preemptively 

jumpered to the LTL, meaning that 

a leak on either the MTL or the LTL 

would impact only half of the critical 

equipment. It is also important to note 

that in this jumpered configuration, 

the ground-controlled capability to 

integrate the MTL and LTL into a 

joined single loop is still possible; 

therefore, failure of a single ITCS 

pump would not cause the loss of 

cooling to critical equipment.

The team looked into multiple ways 

to maximize ground insight and 

command capabilities to the ISS. 

At the time of the Progress 44P 

accident, all commanding to the ISS 

was through the S-band systems 

or Russian Ground Sites (see 

Chapter 13). To provide additional 

redundancy, the team developed a 

way to connect the crew’s Portable 

Computer System (PCS) (see 

Chapter 5) commanding laptops to 

the ISS Joint Station Local Area 

Network (JSL). Once connected 

to the JSL, a flight controller 

would be able to remotely log into 

the PCS using the ISS Ku-band 

system and then send commands 

from the PCS. The ISS Ku-band 

system was later updated to 

provide standard commanding 

without the need to log into a PCS. 

As an interesting sidenote, when 

originally brainstorming ways 

to command through Ku-band, 

the team recommended using the 

humanoid robotic payload Robonaut 

to physically interface with a PCS on 

board. This would have required a 

lot of development in a short amount 

of time since Robonaut operations 

were in their infancy at the time. 

As it turned out, the remote log-in 

capability was easier to implement.

Additionally, the JSL is the gateway 

to the Ku-band system; therefore, 

ground control relies on an onboard laptop server. Nominally 

due to internet protocol and device 

identity limitations, only one laptop 

is configured as a server. If that 

server fails, the crew must deploy 

a new laptop. The JSL engineering 

and ops teams developed a way 

for a second laptop server to be 

deployed and powered in a standby, 

non-interference way. In this 

configuration, if the primary JSL 

server laptop failed, the PLug-inplan UTilization Officer can easily 

configure the standby server to the 

primary role, thus restoring the JSL.

Another hurdle in being able to 

operate the laptops from the ground 

is related to their power source. 

On-board laptops receive power 

from Utility Outlet Panels (UOPs) 

(see Chapter 5). If a UOP loses 

upstream power but is later 

recovered, it will not output power 

to downstream equipment without 

the crew physically cycling a switch 

on the UOP, much in the way a 

Ground Fault Circuit Interrupter 

works on many household electrical 

outlets. In a decrewed configuration, 

it was important that the PCS and 

JSL laptops that were acting as 

backup command capability could 

be repowered after a potential loss 

of upstream power. To offer this 

functionality, a UOP Bypass Jumper 

was installed to provide power 

directly from a Remote Power 

Control Module (see Chapter 9) to 

the laptops. This would allow the 

Station Power, Articulation, Thermal, 

and Analysis officer to remotely 

control power going to the laptops. 

Interestingly enough, the UOP 

Bypass Jumper was developed early 

in the life of the ISS when it was 

determined that the original electrical 

grounding safing function of the UOP 

did not work with the Robotics Work 

Station (see Chapter 15). Although 

the grounding issue was corrected, 

the UOP Bypass Jumper was retained 

on board in case of unexpected 

needs, such as decrewing the ISS.

The crew is normally the on-scene 

eyes and ears of the flight control 

team. Video cameras or laptops 

with cameras were set up to supply 

overviews of each module, which 

would provide visual and auditory 

insight to the ISS during decrewed 

operations. The Communications 

Radio frequency Onboard Networks 

Utilization Specialist would then 

be able to cycle through available 

camera views to assist the flight 

control team in identifying offnominal situations. This would be 

greatly beneficial in the event of a fire 

or rapid depress.
DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION CHAPTER 12 217

Emergency Response

As discussed above, the crew 

takes a leading role in responding 

to emergency events on board the 

ISS. The team thoroughly reviewed 

emergency responses to develop a 

strategy for the flight control team to 

respond to each kind of emergency 

without a crew available.

Rapid Depress

As stated above, prior to leaving, the 

crew would close hatches between 

modules while the IMV was left 

enabled. If on-board sensors detected 

a depressurization, automatic 

software would close the IMV valves, 

thus isolating the modules. If a 

depressurization is too slow to trigger 

automatic software, the flight control 

team would manually command the 

Rapid Depress emergency response—

an action usually taken by the crew. 

This would limit the depressurization 

to the leaking module or modules. 

Without a crew on board, the leaking 

module could not be repaired. At that 

point, the flight control team would 

unpower equipment in the affected 

module. If the affected module 

contained critical equipment, the 

flight control team would attempt 

to keep the critical equipment 

operational on a best-effort basis. 

Toxic Atmosphere

As discussed in Chapters 11 and 19, 

one of the most dangerous events that 

can potentially occur on the ISS is 

the rupture of a TCS heat exchanger 

between the external and internal 

TCS loops. If this were to happen, the 

ammonia in the external loop would 

flood the internal loop and quickly 

fill the ISS atmosphere to lethal 

levels. Additionally, the pressure from 

ammonia entering the atmosphere 

could overcome ISS design limitation. 

However, a system of valves provides 

Positive Pressure Relief (PPR) by 

venting excess pressure overboard. 

This PPR is available only in certain 

modules. Many redundant levels of 

hardware design and hardware and 

software active controls prevent 

the heat exchangers from freezing, 

which could cause them to rupture. 

However, since the potential is so 

dangerous, the crew and ground 

teams train extensively to respond to 

a heat exchanger rupture. When crew 

members are on board, their response 

is to evacuate the United States 

On-orbit Segment (USOS), which is 

the only segment directly impacted 

by the ammonia. They do not have 

time to close hatches between USOS 

modules. However, the automatic 

toxic atmosphere software response 

does close IMV valves between 

modules. With the hatches left 

open, all USOS modules have PPR 

available. In a decrew configuration, 

the USOS hatches would be closed 

and automatic software that closes 

IMV valves would leave some 

USOS modules isolated with no 

access to PPR. If one of those 

modules contained the ruptured 

heat exchanger, that module would 

be exposed to pressures that could 

catastrophically damage the ISS. The 

team decided the best course of action 

was to inhibit the toxic atmosphere 

emergency software automatic 

response, which would leave the IMV 

valves open even if an ammonia leak 

was detected. This would provide 

PPR to the entire USOS, and would 

be similar to the crew response of not 

closing hatches. If the flight control 

team observed other potentially toxic 

substances via downlink cabin video 

or telemetry, the affected modules 

would be isolated by closing IMV to 

those modules.

Fire

Automated software response to 

a fire is to shut down both intramodular ventilation and IMV fans 

(see Chapter 19). This is based on 

the fact that there is no convection in 

microgravity. Without convection or 

forced ventilation, fires will consume 

the locally available oxygen and then 

extinguish due to a lack of additional 

oxygen (see “Convection—Gravity’s 

Cooling Mechanism” in Chapter 11). 

Following ventilation shutdown, 

a crew would use air sampling 

equipment to pinpoint the location 

of a fire. Once the location was 

identified, equipment in that location 

would be unpowered to remove 

possible ignition sources. The crew 

would then investigate this equipment 

further to determine the cause of a 

fire, and set up equipment to remove 

smoke from the atmosphere. Flight 

controllers would not be able to 

pinpoint fire sources or perform 

detailed equipment inspections 

without a crew on board. In this 

scenario, the team determined the 

best fire response would be to allow 

the automated software to terminate 

ventilation. The ground team would 

then review available telemetry, 

including cabin video, to determine 

whether any equipment show offnominal signatures. If telemetry 

pointed to a potential fire source, 

that equipment would be unpowered. 

Whether or not a potential source 
218 CHAPTER 12 DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION

was identified and unpowered, the 

flight controlled team would wait 

approximately 30 minutes to an hour 

for a fire to extinguish, and then 

reactivate ventilation to maintain the 

ISS atmospheric conditions and dilute 

any smoke in the cabin. If the fire 

reignited, ventilation would again be 

shut down. Additional scrutiny and 

powerdowns would follow prior to 

reactivating ventilation.

Recrewing

Per the ISS Program priorities, the 

team also took time to determine what 

actions, both on the ground and on 

board ISS, would best prepare for the 

arrival of a new crew to a decrewed 

station. This included identifying 

any consumables or equipment that 

would need to be launched with 

the new crew members, or prior to 

their arrival. Additionally, the team 

identified a list of items that the crew 

would need for quick access upon 

entering the station. This equipment 

included tools, air sampling devices, 

and personal protection equipment 

(i.e., gloves, goggles, masks) in case 

of an emergency on board while the 

space station was uninhabited. The 

current crew would gather these 

items and stage them in the Russian 

Segment where the new crew would 

be docking. A recrewing procedure 

and timeline was developed to 

return the ISS to a nominal 

configuration in the same way 

the team developed a procedure 

and timeline for implementing the 

decrewed configuration.

Training

Two important aspects of training 

were associated with developing 

the decrewed configuration. The 

first concern was crew training. In 

addition to preflight ground training, 

new crews received “handover” 

training from the current space 

station crews. This training revealed 

the most up-to-date configuration 

of the ISS, and provided handson tips and tricks to performing 

common procedures. If decrewing 

happened, the new crew would not 

have the benefit of this handover 

training. With that in mind, on-board 

crew members began making video 

recordings of common procedures, 

including voice-overs of the topics 

usually included during handover. 

They also recorded video tours of 

the ISS helping the ground teams 

understand the exact physical 

configuration of station systems and 

stowage. These videos were added to 

the training of the next crew and they 

continue to be used for future crew 

training. Additionally, the next-tolaunch crew members aided in the 

development of the decrewing and 

recrew procedures. This added to 

their familiarity with the procedures 

and would greatly benefit the team in 

the event the ISS was decrewed.

Second, the flight control team 

executed a decrewed configuration 

simulation. To do this, the ISS 

training team configured the ISS 

simulator to the expected decrew 

configuration. A team of experienced 

operators were then put through an 

exercise to respond to simulated 

equipment failures and emergency 

situations. This was used to test 

the decrew configuration and 

operational response. Although the 

team learned that some procedures 

would need to be modified, the 

simulation showed that the flight 

control team could maintain the ISS 

in a decrewed configuration.

Conclusion

When Progress 44P was lost due to a 

problem in the engine of the Soyuz U 

rocket’s third stage, the ISS Program 

was faced with the possibility of 

needing to leave the ISS uncrewed 

for an unknown amount of time. 

As seen in the past, the program, 

engineering, and operations team 

quickly stepped up to the challenge.

First, priorities were defined. 

These included maintaining ISS 

safety and operability, increasing 

ISS system robustness, and assuring 

the capability of flight control 

teams to respond to off-nominal 

situations, thus enabling a returning 

crew to quickly recover nominal 

operations and continue scientific 

research. Using these priorities and 

building on previous discussions 

and documentation, the ground 

teams developed procedures, plans, 

and training to place the ISS in 

the best configuration to support 

uncrewed operations and return to a 

crewed configuration.

The Russian Space Agency was 

able to determine the cause of the 

Progress 44P accident and return to 
DAY IN THE LIFE: EMPTY HOUSE—DECREWING THE INTERNATIONAL SPACE STATION CHAPTER 12 219

flying both Progress and the Soyuz 

vehicle before the need to decrew 

the ISS. However, having met the 

initial review and product plan, the 

team was prepared to implement the 

decrewed configuration and support 

the ISS, as necessary. If the potential 

to decrew the ISS arises again, a 

similar review will build off the 

plans, products, and lessons learned 

from this event.

Chapter 13 Systems: 

Communications 

and Tracking—

The Vital Link 

to the International 

Space Station
222 CHAPTER 13 SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION

NASA astronaut Jim Voss and Russian cosmonaut Yury Usachov are having some fun with Mission Control as they demonstrate their alternative means for 

communicating with each other on the International Space Station during the second crewed increment. 

Some of the most iconic 

statements in human history 

such as “Houston, Tranquility 

base here. The Eagle has landed!” 

would not have been possible 

without a good communication 

system—an essential part of any 

crewed or uncrewed spacecraft. 

It is critical that the communication 

system works. It is the link between 

the spacecraft and its crew and the 

flight controllers on the ground. 

Without a good communication 

system, the crew will not have 

adequate insight into the condition 

of the International Space Station 

(ISS) and the ground may not 

be able to help during nominal 

events or, more importantly, 

during emergencies. Spacecraft 

communication systems move 

information from one place to 

another. Information on the ISS needs 

to move between modules of the 

spacecraft, between the spacecraft 

and visiting vehicles flying in 

proximity, and between the spacecraft 

and the control centers on the ground. 

The types of ISS information that 

need to be moved include:

n Commands and computer 

configuration data 

n Health and status data on the 

various systems on the ISS

n Health, status, and ranging 

information of visiting vehicles

n Science experiment data 

n Two-way voice and video 

n Alarm tones

The communication equipment is 

known as the Communication and 

Tracking (C&T) system because 

it can be used to follow, or track, 

the spacecraft. This chapter will 

discuss the essential aspects 

of the C&T system. The main 

communication systems on board 

the ISS are organized into two prime 

areas: Radio Frequency (RF) and 

Baseband. A total of eight types of 

communication systems are located 

within these two main areas. Table 1 

summarizes the key systems and the 

number of each type.

Table 1. A summary of the different communication systems on the ISS. The RF systems are broken 

down by the portion of the electromagnetic spectrum that each uses (defined below). The numbers in 

parenthesis indicate how many of each system exists.

Types of Communication Systems on the International Space Station

n S-band

n Ku-band

n Ka-band

n L-band (for GPS)

n Ultra-high frequency (UHF)

n Very-high frequency (VHF)

n Audio

n Video

}

Baseband

RF

}

* Includes the original ISS S-band system known as the Early Communication System, a temporary

communication system used during the first 3 years of space station operations until the main 

systems were activated.
SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION CHAPTER 13 223

Radio Frequency 

Communication Systems

Conventional communication 

systems dating back to the first 

spacecraft—Sputnik, launched 

by the Russians in 1957—use RF 

links. Radio waves of varying 

frequencies are the same as those 

used by car radios, televisions, and 

cell phones. They are generally ideal 

for communicating with spacecraft 

because they tend to use minimal 

power, and the longer wavelengths 

can easily penetrate the Earth’s 

atmosphere. But a trade-off exists 

between frequency and the amount 

of information the signal can contain. 

Higher-frequency radio waves can 

carry more information but are more 

susceptible to signal degradation 

as the waves travel through the 

atmosphere. For example, satellite 

TV systems operate in the Ku-band; 

the radio waves are susceptible 

to heavy rain showers when the 

signal might be lost temporarily. 

The ISS uses different systems in 

different bands, depending on the 

specific need. Figure 1 depicts the 

electromagnets spectrum with the 

key bands used by the ISS.

Maritime 

Navigation 

Signals

3 KHz

1

L S C X Ku K Ka

2 4 8 12 18 26 GHz40

30 KHz 300 KHz 3 MHz 30 MHz 300 MHz 3 GHz

1-40 GHz

30 GHz 300 GHz

Navigation 

Aids

(e.g. loran-C)

AM

Maritime 

Radio

Shortwave 

Radio, 

Radiotelephohony

VHF TV,

FM Radio,

Navigation Aids

UHF TV,

Cell Phones, 

GPS

Satellite/

Microwave 

Telecommunications

Radio Astronomy, 

Radar Landing 

Systems

Very Low 

Frequency

Low 

Frequency

Medium 

Frequency

High 

Frequency

Very High 

Frequency

Ultra High 

Frequency

Super High 

Frequency

Extra High 

Frequency

X-ray and 

Visible Light

Increasing Wavelength

Satellite Frequency

Increasing Frequency

Figure 1. The RF spectrum used by ISS communication systems. By convention, the electromagnetic spectrum has been divided into specific bands. 

Several bands were delineated by their frequency range—high, very high, ultra, etc.—but several bands were also classified into smaller subdivisions and 

indicated by letters of the alphabet.

The main communication path relies 

on the NASA Tracking and Data 

Relay Satellite (TDRS) system, 

whereas the VHF link provides a 

direct radio transmission between 

a ground station and the ISS. The 

TDRS system consists of a number 

of satellites in geosynchronous orbit 

about the Earth that provide a relay 

link for the S- and Ku-bands between 

ground stations and the space station. 

With the satellites being distributed 

around the planet, the ISS can be 

in continuous communication with 

Mission Control.

S-band

The term S-band refers a specific 

range of radio frequencies at which 

the communication systems operate. 

The S-band range is a subset of 

the super-high-frequency range; 

specifically, 2 to 4 gigahertz. This 

type of RF communication system 

is the most common on the ISS.

The S-band communication 

system is comprised of three boxes 

referred to as Orbital Replacement 

Units: the Baseband Signal 

Processor, the Transponder, and the 

Radio Frequency Group (RFG). See 

Figure 2. The Orbital Replacement 

Units are mounted outside the ISS. 

One set is mounted on the P1 truss 

segment and the other set is mounted 

on the S1 truss segment. Only one set 

is used at a given time, and the two 

sets are alternated. 
224 CHAPTER 13 SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION

Keeping the Lines of Communication Open

The official name of the ISS S-band communication system is the Assembly 

Contingency Subsystem. Originally, the S-band system was intended to 

be used only during the ISS assembly sequence and, after that, only in 

contingency cases. The Ku-band system was intended to be the primary 

communication link for the ISS. To defer costs, the build-up of the Ku-band 

system was extended over more years than originally planned. The S-band 

system continues to operate as the prime communication system for the ISS. 

The Ku-band system is used primarily to support ISS utilization.

The S-band system is used to send 

commands from control centers 

around the world to the ISS. Because 

of this, the system is designated with 

the highest level of criticality. The 

second S-band system is activated 

and configured as a “hot” backup 

for critical operations where an 

unexpected failure of the S-band 

system would threaten the safety of 

the ISS crew members, spacecraft, 

or mission objectives. Upon a 

failure of the primary system, the 

communication link is recovered 

in a minimal amount of time 

(~40 seconds). The S-band system 

is also the primary means of sending 

telemetry data from the ISS to the 

ground. The telemetry data are 

sent to the ground in real time to 

support operations. These data can 

be stored on virtual recorders on 

board the ISS and sent down later.

Another critical function of the 

S-band system is to provide two-way 

voice communication with the ISS 

crew members and the control centers 

around the world. The S-band system 

has two separate voice channels 

referred to in operations as Space-toGround (S/G) 1 and S/G 2. Although 

interchangeable, the channels are 

allocated specific uses that are defined 

in operations policies. 

Software files that can be used by 

the on-board computers and records 

containing data about the ISS can 

be exchanged between the vehicle 

and the ground using the S-band 

system. Almost 300,000 individual 

pieces of data (e.g., temperature, 

energy level of a battery) have been 

designated for possible radioing to 

the ground. However, this represents 

only a subset of the data available on 

the ISS. About 10% of those values 

can be sent down via S-band every 

10 seconds. Sometimes, the flight 

controllers need to look at these 

additional data. Therefore, bulk 

quantities of unprocessed data can 

be retrieved directly from memory 

in the on-board computers. This data 

retrieval is useful in troubleshooting 

a malfunctioning piece of equipment 

or misbehaving computer software 

without exhausting the available 

bandwidth all the time.

The S-band system is capable of 

being operated in two modes: a 

high-data-rate (HDR) mode and 

a low-data-rate (LDR) mode. The 

HDR mode consists of a forward 

link (i.e., transmission to the ISS) of 

72 kilobits per second (kbps) and a 

return link (i.e., transmission from 

the ISS) of 192 kbps, and this mode 

simultaneously supports a pair of 

two-way voice channels (S/G 1 and 

S/G 2). The term “high” is relative 

as, these days, most people carry 

RF communication devices that 

communicate at speeds significantly 

faster. For example, depending on the 

city, carrier, and plan, one can expect 

smartphone download speeds of at 

least approximately 3 to 10 megabits 

per second (mbps)—about 15 to 

52 times faster than the ISS S-band 

system. The LDR mode consists 

of a forward link of 18 kbps and a 

return link of 24 kbps, and supports 

one two-way voice channel (S/G 1). 

This is slower than an old dial-up 

modem, which had speeds of 56 kbps. 

Originally, link speeds were 6 kbps 

and 18 kbps, respectively, with no 

voice channels. Later, the S-band 

system was upgraded, primarily to 

add one two-way voice channel to the 

LDR mode. 

HDR is the primary operation mode. 

This mode requires the use of the 

high-gain antenna (HGA) located in 

the RF group. The HGA is a steerable 

antenna and needs to be pointed 

precisely at the TDRS being used 

to relay the signal from the ISS to 

the ground. The data used to point 

the HGA originate in the Guidance, 

Navigation, and Control (GNC) 

Multiplexer/DeMultiplexer (MDM) 

and are sent to the Command and 

Control (C&C) MDM where they 

are converted to commands for the 

RFG (see Chapters 5 and 7). The 

commands are automatically sent to 

the RFG once per second to keep the 

HGA pointed at the correct satellite as 

the ISS orbits the Earth. 

If computers are not able to point the 

HGA due to a failure of its gimbal 

motors or a failure preventing the 

pointing data to be generated or sent 

to the RFG, then the flight control 

team will use the LDR mode. The 
SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION CHAPTER 13 225

LDR mode uses a hemispherical 

antenna. This antenna is not steerable 

and therefore does not depend on the 

GNC or C&C MDMs. However, its 

field of view is limited; therefore, 

the amount of time this antenna is 

in a line of sight of a TDRS satellite 

is also limited. For this reason, and 

because of the slower data rates, the 

LDR mode is used for contingency 

purposes only. 

A total of four operating modes 

are possible with HDR and LDR 

modes on each of the two strings of 

S-band. The modes can be changed 

manually by the flight control team 

on the ground or by crew members 

on the ISS. Generally, only one mode 

is used: HDR on one of the strings 

of S-band. The other modes and 

string act as a backup configuration. 

Fault detection, isolation, and 

recovery software, which can detect 

whether a component fails and then 

reconfigure to a backup unit, can also 

change the mode. 

Figure 2. The S-band RFG on the S1 truss segment, with the HGA and LGA highlighted. 

Ku-band

The Ku-band system is officially 

known as the Space-To-Ground 

Subsystem and operates at a forward 

link frequency of 13.7 MHz and a 

return link frequency of 15.0 MHz. 

This system was designed for 

and intended to be the prime 

communication system for the ISS 

precursor: Space Station Freedom. 

The Ku-band system was redesigned 

when the plans for Space Station 

Freedom changed to the ISS (see 

Introduction). The redesign was 

needed to accommodate the higher 

radiation environment encountered at 

the orbit in which the ISS would fly 

(see Introduction). In the beginning 

of ISS operations, the forward link 

operated at 3 mbps and the return link 

operated at 50 mbps. Although these 

data transfer rates are significantly 

higher than the S-band capacity, 

there was a growing need to have 

more bandwidth, especially to 

accommodate some of the planned 

payloads on the ISS. Upgrades 

that were made to ground systems 

allowed the downlink rate to increase 

to 150 mbps and the uplink rate to 

6 mbps. In 2007, NASA completed a 

major upgrade of the Ku-band system 

that boosted the forward link rate 

to 25 mbps and the return link rate 

to 300 mbps. NASA engineers are 

exploring options to further increase 
226 CHAPTER 13 SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION

the Ku-band return link rate as science 

experiments on the ISS require faster 

and faster return link rates. 

The ISS has two Ku-band systems; 

only one system is used at a time. The 

Ku-band system in its current state 

consists of the Ku Communications 

Unit (located inside the ISS) and the 

Transmitter/Receiver/Controller and 

Space-to-Ground Antenna (both of 

which are mounted outside the ISS). 

See Figure 3.

Figure 3. STS-132/ISS-ULF4 mission specialist Steve Bowen works to install the backup Space-to-Ground Antenna (the white radio dish near the top left of 

the figure) on the Z1 truss (located next to the original antenna, which is angled to the right).

Astronauts Make the Call . . . From Space!

The ability to make a telephone call from the ISS is extremely helpful to the 

crew members, psychologically, by allowing them to feel more connected 

to home. Calls may be personal—to a spouse or dear friend—or to the 

flight director to talk privately about an issue. However, this process is not 

as straightforward as making terrestrial phone calls. In particular, the crew 

can conduct a call only when the Ku-band satellite link is present. The calls 

must be initiated by the crew for privacy and security reasons. Receiving a 

phone call from space is a fun and unique experience. However, cases have 

occurred where recipients were incredulous about incoming calls from the 

ISS and would hang up on the caller. Also, as with phone calls on Earth, 

the wrong number can be dialed, which has happened on occasion. This 

system is also useful for the ground team. On more than one occasion, the 

crew was required to fix a problem with the S-band radio link. Because of the 

ground team’s inability to call the crew over the S-band radio link to request 

a procedure, the crew’s timeline was re-uplinked via the Ku-band system 

with a big banner-type message that instructed the crew to initiate an internet 

protocol call to Mission Control.

The Ku-band system is used to

transmit all video—internal and 

external—from the ISS. Live and 

recorded video are transmitted 

in high definition and standard 

definition. High definition has 

become the preferred format as 

the available bandwidth from the 

ISS has increased. Two-way video 
SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION CHAPTER 13 227

conferencing is supported and used 

routinely. The Ku-band system was 

upgraded to support a pair of twoway voice communication channels. 

Operationally, these channels are 

called S/G 3 and S/G 4. They augment 

the S/G 1 and S/G 2 channels in 

the S-band system. The ISS crew 

members can use the Ku-band system 

for email, internet access, and phone 

calls (i.e., internet protocol calls) to 

any number on Earth. The biggest 

use of the Ku-band system are the 

payloads that conduct scientific 

experiments on board the ISS. All the 

scientific data are transmitted to the 

ground by the Ku-band system. 

The forward link of the Kuband system is used to transmit 

operational planning data, control 

experiments, and to remote log-in 

to the ISS Local Area Network. The 

remote log-in process is needed to 

conduct operations (e.g., controlling 

Robonaut) and troubleshoot 

equipment, and to support email, 

two-way video conferencing, and 

telephone calls. 

The Ku-band system is the 

communication workhorse of the 

ISS. Every nation involved in the ISS 

depends on the system, mainly for 

their scientific research. 

The Ku-band system is highly 

directional. It must be pointed at the 

TDRS satellite within 0.5 degrees 

to transmit the high data rates. The 

GNC MDM and C&C MDM produce 

the pointing angles for the Space-toGround Antenna gimbals at a rate of 

once per second. The antenna then 

uses these angles to initiate a search 

of the forward link signal that is 

being relayed from the ground by 

the TDRS satellite. Once locked onto 

the signal, the antenna uses that signal 

to automatically track the TDRS 

satellite within the required accuracy. 

Figure 4. Mission Specialist Dave Wolf during STS-127/ISS-2 J/A on the P1 truss directly behind the UHF antennae. 

Ultra-High Frequency

The ISS is equipped with a 

bidirectional UHF communication 

system, as seen in Figure 4. 

The UHF systems provides 

two-way voice communication 

with the spacewalking astronauts 

and the ISS. A two-way voice link 

between the spacewalking astronauts 

and the flight control team on the 

ground is established when the 

audio portion of the UHF system 

is connected to the S-band system. 

Data from the astronauts’ suit and 
228 CHAPTER 13 SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION

biomedical data from the astronauts 

are transmitted to the ISS on the UHF 

system and then sent to the ground 

via the S-band system. 

The UHF system is only meant to be 

used around the vicinity of the ISS. 

The system cannot communicate 

directly with UHF stations on the 

ground because of the way the data 

are incorporated into the radio signal.

Wireless External 

Transceiver Assembly

Another radio frequency 

communication system— the 

Wireless External Transceiver 

Assembly—is associated with US 

spacewalks (Figure 5). The more 

common name for this system is 

the helmet cam video. Through a 

combination of a UHF link and an 

S-band link, the cameras that are 

mounted to the spacewalkers’ helmets 

provide real-time video back to the 

ISS. This video can be transmitted 

to the ground via the Ku-band 

system. The UHF link is used to 

issue commands to the three cameras 

that are mounted on the helmet. The 

S-band link is used to transmit the 

live video from one camera at a time 

to antennae mounted on the ISS. 

Figure 5. Mission Specialists Michael E. Lopez-Alegria (left—red stripes) and John B. Herrington 

(right—no stripes) perform Starboard Keel Pin operations on the P1 truss during STS-113/ISS-11A. 

The Wireless External Transceiver Assembly antenna is in view in the upper left (red arrow), above the 

Crew and Equipment Translation Cart. 

Ship-to-Ship 

Communication Systems

All spacecraft that approach the 

space station communicate directly 

with the ISS, once in range. 

Communications between spacecraft 

is often called “ship-to-ship.” The 

type of communication system, the 

capabilities, and the usable range 

vary from one spacecraft to another 

even though they are typically in 

the S-band portion of the spectrum. 

The Space Shuttle communicated 

with the space station via a UHF 

communication system that supported 

limited commanding, limited 

telemetry exchange, and two-way 

voice between the commanders of 

the two vehicles. The uncrewed 

cargo vehicles that resupply the 

space station (see Chapter 14) also 

communicate directly with the ISS, 

when in range. Incoming vehicles 

receive navigation information 

from the ISS that may be used to 

perform a rendezvous using Global 

Positioning Satellite data for each 

vehicle. Uncrewed cargo vehicles 

also accept crew-issued commands 

over the ship-to-ship communication 

system (e.g., abort and retreat) 

and provide telemetry on their key 

systems back to the ISS for the crew 

to monitor. These RF ship-to-ship 

communication systems are typically 

active only during the approach of 

the visiting vehicle. After a successful 

capture or docking, the system is 

deactivated. The operation of the 

system is the joint responsibility 

of Mission Control and the control 

center associated with the visiting 

vehicle (see Introduction). 

Baseband Communication 

Systems

Audio

An audio system on board the ISS 

allows crew members to talk to each 

other across modules and talk to the 

control centers on the ground. A key 

component of the audio system is the 

Audio Terminal Units (ATUs), shown 

in Figure 6. The ATU is essentially 

a complicated intercom system. The 

microphone converts speech-to-digital 

signals that the audio hardware then 

routes to any other communication 

panel on the ISS. A speaker reverses 

the digital-to-speech conversion. 
SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION CHAPTER 13 229

Fourteen ATUs are located throughout 

the United States On-orbit Segment 

(USOS) (Figure 7). The audio system 

also connects to the S-band and 

Ku-band systems to give the crew 

members access to the space-toground voice loops. Three alarm tones 

(emergency, warning, and caution) 

signal that something serious has 

occurred and the crew members are to 

respond (see Chapter 5). These alarm 

tones are also annunciated through the 

audio system. 

Figure 6. Three ATUs (red arrow) are located at the top, above the spacesuit, in the airlock. During 

preparation for a spacewalk, the suited crew members can plug into these units to communicate with 

each other and the rest of the crew or to the ground without using the battery-powered UHF system in 

the suit. Or, a crew member who is assisting the spacewalkers can use the ATU as a normal intercom. 

Node 3 

Aft

Lab 

Aft

Lab 

Forward

Airlock 

Forward

Node 2 

Port

Node 2 

Starboard

Columbus 

Aft

Columbus 

Starboard

JPM Aft

JPM 

Forward

Node 3 

Starboard

Cupola

Figure 7. Location of the ATUs throughout the USOS. In addition to providing communication between 

crew and ground, the ATUs provide caution and warning alarms. 

The audio system is a Time Division 

Multiple Access digital system. 

As many as five conference calls 

can be supported simultaneously 

with up to 12 ATUs connected to 

each conference. An ATU can be, 

and usually is, connected to more 

than one conference at a time. The 

astronaut is able to talk to anyone 

on the ISS or the ground that is 

tied into that conference by simply 

pushing a button on the ATU for 

the appropriate conference call. In 

a typical operational configuration, 

the first conference, known as Public 

Call 1, will include the Russian 

Segment and is used to talk to all 

crew members throughout the ISS 

during an emergency. The Russian 

Mission Control Center uses Public 

Call 1 for daily operations with 

the cosmonauts. The Americans, 

Europeans, and Japanese use two 

other conferences, known as Public 

Calls 2 and 3, for day-to-day systems 

operations and for payload (science) 

operations. The fourth conference, 

known as Public Call 4, usually 

includes only the USOS modules and 

is used by American, European, and 

Japanese control centers for private 

communications (e.g., when a crew 

member is conducting a planned, 

weekly conference with a flight 

surgeon or family member). 
230 CHAPTER 13 SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION

Video

The video system on board the ISS 

generates and distributes highdefinition and standard-definition 

video. As with audio, video signals 

can be routed from a variety of 

sources and directed to an assortment 

of destinations—whether it be to a 

computer monitor for the crew or 

to the ground. Standard definition 

cameras that are mounted externally 

are known as the External Television 

Camera Group (Figure 8). This group 

consists of the camera that can be 

panned, tilted, and zoomed, a light 

that moves with the camera, and a 

controller. These cameras operate 

continuously on the ISS and provide 

video of spacewalking astronauts, 

views of visiting vehicles, or views 

of the outside of the space station 

for the ground controllers to monitor 

(see Chapter 17).

The crew on board the ISS and by the 

flight control teams and engineering 

support teams around the world 

use the video system to monitor 

spacewalks, robotics operations, 

and arrival and departure of visiting 

vehicles, as well as for inspections 

of the ISS. Recall that there are very 

few windows to actually allow the 

crew to see outside. Live video of 

the astronauts can be useful for the 

ground team to monitor activities and 

assist the astronauts in their work. 

When the ISS bandwidth allows 

(i.e., not all in use by payloads or 

telemetry), one video feed from the 

ISS is streamed live on the internet. 

Occasionally the external cameras 

are used to track hurricanes and 

typhoons since the ISS provides a 

unique, real-time vantage of such 

situations. The video system is a key 

part in conducting media outreachtype events on board the ISS to 

help educate the public about life 

on the ISS. Often, the astronauts 

participating in the live event serve 

as their own camera crew. They will 

set up the camera in advance. Then, 

the flight control team will configure 

the video and Ku-band system to 

bring the view from the camera 

to the ground where the NASA 

Public Affairs Office distributes the 

video to the client. Figure 9 shows 

Expedition 31 flight engineer and 

European Space Agency astronaut 

Andre Kuipers setting up a camera in 

preparation for a Public Affairs Office 

event in the US Laboratory. Two 

other cameras are visible in addition 

to the one Kuipers is setting up. Over 

time, the camcorders on the ISS were 

replaced with more recent models.

The video from these cameras 

and the video from the Wireless 

External Transceiver Assemblies go 

external to internal by way of one 

of three external video switching 

units. Once internal to the ISS, 

the video is further distributed by 

one of four video switching units. 

High-definition video recorders are 

typically distributed throughout the 

USOS modules inside the ISS. The 

video from these recorders is also 

distributed throughout the ISS and 

are connected to the Ku-band system, 

allowing video to be downlinked to 

the ground. The video units are also 

connected to the Robotic Workstation 

monitors in the Cupola and the US 

Laboratory, thereby allowing the 

crew to view the live video from the 

External Television Camera Groups 

or from the Mobile Service System 

(see Chapter 15). Usually, the flight 

controllers will configure the video 

system when it is needed, leaving the 

crew to only power up and position 

internal cameras. 

Figure 8. View of the S1 truss segment External Television Camera Group. The white oval is the light 

attached to the camera (tan rectangular box directly to the left of the light). If there is nothing critical to 

watch at the ISS, the flight controllers will point the cameras at the Earth to allow the team to enjoy the 

view from above in the control center. 
SYSTEMS: COMMUNICATIONS AND TRACKING—THE VITAL LINK TO THE INTERNATIONAL SPACE STATION CHAPTER 13 231

Figure 9. In 2012, Expedition 31 flight engineer and European Space Agency astronaut Andre Kuipers works with a video camera while preparing for a 

Public Affairs Office event in the Destiny US Laboratory. 

Managing the video system is a 

complicated job performed by 

the Communication Rf On-board 

Network Utilization Specialist. 

The video management needs to be 

planned in advance and executed on 

time because of the dozens of video 

sources on board the ISS, Ku-band 

return link bandwidth limitations, 

time constraints, and input and output 

constraints on the video switches. In 

addition, a number of payloads use 

video, recorded and live, to observe 

experiments and document the results. 

The daily coordination spans multiple 

control centers around the world.

Conclusion

Since the beginning of the Space 

Age, video and audio communication 

systems have been referred to as 

the eyes and ears of a spacecraft. 

The communication system of a 

spacecraft has always been vital to 

a mission, whether for video of an 

astronaut saying, “Roger, zero-g and 

I feel fine,” from the moon, or video 

of plants or other experiments on 

the ISS, In addition to bringing the 

cosmos to Earth, the ground uses 

communication systems to support 

the astronauts by ensuring they 

complete their missions safely and 

effectively. The ISS has a number 

of different communication systems 

that are used for highly specific 

functions. Audio communication 

between crew members on the 

large space station, as well as the 

ground, allows for timely, efficient 

operations. Video can be used to 

provide information about life on 

board the space station or to record 

data. Due to the critical nature 

of communication, the systems 

are designed with a great deal of 

robustness and redundancy. To help 

ensure a smooth operation, the 

flight control team is just a quick 

call away.

Chapter 14 Day in the Life:

Vital Visiting Vehicles—

Keeping the 

Remote Outpost 

Crewed and Operating
234 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

Expedition 45 astronauts and cosmonauts gather to watch the launch of the Orbital ATK Cygnus resupply spacecraft atop of the United Launch Alliance 

Atlas V rocket from Cape Canaveral, Florida on December 6, 2015.

Purpose and Importance 

of Visiting Vehicles

On Earth, a person’s typical week 

might consist of a trip to the grocery 

store, several trips to the local home 

improvement store, taking out the 

trash and recyclables, and doing a 

few loads of laundry. If something 

is broken in the home, a replacement 

part is ordered and the homeowner 

must wait for a delivery. Or, he or she 

might need to schedule a professional 

to make the repair. Homeowners 

probably do not think about the water 

supply. They definitely do not worry 

about the supply of oxygen needed 

to breathe or the removal of carbon 

dioxide that is expelled from the 

human body. 

The International Space Station 

(ISS) is a unique, world-class 

orbiting laboratory. It is also home 

to astronauts and cosmonauts. The 

logistics of keeping such a home 

running are complicated. In space, 

there are no grocery stores or home 

improvements stores. The “trash 

truck” only comes around every 

few months. Washers and dryers for 

clothing do not exist, and access to 

clean attire can take months. Much of 

the breathable air and drinkable water 

must be delivered. When supplies 

(e.g., bathroom tissue) are low, crew 

members cannot tap a few keys on the 

computer and wait for resupplies to 

arrive at the door. They call Mission 

Control and place their order, and 

then they wait. 

Moving astronauts and cosmonauts, 

science experiments, food, water, 

air, spare parts, and other supplies 

to and from the ISS is a highly 

choreographed international 

operation that must be executed 

with near perfection, every time (see 

Chapter 1). Such an effort requires 

more than one spacecraft. This 

was never more evident than in an 

8-month span between October 2014 
DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 235

and June 2015 when three different 

resupply missions were lost 

during or shortly after launch. 

Three different rockets from three 

different companies experienced 

three different failures. According 

to statistics, this scenario was 

supposed to be nearly impossible. 

Yet, it happened. Operations on 

board the ISS continued despite the 

lack of resupply. 

So, exactly what does it take to 

keep the ISS resupplied? It starts 

with a procession of vehicles from 

around the world that visit the ISS. 

This chapter will discuss this lineup, 

including the unique way the vehicles 

are attached to the space station 

and how heavily they rely on the 

robotic system. The critical role of 

the crew, how a vehicle controlled by 

another government or a private US 

company is safely integrated into the 

operations of the ISS, and how their 

flight control teams train and interact 

with the NASA flight control team in 

Houston, Texas, are also presented. 

Details for the Russian cargo vehicle, 

Progress, are not discussed here. 

Lineup of Visiting Vehicles 

Space Shuttle (retired)—The NASA 

Space Shuttle was launched from 

Kennedy Space Center in Cape 

Canaveral, Florida, and controlled 

from Mission Control CenterHouston (MCC-H). It carried crew 

of up to seven and cargo to and from 

the ISS. The shuttle could deliver 

approximately 19,000 kg (42,000 lbs) 

of cargo, usually in the form of 

modules or elements in the external 

cargo bay, but it could also transport 

dry and wet cargo. Dry cargo consists 

of hardware, food, and other nonwet consumables whereas wet cargo 

generally refers to water, nitrogen, 

oxygen, or air. The shuttle docked to 

the United States On-orbit Segment 

(USOS) of the ISS. As happens with 

all the visiting vehicles, dry cargo is 

always accessed from the pressurized 

part of the vehicle in a shirt-sleeve 

environment. Figure 1 shows the 

Space Shuttle docked to the ISS, as 

well as the next several vehicles, in 

what was termed the “family portrait.”

Shuttle Endeavour

STS-134/ISS-ULF-6

Progress 

(42P)

ATV-2

Soyuz 

(26S)

Figure 1. This image was taken in May 2011 by Expedition 27 crew member Paolo Nespoli from 

the Soyuz (25S) following its undocking to return the Expedition 27 crew to Earth. These are the first 

images of a Space Shuttle docked to the ISS, as taken from another crewed spacecraft. 

Soyuz—The Russian Soyuz 

Spacecraft launches from the 

Baikonur Cosmodrome in Kazakhstan, 

and is controlled from the Mission 

Control Center-Moscow (MCC-M) in 

Korolev, Russia. It carries a crew of 

three and a limited amount of cargo 

to and from the ISS. The Soyuz docks 

to one of several ports on the Russian 

Segment (RS) of the ISS.

Progress—The Russian Progress 

Spacecraft launches from the 

Baikonur Cosmodrome in 

Kazakhstan, and is controlled from 

the MCC-M in Korolev, Russia. It 

carries cargo to the ISS and removes 

trash from the ISS via destructive 

reentry. The Progress can transport 

approximately 2,600 kg (5,732 lbs) 

of dry and wet cargo to the ISS and 

docks to one of several ports on the 

ROS. Unique among the current 

visiting vehicles, the Progress also 

transports propellant for the re-boost 

and refueling of the station.

Automated Transfer Vehicle (ATV) 

(retired)—During five missions 

between 2008 and 2014, the European 

Space Agency (ESA) launched the 

ATV from the Centre Spatial Guyana 

near Kourou, French Guiana, and 

controlled it from the ATV Control 
236 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

Center in Toulouse, France. Each 

ATV carried cargo to the ISS and 

disposed of trash from the ISS via 

destructive reentry. The ATV was able 

to deliver 8,000 kg (17,637 lbs) of 

supplies, including dry and wet cargo 

with propellant for the re-boost and 

refueling of the station, and docked to 

the aft docking port of the RS.

H-II Transfer Vehicle (HTV) 

Kounotori (White Stork)—Japan 

launches the HTV from the 

Tanegashima Space Center in 

Tanegashima, Japan, and controls 

it from the HTV Control Center in 

Tsukuba, Japan. The HTV carries 

cargo to the ISS and disposes of trash 

from the ISS via destructive reentry. 

The HTV is captured by the Space 

Station Remote Manipulator System 

(SSRMS) and is then berthed to the 

USOS, as shown in Figure 2. Each 

HTV can deliver approximately 

7,600 kilograms (16,800 lbs) of 

cargo, including external cargo 

transfer capability.

Figure 2. The Japan Aerospace Exploration Agency Kounotori HTV-5 is seen berthed to the ISS 

(vertical, left side of image). The external CALometric Electron Telescope experiment, which will search 

for signatures of dark matter, is seen being extracted from the unpressurized section by the station’s 

robotic arm, Canadarm2. An aurora over the Earth limb is visible in the background. Photo is from 

August 25, 2015. 

Dragon—Developed by the 

commercial company Space 

Exploration Technologies 

Corporation (SpaceX), Dragon 

launches from Cape Canaveral, 

Florida, and is controlled from the 

SpaceX Mission Control Center 

in Hawthorne, California. Dragon 

carries cargo to the ISS and returns 

cargo and science via splashdown 

in the Pacific Ocean off the coast of 

California. As with HTV, Dragon is 

captured by the SSRMS and berthed 

to the USOS, as shown in Figure 3. 

Dragon can transport approximately 

5,400 kg (12,000 lbs) of cargo, 

including some items externally in its 

exposed “trunk.” Figure 3. View of the berthed SpaceX Dragon Commercial Resupply Services-3 spacecraft on April 26, 

2014, Canadarm2 SSRMS, and portions of the forward ISS in front of an orbital dawn. 
DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 237

Cygnus—Also developed by a 

commercial company, Orbital ATK, 

the Cygnus can launch from the 

Mid-Atlantic Regional Spaceport 

on Wallops Island, Virginia, or from 

Cape Canaveral, Florida. The mission 

is controlled by a team at Mission 

Control Center-Dulles located in 

Dulles, Virginia. Cygnus carries 

cargo to the ISS and disposes of trash 

from the ISS via destructive reentry. 

As with the HTV, the Cygnus is also 

captured by the SSRMS and berthed 

to the USOS (Figure 4). Cygnus 

can deliver up to about 3,600 kg 

(7,940 lbs) of cargo to the ISS.

Figure 4. The Orbital ATK Cygnus spacecraft about to be captured by the Canadarm2 on March 26, 

2016, before being berthed to the nadir port of the Node 1 module of the ISS, as photographed by an 

Expedition 47 crew member. The Earth can be seen in the background. 

Preparation for the 

Arrival of an H-II Transfer 

Vehicle, Dragon, or 

Cygnus Visiting Vehicle

Scheduling

As described in Chapter 1, the 

flight control team works with ISS 

Program personnel, including the 

international partners, to meticulously 

plan the rotation of crew members, 

delivery of new science experiments, 

return of completed experiments, 

and resupplies for the ISS. Launch 

schedules around the world need 

to be negotiated. This, in itself, can 

be extremely complicated. Each 

company or government launches 

other payloads; therefore, delays 

on one vehicle, due to weather 

or technical issues, can impact 

other missions to the ISS. Careful 

coordination is also required to 

manage the available ports for 

berthing the vehicles. The only two 

berthing ports are located on the 

nadir, or bottom, side of the ISS. 

Cargo preparation and delivery 

schedules need to be established 

and often adjusted when equipment 

unexpectedly fails or priorities 

change. In some cases, the orbit 

of the ISS needs to be adjusted to 

accommodate the arrival of the 

visiting vehicle. Physics determines 

how quickly a spacecraft can get to 

the ISS, and must be factored into the 

power and fuel with which the vehicle 

has to perform the rendezvous. The 

number of constraints that need 

to be simultaneously satisfied for 

even a single mission proves to 

be a challenge almost every time. 

Some highly unusual constraints 

have impacted the scheduling of 

launches. For example, during the 

Japanese fishing season off the coast 

of Tanegashima, large numbers of 

fishing vessels are situated off the 

waters of the launch site, which 

would put people at risk if a rocket 

exploded. Another constraint was the 

estimated pressure in the off-nominal 

case of an explosion of the vehicle 

near the Mid-Atlantic Regional 

Spaceport in Virginia. Yet another 

was the G8 summit in Arkalyk, 

Kazakhstan, and the associated air 

space restrictions over Kazakhstan 

during the arrival of all the Heads of 

State. This situation prohibited the 

Russian search-and-rescue aircraft 

from conducting the Soyuz recovery 

mission on the original date. Other 

constraints have included the sea state 
238 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

in the Pacific Ocean off the coast of 

California so that a vehicle could land 

safely and be recovered, the position 

of the sun relative to the ISS orbit 

(known as the beta angle) due to the 

impact of lighting on key sensors 

on a spacecraft, and the failure of 

an external pump on the ISS that 

took out cooling to half of the space 

station—including the equipment 

needed for safely berthing a vehicle. 

Because of the number of constraints, 

it is common for the dates of a 

visiting vehicle mission to change 

several times. Operationally, this can 

mean planning the mission multiple 

times prior to execution. Once the 

international community sets a date 

for a mission, the preparations begin. 

“Piece by Piece; Step by Step” 

Jeff Williams, STS-101, ISS Expeditions 13, 21, 22, 47, 48

Among the most impressive—and sometimes 

overlooked—aspects of the history of the ISS assembly 

and ongoing operations are the visiting vehicles 

necessary to build and sustain the space station. 

Napoleon Bonaparte is credited with the quote, 

“an army marches on its stomach,” emphasizing the 

criticality of logistics to ensure mission success of a 

deployed military. The same is true of the space station 

and her continuously deployed crew. As of mid 2017, 

178 rocket launches were dedicated to building, manning, 

and maintaining the ISS.

Food, of course, is just one element of the vast logistics 

train necessary in keeping the ISS and its crew going 

strong over the many years away from the planet. 

My first visit to the orbital outpost on a Space Shuttle 

crew in 2000 was, in part, dedicated to stockpiling 

the supplies and equipment necessary to prepare for 

the arrival of Expedition 1. Over the years since, during 

long-duration expeditions to the growing complex, 

I experienced visits by four additional Space Shuttles and 

stays of seven Soyuz spacecraft besides my own three, 

and I watched eight Progress, one HTV, one Cygnus, and 

two Dragon spacecraft come and go. Food—including 

fresh fruits and vegetables and, occasionally, even ice 

cream—was present on every vehicle. So was clothing, 

general supplies, repair parts and tools, large and small 

elements of the growing complex, science and research 

experiments, new technology demonstrations, and even 

“cards and letters” from home. Several of the shuttles and 

Russian rockets delivered major components of the ISS, 

including module and truss elements. Most significantly, 

the Space Shuttles and Soyuz spacecraft enabled the 

coming and going of crewmates.

Spaceflight is inherently hard, and access to space from 

Earth and the return to Earth are particularly hard phases. 

That is what makes the ISS visiting vehicle story so 

impressive. The loss of several supply ships during the 

launch and ascent phase gives testimony to the particular 

challenge of sustaining the orbital outpost. The loss of our 

friends on the Space Shuttle Columbia, which grounded 

the fleet during the ISS assembly, makes it a particularly 

human challenge. 

What we have learned from the critical role of visiting 

vehicles and the logistics train supporting the ISS will 

be an essential enabler for future exploration beyond 

Earth orbit. We will, of course, improve regenerative 

efficiencies for things such as water and atmosphere, and 

we will even find ways to draw from natural resources at 

the location of future destinations. However, there will 

always be a dependency on resources and consumables 

from Earth, especially those required for life support. 

Regardless of future ends in space exploration, launching 

and returning vehicles will always be among the required 

means to accomplish the goals and objectives. As with 

the space station, that will be piece by piece, step by 

step, by way of visiting vehicles.

Flight Controller Training

A flight-specific team of controllers 

will be assigned to each visiting 

vehicle mission no later than 

approximately 6 to 8 months ahead of 

the scheduled event. A team of flight 

controllers, led by a flight director, 

will be at MCC-H, and a team of 

flight controllers will be at the home 
DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 239

control center of the visiting vehicle. 

These teams will spend months 

preparing procedures and flight rules 

to govern the real-time execution 

of the mission. The team will also 

simulate the operations multiple 

times to ensure the procedures 

and rules are correct, the timing 

and communication between the 

control centers is perfect, and the 

ground equipment that allows the 

control centers to share data and 

voice communication is operational 

(see Chapter 10). The simulations, 

conducted jointly between NASA 

and the home control center for the 

visiting vehicle, generally occur 

between launch minus 6 weeks and 

launch minus 2 weeks. 

When the approaching visiting 

vehicle enters the real-time phase 

of the mission known as Joint 

Operations, the mission authority 

transfers from the home control 

center of the vehicle to MCC-H, 

except in the case of Russian vehicles 

when the MCC-M is in charge. The 

home control center retains vehicle 

authority and is responsible for 

configuration and performance of the 

vehicle. NASA is responsible for the 

overall safety of the ISS crew, the 

safety of the ISS, and the mission 

objectives. Within Joint Operations, 

all decisions to proceed to the next 

phase of the mission (known as 

“go/no go” decisions) are made 

by the flight director in MCC-H 

after consultation with the mission 

director at the home control center. 

These roles and responsibilities are 

stressed during the training so that 

decisions can be made accurately and 

expeditiously during the real-time 

execution of the mission.

Crew Training

The crew on board the ISS has a 

critical role in the execution of a 

visiting vehicle mission. The crew will 

monitor the incoming vehicle, starting 

at a range of approximately 1000 m 

(3281 ft) relative to the ISS. The crew 

is given specific parameters to monitor 

and actions to take if the vehicle 

violates preset criteria. The crew 

monitors the vehicle range relative to 

the ISS, the range rate or speed, and 

the position of the vehicle relative to 

the space station. If precisely defined 

criteria using these parameters, 

previously worked out between the 

two flight control teams, are violated, 

the crew can issue a command to the 

incoming vehicle over the ship-toship link (see Chapter 13) to have it 

hold its current position, retreat to a 

preset previous position, or perform 

an abort and fly away from the ISS. 

This monitoring is critical to prevent a 

collision between the visiting vehicle 

and the ISS. For example, each 

visiting vehicle will move toward 

the ISS within the approach corridor, 

which is a cone with its apex centered 

on the destination point of the visiting 

vehicle. The ISS crew will issue a 

command for the visiting vehicle to 

abort its rendezvous and move away 

from the station if the spacecraft goes 

outside of this corridor, thus indicating 

that the control system is not working 

properly and the ISS is at risk of a 

collision if the trajectory worsens. 

The home control center of 

the vehicle is responsible for 

commanding the vehicle to advance 

toward the ISS after receiving the 

appropriate approval or “go” from 

the flight director at MCC-H. Once 

the incoming berthing vehicle 

reaches a predetermined position—

about 11 m (36 ft) underneath 

the ISS—it will hold its position 

relative to the space station. At this 

point, the visiting vehicle and the 

ISS are flying in formation. The 

crew will use the SSRMS to grab 

the visiting vehicle. This is known 

as the capture operation. As they 

do with a module, the astronauts 

will maneuver the robotic arm end 

effector and capture a grappling pin 

on the hovering vehicle. The capture 

needs to be performed precisely so 

as to avoid knocking the vehicle and 

thereby causing it to spin and move 

uncontrolled in close vicinity of 

the ISS. Once captured by the arm, 

the vehicle automatically goes to 

what is known as free drift, which 

means it is no longer firing any of its 

thrusters. This allows the SSRMS to 

maneuver the vehicle to its berthing 

port without damaging it through an 

unexpected push or pull by a thruster. 

See also Chapter 15.

The crew procedures, displays, data, 

and training need to be near perfect 

because of the close interaction 

between the crew and the flight 

control teams on the ground and the 

tight timeline choreography. Crew 

members are trained on the ground 

before they begin their mission on 

board the ISS. About a week prior 

to the arrival of the visiting vehicle, 

crew members conduct their refresher 

on-board training as it likely has been 

many months since they received 

training on the ground. The crew 

uses a robotic arm computer-based 

simulator to practice moving the 

SSRMS in and capturing the visiting 

vehicle. In the days leading up to 

the arrival of the vehicle, the crew 

will practice the capture operation 

over and over again on a laptop 
240 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

computer simulator, which includes 

hand controllers to replicate the 

grappling with the robotics system 

in preparation for the real operation. 

The crew members will also review 

their monitor procedures, criteria to 

take action, and the actions. The crew 

and the flight controller teams will 

conduct a conference led by the flight 

director about 1 to 2 days prior to the 

arrival of the vehicle to make sure 

everyone is ready for the operation. 

Are we there yet?

As noted in Chapter 7, the ISS orbits the Earth at an 

altitude of about 410 km (255 miles) above the surface. 

About a dozen vehicles from various countries and 

organizations visit the ISS every year. 

When describing the physics that govern their rendezvous 

with the ISS, two principles should be considered—

principles that are too complicated to go into here. First, 

Newton’s Law of Gravity says that gravity pulls on objects 

in lower orbits with more strength than it pulls on objects 

in higher orbits. Second, Kepler’s Laws of Planetary 

Motion say, in part, that objects traveling in lower orbits 

go around the Earth faster than objects in higher orbits. 

In planning orbital rendezvous, both principles need to 

be considered simultaneously. In short, the process is 

similar to the case of a police officer who is sitting at the 

side of the road, looking for speeders. The officer cannot 

leave his or her observation spot (i.e. “launch”) until the 

speeding car passes. Once this happens, the officer has 

to catch up—first accelerating to higher speeds to close 

the gap and then gradually slowing to match the speed 

of the car he or she is pursuing. If the officer doesn’t slow 

down and match the speed of the other car, he or she 

risks hitting it and causing damage. If the officer lets the 

car get too far ahead before pursuing, he or she may not 

have enough fuel to catch the speeder. If a cylinder on 

the car is misfiring or if the weather is bad, the officer will 

have to make additional driving adjustments. 

In the case of the ISS, the visiting spacecraft will launch 

when the ISS flies overhead. The vehicles are uncrewed 

and rendezvous with the ISS autonomously with guidance 

from the control center. During the mission, the Visiting 

Vehicle Officer monitors the maneuvers or burns of the 

spacecraft as it climbs to the orbit of the ISS, and then 

matches the speed for a capture by the robotic arm 

or gentle docking. The trajectory is updated as things 

change during rendezvous, which can happen if a thruster 

does not quite burn as expected or if atmospheric drag 

is different than expected due to variations in the sun—

among a multitude of other reasons. Small burns may be 

added to the mission to compensate for these issues. 

To complicate matters, the rendezvous has to be timed 

precisely so that the sun does not blind cameras or crew 

members. This process can take as few as 6 to 8 hours 

but typically takes about 2 to 3 days. 

When the vehicle is in close proximity of the ISS, even a 

few meters a way, it is technically in a different orbit and 

therefore will move slightly differently than will the ISS. At 

this point, it is a little like keeping a balloon off the floor, 

Gravity will try to pull the balloon back to the Earth, but 

small upward taps with the hand will keep it in the air. 

Newton told us that the Earth will try to pull the visiting 

vehicle down faster than the ISS; however, thrusters are 

used to tweak the motion to keep it in close proximity. 

The visiting vehicle officers watch this dance very closely 

to ensure a successful rendezvous while the flight director 

ensures the ISS is ready for the new spacecraft.

Cargo Delivery and Loading

As the flight control teams prepare 

the mission, the cargo teams finalize 

the list of cargo to fly on the visiting 

vehicle. The supplies on the ISS, 

including spare or replacement 

parts, are meticulously tracked and 

resupply schedules are set and reset 

on a continual basis. Time is also 

allocated for carefully packing the 

cargo on the spacecraft. Not only 

does it have to be meticulously 

packed to withstand the forces of 

the launch, but the mass has to be 

precisely balanced to ensure the 

vehicle flies correctly. Last-minute 

issues on board the ISS that require 

unplanned resupplies or new 

hardware are balanced against the 

mission schedule to determine what 

can be accommodated. Consumables 

such as food, water, and oxygen have 

to be very carefully managed. Not 

only are enough supplies needed, 
DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 241

extra materials have to be sent to 

the ISS to protect for the case when 

another cargo vehicle—or three, as 

mentioned above—cannot make 

it to the ISS. Once the manifest is 

finalized, the items are packaged 

and delivered to the visiting vehicle 

company for packing into the vehicle. 

The delivery of the cargo is usually 

staged. Items that are ready early are 

sent first. Usually, a late load of items 

accommodates last-minute changes 

to the manifest, or there may be 

science experiments that have strict 

timing constraints between launch 

and arrival on the ISS. Once the 

cargo has been loaded, the spacecraft 

has been declared ready, and the 

rocket has been declared ready, it is 

time to launch. 

Day of Arrival

After a successful launch and orbit 

insertion, the visiting vehicle will 

spend 2 to 3 days catching up to the 

ISS. This is referred to as phasing. 

During this time, the home control 

center of the vehicle is in charge 

of the mission. The flight control 

team at the home control center 

(Figure 5) monitors the performance 

of the spacecraft and performs 

checkouts of the systems that will be 

used for the rendezvous with the ISS. 

Photo courtesy of Ken Peek (Orbital ATK) used with permission by Orbital ATK

Figure 5. (Top) The flight control team supports a Dragon mission from the SpaceX Mission Control 

Center in Hawthorne, California. Photo from Space Corporation, which has waived all copyright and 

related or neighboring rights to this work. (Bottom) Image of the Orbital ATK Mission Control Center in 

Dulles, Virginia. 

The ISS Joint Operations commence

as soon as the vehicle reaches 

approximately 35 km (22 miles) 

behind and 4 km (2.5 miles) below. 

MCC-H has mission authority 

from this point, and until the 

vehicle completes its mission and 

departs the ISS. Up to this point, 

the flight-specific team in MCC-H 

has monitored the progress and 

performance of the vehicle, reviewed 

data, and stayed in communication 

with the team at the home control 

center of the vehicle. Joint 

Operations begins while the crew 

members are still asleep since the 

capturing and berthing process can 

take a significant portion of their 

day. During Joint Operations, the 

vehicle continues to move closer 

to the ISS and starts orienting its 

trajectory relative to that of the ISS. 

As operations progress into the start 

of the crew day, crew members on 

the ISS begin preparing for their 

monitoring role and the capture. 
242 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

Figure 6. (Left) Expedition 41 crew member Alexander Gerst (ESA) as an operator controlling the SSRMS from the Cupola Workstation during the 4th SpaceX 

mission on September 23, 2014. The Dragon vehicle can be seen in the far right monitor in the image as it approaches the ISS. Astronaut Reid Wiseman 

floats behind Gerst and performs camera operations. (Right) Japan Aerospace Exploration Agency astronaut Koichi Wakata (top) and NASA astronaut Mike 

Hopkins, both Expedition 38 flight engineers and both wearing sunglasses, pose for a photo in the Cupola module while waiting for the Orbital-1 Cygnus 

arrival (in background) on January 12, 2014. The visiting vehicles, which have built-in hold points during their approach, will inch slowly toward the ISS while 

the flight control teams on the ground assess the performance of each spacecraft and its readiness to proceed closer. Photo was taken during Expedition 38. 

At a range of approximately 1000 m 

(3281 ft), the crew on board the ISS 

starts looking for the incoming 

visiting vehicle. Two crew members 

are situated in the Cupola module, 

looking down toward Earth. This 

is where they will conduct the 

monitoring and the capture operations, 

as shown in Figure 6. A backup work 

location is set up and ready in the 

US Laboratory Module in the event 

of a failure with the equipment setup 

inside the Cupola (see Chapter 15).

As the crew monitors the approach 

of the visiting vehicle, the flight 

control teams on the ground review 

the performance data, assess the 

“go/no go” flight rules, and configure 

the systems both on the incoming 

spacecraft and on the ISS to faciliate 

a safe approach. The Joint Operations 

become more time critical and riskier 

as the vehicle gets closer to the 

ISS. The criteria for proceeding are 

tighter. When the vehicle successfully 

arrives at the capture point, SSRMS 

operations commence (Figure 7).

Figure 7. (Left) The robotic arm moves toward the unpiloted Japanese Kounotori HTV-4 as it approaches the ISS on August 9, 2013. The HTV-4 is delivering 

3,600 kg (7936 lbs) of science experiments, equipment, and supplies to the orbiting complex. (Middle) Using the ISS robotic arm, seen at the right of the 

picture, NASA Flight Engineer Kjell Lindgren prepares to capture the Orbital ATK Cygnus cargo vehicle on December 9, 2015. The space station crew and the 

robotics officer in MCC-H will position Cygnus for installation to the orbiting laboratory’s Earth-facing port of the Node-1 module. (Right) The SpaceX Dragon 

Commercial Resupply Services-3 spacecraft approaches the ISS for rendezvous and grapple during Expedition 39 on April 20, 2014. 

To perform this complicated task of 

monitoring an approaching vehicle, 

capturing it, and then berthing, the 

astronauts rely heavily on the robotic 

systems of the station—especially 

the Robotic Workstation. External 

cameras provide critical views with 

additional graphics overlaid on the 

image. Those graphics, or overlays, 

are essentially a heads-up display for 
DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 243

the crew, providing such things as 

joint angles, position and orientation, 

visiting vehicle approach data (e.g., 

range and speed), and caution and 

warning statuses. An example of this 

is shown in Figure 8.

Figure 8. An example of using graphics overlay to capture a visiting vehicle—in this case, the first 

SpaceX Dragon spacecraft to the ISS. This picture shows one of the Robotic Workstation monitors 

during capture operations for the Dragon vehicle during Expedition 31 (May 25, 2012). The view of the 

ISS with the robotic arm and the incoming Dragon vehicle are provided by a camera mounted on the 

truss of the space station. The green lines, numbers, and letters define such things as a safe location 

for the spacecraft (e.g., the large green rectangle near top center) and the location where the vehicle 

is expected to be, as indicated by the green outline of the Dragon. These graphics are then overlaid on 

the video and shown to the crew member who is operating the arm. These overlays provide the crew 

member with real-time data about the Dragon, such as position and orientation, as well as outlining 

an imaginary approach corridor that the Dragon needs to maintain as it approaches the space station. 

Using overlays in this fashion allows the crew member to maintain situational awareness of the incoming 

vehicle without having to take his or her eyes off of the video showing the actual approaching vehicle. 

Under the direction of MCC-H, 

the crew captures the vehicle using 

the SSRMS. After a point shortly 

following the capture, the crew 

turns over the SSRMS operations 

to MCC-H. Flight controllers in 

MCC-H will manuever the SSRMS 

and grappled vehicle to the assigned 

port—Node 1 or Node 2—and 

position the vehicle for berthing 

operations (Figure 9). 

Figure 9. Flight controllers led by Flight Director Brian T. Smith (standing left of center in the third row 

from the front), supported the orbital work in the space station flight control room in Johnson Space 

Center’s Mission Control Center as the Canadarm2 berthed the Orbital ATK Cygnus commercial cargo 

craft to the Harmony node of the ISS on Jan. 12, 2014. 

The rendezvous, capture, and

berthing operations, which take a 

number of hours, are conducted 

within a single crew day. The 

flight control team needs to stay 

on schedule to ensure the visiting 

vehicle is not stuck on the end of 

the SSRMS during the crew sleep 

period. The following day—and, in 

some instances, the same day—the 

crew will ingress the newly arrived 

visiting vehicle. Sometimes, a crew 

care package has been conveniently 

stowed where crew members have 

quick and relatively easy access. 

The care packages will contain some 

of the crew members’ favorites 

things. A popular care package item 

is fresh fruit. Sometimes, notes are 

included from the flight control team 

back in Houston, wishing the crew 

well on the rest of the mission. Crew 

members will spend anywhere from 

1 to several months unloading the 

cargo and stowing it on the ISS. As 

they unload the new cargo, they will 

also start filling the vehicle with 
244 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

items to be disposed off or to be 

returned to Earth. See Figure 10.

Figure 10. Astronauts Karen Nyberg (center) and Chris Cassidy (left), Expedition 36 flight engineers 

work inside the ESA ATV-4 “Albert Einstein” while docked with the station. ESA astronaut Luca 

Parmitano (right), flight engineer, is taking the selfie. 

Timing is Everything

As noted above, a great deal of planning is required to 

orchestrate the coming and going of visiting vehicles. 

Even with so much planning and training, the flight 

control team has to be ready at all times for problems 

and replanning. For example, a timing issue in September 

2013 between the ISS and the first Orbital ATK mission 

affected how the Cygnus calculated it’s relative position, 

thus causing an automated abort of the rendezvous. The 

rendezvous could not be immediately resumed since it 

took the flight control team some time to determine what 

had happened but also to allow for the docking of the 

Soyuz that carried the Expedition 37 crew. The uncrewed 

cargo vehicles have the ability to loiter for several days, 

whereas the priority is to get the crew to the ISS as 

quickly as possible. 

Similar flexibility with a twist was required in September 

2008 when the first ATV, called “Jules Verne,” was 

preparing to be undocked from the ISS. It was scheduled 

to undock on September 5 and a new Progress vehicle 

was scheduled to launch on September 10 and dock to 

the same port. However, MCC-H was in the process of 

shutting down to prepare for Hurricane Ike as it headed 

for Houston. The NASA flight control team worked quickly 

to safely complete the undocking. This scenario was 

never expected to occur during a hurricane, but the tight 

schedule required the team to adapt. Five days after 

conducting the successful undocking, NASA dispatched 

flight control teams to two different locations to set 

up one temporary (undisclosed location) and a more 

permanent (Marshall Space Flight Center in Huntsville, 

Alabama) backup ISS control center in advance of 

evacuating MCC-H. Both were used.

One to several months after arriving

at the ISS, the visiting vehicle will 

depart and conclude its mission. 

The crew uses the SSRMS to grapple 

the vehicle and unberth it from the 

ISS. The crew then manuevers 

the SSRMS to the release position 

and releases the vehicle. The 

vehicle performs a short jet firing 

to initiate a flight trajectory away 

from the ISS, followed by a series 

of manuevers to either destroy itself 

upon reentry or safely land in the 

Pacific Ocean for retrieval. 

As elsewhere in the ISS Program, 

visiting vehicles have also evolved. 

Initially, it was envisioned that only 

one cargo vehicle at a time would 

berth to the USOS during a given 

period. It soon became apparent 

that as schedules shift, sometimes 

due to launch failures as noted 
DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 245

above, missions might overlap. 

More flexibility would be possible 

if two places were available for the 

cargo craft to berth on the USOS. 

After a significant amount of work, 

a second berthing port was added to 

the nadir side of the Node 1 module 

in addition to the one already present 

on the nadir side of Node 2. In the 

spring of 2016, two vehicles—a 

Dragon and Cygnus—were berthed 

to the space station at the same time, 

as seen in Figure 11.

Figure 11. A view from the external cameras on the ISS showing the capture and berthing at Node 2 on April 10, 2016, of the SpaceX Dragon while the 

Orbital ATK Cygnus, which arrived previously on March 26, is parked on the nadir side of the Node 1 module. 

More to Come

As with the ISS itself, vehicles that 

visit the space outpost are evolving 

as well. NASA purchased the 

services of the private companies 

SpaceX and Orbital ATK that build 

the Dragon and Cygnus vehicles, 

respectively, under the Commercial 

Resupply Services (CRS) contract, 

which was awarded in 2008. In 

January 2016, NASA announced 

the second phase of the supply 

missions, known as CRS-2. In 

addition to SpaceX and Orbital 

ATK, NASA selected Sierra Nevada 

Corporation, which is building 

the Dream Chaser spacecraft 

(Figure 12), to provide cargo 

missions. Sierra Nevada Corporation 

is expected to fly the first Dream 

Chaser mission in 2020.

Image Courtesy Sierra Nevada Corporation

Figure 12. The Dream Chaser cargo vehicle, to be developed by Sierra Nevada Corporation, berthed to 

the nadir port of the Node 2 module. It is estimated to fly in 2020. 

Following the retirement of the 

Space Shuttle, the ISS became

completely dependant upon 

the Russian Soyuz to transport 

astronauts to and from the space 

station. Beginning in 2010, NASA 

partnered with commercial aerospace 

companies to develop crew 

transportation subsystems, followed 

by later development phases—an 

approach that was modeled after 

the successful CRS program. In 

September 2014, NASA selected two 

companies—Boeing and SpaceX—

to develop the CST-100 Starliner 

and Crew Dragon, respectively, for 

this task. The first flight tests are 
246 CHAPTER 14 DAY IN THE LIFE: VITAL VISITING VEHICLES—KEEPING THE REMOTE OUTPOST CREWED AND OPERATING

anticipated to take place in 2018. 

See Figure 13. These new crew 

spacecraft will be able to carry up 

to four astronauts to and from the 

space station, which would bring the 

station crew size up to seven.

Image courtesy of Boeing Image courtesy of SpaceX

Figure 13. CST-100 Starliner (top) and Crew Dragon (bottom) approach the forward docking port on 

the Node 2 module.

Unlike the cargo vehicles, which 

berth, the new crewed spacecraft will 

dock using a newly developed NASA 

Docking System. Cargo is often 

bulky, especially if a full payload rack 

is being sent to the ISS; therefore, 

these uncrewed cargo vehicles use the 

wider Common Berthing Mechanism 

described in Chapter 3. However, 

the crewed vehicles will not be 

transporting large pieces of cargo, 

and they must be able to quickly get 

away without requiring the robotic 

arm since the vehicles will also serve 

as the emergency lifeboat for the 

crew. SpaceX will control its Crew 

Dragon vehicle out of its Mission 

Control Center facility in Hawthorne, 

California. Boeing, partnered with 

the Flight Operations Division at 

Johnson Space Center, will operate 

the Starliner out of one of the control 

rooms in Houston that is known as 

Mission Control Center CST-100.

Conclusion

Although the ISS is a technical 

marvel, having been built by multiple 

countries through many launches, 

supplying the remote outpost has 

been critical to its survival. When 

Space Shuttle Columbia was 

destroyed during reentry in 2003, 

the ISS had to reduce the number 

of resident crew members from the 

limit of three (at the time) to two. 

This was because the only cargo 

vehicle available was the Russian 

Progress spacecraft, which could 

carry enough supplies for only two 

people. Today, four different vehicles 

can transport cargo to the ISS. As of 

2015, more than 30 cargo missions 

have flown by the fleet consisting of 

the European ATV, the Japanese HTV, 

and the American Cygnus and Dragon 

vehicles. The new cargo craft—the 

Dream Chaser—should be added in a 

few years. 


Chapter 15 Systems: 

Robotics—

the Construction 

Equipment for 

the International 

Space Station
250 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

An image of the Canadian five-dollar bill features a spacewalker wearing a Canadian flag on the shoulder, the International Space Station robotic arm, and the 

Special Purpose Dexterous Manipulator.

Brains, voice, heart, lungs, and 

circulation system—all are critical 

for life. The International Space 

Station (ISS) requires the technical 

versions of such systems, as well. 

Just as important are “limbs”—

most notably, the giant robotic arm 

of the space station. The robotic 

arm is fundamental for executing 

spacewalks, conducting repairs, and 

performing cutting-edge research. 

The ISS would not exist without this 

limb, which played a key role during 

construction of the space station. 

For 15 years, the ISS was essentially 

a construction site, albeit one that 

orbited at 28,163 km/h (17,500 mph). 

As with any construction site, cranes 

are required to move large pieces 

into place. The focal point of space 

station assembly “job site” was the 

main robotic arm. This machine, 

measuring 17.6 m (57.7 ft) in length, 

moved massive objects such as 

large pressurized modules and truss 

segments, as well as transported 

spacewalkers to areas that would 

otherwise be unreachable. The arm 

is part of a complex system that is 

extremely flexible, allowing the 

arm to move to different work sites, 

grab other arms that can do fine 

detail work, and even repair itself. 

In fact, because of this flexibility, the 

entire system is known as the Mobile 

Servicing System (MSS).

This chapter focuses on the MSS; in 

particular, the space station crane (i.e., 

the Space Station Remote Manipulator 

System) and the components that 

make up the supporting equipment 

(i.e., Special Purpose Dexterous 

Manipulator [SPDM], Mobile 

Transporter [MT], and Mobile 

remote server Base System [MBS]). 

Operation of the MSS is discussed, 

which will explain how the crew 

and a blended NASA and Canadian 

Space Agency flight control team 

work together. The evolution of 

this symbiotic relationship is also 

presented, as well as some of the 

challenges that the flight control team 

has faced over the years, beginning 

with the birth of the systems during a 

time of crisis. Since its activation, the 

robotic arm has played a critical role 

in increasingly complex operations. 

The Japanese contributions of robotic 

systems are the Japanese Experiment 

Module Remote Manipulator System 

Main Arm and the Small Fine Arm. 

The European Robotic Arm is 

scheduled to be installed in or around 

2018. Activation and operation 

of this arm is tied to the arrival 

of the Russian module called the 

Multipurpose Laboratory Module 

(see Introduction). As with other 

systems provided by international 

partners, these are not discussed 

further here. This chapter, however, 

focuses on the Canadian-built robotic 

system. Collectively, the components 

are called the MSS. 
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 251

Robotic Systems on the 

International Space Station

As part of a longstanding partnership 

between NASA and the Canadian 

Space Agency (CSA), Canada’s main 

contribution to the ISS has been the 

robotic systems. Canada already had 

an established capability in space 

robotics. The Canadian government 

managed and funded the design of the 

Shuttle Remote Manipulator System 

(SRMS), commonly referred to as 

Canadarm. The first shuttle-based 

Canadarm was launched on Space 

Transportation System (STS)-2 in 

November 1981, with operational 

responsibility residing with the 

NASA Flight Operations Directorate. 

After President Ronald Reagan’s 

invitation in 1984 for international 

friends and allies to participate in 

the Space Station Freedom Program, 

Canada chose to contribute a suite 

of robotics elements that would be 

critical to space station assembly and 

maintenance. The formal agreements 

were signed between the United 

States and Canada on September 29, 

1988—the same day the space shuttle 

returned to flight following the postChallenger hiatus.

The centerpiece of the ISS MSS is the 

Space Station Remote Manipulator 

System (SSRMS), dubbed 

Canadarm2 by the CSA. Since it is 

larger than the shuttle arm by 2.0 m 

(6.6 ft) and wider by 2.0 cm (0.8 in.), 

it is also referred to as the “big arm.” 

Although similar to the shuttle arm in 

many respects, the new space station 

arm represented an evolutionary 

step forward. Table 1 lists the key 

characteristics of the SSRMS with 

an overview of the MSS shown in 

Figure 1.

Table 1. Summary of the SSRMS properties, based on data provided by CSA (http://www.asc-csa.gc.ca/eng/iss/canadarm2/c1-c2.asp).

Detail International Space Station Mobile Servicing System (Canadarm 2)

Mission Profile Permanently in space.

Range of Motion Moves end-over-end to reach many parts of International Space Station in an inchworm-like 

movement; limited only by number of Power and Data Grapple Fixtures (PDGFs) on the station. 

PDGFs located around the station provide power, data, and video to the arm through its Latching 

End Effectors (LEEs). The arm can also travel the entire length of the space station on the Mobile 

Base System.

Fixed Joint No fixed end. Equipped with LEEs at each end to provide power, data, and video signals to arm.

Degrees of Freedom 7 degrees of freedom. 

Much like a human arm: shoulder (three joints), elbow (one joint), and wrists (three joints). 

However, Canadarm2 can change configuration without moving its “hands.”

Joint Rotation Full joint rotation. 

Joints (7) rotate 540 degrees. 

Larger range of motion than a human arm.

Senses Force moment sensors provide a sense of touch. Automatic self-collision avoidance.

Length 17.6 m (57.7 ft)

Weight 1,800 kg (3,968 lbs)

Diameter (exterior diameter of 

composite boom)

35 cm (13.8 in.)

Mass Handling Capacity 116,000 kg (255,736 lbs)—design case handling payload.

Speed of Operations Unloaded: 37 cm /sec (1.21 ft /sec) 

Loaded: Station Assembly—2 cm/sec (.79 in./sec) 

EVA Support—15 cm/sec (5.9 in./sec) 

Orbiter—1.2 cm/second (.47 in./sec)

Composition 19 plies of high strength carbon fiber—thermoplastic

Repairs Designed to be repaired in space by replacing Orbital Replacement Units. Built-in redundancy.

Control Ground operation or astronaut control

Cameras Four color cameras (one at each side of the elbow, the other two on the LEEs)

Early assembly of the ISS (including

supporting spacewalks) was 
252 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

performed using the shuttle arm. 

This included installing the Port 6 

(P6) and zenith (Z1) truss segments 

on STS-97/ISS-4A and the laboratory 

module on STS-98/ISS-5A. The 

SSRMS did not arrive on the space 

station until STS-100/ISS-6A in 

April 2001 (Figure 2). Even after 

the SSRMS arrived, the shuttle arm 

was often used to hand, back and 

forth, modules and other equipment 

going to, or returning from, the ISS 

(Figure 3).

Space Station Remote 

Manipulator System 

The core part of the station robotic 

systems is the SSRMS, shown in 

Figure 4. The SSRMS elbow joint 

(the joint in the middle of the arm) is 

offset, or side-by-side, which allows 

for greater mobility. For comparison, 

human arms are attached to the 

shoulder with “in-line” joints. If the 

elbow is bent, a person can touch 

a finger to his or her shoulder, but 

can’t rotate past the point where 

the forearm touches the bicep. The 

Canadarm also had joints that could 

rotate only up to 160 degrees. The 

amount of possible rotation depended 

on the joint. The offset elbow joint 

of the station arm allows the booms 

on the arm (the “forearm” and the 

“bicep”) to rotate past each other. The 

joint can rotate a total of 540 degrees. 

The pitch and yaw joints at the end 

of the booms are also offset and have 

540 degrees of rotation, with the yaw 

joint being slightly longer to help 

reduce the chance of the arm hitting 

itself in what is known as a selfcollision. The final joint on either 

end of the arm, underneath the end 

effector, is called a roll joint. The roll 

Figure 1. This artist’s rendering shows the robotic equipment discussed in the chapter. The SSRMS 

is outlined in orange. The Robotics Workstation (RWS) is outlined in blue. (Note: in this graphic, the 

pressure shell of the US Lab is cut away to show the location of one RWS. The second RWS is located 

in the Cupola attached to Node 3 [the blue dome near the white SSRMS.]) The MBS is outlined in 

green. The Mobile Transporter and rails are outlined in purple. The SPDM is outlined in yellow. 

Drawing courtesy of CSA

Figure 2. This photograph, taken from the space station during rendezvous operations, shows the 

Space Shuttle Endeavour payload bay. The SSRMS, in its launch configuration, is seen folded up on a 

pallet (outlined in yellow) in front of the Raffaello Multi-Purpose Logistics Module (MPLM). For scale, 

the MPLM is 6.6 m (21.6 ft) in length and 4.6 m (15.1 ft) in width. During the mission, the shuttle arm 

removed the pallet with the SSRMS from the payload bay and installed it on the ISS. Spacewalking 

astronauts later unfolded the arm. The first payload ever handled by the SSRMS was the pallet on 

which it flew. The SSRMS removed the pallet from the space station. The pallet was then handed back 

to the shuttle arm, which placed it in the shuttle payload bay for return to Earth. 
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 253

Station 

Arm

Shuttle 

Arm

MRM1

Figure 3. During STS-132/

ISS-ULF4 in 2010, Space 

Shuttle Atlantis delivered the 

Russian Rassvet (“Dawn”) Mini 

Research Module (MRM)1 

to the space station. In this 

picture, which was taken during 

the mission, MRM1 has been 

removed from the payload bay 

by the shuttle arm (bottom). 

The station arm (closer to the 

camera) is also grappled to 

the module. The manipulators, 

controlled by astronauts inside 

both the space station and the 

shuttle, are performing what is 

called “handoff” between arms. 

The station arm subsequently 

installed MRM1 on the Russian 

Segment of the ISS. 

LEE

Drawing courtesy of CSA

Figure 4. Drawing of the station arm showing offset joints and the positive direction of motion for each of the seven joints is shown by the blue arrow. 

The direction in which each of the five joints can rotate is shown in blue. A black band is seen at the end of Boom B to differentiate one of the ends. 
254 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

joints cannot be offset with anything; 

however, as with the other joints, 

they have 540 degrees of motion. A 

large black stripe is located on one 

of the booms (Boom B) since either 

end can be fixed to structure while 

the other end is used to manipulate 

an object. The boom at the other 

end is referred to as Boom A. Four 

cameras—one at each end and two 

at the elbow (not shown)—allow 

the operator to see what is being 

grappled and help prevent collisions 

between the arm and structure.

One of the most critical parts of the 

arm is the Latching End Effector 

(LEE). A LEE is located on each end 

of the arm. One LEE allows the arm 

to grab payloads while the other acts 

as “base” for the arm when attached 

to the space station (Figure 5). 

The LEE is similar in size and shape 

to a barrel with the lid removed. 

Four latch mechanisms, an 

attachment point of an extravehicular 

activity (EVA) boot plate that 

allows an astronaut to attach to the 

arm (See Chapters 17 and 18), and 

a camera with a light are all situated 

around the outside of the LEE.

Latches

(4) 

EVA 

Attach 

Point

80 cm

(31 in.)

Light 

(Camera 

is hidden)

Figure 5. A LEE. The lights on top of the camera are to the right in this image. The EVA attach 

point allows a spacewalking astronaut to attach a foot restraint, attach his or her boots, and “ride” 

the arm (see Chapters 17 and 18). The snare cables in this image are completely open and fit flat 

against the opening. 

Grabbing or attaching payloads is 

accomplished using a combination 

of snares and latches. The snares are 

braided wire ropes on a rotating ring. 

When the inner ring is rotated, the 

snares form a web across the open 

end of the LEE (Figure 6). 

To capture a payload, the snares 

close across a metal rod called a 

grapple shaft on the grapple fixture. 

An operator maneuvers the LEE so 

that the grapple shaft is inside the 

open cavity of the LEE. The snares 

close around the grapple shaft 

and a semisphere on top of the pin 

prevents the rod from sliding out of 

the snares. The three lobes (Figure 7) 

in the grapple fixture align with the 

indentations of the LEE, thereby 

allowing the arm to snuggly align to 

the base of the grapple fixture. The 

arm has a strong hold on the payload 

once the carriage has retracted and 

the back plate of the grapple fixture 

is tight against the face of the LEE. 

Some grapple fixtures (Figure 7) 

have additional features that the 

SSRMS can latch onto, which can 

provide power and data. This special 

type of grapple fixture is called a 

Power and Data Grapple Fixture 

(PDGF). Behind four small, springloaded doors are electrical, data, 

and video connections. A PDGF also 

has an outer ring on the baseplate. 

This outer ring is composed of many 

small teeth called a curvic coupling. 

A matching set of teeth are located 

on the LEE (Figure 5). As a PDGF 

is grappled, the curvic coupling 

enables precise alignment between 

the LEE and the grapple fixture, 

thus allowing for various service 

connections to be made. When the 

arm grapples a PDGF, umbilicals 

are extended from the LEE, which 

will pass through the protective 

doors and connect to power, data, 

and video. 

The ability to provide power, data, 

and video through a PDGF to the 

arm is major component of the 

mobility in the MSS. Several PDGFs 

are positioned around the ISS. 

These PDGFs, coupled with the 

LEEs, allow the SSRMS to reach 

worksites that a fixed robotic arm 

could not. The arm is connected 

to a PDGF at both ends to change 

locations. One end is then released 

and moved to another PDGF. This 
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 255

can be repeated multiple times 

to move the arm around. In the 

vernacular, the arm is designed 

to “walk” much like a Slinky®

toy (Poof-Slinky, Inc., Plymouth, 

Michigan) or an inchworm.

Figure 6. (Left) Looking down the open end of the LEE, showing the snares in their open position. A ring that is holding the snares begins to rotate when 

the robotic arm is over a grapple pin (Figure 7), thus causing the snares to trap the rod. (Right) In this image, the inner snare mechanism has rotated, thus 

causing the LEE snare cables to form a web across the opening. 

Doors 

(4)

Gear 

Teeth

Figure 7. A PDGF. The grapple shaft is in the center with the white semisphere at the end. The three 

gold lobes align with identical indentations on the LEE to help align the arm. A black-and-white target 

allows the operator, using a camera at the end of the LEE, to make sure the arm is directly over the pin. 

Note the curvic coupling (gear teeth) and the four doors. 

Special Purpose Dexterous 

Manipulator

Another robot on the ISS, the 

SPDM (Figures 1 and 8), arrived 

on STS-123/ISS-1J/A in 2008. 

The SPDM is comprised of several 

components, including a LEE, a 

Power Data Grapple Fixture, two 

robotic arms, a tool holster, and a 

stowage platform. The fine control 

of the SPDM arms facilitate the 

manipulation of various hardware 

components on the outside of the 

ISS, thereby allowing for a number 

of operations that do not require 

a spacewalking astronaut. For 

instance, the SPDM allows the 

replacement of failed components 

such as the Remote Power Control 

Modules (see Chapter 9).

To change out failed items such as 

Remote Power Control Modules, 

the SSRMS first retrieves the 

SPDM from wherever it is currently 

stowed and maneuvers it close to 
256 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

a Cargo Transportation Carrier, 

which contains a spare unit. Using 

one of its arms, the SPDM opens 

the container and retrieves one of 

the new Remote Power Control 

Modules. The other arm would then 

close the container. A similar process 

is repeated at the site of the failed 

component to swap units, and then 

again to return the failed unit to a 

storage location. 

PDGF

Arm Arm

Stowage 

Platform

LEE

Tool

Holster

Figure 8. This drawing of the SPDM shows the individual elements including the LEE, where it can be 

mounted, or a PDGF, where it can be grappled by the arm.

Drawing courtesy of CSA

Payload ORU 

Accomodation

Power and Data 

Grapple Fixtures 

(four places)

Mast 

Camera

Mated Umbilical 

Mating Adapters

MBS Common 

Attach System

Figure 9. This picture shows the MBS right after it was delivered to the space station on STS-111/

ISS-UF-2. Note the four PDGFs, one of which has the arm attached, the Payload Orbital Replacement 

Unit Accommodation, the Mast Camera and the Umbilical Mating Adapters mated at a worksite. The 

MBS Common Attach System similar to the UCCAS is also shown. See also Chapter 3.

Mobile Remote Servicer Base 

System and Mobile Transporter 

In addition to “walking” around 

the station, the SSRMS can also 

hitch a ride and be carried along 

the truss. The MBS is a workbench 

for the SSRMS and SPDM 

(Figures 1 and 9). It contains four 

separate PDGFs that can be used 

as base points for either system. 

Depending on whether the operation 

to be performed is port or starboard, 

zenith or nadir, one of the four base 

points will be ideal for the activity. 

The MBS sits atop and is 

permanently attached to the NASAbuilt Mobile Transporter. A set of 

“tracks” is built in along the forward 

face of the ISS truss structure. 

These tracks allow the transporter 

with the MBS to move up and down 

the truss. Often, the transporter 

is moved to a different worksite, 

as seen in Figure 10, so that the 

SSRMS can reach some area of the 

space station. For those moves, the 

SSRMS and/or the SPDM are first 

attached to the MBS (Figure 11) and 

the transporter relocates everything 

to a new worksite. However, the 

transporter cannot stop at just any 
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 257

location along the truss. It can stop 

and “plug in” to the power and 

data networks at specific locations. 

Altogether, there are 10 transporter 

worksites on the ISS numbered 

0 (W0) through 9 (W9), but only 

eight of them are actually used. The 

last two worksites (W0 and W9) 

are located outboard of the Solar 

Array Rotary Joint (see Chapter 9). 

The rails were never installed on 

those outer segments; thus far, those 

outboard worksites have never been 

required for operations. 

Drawing courtesy of CSA

Figure 10. Locations where the Mobile Transporter can park along the truss of the ISS are listed as Worksite (W)1 through W8. W1 is located on the 

Starboard 3 (S3) truss segment. Worksites W0 and W9 are not shown and would be on the S4 and Port 4 (P4) trusses, respectively. 

SSRMS is 

attached to 

an MBS PDGF

SSRMS is holding 

the SPDM, which 

is holding another 

piece of hardware

POA is 

holding a 

piece of 

hardware

Figure 11. This picture taken during Expedition 26 shows the SSRMS based on an MBS PDGF holding 

the SPDM, which is attached to an Orbital Replacement Unit. The Payload Orbital Replacement Unit 

Accommodation (POA) is also holding another Orbital Replacement Unit. 
258 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

Mobile Servicing 

System Operations

Operations of the robotic systems 

are unique in a number of aspects 

and, much like the ISS, have evolved 

over the years. On the Space Shuttle, 

the Canadarm was controlled by 

the astronauts, which was the initial 

plan for the MSS. Today, the ISS 

systems can be operated by either 

the astronauts or the flight control 

team based in Houston or Montreal. 

Where possible, it is preferable 

to perform operations from the 

ground to free up the astronauts 

to focus on scientific research. 

Crew Operations and the 

Robotic Work Station 

The crew interface to the robotic 

systems is the Robotics Work Station 

(RWS).The ISS includes two identical 

RWSs (Figures 1 and 12). One is 

located in the Laboratory Module 

and the second is located the Cupola. 

Their key components include a 

control panel, two hand controllers 

for control of the arm, and three video 

displays to provide camera views to 

the astronaut operator. The control 

panel controls key functions such as 

how fast the arm can move and which 

of the many external cameras are 

visible on one of the three monitors. 

Figure 12. (Left) Expedition 18 Commander Michael Fincke (left) and STS-126/ISS ULF-2 Mission Specialist Donald Pettit (right) work the controls at 

the RWS in the US Laboratory on November 17, 2008. The three monitors in the middle can be used to view any external camera on the ISS. Additional 

computers are used to display a graphical representation of the arm or video from other sources (e.g., from the shuttle payload bay). The laptop that Don 

Pettit is using displays the timeline and procedures. Today, the Laboratory RWS is only used as a backup for the one in the Cupola. (Right) Expedition 36 

Flight Engineer Karen Nyberg prepares to capture the “Kounotori” H-II Transfer Vehicle-4 on August 9, 2013. Her hands are on the two-hand controllers and 

the three video monitors are at her eye level with a laptop in the center showing the joint angles of the robotic arm. The tip of a solar array is visible in the 

window on the right while the robotic arm is seen in the window on the left. 

Two hand controllers are located 

on each work station. These allow 

crew members to control arm motion 

and perform capture-and-release 

operations. A crew member who 

maneuvers the arm via the RWS 

hand controllers is said to be “flying 

the arm.”

The monitors are used to provide 

situational awareness cues to crew 

members while they are operating 

the system. Several cameras on the 

ISS structure and several cameras on 

the robotic system can be displayed. 

When grappling a free-flying 

spacecraft, for example, the crew 

members will display the camera 

that is mounted on the tip of the 

arm, which allows them to see visual 

cues about the alignment of the end 

effector relative to the grapple pin. 

If the robotic system is being used to 

maneuver a spacewalker, a camera 

on the ISS structure might be used 

to monitor how close his or her boot 

plate is to the station structure. 

Ground Operations and the 

Flight Control Team

Unlike robotic arms that move fast 

and easily, such as those in science 

fiction movies, the motion of the 

space station systems requires long 

and careful planning by the Robotics 

Officer (ROBO) team. If the operation 

is something that can be performed 

methodically, such as replacing a 

piece of hardware on the exterior of 

the ISS, and which can be planned 

well in advance, the flight control 

team will perform the operations; 

otherwise, the crew may perform the 

task. For more dynamic operations—
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 259

e.g., capturing a visiting vehicle or 

supporting a spacewalk—the on-board 

astronauts will execute the procedure.

In addition to providing the hardware, 

CSA also provided flight controllers 

to operate the MSS. Whereas the 

other international partners control 

their contributions from a control 

center in their host countries with 

their own flight director, the MSS 

is controlled from Houston, Texas, 

under the supervision of the NASA 

flight director. In Houston, the 

system team, led by the ROBO 

(see Introduction) is made up of 

approximately 50% CSA employees. 

Initially, the CSA robotics support 

room in Montreal provided primarily 

engineering support during robotics 

operations, which was the equivalent 

of the Mission Evaluation Room 

discussed in the Introduction. Over 

time, the capabilities of the facilities 

and operators in Montreal grew. 

Today, it now serves as a control 

center. Here, the MSS systems and 

MSS task flight controllers support 

the ROBO (Introduction Figure 10) 

and, on occasion, ROBO supports 

from Montreal with the backroom 

support in Houston (Figure 13). 

Figure 13. Expedition 47 ROBO Jason Dyer (CSA) on console in Mission Control Center-Houston during rendezvous with Orbital/ATK Cygnus OA-6 cargo 

vehicle in March 2016. Various data are displayed on the computer monitors including a graphical display below the ROBO sign on the left, similar to what 

the astronauts use, showing the current position of the robotic arm. On the left side of the front wall displays are six images from external cameras on the 

ISS. The middle wall display tells the flight director (not shown) the location of the ISS in relation to the Earth, as well as the vehicle orientation. The far-right 

display shows the commands being sent to the ISS and any alarms that are present. 

In the early days of robotic operations 

on the ISS, the flight control team 

powered the MSS on or off but 

left the dynamic operations to the 

crew. After a serious ISS computer 

system failure on STS-100/ISS-6A 

(see below), the team began to 

imagine how operating the robotic 

systems from the ground could 

actually work. Today, many of the 

SSRMS operations, all translations 

of the systems using the Mobile 

Transporter, and all of the SPDM 

operations are actually performed 

by the ground team. The Bigelow 

Expandable Activity Module was 

installed in April 2016, completely 

by the ground team. The astronauts 

performed only the time-critical steps 

with the Common Berthing Module. 
260 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

In 2004, the ground team uplinked 

approximately 3,500 commands to 

the MSS. This number is expected to 

rise to greater than 80,000 in 2018. 

Ground control does not employ 

hand controllers. Although the 

ROBOs could perform operations 

with hand controllers, the latency 

involved in issuing commands to 

the ISS via the Tracking and Data 

Relay Satellite System preclude them 

from performing the subtle motions 

required for operations using hand 

controllers. Therefore, personnel in 

the Mission Control do not “pilot” 

the arm like the crew does. Instead, 

flight controllers use pre-calculated, 

automatic sequences of instructions 

that tell each joint exactly how far 

to turn, at what rate, and in which 

order. During motion of the arm, the 

ROBO then monitors the system to 

verify it is executing the instructions 

correctly. These “ground control” 

operations use the various camera 

views available to Mission Control 

Center-Houston as well as computer 

depictions of where everything is 

in relation to each other, driven by 

real-time telemetry from the ISS, to 

provide in situ awareness for the flight 

controllers who are flying the arm. 

Crew, Houston, and Canadian 

Ground Control Working Together—

A Case Study

Another key capability of the arm 

is to capture visiting vehicles (see 

also Chapter 14)—a process that is 

performed symbiotically between the 

ground and crew, as illustrated by 

the example of the fifth H-II Transfer 

Vehicle (HTV) cargo mission to the 

ISS. On August 15, 2015, the Japan 

Aerospace Exploration Agency 

launched the HTV5 “Kounotori 5” 

resupply vehicle toward the ISS. 

Prior to the launch, flight controllers 

in Houston and Montreal attached 

the SSRMS to a PDGF on Node 2 

and positioned it for the arrival of the 

visiting vehicle. After a couple days of 

free flight, HTV5 arrived underneath 

the space station and started slowly 

approaching the ISS on August 24 

(Figure 14).

Figure 14. HTV5 approaching the ISS from underneath in August 2015. Sunlight reflecting off shiny surfaces on the vehicle cause the starburst pattern. 

Over the course of a couple of hours, 

HTV5 moved closer to the ISS, 

orbiting just below the station (see 

“Are we there yet?” in Chapter 14). 

As the HTV moved closer, the crew 

on board the space station monitored 

the vehicle to verify it stayed within 

the approach corridor. The trajectory 

is designed such that HTV arrives at 

its station while keeping the position 

with its grapple fixture directly in 

front of the SSRMS LEE (Figure 15). 

From that point, the on-board crew 

members take over. They maneuver 
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 261

the arm to grapple the free-flying 

HTV5. Crews train extensively to 

be able to capture a vehicle that is 

not completely steady. The amount 

of hand/eye coordination and quick 

responses required to grapple a free 

flyer precludes the flight controllers in 

Houston or Montreal from being able 

to capture a vehicle. Once the HTV5 

was captured, however, operations 

transitioned back to the ground. The 

ROBO took over the operations and 

maneuvered HTV5 to mate with 

the Node 2 nadir-facing Common 

Berthing Mechanism. Working in 

concert with the on-board crew 

members who operate the common 

berthing mechanism, the ground 

team installed the HTV5 on the 

Node 2 nadir port (Figure 16). See 

also Chapter 3.

Figure 15. Flight Director Royce Renfrew and his team watch as the HTV5 arrives at the capture point, oriented such that its grapple fixture is directly in 

front of the LEE. The gold-colored material (left in the view) is part of the thermal covering of the vehicle. The white circle in the center of the gold-colored 

area is the grapple fixture. JAXA astronaut Koichi Wakata is sitting to the right of the Flight Director.

Figure 16. The HTV5 being maneuvered toward the Node 2 nadir Common Berthing Mechanism on 

the ISS (top of image). 
262 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

Several days after arrival, the 

SSRMS removed the exposed 

pallet from the HTV trunk. The 

pallet contained a new payload for 

the Japanese Experiment Module 

exposed facility. Additionally, two 

completed and used-up experiments 

were placed on the exposed pallet, 

which was eventually installed back 

in HTV5 for disposal (Figure 17). 

Reversing the capture and berthing 

process, the crew and ground 

removed the HTV from the ISS 

on September 28. The HTV then 

reentered the Earth’s atmosphere 

and disintegrated.

Figure 17. Astronaut Kjell Lindgren operates the 

Canadarm2 to install the exposed pallet into the 

HTV5 trunk area. The exposed pallet contained 

two experiments that had been completed and 

were ready for disposal. NASA video. 

Operational Challenges 

and Triumphs

The SSRMS was delivered to the 

ISS in 2001 during the STS-100/

ISS-6A assembly mission. Its 

activation and commissioning did 

not go smoothly, however. Not long 

after the arm had been activated, the 

ISS Primary Command and Control 

(C&C) Multiplexer/DeMultiplexer 

(MDM) (see Chapter 5) failed. 

This by itself was not critical. 

Computers are known to have 

problems now and then, which is 

why there are three of these on the 

ISS. However, by all indications, it 

was not a software problem; rather, 

the spinning hard drive had failed. 

The robotic systems relied heavily 

on the hard drive, reading critical 

programming files and recording key 

data about the system performance 

for flight controllers to monitor. 

Due to this reliance and use of the 

hard drive, it was first believed that 

the SSRMS was the cause of the 

failure. This concern increased when 

a second C&C MDM failed with 

a similar signature. The situation 

became more critical when the third 

computer failed (see also “When 

Computers Crash,” Chapter 5). As 

the Onboard Data Interfaces and 

Network (ODIN) (see Introduction) 

flight control team figured out how to 

recover the computers, the robotics 

flight controllers were challenged to 

complete the operations on ISS-6A. 

These operations included returning 

the pallet on which the arm had 

been delivered back to the shuttle 

payload bay, and putting the arm in 

a safe configuration for the shuttle 

undocking. Fortunately, the arm was 

already activated when the MDMs 

failed because, normally, it loads 

all of its operating software from 

the same hard drives that failed. 

However, the crew’s displays on 

the Portable Computer System, 

which is used for operating the 

SSRMS, also depend on the hard 

drive. ROBO was faced with a 

brand new robotic arm with no way 

to control it. Ground control had 

not yet been invented. The ground 

team worked rapidly to figure out 

how to have the crew maneuver the 

SSRMS to the needed position, and 

then have the astronauts fly the last 

little bit using the hand controllers, 

which still worked. This had to be 

accomplished without the displays 

that the crew had been trained to 

use, and had to be executed under 

the direction of ROBO using video 

and telemetry on the ground. In this 

fashion, the team “limped” through 

the remaining robotics operations. 

After the mission, the ROBO team 

began working out concrete plans for 

ground control operations.

After detailed investigation by 

the flight control and engineering 

teams over several weeks, the 

flight control team determined that 

various problems during years of 

testing on the ground had caused the 

C&C MDM hard drives to literally 

fracture. Although this had significant 

implications for the space station 

since these computers controlled the 

US On-orbit Segment, it directly 

and severely impacted the robotic 

operations. The next mission, 

STS-STS-104/ISS-7A, was scheduled 

to deliver the airlock module; the 

SSRMS was required to successfully 

install it, as was the case with all 

remaining modules. Flight controllers 

worked hard over the next 3 months 

to install spare hard drives and 

reload all the software from scratch, 

including the robotics software. No 

further problems occurred during the 

installation of the airlock on ISS-7A.

New challenges soon emerged. 

On March 5, 2002, one of the two 

redundant electrical drive motors on 

the wrist roll joint on the “A” end 

(see Figure 4) failed on the SSRMS. 

Two systems were built into the arm 

so that if one failed during a critical 

operation, such as while installing 

a module, the second motor could 

take over and complete the job. 

However, to start a major operation 

with one system already failed 
SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 263

meant another failure could leave 

the arm stuck. A module stranded 

on the end of the SSRMS would be 

an extremely critical scenario. First, 

critical cables that provide power to 

heaters that keep the equipment from 

freezing have to be disconnected 

from the shuttle payload bay and 

reconnected after the module is 

berthed. Hardware stuck on the arm 

could freeze in a matter of hours. 

Second, this configuration would not 

be stable enough for the space shuttle 

to undock because vibrations and 

thruster plumes from the shuttle could 

jolt the SSRMS during the undocking 

process. This could damage the arm 

and even cause the hardware to be 

inadvertently released, possibly 

colliding with the ISS.

Figure 18. Mission Specialists Franklin ChangDiaz (red stripes on legs) and Philippe Perrin 

repair the wrist roll joint on STS-111/ISS-UF-2 

on June 11, 2002. (Top) Crew members set up 

to perform the replacement. The shuttle robotic 

arm (Canadarm), in the left of the image, acts as 

a “cherry picker” to move one of the astronauts 

around. An articulating portable foot restraint near 

the feet of the other astronaut acts as a fixed boot 

plate during the repair. (Middle) After installing 

the portable foot restraint in the shuttle robotic 

arm, Chang-Diaz inserts his feet in the boot plate. 

Astronauts inside the shuttle maneuvered him to a 

location where he could remove the station robotic 

arm’s LEE. The LEE had to be removed to get to 

the failed roll joint, which is the next joint in line. 

(Bottom) The new roll joint, installed on the station 

robotic arm. Note how the multilayer insulation 

(MLI) on the new joint is much whiter in color than 

the MLI on the other station arm components. 

Off-gassing of the MLI changes its color over time 

on orbit. Both crew members in this picture are 

maneuvering the old LEE to reinstall it. 

Since there was no way to replace

only a motor on the arm, the entire 

joint containing the two drive 

motors would need to be replaced. 

Unfortunately, the spare joint 

motor could not be delivered and 
264 CHAPTER 15 SYSTEMS: ROBOTICS—THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION

installed until STS-111/ISS-UF2, 

after the STS-110/ISS-8A mission, 

which required the arm to install 

a key component of the ISS truss. 

The flight control team quickly put 

together a plan that would not require 

using that particular joint. The 

ROBO team developed a less-direct, 

complex sequence of maneuvers, 

enabled by the number of joints 

and the wide range of position each 

possessed. Although the primary 

system was working fine, the plan 

could not use that joint since a failure 

could put the arm in a position from 

which it could not be safely moved. 

However, it was never envisioned 

that the controllers would operate 

the software in this way, instead 

trying to figure out where the arm 

needed to go and calculating the 

most efficient way to get there. The 

ROBO team conceptualized the new 

software operations and the code was 

updated and tested quickly by CSA 

contractor MacDonald Dettwiler and 

Associates. Procedures were updated 

and the crew quickly retrained on the 

new operational scheme, which was 

now referred to as Degraded Joint 

OPerationS (DJOPS). This entire 

process was performed in about 

1 month and the ISS-8A mission was 

completed without incident. As with 

all situations, the flight director and 

flight control team spent a lot of time 

preparing for the worst and hoping 

for the best. Although the DJOPS 

was not used on that mission, it has 

become a standard capability. 

During STS-111/ISS-UF-2, similar 

contingencies were prepared for 

the flight’s robotics mission design, 

which involved the installation 

and deployment of the MBS, as 

well as spacewalk support. The 

SSRMS joint was successfully 

replaced (Figure 18) during the final 

spacewalk of the mission, taking 

place exactly 100 days after the joint 

failure first occurred. The new joint 

restored SSRMS fault tolerance, and 

the ISS assembly could continue 

on the subsequent shuttle missions 

with a fully functional arm.

Conclusion

As with the construction of any 

project, whether it be a pyramid 

or a space station, tools are very 

important. The ISS robotic systems 

were critical for the successful 

assembly of the station. Based on the 

experience of the SSRMS, the space 

station robotic systems are both more 

complex, as well as significantly 

more capable and flexible. Although 

the ISS and its construction was 

developed with the MSS in mind, 

the SSRMS and its family of 

support equipment has been critical 

in supporting the daily operation 

of the station, often used in ways 

never originally imagined. External 

hardware, such as Remote Power 

Control Modules, are now routinely 

replaced using the SPDM, thus 

allowing the astronauts to focus on 

more scientific research. As discussed 

in Chapters 17 and 18, the big arm 

was critical in numerous spacewalks, 

including spectacular contingency 

operations, and will continue to play 

a major role in the operation of the 

ISS. Robotic systems in science 

fiction movies tend to inspire awe 

by moving fast and operating with 

significant, often autonomous, 

intelligence. Reality is that the MSS 

on the ISS represents the state of the 

art today as it inspires awe in the 

robust and flexible manner that it 

supports an outpost on the edge of 

space. At the core of the system is the 

seamlessly blended NASA and CSA 

flight control team on the ground. 

Through discipline and competence, 

the ROBO team has pushed this tool 

to its maximum potential. Some 

form of robotics will be needed 

for humans venturing to the moon, 

Mars, and beyond. Operations in 

the harsh environment of space are 

best performed by robotics, leaving 

the human explorers safer in the 

relative protection of their spacecraft. 

The lessons learned after years of 

operating the space station robotic 

system will play a vital role in 

development and operations of those 

future robotic systems. 


Chapter 16 Day in the Life:

In-Flight 

Maintenance
268 CHAPTER 16 DAY IN THE LIFE: IN-FLIGHT MAINTENANCE

Expedition 43 astronauts Scott Kelly (left) and Terry Virts perform in-flight maintenance on the Carbon Dioxide Removal Assembly. The inner workings of the 

device were removed from the rack in Node 3 and moved to the Japanese Experiment Module to provide a larger area in which the crew can work.

A spacecraft as large, complex, 

and long-lived as the International 

Space Station (ISS) will clearly need 

to be maintained. This is especially 

true when considering that the first 

components of the ISS have been in 

space since 1998. ISS maintenance 

is the responsibility of both the crew 

and the flight control teams as part 

of day-to-day operations. Some 

components have limited lifetimes 

and need to be replaced or repaired 

on a periodic basis. Examples of 

equipment in this category include 

dust filters, batteries, experiment 

igniter tips, overhead lights, 

and various waste filters in the 

regenerative life support system. 

Other components need regular 

inspection to ensure they are 

still functioning, or are able to 
DAY IN THE LIFE: IN-FLIGHT MAINTENANCE CHAPTER 16 269

function properly. Examples of 

such components include hatches, 

portable breathing masks, and other 

emergency equipment. 

Finally, hardware may simply break 

unexpectedly and will need to be 

fixed for a certain component or 

system to be returned to operational 

use. When hardware fails on the space 

station, the way it fails or breaks may 

not have been envisioned when the 

hardware was being designed.

All of this work falls in the realm 

of in-flight maintenance (IFM). 

IFM occurs both inside and outside 

of the ISS. The primary focus of 

this chapter is the internal IFM, 

which is managed by the Operations 

Support Officer (OSO) console. 

External maintenance, which might 

include replacing a cooling pump or 

installing power cables, is managed 

by the extravehicular activity (EVA) 

console and is discussed in detail in 

Chapters 17 and 18. 

The three categories of IFM 

include: Preventive Maintenance, 

Corrective Maintenance, and 

Diagnostic Maintenance. Preventive 

Maintenance entails all of the regular 

cleanings and inspections that are 

performed to ensure the proper 

operation of the hardware or system. 

Corrective Maintenance involves 

repairing or replacing hardware that 

has stopped working either because 

it is a consumable at the end of its 

life (e.g., a filter) or because it has 

broken unexpectedly (e.g., a light 

bulb or computer). Sometimes, 

hardware or equipment breaks and 

it is not obvious what has broken, 

especially in electronic equipment. 

In these cases, Diagnostic 

Maintenance is first required to 

determine where faults might be 

located, and to help ground teams 

establish the best way to repair the 

hardware or situation.

Maintenance Methodology

To the maximum extent possible, 

all ISS maintenance procedures are 

thoroughly reviewed and validated 

on mock-ups or flight-like hardware 

before the crew performs any 

procedures. OSO flight controllers, 

assisted by the necessary engineering 

specialists, develop methods and 

procedures for all maintenance tasks 

inside the ISS—from accessing and 

cleaning a filter, to the complicated 

replacement of a valve in the 

Carbon Dioxide Removal Assembly. 

Whenever possible, these procedures 

are tested on the ground prior to 

being given to the crew to ensure 

the correct tools are called out and 

that no unexpected problems occur 

while accessing certain areas, and 

to look for any hidden “gotchas” 

throughout the maintenance activity. 

Such procedures “walk” the ground 

teams and the crew through every 

aspect of maintenance activities. 

The general flow of these procedures 

is to gather the needed tools and 

spare parts, turn off the power to the 

equipment, access the equipment 

being maintained, perform the 

maintenance, clean up and close 

out the workspace, and finally turn 

everything back on and ensure the 

hardware is functioning properly.

Some aspects of ISS maintenance 

are similar to the maintenance 

done at home, or in automotive or 

aircraft repair facilities. Crews use 

standard hand tools to remove bolts 

and other fasteners to access broken 

components. They remove failed 

components and replace them with 

spare parts, then put the equipment 

back together using a torque wrench 

to ensure every fastener is tightened 

properly. In some instances, a good 

pair of pliers will help move a 

stubborn panel or a bent fastener. 

Given that astronauts all have 

varying degrees of experience in 

tools and maintenance, each crew 

member participates in maintenance 

training lessons that range from tool 

identification to performing complex 

maintenance operations on jet 

aircraft hardware. They also receive 

instruction on soldering, sewing, 

using a rivet gun, replacing Ethernet 

connectors, and creating wire jumpers 

and splices, not to mention the use of 

items such as a tap and die kit, driver 

drills and impact drills, and screw 

extraction kits.

The ISS is stocked with a wide 

variety of spare parts and tools 

because resupply from Earth is 

difficult, expensive, and time 

consuming. The tool inventory on 

board includes an array of hand 

tools, repair kits, and a number of 

specialty tools such as multimeters, 

pressure and temperature monitors, 

oscilloscopes, borescopes, and 

fiber optic diagnostic systems. 

Table 1 provides a summary of the 

maintenance tools and kits available 

for use in the US Segment of the ISS.

Maintenance and system upgrades 

on Earth often generate stories 

worth retelling, both when things 

go right and when things do not go 

quite as anticipated. What follows 

are a few of these stories to describe 

the implementation of some of 

the different types of maintenance 

performed on the space station.
270 CHAPTER 16 DAY IN THE LIFE: IN-FLIGHT MAINTENANCE

Table 1. Summary of ISS Tools and Diagnostic Equipment for use in the Pressurized ISS Environment

In-Flight 

Maintenance Tools

Description

ISS Toolbox

(Figure 1) 

A box of five sliding drawers that stores a majority of the ISS 

hand tools. The toolbox contains various sizes of wrenches, 

sockets, ratchets, torque wrenches, screwdrivers, pliers, 

L-wrenches, hammers, pry bars, files, tape measures, saws, 

feeler gauges, chisels, and punches. Many tools are available in 

both metric and standard sizes. 

Multiple sets of the commonly used tools are kept on the ISS to 

provide spares and to allow more than one crew member to use 

the same size/type of tool at the same time.

Power Tools The handheld, battery-operated power tools on the ISS include 

driver drills, impact drivers, and the necessary drill bits, 

batteries, and chargers.

Repair Kits The repair kits on the ISS include a generic parts kit that 

contains hose clamps, hose menders, hex nuts, zip ties, 

fasteners, countersunk screws, solid-state relays, switches, 

breadboards, potentiometers, capacitors, resistors, lightemitting diodes, transistors, diodes, circuit board fuses, 

cartridge fuses, knobs, tape, and foam. 

Additional repair kits include an Ethernet kit, soldering kit, 

wireway and coldplate covers, clamp and bracket kit with rivet 

gun, light-duty and heavy-duty sewing kits, screw extractor kit, 

and tap and die kit.

Electrical Tools For electrical repairs, the ISS has a Scopemeter, which is a 

combination multimeter and oscilloscope, a current probe, 

a temperature probe, a pressure probe, a multimeter, and 

oscilloscopes. 

Two pin kits contain a number of wires of various gauges as well 

as pins and sockets to enable crew members to create their 

own jumper wires. These kits also have the various plugs and 

adapters needed for use with the Scopemeter and multimeter to 

take measurements on the ISS wiring. 

Diagnostic 

Equipment

For troubleshooting and investigating maintenance problems, 

the ISS has diagnostic measurement software, a diagnostic 

power supply and accessories, a databus analyzer kit, 

Breakout Box, Multiplexer/DeMultiplexer On-Orbit Tester, 

electrical cable tester, fiber optic diagnostic and cleaning kits, 

and a fiberscope kit.

Fluid Servicing

(Figure 2) 

A Fluid System Servicer is used to drain and fill fluid lines inside 

the ISS. A fluid fitting torque device is used to mate and demate 

gamah-type fluid connections, which require very high torque 

to fully seal them. Fluid sampling tools are used to take and test 

fluid samples in the various internal thermal control loops.

Leak and Fire Maintenance equipment will be needed in the cleanup after 

an overboard leak or a fire on the ISS. Kits to support that 

work include the ISS Leak Kit and the Post-Fire Cleanup Kit. 

The ISS Leak Kit contains patches for sealing small holes to 

vacuum in the pressure shell as well as the Ultrasonic Leak 

Detector to help the crew find the leak point. The Post-Fire 

Cleanup Kit includes the tools and adapters needed to clean 

combustion by-products out of the cabin air after a fire has 

been extinguished.

Figure 1. The ISS toolbox in Node 1. 

Figure 2. Shannon Walker with the 

Fluid System Servicer. 
DAY IN THE LIFE: IN-FLIGHT MAINTENANCE CHAPTER 16 271

“Can You See It Now?”

The Finding Ready to Latch section 

of the Structures and Mechanisms 

chapter provides details on the 

Centerline Berthing Camera System 

(CBCS). The heart of the CBCS is 

a video camera that looks through a 

hatch window at an incoming space 

station module or cargo vehicle. The 

camera view is important in ensuring 

precise alignment of the new module 

before it can be attached to the ISS. 

On Space Transportation System 

(STS)-102/ISS-5A.1 (2000), the 

CBCS video signal was to be sent 

to the aft flight deck of the orbiter to 

assist the shuttle crew in installing 

the Multi-Purpose Logistics Module 

(MPLM) for the first time. This 

would also be the first time the CBCS 

signal was sent from Node 1 through 

the newly installed US Laboratory, 

through Pressurized Mating Adapter 

(PMA)2, to a visiting orbiter (Space 

Shuttle Discovery, in this case). 

The video monitor on the aft 

flight deck remained black after 

everything was connected and 

power was applied to the camera 

for a checkout on the day prior to 

MPLM installation. Thankfully, the 

CBCS checkout had been scheduled 

to occur the day prior to the MPLM 

installation, which gave the ground 

teams time to troubleshoot overnight. 

By the following morning, the 

crew had a fresh set of Diagnostic 

Maintenance procedures that could 

be used to pinpoint the source of 

the problem.

The crew first used one of the ISS 

laptops as a portable video monitor. 

With some spare cabling, the crew 

connected the laptop to the CBCS 

camera. This setup enabled crew 

members to see the video and 

confirm the camera was functioning 

properly. For the CBCS to be fully 

operational, the camera needed to 

receive a return (sync) video signal 

from the orbiter. Yet, when the crew 

connected the laptop to the return 

line from the orbiter, no video was 

displayed, thereby indicating a video 

cable problem between Node 1 and 

the orbiter.

After ruling out any problem with 

the CBCS, the ground team looked 

at ISS video system drawings. It 

turned out that although PMA3 

(used successfully with CBCS on 

STS-98/ISS-5A, months earlier) 

and PMA2 are nearly identical, the 

video wiring is not. The video and 

sync lines were inadvertently crossed 

on the PMA2 drawings. This cross 

wiring was dutifully implemented 

according to the drawings when 

PMA2 was built. This problem was 

not caught in ground testing because 

the testing did not use a setup that 

requires successful receipt of the 

video signal on the sync line, which 

is something the CBCS requires. 

Once the problem was identified, 

developing a solution was simple. 

The video lines between Node 1 

and the orbiter needed to be 

“uncrossed.” The crew created two 

jumper wires using the on-board pin 

kit, which is a collection of spare 

wire and electrical contacts (pins 

and sockets). These jumpers allowed 

the crew to cross the video and sync 

lines in the US Laboratory so that the 

wiring for the PMA2 would uncross 

it. This option was possible because 

the ISS wire bundles and harnesses 

have numerous connectors located 

throughout the spacecraft that are 

readily accessible to the crew. When 

necessary, the crew can disconnect 

a wire bundle and use a connector to 

perform diagnostic troubleshooting 

on hardware or, in the case of the 

CBCS, correct an error in design 

and manufacturing.

The result: Successful CBCS video 

was received on the flight deck in 

time to complete the first installation 

of an MPLM on the ISS. A more 

permanent jumper was manufactured 

and flown on STS-100/ISS-6A a few 

months later, and installed in place 

of the temporary pin kit jumpers. 

That jumper harness remained 

installed until Node 2 (Harmony) 

was installed on STS-120/ISS-10A 

(2007). Node 2 was built with 

crossed video wiring such that it 

would correct the wiring problem 

in PMA2 without the need for the 

extra jumper in the US Laboratory.

“Where’s The Leak?”

Air leaks on a spacecraft are usually 

bad news because the air needs to 

stay inside for the crew to breathe. 

However, when an EVA (i.e., 

spacewalk) takes place, the airlock 

must be able to be depressurized 

to vacuum. When the normally 

pressurized airlock and its systems 

are at vacuum, there must also be 

certainty that no cabin air from 

elsewhere on the ISS leaks into the 

depressurized airlock. In the early 

years of the ISS, both types of “things 

you don’t want” occurred; i.e., a 

small leak of cabin air to space, and a 

small leak of cabin air into the airlock 

when it was at a lower pressure than 

the rest of the space station. In both 

cases, a diagnostic tool was required 

to help the crew find the source of the 

leak and stop it.
272 CHAPTER 16 DAY IN THE LIFE: IN-FLIGHT MAINTENANCE

The new Joint Airlock, named 

Quest, was brought to the ISS on 

board STS-104/ISS-7A (2001). This 

proved to be an ambitious assembly 

mission. The first two of three EVAs 

to install the new ISS airlock were 

successfully conducted from the 

airlock of the Space Shuttle orbiter. 

The mission called for the final EVA 

to be conducted from the new airlock 

to prove that all airlock systems 

functioned correctly. A feature of the 

airlock design is that a depress pump 

can pump cabin air from the airlock 

back into Node 1. Instead of having 

to vent the cabin air overboard when 

depressurizing the airlock, and thus 

losing the valuable air resource, the 

air can be saved by putting it back in 

the ISS stack. This would only work 

as long as the hatch seal between 

Node 1 and the airlock did not leak. 

It also meant that the seals in the air 

lines between the depress pump and 

Node 1 could not leak; otherwise, 

cabin air would leak back from 

Node 1 into the airlock. 

It was quickly discovered that a 

leak existed in the air lines when the 

depress pump was first turned on, 

thus allowing air from Node 1 to 

leak back into the airlock. This leak 

prevented crew members from being 

able to keep the airlock at the lower 

pressure they needed. Fortunately, a 

new diagnostic tool—an Ultrasonic 

Leak Detector (ULD)—was flown 

to the ISS on this mission. The ULD 

is a tool used widely in industry 

to find leaks in pressure vessels 

by converting the ultrasonic noise 

created by the leaking, turbulent gas 

into an audible sound. The more 

directly the microphone of the tool is 

pointed at the leak point, the louder 

the sound gets. The crew successfully 

used the ULD during the mission to 

locate a leaking fitting on the depress 

pump. The fitting was tightened 

and, ultimately, the final EVA of the 

mission was completed from the 

brand new airlock.

The primary reason for sending the 

ULD to the space station was to 

help the crew find leaks of cabin 

air to space. This method of using 

the ULD was first put to the test 

during Expedition 8 (2004). The 

ground teams detected a small leak 

(approximately 1.2 mm Hg 

[0.02 psi] pressure drop per day); 

however, the point of the leak could 

not be easily determined. The leak 

rate was slow enough that crew 

members did not need to perform 

their emergency depressurization 

procedures; nonetheless, they did 

need to determine the source of the 

leak in order to stop it and prevent 

additional air from escaping. Over 

a number of weeks, the crew and 

the ground used the ULD and other 

techniques to isolate the leak to 

somewhere in the US Laboratory. 

The crew then used the ULD to 

survey the laboratory. The crew 

ultimately determined that the 

loudest source of ultrasonic noise 

was coming from a vacuum hose 

attached to the large window in that 

module (see Figure 21 in Chapter 3). 

The crew demated the hose from 

the vacuum source, which stopped 

the air from leaking. 

Figure 3. Expedition 8 Commander Mike Foale uses the Ultrasonic Leak Detector to try to pinpoint 

a small cabin leak to space near the window in the US Laboratory. A small probe is attached to the 

microphone of the ULD (near the astronaut’s hand), which detects the ultrasonic noise of leaking air. 

That ultrasonic noise is converted to audible noise that the astronaut listens to in the headphones. 

The louder the noise, the closer the ULD probe is pointed toward the leak point.
DAY IN THE LIFE: IN-FLIGHT MAINTENANCE CHAPTER 16 273

“That’ll Never Happen”

The computer systems on the ISS are 

divided into tiers (see Chapter 5). The 

Command and Control Multiplexer/

DeMultiplexers (MDMs) make 

up the topmost tier. The three 

Command and Control computers, 

for redundancy, are always 

powered on. One is designated as 

the primary computer; the other 

two serve as backups. Prior to the 

STS-100/ISS-6A (2001) mission 

it was considered impossible—

or, at least, non-credible—for all 

three of these computers to fail 

at the same time. If this were to 

happen, there would be nearly no 

way for the crew or the ground 

to interface with any of the other 

computers or space station systems.

During STS-100/ISS-6A, the 

impossible happened. One after 

another, all three computers failed. 

Fortuitously, this failure occurred 

while the Space Shuttle orbiter was 

docked. Since the orbiter had its own 

communication link with the ground, 

instructions could be voiced up to 

the ISS and orbiter crews to assist 

in recovering the computers. After 

some troubleshooting, the ground 

team determined that the only way 

to recover the system was to build 

new computers. The Payload MDMs 

are physically the same size as the 

Command and Control MDMs and 

use most of the same computer cards. 

Thus, one of the Payload MDMs 

was deemed a suitable Orbital 

Replacement Unit (ORU) to scavenge 

in order to build a new Command 

and Control MDM. Since the MDMs 

were not identical and did not have 

the same software load, the crew 

performed corrective maintenance 

to remove a Payload MDM, change 

some cards inside, and repurpose it as 

a Command and Control MDM.

The MDMs on the ISS were 

designed to be maintained at two 

different levels. The entire MDM 

ORU could be replaced. Or, the front 

face plate of the MDM could be 

removed, and individual computer 

cards or hard drives inside the 

MDM could be changed. A 

combination of both ORU-level 

and card-level maintenance was 

required to create the new Command 

and Control MDMs. 

Figure 4. The front cover of two MDMs are removed while the crew works to repair them during the 

STS-100/ISS-6A mission. The computer on the left is a Command and Control MDM, evidenced by the 

large black box of a hard drive in the right-hand bay of the MDM. The MDM on the right does not have 

the hard drive installed. 

First, the backup Payload MDM,

which is usually not powered when 

the primary Payload MDM is 

functional, was removed from its 

rack location in the US Laboratory. 

The front plate of that MDM was 

opened. Spare computer cards were 

inserted to change the internal 

card configuration to match the 

configuration of the Command and 

Control MDM. One of the spare 

cards was a hard drive that included 

the software needed for the MDM to 

boot up. Once this new Command 

and Control MDM was installed, the 

ground was able to boot the newly 

constructed MDM into a diagnostic 

mode, which is similar to safe 

mode on a home personal computer. 

In this state, the ground slowly 

erased the payload operating software 

and loaded the data for the Command 

and Control software. Once all 

files of the new operating system 

were loaded, the flight controllers 

rebooted the machine and slowly 

recovered all the necessary software 

functions. With a single Command 

and Control MDM running, the crew 

completed additional IFM work to 

repair the other two Command and 

Control MDMs.

“Give It a Whack”

For space station hardware to be 

strong and secure enough to survive 

the fairly rough ride into space and, 

at the same time, fit together well, 

designs usually require precise 

manufacturing and allow only 

small tolerances in the fit between 
274 CHAPTER 16 DAY IN THE LIFE: IN-FLIGHT MAINTENANCE

components. Ideally, everything 

would be fit checked on the ground 

prior to launch; however, this not 

always possible due to schedule, 

cost limitations, and the fact that 

many of the hardware pieces are 

built in different countries around 

the world. In addition to the standard 

conditions of their intended use, flight 

hardware must endure the vibrations 

of launch, the change in pressure as 

hardware goes from Earth pressure to 

vacuum (for hardware kept outside 

on the ISS), and the widely changing 

thermal environment in Earth orbit. 

The thermal environment especially 

affects hardware located outside the 

space station, as that environment 

fluctuates with each orbit as well as 

with each season.

Despite the best maintenance 

approaches and planning, as well 

as the best hardware design, two 

pieces of hardware can get stuck 

together and need to be separated. As 

sometimes happens when conducting 

repair work on Earth, the two pieces 

may need nothing more than a slight 

tap or even a good whack. Due to the 

cost of equipment on the ISS, this is 

usually an option of last resort.

The need for a tap or a whack has 

played out a number of times on the 

ISS. On multiple occasions, hardware 

inside the space station needed some 

extra hammer taps to be convinced to 

come free from mounting locations 

they had occupied since launch. The 

same is true for hardware outside 

the space station. During an EVA in 

Expedition 6 (2003), astronauts Ken 

Bowersox and Don Pettit needed 

to move a light stanchion, or post, 

that was mounted to the ISS truss. 

The stanchion was held in place by 

a single bolt, and it sat in a type of 

tongue-and-groove interface on the 

truss. After the bolt was released, 

the stanchion refused to come free 

from the truss. After the astronauts 

tried multiple ways of wiggling and 

shaking to free the stanchion, it was 

decided to abandon the stanchion 

until the next EVA so that the ground 

team could come up with additional 

options and recommendations.

After much discussion between the 

engineering and flight control teams 

on the ground, it was decided that 

the best option for the second EVA, 

if renewed wiggling and shaking did 

not work, was to use a hammer to 

tap the stanchion free. After a few 

small taps did not free the stanchion, 

the crew gave the stanchion a 

more reasonable “whack,” and the 

stanchion came loose.

The STS-114/ISS-LF1 (2005) 

mission was the Return to Flight for 

the Space Shuttle Program after the 

loss of the Space Shuttle Columbia. 

This mission brought the MPLM to 

the space station to provide some 

much needed cargo resupply. The 

MPLM is a full-sized ISS module, 

flown up in the Space Shuttle cargo 

bay, and attached to one of the ISS 

Node modules. Once the MPLM was 

attached on this mission, the crew 

was ready to open its hatch and start 

transferring supplies.

As happens with most new modules 

that are brought to the ISS, once 

power is available to the module, 

the internal fans are turned on to 

circulate the air within the module 

before the hatch is open. This draws 

any free-floating debris to the air 

filters so the crew members do not 

breathe in the debris or get any 

in their eyes when they enter the 

module for the first time. This air 

motion can generate a slight increase 

in pressure inside the module, 

which will effectively push the 

hatch closed. Given the large size of 

the hatches, even a small pressure 

differential across a hatch can create 

a large pressure force pushing the 

hatch against its seals, which would 

prevent the crew from being able 

to open the hatch. For example, a 

pressure differential of 0.98 mm Hg 

(0.019 psi) pushing the hatch closed 

will require the crew to put 220 N 

(50 lb) of force into the hatch handle 

to overcome the pressure. When the 

external side of a hatch is exposed 

to space vacuum, approximately 

173,500 N (39,000 lb) of force press 

the hatch against the bulkhead seals.

Hatch designers thought of this, 

of course, when the hatches were 

designed. All hatches have valves that 

crews open to allow the pressure on 

both sides of the hatch to equalize. 

Thus, to open any hatch on the space 

station, the crew must first open the 

equalization valve and wait for the 

pressures to balance. 

On STS-114/ISS-LF1, crew members 

opened the equalization valve and 

waited the appropriate amount of time 

to equalize the MPLM pressure with 

the ISS pressure. When they tried to 

open the hatch, it would not budge. 

As described in the “Hatches” section 

of Chapter 3, the hatch mechanism 

contains “kickers” that push against 

the bulkhead of the module when the 

crew turns the hatch handle. These 

kickers help crew members unseat the 

hatch. Even though crew members 

put extra force into the hatch handle 

to try to get these kickers to push 

harder against the bulkhead, the hatch 

would not open. 
DAY IN THE LIFE: IN-FLIGHT MAINTENANCE CHAPTER 16 275

When The Nearest Handyman is You 

Colonel Timothy Kopra, Expeditions 20 and 46/47

The ISS is a world-class orbiting laboratory. Every 

day, the crew members on board conduct a variety 

of experiments that will help us prepare for going out 

beyond Earth’s orbit, discovering fundamental aspects 

of science, and improving life on Earth. The space 

station is an amazing place to work and live, but the 

environment we have is only what we have created and 

maintained. Outside of the station’s thin aluminum hull 

is a vacuum that is completely inhospitable to life. It is 

so vital, then, that we maintain and sometimes repair the 

systems on board that provide our clean atmosphere, 

water, electricity, thermal control, and communications, 

just to name a few. 

One of the key components of our life support system 

on the space station is the Carbon Dioxide Removal 

Assembly (CDRA). After we extract the oxygen that our 

body needs when we inhale, we exhale a significant 

amount of carbon dioxide (CO2

). Each person exhales 

around 20 liters (5 gallons) per hour, for a total of 120 liters 

(32 gallons) per hour introduced into our atmosphere 

when there is a crew of six on board. Humans are very 

sensitive to even low amounts of CO2

 when we breathe it 

in. Just a fraction of 1% of CO2

 in the air can give you a 

headache, cause fatigue, and affect how clearly you think.

The primary CDRA installed in Node 3 failed in 

February 2016, when the fan motor controller 

malfunctioned. This device controls the operation of 

the blower that provides airflow through the CDRA. 

The task of replacing the motor controller was a bit like 

removing the engine from a small car and then replacing 

some of the components attached to it. The CDRA was 

located in a rack about the size of a large refrigerator 

behind some panels. It is tightly installed within the 

rack and connected to other parts of the system. 

After removing the panels to get access to the CDRA, 

Scott Kelly and I followed the well-crafted procedures 

developed by the ground maintenance team to slide the 

CDRA out, disconnect it, and remove it from the rack. 

After this, we were able to get to work on the repair.

We floated the large CDRA through the station to a 

maintenance work area (our workbench), located in 

Node 2. While zero gravity makes it easy to move around 

a large piece of hardware such as the CDRA, it can be a 

bit tricky to secure it and set it up for maintenance. We 

used a set of bungee cords on the maintenance work 

area to keep the CDRA in place while still providing 

access for the maintenance tasks. 

Since considerable time is dedicated to removing a 

CDRA, the ground team decided that we should also 

replace some other parts that were not in top working 

order. We were tasked with replacing a heater controller 

and one of CDRA’s valves as well as the motor controller. 

Earlier in the morning, we had collected the spare 

components and all of the tools that we needed for 

removing and replacing each part. The rest of the job was 

pretty straightforward: Scott and I worked together to 

replace the failed components using the procedures that 

described in detail which tools to use and the steps to 

remove the components and install the new ones. After 

the removal and replacements were complete, we worked 

in reverse, floating the CDRA back to Node 3, installing it 

back into the rack, and reattaching the panels. We then 

waited with anticipation as the ground team performed 

the activation steps to make sure it all worked. We were 

glad to hear the call from Mission Control that the Node 3 

CDRA was again up and running.

One lesson that this relatively routine maintenance 

task highlights for me is how important it has been for 

us to have a highly functioning team to keep the ISS 

operational every day. Teams of experts on the ground 

have the in-depth knowledge of all of the systems and 

hardware on board, and they are the ones who identify 

the failures that occur, develop the thorough and clear 

procedures, train us to make the repairs, and manifest the 

replacement parts and tools for maintenance. We have 

a team of teams that keep our space station flying, and 

they frankly do such an outstanding job that they make it 

look easy. And it certainly is not.
276 CHAPTER 16 DAY IN THE LIFE: IN-FLIGHT MAINTENANCE

Figure 5. Expedition 11 Commander Sergei Krikalev and STS-114/ISS-LF1 Mission Specialist Wendy 

Lawrence prepare for opening the MPLM hatch in 2005. Their initial attempts would not be successful. 

Ultimately, a well-positioned shove would be required to open the hatch. 

Ground controllers in Houston 

struggled to come up with another 

option as all the standard “tricks” 

were not working. With everything 

the crew and ground had tried, the 

hatch should have opened easily at 

this point. The ground teams talked 

about the possibility that the MPLM 

hatch may not open at all, and what 

the impacts to the mission might be 

in that scenario. As Mission Control 

talked to the crew about possible 

options, the flight control team 

heard a muffled “ooomph” in the 

background, followed by a cheer from 

the crew. The hatch had opened. The 

trick that worked? One of the taller 

astronauts stood on the hatch ribs and 

then crouched while reaching up to an 

overhead footbridge. He straightened 

his body and pushed hard against the 

Node 1 footbridge. Effectively, he 

put all his weight into the hatch and 

forced the hatch open. The mission 

could continue as planned.

Later, engineers speculated that the 

small space between the two hatch 

seal beads had a lower pressure than 

the space station cabin—possibly 

even a vacuum. This lower pressure, 

due to the large hatch size, was 

effectively “sucking” the hatch 

against the MPLM bulkhead until 

enough force could be put into the 

hatch to overcome this pressure force. 

Sometimes, when it comes to getting 

hardware to work correctly in the 

extreme environments away from 

Earth—despite the best designs and 

pre-laid plans to resolve problems—a 

good tap, nudge, whack, or shove 

may ultimately do the trick.
DAY IN THE LIFE: IN-FLIGHT MAINTENANCE CHAPTER 16 277

The Mod Kit

Short for “modification kit,” a mod 

kit is a collection of equipment 

that needs to be installed on the 

ISS (usually inside, but sometimes 

outside, as well) to accommodate 

new hardware or new functions on 

the spacecraft. Mod kits can be small 

in size, or they can be quite large 

and complex. The need to install a 

mod kit usually presents a relatively 

rare opportunity to renovate and/or 

remodel the space station. Installation 

of a mod kit often requires the use 

of the many different maintenance 

techniques mentioned in this chapter. 

An example of a relatively small 

mod kit was the transition away 

from a large, single ORU in the urine 

processor that both filtered and stored 

pretreated urine. The large, single 

tank was being disposed of when 

the urine container was at its end of 

life, even though the filters (which 

were contained inside the tank) still 

had a much longer life available. 

The mod kit replaced this single 

component with a number of smaller, 

individual filters and a separate urine 

containment tank. The new design 

allowed for each subcomponent to 

be used until it had reached its own 

end of life. The mod kit contained 

the various separate filters, urine 

tank, and hoses to connect them all 

together. In this case, the OSO flight 

controller’s job was to determine 

how to best install the new hardware 

to make sure it would all fit inside the 

rack that was designed and built to 

accommodate the single, larger ORU. 

An example of a much larger mod 

kit is the project to reconfigure the 

ISS to support the Commercial 

Crew Program. This renovation 

requires the relocation of the 

Permanent Multipurpose Module 

and PMA3 module, installation 

of new docking adapters and 

control panels to operate them, and 

installation of new equipment so 

the ISS can communicate with the 

new commercial crew vehicles. 

New power and data lines will 

run throughout the US Segment 

to connect the new hardware, and 

to ensure full functionality of the 

modules that were relocated. A 

number of software changes on 

the ISS are also required to ensure 

the ISS MDMs know how to 

communicate with and control the 

new and reconfigured equipment.

A number of mod kits are involved 

in this US Segment reconfiguration. 

Planning and coordinating the 

implementation of this major 

rearrangement is being done across 

all of the flight control disciplines, 

the ISS Program, engineering 

organizations, and the various ISS 

Program contractors. The mod 

kit components and hardware 

will not all arrive at the ISS at the 

same time. They will launch to 

the ISS over a span of a number 

of years. Thus, choreography of 

what can be installed or relocated 

is as important as developing the 

maintenance procedures to actually 

perform the work. The first mod 

kit installation on the ISS for this 

effort occurred in January 2015, 

and completion is expected in time 

to support the first docking of a 

commercial crew vehicle in 2018. 

This major renovation work is also 

choreographed to ensure that the 

ISS and its crew can remain focused 

on the primary ISS mission of 

performing as much research and 

scientific investigation as possible.

Conclusion

Maintenance is a key factor in 

keeping the space station fully 

functional to support not only the life 

and livelihood of its crew but also its 

primary mission of unique off-Earth 

scientific research. Maintenance 

comes in a wide variety of forms, 

from simple cleaning and hardware 

replacement to intricate diagnostics 

and component repair. Repairs 

have proven successful through 

prepositioning supplies, detailed 

pre-launch training, and teamwork 

between the ground and crew. 

Often, adaptability and ingenuity 

has been required for problems 

that were not always anticipated. 

A copious supply of tape and 

resourcefulness from all involved has 

also proven to be a key factor, and 

will undoubtedly remain so for the 

rest of the space station program. 

Chapter 17 Systems: 

Extravehicular 

Activities—Building 

a Space Station
280 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

Astronaut Mike Hopkins participates in the second of two US spacewalks to change out a faulty external pump on the International Space Station (ISS). Visible 

in his helmet visor are Rick Mastracchio (Hopkins’ partner on the spacewalk), the ISS robotic arm, and some ISS structure and solar arrays. Dec. 24, 2013. 

Something about seeing an 

astronaut in a spacesuit captures 

the imagination of children and 

adults alike. Perhaps the human 

shape of the spacesuit against the 

backdrop of Earth gives one a sense 

of human fragility, or maybe looking 

at the suit is a little like glimpsing at 

a futuristic human race. The general 

public can tell just by looking at a 

photo that “walking” in space while 

attached to the vehicle by a tenuous 

lifeline is one of the most dangerous 

pursuits. A spacewalker wears a 

personal spacecraft that must provide 

protection from the freezing cold of 

space, the burning heat of the sun, 

and the small pieces of space debris 

that could come hurtling at him or 

her at thousands of miles per hour. 

The reality is that astronauts and 

Mission Control are hyperaware of 

such dangers during a spacewalk. 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 281

The Foundation for 

International Space Station 

Spacewalks 

Spacewalks—or extravehicular 

activities (EVAs)—performed on 

the International Space Station 

(ISS) evolved from a rich history of 

spacewalk experience starting in 1965 

with the first Soviet and American 

spacewalks and continuing through 

subsequent human space programs. 

Spacewalks continued to evolve when 

the ISS came along since building 

the station required an unprecedented 

number of EVAs. The ISS is almost 

four times as large as the Russian 

space station Mir and about five times 

as large as the US Skylab, with a 

design that demanded a lot of manual 

bolting together of components and 

hand-mated connections. 

As the timeline for construction 

of the ISS approached, EVA teams 

looked at the daunting task of 

assembly as the “Wall of EVA” 

(Figure 1) since the amount of EVA 

time would rise rapidly compared 

to prior years. As of Expedition 51 

in 2017, astronauts had completed 

more than 1243 EVA hours in 191 

EVAs for the ISS, including 28 Space 

Shuttle-based EVAs. Astronauts and 

cosmonauts conducted roughly 80% 

of ISS EVAs in US spacesuits, and 

the rest were conducted in Russian 

spacesuits out of a Russian airlock. 

For comparison of the US programs, 

the Gemini Program conducted nine 

EVAs (the first of which was only 

20 minutes long, compared to today’s 

standard planning of 6+ hours per 

EVA), the Apollo Program conducted 

five spacewalks and 21 lunar 

“moonwalks,” and Skylab conducted 

10 EVAs. Prior to ISS assembly, 

astronauts conducted 41 EVAs during 

Space Shuttle flights over the course 

of 15 years.

Looking back now at the Wall of 

EVA, NASA’s expectations were 

right on the money. These spacewalkheavy years were extremely intense 

and challenging for the Space Shuttle 

and ISS teams. But these years were 

also incredibly rewarding, with the 

creation and growth of the space 

station occurring one EVA at a time.

140

120

100

80

60

40

20

0

1965 1970 1975 1980 1985 1990 1995 2000 2005 2010 2015 

Total PET (hours)

Gemini

ApolloSkylab Shuttle

U.S. EVA Hours Per Year

Shuttle

First ISS-based EVAs for ISS

First Shuttle EVAs for ISS

Shuttle and ISS

Post

Challenger

Accident

Post

Columbia

Accident

Year

ISS

Last Shuttle 

Flight and ISS 

Assembly 

Complete for 

US Segment

Figure 1. US EVAs over the course of NASA’s history through mid 2017. The Wall of EVA hours looked daunting to the EVA teams as the ISS Program approached. 

The Space Shuttle Program provided 

the major basis for US EVA hardware 

and techniques for the ISS since the 

shuttle was bringing up the United 

States On-orbit Segment elements 

for installation and assembly. 

Furthermore, the US Segment was 
282 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

built largely by shuttle crews that 

wore shuttle spacesuits. 

Figure 2. Astronaut Mark Lee tests the nitrogen-propelled backpack that would be needed for the ISS. Space Shuttle mission STS-64 (September 1994). 

During the ISS design development,

NASA conducted specific Space 

Shuttle EVA experiments to 

determine acceptable ways to 

assemble a space station and 

understand new requirements for 

EVA equipment. This process 

included testing designs for 

assembling a truss structure and 

new EVA tools for an extravehicular 

crew member who had to maneuver 

around a large ISS structure. 

Although all ISS EVAs include 

having the crew member tethered 

by lifeline to its structure, shuttle 

crews tested a nitrogen-propelled 

backpack flown by extravehicular 

crew members using a joystick 

(Figure 2). This backpack—called 

Simplified Aid for EVA Rescue 

(SAFER)—can be used in case an 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 283

astronaut “falls off” of the ISS since 

the space station is not able to chase 

after a lost crew member as the Space 

Shuttle theoretically could have done.

The focus of this chapter is on US 

spacewalks using the US spacesuit, 

which is called the Extravehicular 

Mobility Unit (EMU). However, 

Russian EVAs (using the Orlan 

spacesuit out of a Russian Segment 

airlock) have also contributed greatly 

to the construction and maintenance 

of the ISS. US EVA experts spent 

a number of years during early ISS 

construction temporarily living in 

Moscow to work with Russian EVA 

experts for the purpose of negotiating 

crew training, spacewalk techniques, 

and hardware use. Spacewalks 

have been conducted by Americans 

in Orlans and Russians in EMUs 

(plus other international partners in 

both suits), and training has been 

conducted in both countries in both 

spacesuits. In fact, early in the 

program, it was envisioned that the 

US Segment airlock would be used 

for both Orlan and EMU EVAs. 

The airlock was built accordingly to 

accommodate both suits. The airlock 

Quest on the US Segment is called 

the Joint Airlock for that reason. 

However, having Orlan operations 

on the US Segment has not been 

needed as much as anticipated, and 

Russian Segment tasks are closer 

to the Russian airlock. Therefore, 

some of the equipment that the 

Joint Airlock would require for an 

Orlan EVA was not launched for 

installation in the airlock (notably, 

the Orlan umbilicals needed for 

oxygen, cooling, power, and 

communication while the crew 

member was still in the airlock). All 

Orlan EVAs have been executed out 

of Russian Segment airlocks, to date. 

The US Spacesuit

The iconic white US spacesuit 

has to provide the functions of a 

spacecraft while being wearable. 

Its design is mostly unchanged 

from the Space Shuttle Program, 

although some features and 

components evolved during ISS 

operations. For example, the Space 

Shuttle EMUs were designed to 

be used for the short duration of a 

shuttle mission—i.e., no more than 

a handful of EVAs—and returned 

to Earth for servicing before use on 

a subsequent flight. It was desirable 

to leave the EMUs on the station 

for longer periods of time since 

launching bulky spacesuits over 

and over to the ISS is expensive 

and would mean other things 

couldn’t be launched in their place. 

The spacesuit contractor extended 

the life of EMUs by replacing some 

parts and testing others for longer 

life to enable them to remain on 

orbit for several years without 

periodic ground checks. Another 

upgrade was to toughen some of the 

material on the gloves. Astronauts 

use their hands to maneuver around 

the ISS, thus the glove material 

had to be strengthened to withstand 

extended wear and provide more 

protection against the sharp edges 

that develop on the exterior of the 

station over time. Although almost 

all of the external hardware is 

manufactured to have smooth edges, 

Micrometeoroid and Orbital Debris 

(MMOD) strikes on the ISS surface 

over the years have produced various 

cuts and protrusions in the metal 

handholds and on other surfaces. 

The material upgrade was made after 

the crew discovered a number of 

cuts in the outer layer of the gloves 

following EVAs. 

The EMU (Figure 3) provides the 

fundamental needs for a crew member 

on a spacewalk lasting approximately 

6.5 hours. It provides pressure 

and an oxygenated atmosphere, 

environmental protection from 

extreme temperatures/radiation/

some space debris, mobility, and 

communications. Sometimes, 

the EMU can provide these 

fundamental needs for more than 

6.5 hours, depending on the thermal 

environment, specific crew member 

metabolic rate (which determines 

how much oxygen he or she breathes 

and how much carbon dioxide is 

produced), and the difficulty or 

workload for a given EVA. In addition 

to the expected 6.5 hours, the suit 

allows the team to manage 30 minutes 

of additional capability (e.g., oxygen 

and other consumables, such as 

battery power, that are used during 

an EVA) as pure margin to ensure the 

crew member gets back inside the 

station before critical supplies run out. 

The EMU breathing environment 

during an EVA is pure oxygen at 

217 millimeters of mercury (mm Hg) 

(4.3 pounds per square inch [psi]), 

which is equivalent to approximately 

9 km (30,000 ft) altitude simply in 

terms of pressure. This environment 

was originally chosen based on 

historical knowledge of pressure 

suit systems, and it accommodated 

several competing requirements for 

Space Shuttle EVAs. A spacesuit 

needs a strong pressure bladder to 

retain the atmosphere, as well as 

restraining material to conform the 

suit to a human and hand shape. 

Lower pressure is necessary to 

allow for the mobility required to 

grasp tools and move around the 

structure while working inside 

the bladder and restraints. Even at 
284 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

Lower torso

assembly

Liquid cooling

and ventilation

garment

Boots

LCVG liner (tricot)

LCVG outer layer

(nylon/spandex)

LCVG water transport tubing

TMG cover (ortho-fabric)

TMG insulation layers

(aluminized mylar)

TMG liner

(neoprene coated nylon ripstop)

Pressure garment cover-restraint

(dacron)

Pressure garment bladder

(urethane coated nylon)

ARM

Secondary oxygen

pack

Primary life

support subsystem

Battery

Contaminant

control cartridge

Primary O2 tanks

Sublimator

Caution and

warning computer

Lights

Radio TV camera

Lights Lights

Antenna

Muffler

Fan/separator/

pump/motor assy.

H2O tank

Display and

control module

Secondary

O2

 tanks

O2 regulators

Gloves

Hard upper

torso

Helmet

Extravehicular

visor assembly

TV camera

Communications

carrier assembly

Insuit

drink bag

Connection

for service

and cooling

umbilical

MMU

mount

Temperature

control valve

O2 control

actuator

Extravehicular Mobility Unit

Figure 3. The major components that make up the EMU. 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 285

217 mm Hg (4.3 psi), working in 

the suit can be fatiguing, especially 

for a crew member’s hands. At 

pressures this low, air does not supply 

the necessary quantity of breathing 

oxygen, hence the pure oxygen 

atmosphere. The lowest allowable 

oxygen pressure in which humans 

can operate safely is approximately 

160 mm Hg (3.1 psi). However, a 

pressure that low does not allow 

any margin for suit leaks or normal 

variation in system components. 

Very low suit pressure also increases 

the risk that the crew member will 

develop decompression sickness 

(DCS)—i.e., “the bends” that scuba 

divers work to avoid. Therefore, 

the EMU pressure of 217 mm Hg 

(4.3 psi) was selected in a balance of 

these factors.

Oxygen is supplied by the primary 

oxygen supply tanks (~44000 mm Hg 

[850 psi]). Or, if needed, oxygen can 

be supplied by the Secondary Oxygen 

Package (SOP) tanks (~258,000-

310,000 mm Hg [5000-6000 psi]). 

The pressure regulation system uses 

the primary oxygen exclusively on 

an EVA unless the pressure in the suit 

drops to approximately 201 mm Hg 

(3.9 psi) due to primary oxygen 

depletion or a leak in the suit. At 

that point, the SOP will “come on 

line” to keep the suit pressure around 

201 mm Hg (3.9 psi). The SOP tanks 

are sized to provide enough oxygen 

to keep the suit pressurized while the 

crew member quickly translates back 

to the airlock in the case of a small 

leak, and also for potential failures 

that would require the crew member 

to “purge” the suit by intentionally 

opening one of two small holes to 

allow gas to flow out. Purging might 

be needed if, for example, the fan 

shuts down and dangerous levels 

of exhaled carbon dioxide start to 

accumulate in the helmet. In these 

cases, the primary oxygen tanks will 

become depleted faster, requiring the 

SOP to provide the necessary makeup oxygen to allow the crew member 

enough time to reenter the airlock. 

During an EVA, a fan circulates 

the oxygen, and the crew generates 

carbon dioxide, heat, humidity, 

and other contaminants. The flow 

is forced through a Contaminant 

Control Cartridge (CCC), which is a 

replaceable container that “scrubs” 

(i.e., removes) carbon dioxide and 

other contaminants from the gas 

environment. The CCC contains 

filters and charcoal to remove 

contaminants and odor, and either 

heritage Space Shuttle-based lithium 

hydroxide (LiOH) or ISS-based metal 

oxide (Metox). The LiOH or Metox 

removes carbon dioxide through a 

chemical reaction, introducing heat 

and water vapor into the oxygen 

flow. After the flow is cooled and 

humidity is condensed out, the 

newly scrubbed oxygen combines 

with fresh oxygen from the primary 

system and is introduced to the crew 

member’s helmet, blowing over 

the face. The CCC is changed out 

prior to each EVA. LiOH cartridges 

are used only one time, whereas 

Metox is a regenerable cartridge that 

was created for ISS use and can be 

reused on a subsequent EVA after 

the carbon dioxide is removed using 

a specialized heating system in the 

airlock (Figure 4).

Gas Trap

PLSS Structure

PLSS Shear Panel

MMU Mount

Isolation

Valve Assembly

Battery

Optical

Connection

CCC

Fan/Separator/

Pump/Motor Assy

Primary 02 Tanks

02 Subsystem

C02 Sensor

and Bracket

Primary 02 Regulator

Assy and 02 Actuator

H20 Tanks

Hut Mtg Interface

Sublimator

Caution and Warning

System

Valve

Module

EVC

Antenna

Vent Flow

Sensor

Muffler

Credit: “Suited for Spacewalking: An Activity Guide for Technology Education, Mathematics, and Science, EG-1998-03-112-HQ.”

Figure 4. Some key life support system components in the backpack of the EMU. 

Temperatures in low-Earth orbit 

reach extremes of approximately 

-93oC to +149oC (-200oF to +300oF). 

The EMU keeps the crew member 

comfortable, although he or she can 

get too hot or cold depending on a 

variety of situations. Factors include 
286 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

Micrometeoroid and Orbital Debris

Spacecraft in orbit around the Earth encounter small fragments 

of rock called micrometeoroids (as opposed to meteorites, 

which are larger pieces of rock that survive reentry into 

Earth’s atmosphere). Orbiting spacecraft also encounter a 

growing amount of debris such as rocket bodies and pieces of 

spacecraft that have exploded. Collectively, these particles are 

called MMOD. The entire ISS must be maneuvered to dodge 

larger pieces that could slam into the station and create a large 

hole in the structure. However, the ISS is constantly exposed 

to tiny particles that are too small to track from the ground 

(Figure 5). This issue is discussed, in greater detail, in Chapter 8.

Partway through the ISS assembly, serious cuts in the 

EMU gloves were seen, which caused alarm within the 

EVA community. ISS EVAs were already rough on an 

astronaut’s gloves due to connector manipulation and moving 

long distances, but crews also started pointing out and 

photographing more and more MMOD strikes on the ISS that 

could be contributing factors. When a piece of debris strikes 

the ISS, it can leave a small pit or hole with sharp points that 

could tear an EMU glove (Figure 6). Initially, the crew was 

told to mark an MMOD strike with a wire tie (i.e., a few inches 

of wire similar to a coat hanger) by wrapping it around the 

handrail as a visual indication to the next astronaut. However, 

the strikes became too numerous. Crew members are now 

given a briefing where they view several photos that show the 

many known MMOD strikes. The message to the crew: Look 

before touching. Each time an astronaut performs an EVA, a 

new strike might have happened since the last EVA. The EMU 

glove materials were upgraded to be more durable, but the 

gloves are still carefully photographed and inspected after each 

EVA. Tethers—a crew member’s lifeline to the ISS—are also 

inspected for MMOD strikes before reuse. 

Depending on the EVA, the calculated odds are approximately 

1 in 8000 that an EVA crew member’s spacesuit will be struck 

by MMOD during that EVA, although the strike would have 

to create a hole approximately 4 mm (0.2 in.) or larger to 

be fatal. The odds that any crew member, inside the ISS or 

performing an EVA, will not survive because of an MMOD 

strike to the ISS are around 1 in 120 over a 6-month period, 

since a hurtling piece of debris could puncture a pressurized 

module and cause rapid depressurization that is too fast to 

allow astronauts or equipment to react.

Figure 5. Two views of an MMOD strike on a tool that had been 

on the ISS exterior, exposed to the elements. The crew found this 

crater during Space Shuttle mission STS-123/ISS-1J/A. 

Although a lot of the 

outer-most material 

is missing, the hole in 

the fabric is the area 

of greatest concern.

Figure 6. Glove tears that were noted during an EVA on 

STS-118/ISS 13A.1, causing the flight control team to terminate 

the EVA (i.e., bring the crew member back into the airlock early) 

as a preventative measure. Fortunately, the bladder that holds 

in the oxygen and keeps pressure on the astronaut was not 

damaged. Only the outer layers and fabric were affected. 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 287

whether the crew member is shaded 

from direct sunlight, whether the 

tool or the contact surface tends to 

absorb or reflect heat, and the crew 

member’s activity level relative to the 

cooling system of the suit. Cooling 

is performed both passively and 

actively. Passive thermal control and 

radiation protection is provided by the 

outer suit layers that reflect sunlight 

and provide insulation. Active cooling 

removes generated and absorbed heat 

via a circulating water system with 

a component called the sublimator. 

Tanks supply water to form a sheet 

of ice on the sublimator, which is 

exposed to the vacuum of space. In 

a vacuum, the ice sublimates (i.e., 

transitions directly from a solid to 

the gas phase without going through 

the liquid phase), removing heat as 

part of the process. Oxygen that is 

being circulated through the CCC and 

fan passes through the sublimator to 

provide cooling of the circulating gas 

and to condense out excess humidity.

Water is circulated over the crew 

member’s body via the Liquid 

Cooling and Ventilation Garment 

(LCVG), which is an internal 

bodysuit with approximately 91 m 

(300 ft) of thin flexible tubing sewn 

into the fabric. Ventilation ducting 

provides oxygen circulation in the 

arms and legs of the suit, thus the gas 

in those areas is also cleansed and 

dehumidified (Figure 7).

Figure 7. An LCVG, with its small water-filled tubes throughout and larger yellow ventilation ducts on 

the shoulders, floats in the airlock. The water tubes and ventilation ducting come together at the right 

waist with a connection point to the spacesuit. The fan/pump/water separator in the suit’s backpack 

(not shown) provides the circulation. Shoulder pads provide a cushion from hard points in the suit and 

help fill some volume for an overall snug and comfortable fit. 

In addition to providing thermal 

control, the carefully crafted multiplelayer composition of the suit is a 

stack of nylon, insulation, and fabric. 

Its design holds in the pressure, 

restrains the suit to conform to the 

body, and provides some protection 

from suit leaks due to small MMOD 

hits or punctures from tools or sharp 

objects on the ISS. The outer garment 

protects the internal pressure bladder 

(i.e., coated nylon “balloon” that 

keeps the pressure in) with materials 

that help protect against abrasion, 

puncture, and damage propagation. 

In other words, the design intention 

is such that a small hole is less likely 

to become a huge rip as the crew 

member moves around in the suit. 

Communication with other 

spacewalkers, the ISS, and the 

ground occurs through an ultra-high 

frequency (UHF) radio system, 

at a frequency that is lower than 

that used in car alarm systems and 

walkie-talkies (see Chapter 13). UHF 

antennas are located in the airlock and 

on the outside of the space station to 

transmit communication and some 

EMU status information to the ISS. 

That information is relayed to the 

ground through the standard space 

station communication system. Each 

EMU has a primary radio and a 

backup radio (as does the UHF system 
288 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

on the ISS) to ensure communications 

are not lost. Crew members wear a 

communication cap (i.e., a “Snoopy” 

cap) with a microphone boom. The 

microphone is set to transmit without 

requiring the crew member to push a 

button on the suit. Everything he or 

she says can be heard, assuming the 

communication links are good. Each 

crew member’s electrocardiogram 

data are also transmitted over UHF 

so that flight surgeons in Mission 

Control can monitor the health of 

each astronaut during the activities. 

EVAs are strenuous. Prevention 

of a serious health issue is critical 

since treatment is difficult, if not 

impossible, until the crew member is 

back inside the space station. 

The Display and Control Module is 

the brains of the suit and includes 

a Liquid Crystal Display readout, 

switches, and a pressure gauge. The 

crew display is somewhat similar to 

a car or cockpit’s computer readout 

system. It gives the crew member 

insight into the health of his or her 

suit, including audible alarms through 

the Snoopy cap, when required. Since 

a crew member can’t see the front 

of his or her chest when in the suit, 

a wrist mirror is used to look at the 

controls on the front of the suit, which 

is why the labeling is backward. 

The Cuff Checklist—a small binder 

attached to the crew member’s 

wrist—contains reference instructions 

and emergency procedures (Figure 8).

Cuff 

Checklist

Photo credit: NASA/Dina Contella

Figure 8. The EVA Cuff Checklist (bottom) is a small book worn on the wrist (top) that the crew can 

reference for steps to perform during normal operations and in emergency situations. The crew often 

prints out new pages sent from Mission Control Center or writes on blank pages with some additional 

reminders just before an EVA. 

The EMU is sized for each crew 

member through a modular approach, 

with various sizes and lengths for 

the main torso and other parts. Fit is 

further improved with sizing spacers 

and fine adjustment tabs in the suit, 

although EMUs are still notoriously 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 289

difficult to size perfectly (Figure 9). 

Crew members often have their own 

gloves made to fit their hands, or they 

use another crew member’s gloves 

if they are a good approximation 

and available for their flight. The 

spacesuits cannot stay on orbit 

indefinitely, and there is not enough 

storage space to accommodate 

multiple sets of every sized piece. 

Thus, ground teams work on EMU 

logistics to ensure the various parts, 

including spares, get launched and 

are on orbit for each crew member. 

Wrinkles in these complicated 

logistics can occur, as was the case in 

the destruction of the Cygnus cargo 

vehicle on October 28, 2014, when 

the rocket carrying Cygnus exploded 

shortly after liftoff (Chapter 14). The 

cargo mission was carrying EMU 

equipment, including a sized LCVG 

for one crew member, as well as a 

SAFER unit and several tools and suit 

maintenance items that had to be sent 

up on a later mission. A SpaceX cargo 

vehicle was also lost during launch 

on June 28, 2015, resulting in the loss 

of an EMU life support system and 

upper torso that was being sent up for 

its freshly refurbished parts. 

Figure 9. EMU components are specifically picked out for each crew member so the suit can be appropriately sized. Shown are: (left) the Lower Torso 

Assembly, with boots and metal sizing rings pictured; (center) an EMU glove; and (right) a sizing ring for lengthening an arm.

The EMU offers quite a bit of 

functionality, considering its 

small size as a spacecraft. It has a 

rechargeable battery for powering 

the various components when out 

on an EVA. A crew member can pull 

down a sun visor on the front of his 

or her helmet to act as sunglasses 

when orbital night turns into brilliant 

orbital day approximately every 90 

minutes (a sunrise or sunset occurs 

approximately every 45 minutes). 

Helmet lights are used for operations 

at night, and a television camera is 

mounted to the helmet so the ISS 

crew inside and the flight controllers 

on the ground can monitor the 

extravehicular crew’s activities. Crew 

physiology support includes a drink 

bag with a straw and a maximum 

absorbency garment (i.e., a diaper). 

After an incident where water 

entered a crew member’s helmet on 

US EVA 23, NASA equipped the 

EMU with a helmet absorption pad 

to absorb water on the head, as well 

as a snorkel similar to those used by 

scuba divers. The snorkel extends 

from near the mouth down to the 

waist so the astronaut can breathe 

oxygen from the body of the suit if 

the helmet fills with water.

The Orlan (Figure 10) provides 

similar capability but is packaged 

differently. Example differences 

include rear entry through a hatch 

for quick self-donning instead of 

the EMU shirt-and-pants design, 

adjustable length sizing rather than 

modular parts, and a higher operating 

pressure (295 mm Hg [5.7 psi]). 

Figure 10. US astronaut Mike Fincke is working 

in a Russian Orlan spacesuit. Some US tools were 

used during this EVA, with adapters installed as 

needed so they could be used with the Orlan. 
290 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

US Extravehicular Activity 23 Water-in-Helmet Incident

During US EVA 23 on July 16, 2013, water entered 

astronaut Luca Parmitano’s helmet about an hour into 

the EVA. The crew, flight control team, and engineers on 

the ground did not understand the source of the water 

and initially thought it may have come from a leak in the 

drink bag. However, the increasing quantity and unknown 

source caused the flight control team to call for an early 

termination of the EVA. Parmitano started translating 

back to the airlock. On the way, the water migrated to 

his face, covering his eyes, ears, and nose. Since there 

was no gravity to pull the water away from his nose and 

mouth, he could potentially drown in space. His vision 

and communications were degraded, and he had to use 

his safety tether as a guide to get into the airlock. Both 

crew members made it back into the airlock. Via a series 

of hand squeezes, Chris Cassidy (the other crew member) 

confirmed Parmitano was okay while they performed an 

airlock repress and suit doffing. After the EVA, the crew 

reported approximately 1.5 liters (0.4 gallons) of water in 

Parmitano’s helmet. This quantity matched the amount 

that was later determined to be missing from the water 

tanks that fed the sublimator during the EVA. Looking 

back, it was clear that Parmitano nearly drowned in the 

suit, and that the quick actions taken by the crew and 

ground team saved his life. 

Prior to this incident, crew procedures did not mention 

what to do if this quantity of water was in the helmet. 

This is because spacesuit testing on Earth showed that the 

fan would shut down and the water system would close off 

if a large quantity of water entered the ventilation system. 

However, in a zero-gravity environment, water can form a 

thin layer on the wall of the fan housing, flowing along the 

wall without stopping the fan blades as it would on Earth. 

The teams realized this fairly soon after the incident and 

then focused on determining how the water had entered 

the ventilation system in the first place. 

Because the investigation was expected to take quite 

some time, the team worried about calling a halt to EVAs 

for several months. The team needed to have the ability 

to perform EVAs while the investigation was ongoing. 

Without knowing the failure’s exact cause (root cause), 

the team developed procedures to have the crew to take 

safing actions and return to the airlock if this happened 

again. A helmet absorption pad, which was attached 

by Velcro to the inside of the helmet, and a snorkel that 

extends from the crew member’s mouth down to the waist 

area were designed and quickly flown to the ISS. 

The EMU has a fan for oxygen ventilation, a pump for 

water circulation, and a water separator for condensation 

gathering that are coupled together through a common 

shaft and magnetism. The unit is called the Fan/Pump/

Separator (Figure 11). The water separator portion of the 

FPS in Parmitano’s suit had become clogged with tiny 

particles, causing water to back up and deposit into the fan. 

Planning and Training 

Extravehicular Activity Tasks

When the external portions of 

the ISS were being designed, the 

engineers and managers often made 

compromises between how much 

time would be spent assembling 

or repairing a component via 

EVA versus the use of robotic or 

automated systems. Many factors 

had to be considered, including the 

complexity of performing a task in 

space by a human or a robotic arm, 

the mass or size of the item, the 

cost of manufacturing the hardware 

or software for each option, and of 

course the schedule. To reduce the 

amount of EVA time to assemble the 

ISS, engineers designed modules 

and some truss segments with 

automated bolts and power and data 

connectors to create a permanent 

interface. When possible, automated 

mechanisms deployed appendages 

such as antennas and solar arrays 

that had to be tucked down to a 

lower profile to fit in the cargo bay 

of the Space Shuttle. However, 

having a human perform a spacewalk 

allowed for lower-complexity 

designs with simpler bolts or 

mechanisms driven by powered 

drills that were held by EVA crew 

members. Also, an EVA crew could 

assist with human intervention 

to save the day when automated 

systems encountered a failure. 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 291

Tether Stowage Area

Fan/Pump/Separator 

unit, removed from suit

EMU with backpack facing Steve, who unzipped the white thermal 

cover and tilted the suit down to access the suit components. 

Figure 11. Astronaut 

Steve Swanson holds a 

Fan/Pump/Separator unit 

(with protective cylinder 

installed on the end). 

Several of these units 

were changed out in 

the on-board suits due 

to failures, as well as to 

investigate the cause of 

an incident on US EVA 23 

where water entered a 

crew member’s helmet. 

The EMU is installed in a 

rack that assists with suit 

donning, and it is tilted 

down with the backpack 

cover unzipped to expose 

the suit’s life support 

system. Below the EMU is 

the tether stowage area in 

the Equipment Lock. 

The investigation found that some filter devices used 

to clean the water system of the suit during periodic

maintenance (to control microbial growth and take out 

other contaminants) were inadvertently exposed to 

impure ground water. These were launched to the ISS 

and used with Parmitano’s suit and the other suits, 

and were likely the source for the majority of the 

particles that caused the clog. Numerous potential 

contributing factors were associated with Parmitano’s 

suit (e.g., excessive grease could have been in the 

system, applied to the seals).

The airlock system was flushed with water, several EMU 

components were changed out, and the filters in question 

are now carefully manufactured with pure water flowing 

through them. The helmet absorption pad and snorkel 

are used for all US EVAs. Crews and ground teams are 

now very well trained for this failure mode.

After weighing the various factors 

for each interface, the ISS and 

especially the US Segment ended 

up requiring a lot of EVA time to 

assemble. Use of the large Canadian 

robotic arm is often still required 

to reach otherwise-inaccessible 

areas of the ISS and to secure an 

astronaut’s feet so he or she can grip 

something with both hands (e.g., 

while moving an item to another 

area on the ISS).

On paper, the tasks needed for ISS 

assembly—e.g., driving a bolt, 

carrying something from one place to 

another, taking off a cover, plugging 

in an electrical cord—might not seem 

too complex. However, conducting 

such tasks while wearing a spacesuit 

with pressurized gloves (possibly 

with one’s feet planted on the end 

of a long robotic arm), working in 

microgravity, maneuvering around 

huge structures while moving massive 

objects, having time constraints based 

on spacesuit consumables, and using 

specialized equipment and tools made 

these tasks and EVAs challenging. 

Tasks such as working with cables 

or fluid hoses (Figure 12) are handintensive work—fingers and forearms 

get quite a workout in pressurized 

gloves that feel like stiff balloons 

and resemble oversized garden 

gloves. Added to these complexities, 

space “walking” is mostly done 

with the hands. The astronaut grasps 

handholds and maneuvers the 
292 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

combination of the EMU, SAFER, 

tools, and himself of herself around 

the structure. 

The team on the ground has to come 

up with a choreography and order 

of events for the EVA, in advance. 

The flight control team creates the 

EVA timelines based on a high-level 

prioritized list of tasks determined 

by ISS management (e.g., move a 

specific antenna, install a particular 

avionics box). The flight controllers 

start with the top ISS priority task 

and assesses the other tasks that can 

fit into the EVA based on multiple 

factors such as how long the tasks 

will take based on past experiences, 

whether both crew members need to 

work together, task location on the 

ISS, how much equipment will fit 

into the airlock, the tools required, 

crew experience level, and the level 

of crew effort to complete the task. 

A task that might fit (but only if the 

team is efficient) is put on the list as a 

“get-ahead” task. See also Chapter 4. 

Real-time discussions in Mission 

Control of EVA time remaining, 

crew fatigue, and suit consumables 

could allow the get-ahead task to 

be accomplished in addition to 

the planned tasks. Some tasks are 

performed on a “clock”; i.e., if power 

is removed from an item, it might 

get cold and need heater power in a 

matter of hours or sometimes within 

minutes to prevent damage. While a 

timeline is still in a draft version, the 

team conducts testing as required to 

prove out the operations. The team 

then trains the crew and refines and/or 

changes the timeline, sometimes up to 

the day of the EVA. 

Figure 12. Modules had to be connected, by hand, with stiff hoses for ammonia transfer as well as electrical power connections. Hand and EMU access was 

often tight. The crew had to carefully avoid snagging the lines with tools and tethers. The actual “flight hardware” connections were piecemeal tested to the 

extent possible, but the full three-dimensional (3-D) geometry with the crew in real EMUs was impossible to fully simulate on the ground. The Laboratory (top) 

and Node 1 (bottom) are the silver modules under all of the cabling in this photo from STS-110/ISS-8A. 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 293

Extravehicular Activity 

Testing and Training

Figure 13. The NBL near Johnson Space Center. Above the water level is the control room, a mini 

Mission Control, visible on the far right behind the white wall. The yellow cranes are used to hoist crew 

or other test subjects into the water. The crew must use special EMUs that are made to be used in the 

water. The mock-ups underwater include the Laboratory Destiny with the central piece of the truss 

structure on top (farthest away), truss and solar array structures (center and right), and the Space 

Shuttle’s cargo bay (foreground). 

Figure 14. An astronaut (i.e., the test subject) translates along the forward face of the mocked-up ISS 

truss, with a scuba diver assisting to keep the air and cooling umbilical from becoming entangled or 

pulling on the EMU. 

Testing and crew training for an EVA 

takes place in many facilities due 

to the complexities associated with 

adequately mimicking microgravity, 

working in a spacesuit, and the 

large scale of the ISS. One of 

the main facilities used for EVA 

development and crew training is 

the Neutral Buoyancy Laboratory 

(NBL)—a large pool that measures 

approximately 61 m (200 ft) long by 

30 m (100 ft) wide by 12 m (40 ft) 

deep—near Johnson Space Center in 

Houston, Texas (Figure 13). Training 

versions of EMUs are balanced by 

scuba divers with weights so the test 

subject does not sink or float and 

can work as he or she would in zero 

gravity. The underwater suits each 

use an umbilical hose that goes to 

the surface to supply breathing gas 

and cooling. The divers manage this 

umbilical, thus the crew usually does 

not know it is there. Water does not 

provide a perfect model for space—

the ISS mock-up and tools corrode 

over time, the water drag makes 

large objects (including the crew 

members) harder to start moving and 

easier to stop moving than in space, 

and equipment is inclined to float 

or fall in a manner that it would not 

in space. Also, the ISS is so big that 

the entire structure does not fit in 

the pool, so it is broken into pieces. 

When the crew members translate 

along the ISS structure in the pool, 

the divers must assist by physically 

moving the crew members between 

parts of the ISS when there is a gap 

between structures (Figure 14). 

The NBL replaced the Weightless 

Environment Training Facility at 
294 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

Johnson Space Center and is where 

most of the EVA choreography 

is currently tested. However, the 

Weightless Environment Test System 

in Tsukuba, Japan, and the Neutral 

Buoyancy Simulator in Huntsville, 

Alabama, have also made major test 

contributions to ISS EVAs. 

Space Shuttle crews for ISS assembly 

missions were trained multiple 

times in the NBL on their EVA 

choreography using the specific 

tools and required tethers. ISS crews 

remain on station for a much longer 

amount of time, and they have long 

preflight training periods in multiple 

countries and can’t be expected to 

remember fine details for extended 

periods. EVA priorities often change 

after months of ISS operation 

anyway. Therefore, the ISS crews are 

trained on some specific EVA tasks, 

but their training focuses mainly on 

skill building (e.g., giving robotic arm 

operator directions, rescuing the other 

EVA crew member) rather than on 

memorizing choreography. 

EVA teams use a variety of other 

locations for testing and training. 

Vacuum chambers are used to verify 

that spacesuits do not leak in the 

vacuum of space. They are also 

used to test when reduced pressures 

(sometimes coupled with extreme 

temperatures) might affect operations, 

such as with the friction between 

moving parts, bubbling of substances, 

or stiffness of hoses. Moving massive 

objects by hand is not feasible when 

simply standing on the ground, so 

teams put high-mass objects on a 

system that blows air onto a polished 

steel floor and allows movement 

via principles similar to an air 

hockey table (Figure 15). This gives 

astronauts and test subjects a morerealistic feel for starting and stopping 

movement of heavy equipment since 

neutrally buoyant objects in a pool 

still tend to twist and float when 

affected by trapped air. 

Pads that blow air 

onto the polished 

floor, like “reverse 

air hockey”

Figure 15. The Precision Air Bearing Facility, with a test subject inside an EMU. Air blows out of pads 

on which the EMU is resting, so the unit will slide based on how the person inside the EMU moves or 

when pushed. In this case—a test that followed the Columbia accident—the subject was pushed to 

slide along the floor as if flying a SAFER while using a tool to measure damage to Space Shuttle tiles. 

Another key training facility is

the Virtual Reality laboratory, which 

allows the test subject to view a 

graphic ISS in 3-D (often while 

wearing a helmet with goggles). 

This makes it possible for the teams 

to envision the workspace and 

practice EVA-robotics choreography 

(Figure 16).

One famous testing platform was 

the “Vomit Comet” aircraft that 

allowed for intermittent periods of 

weightlessness. The KC-135 

aircraft (later replaced by a DC-9) 

was outfitted to fly a parabolic 

trajectory and provide approximately 

20 to 25 seconds of microgravity 

at a time. This allowed for quick 

tests with flight-like materials that 

could not be done underwater or that 

needed microgravity. 

Often, the team proves out techniques 

and uses EVA tools on real flight 

hardware while it is still in an 

assembly facility on the ground. 

It is better for NASA to discover 

that something is too difficult to 

reach/manipulate/turn by EVA crew 

members, or that tools don’t fit their 

interface, while on the ground rather 

than in space. Hardware obviously 

cannot be ground-tested in this way 

after it is already on orbit, which 

adds to the challenge now that ISS 

assembly is complete.
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 295

Figure 16. Astronaut Dan Burbank flies a mocked-up SAFER unit in the Virtual Reality laboratory. He 

is seeing the space station in 3-D and using the hand controller to “fly” back to the ISS. This provides a 

simulation of what it would be like if his tether broke and he detached from the structure.

All told, the preflight EVA 

development process is fairly 

lengthy and complex. In an attempt 

to make designs EVA-friendly, 

with handholds and interfaces for 

standard EVA tools, NASA levied 

requirements on the ISS hardware 

designs. The operations team 

often works with the design team 

during development. Analysis and 

preliminary design would often 

lead to building mock-ups for 

preliminary testing underwater. EVA 

teams might test choreography for 

an EVA several times in the NBL. 

The teams also go to different 

facilities around the country to test 

the fit of tools, put together pieces 

of the real ISS, and try out putting 

blankets on structure—all things 

that cannot be done realistically 

underwater. Astronauts typically 

get into a spacesuit and go through 

the procedures for depressing the 

airlock to get a feel for the stiffness 

and sounds of a flight-like spacesuit. 

The crew slated for a spacewalk 

will practice flying SAFER in the 

Virtual Reality laboratory, as well as 

practice calling for robotic movement 

from the crew inside (e.g., “Move 

me down to the structure”). For 

assembly, crews would get into the 

real Space Shuttle cargo bay where 

ISS elements were located, as well 

as look at Space Shuttle interfaces 

in case of Space Shuttle off-nominal 

situations that might need an EVA. 

Astronauts may participate in other 

specialty classes and tests associated 

with tools or ISS hardware to further 

prepare them for a plethora of 

situations. After all is said and done, 

the EVA development effort involves 

many operations experts, hardware 

and EVA tool designers, analysts, 

experienced astronauts, safety 

experts, and facility experts. 

Extravehicular Activity Tools

Tethers (cords) are critical for 

keeping hardware from floating 

away and act as lifelines back to 

the ISS structure (Figure 17). Some 

tethers are retractable and can be 

temporarily locked out (similar to a 

measuring tape), while others are a 

fixed length. Tethers are a constant 

source of discussion and can be key 

to the choreography, so the team 

carefully considers where a tether is 

best anchored on the crew member 

or structure. Work sites are often 

farther from the airlock than the 

length of a single tether, thereby 

requiring multiple tethers to be strung 

together or used in combination, 

which increases the complexity of 

getting somewhere and ensuring 

the astronauts always “make” (i.e., 

close the hook for) a connection 

before they “break” (i.e., open the 

hook from) the previous connection. 

Occasionally, a crew member can 

end up in a “snarl” or get snagged by 

a cord. In these cases, the astronaut 

must carefully untangle himself/

herself or the equipment, although 

the EVA choreography is designed to 

prevent such tangling. 

Crew members often use foot 

restraints when they need to work 

on something with two hands. In 

microgravity, actions such as pushing 

a piece of equipment or a tool would 

cause the astronaut to float in the 
296 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

opposite direction, something that 

doesn’t happen on the Earth where a 

person’s feet anchor the body against 

these forces. Another stabilization 

tool is the Body Restraint Tether—a 

device attached to the EMU that 

clamps to a handhold on the ISS 

and can be made rigid to hold a 

crew member steady. This tether is 

actually a stack of balls with a cord 

through the middle and a tightening 

mechanism, similar to a shop light 

or camera mount. A computerized 

Pistol Grip Tool is comparable to 

a sophisticated power screwdriver 

or cordless drill used to install or 

remove bolts when precise torque or 

turns are required. 

In addition to specialized tools for 

some tasks, common tools that were 

made EVA-friendly include wrenches 

and sockets, bags to keep tools 

contained, cameras, trash bags, etc. A 

tool mount called a Mini-Workstation 

on the front of the suit contains oftenneeded tools, ready and within reach.

Foot Restraint (boot 

tips go under loops)

Bag for small tools

Cart for moving larger 

items down the front 

face of the ISS truss

Tethers Trash Bag

Pistol Grip Tool

Figure 17. This photo of astronaut Sunita “Suni” Williams was taken by astronaut Aki Hoshide during Expedition 32. A fairly standard quantity of tools can 

be seen on the front of her spacesuit, although each EVA requires a somewhat different complement of tools. Two versions of safety tethers are attached to 

D-shaped rings on the suit near the hips, and one of these has a take-up reel that houses a 26-m (85-ft) steel cable. This safety tether can be attached to 

the structure and allows the crew member to travel far without having to relocate his or her tether point. However, if the crew member were to let go with only 

this cable attached, he or she could float away from structure and possibly come back to impact an unintended area off of the ISS. Other tethers are often 

used in addition to safety tethers, once a crew member arrives at the work area. A Pistol Grip Tool (under Williams’ arm) has functions similar to a cordless 

drill used for bolting and unbolting equipment. She is holding onto a cart that can translate along the truss but is rarely used for this purpose. 

Extravehicular Activity 

Preparations and the Airlock

For an EVA to be conducted, the 

crew has to get outside without 

taking the entire ISS cabin pressure 

down to vacuum. Thus, the suitedup EVA crew members go into a 

telephone booth-sized airlock that 

is depressed to vacuum just prior 

to the EVA. That small volume 

on the ISS that goes to vacuum is 

called the Crewlock, which is part 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 297

of a larger module called the Joint 

Airlock (Quest). The Joint Airlock 

houses the Crewlock and also has 

an Equipment Lock that holds EVA 

suits and equipment for storage and 

allows for suit donning and doffing. 

A Russian-designed depress pump is 

used to reclaim most of the Crewlock 

air for continued use in the cabin, 

rather than depressing the volume of 

the Crewlock by opening a valve to 

space in order to equalize with the 

vacuum of space (Figure 18).

Figure 18. Astronaut Doug Wheelock exits through the EVA hatch of the Joint Airlock. A thermal 

cover (shown directly behind him) keeps the airlock and its hatch at a stable temperature. This flap is 

closed by a Velcro fixture and must be opened when a crew member goes into or comes out of the 

hatch. The hatch itself cannot be seen in this photo because the hatch opens into the airlock. 

Airlock systems also provide vital

consumables via umbilicals, or 

hoses, prior to the crew exiting the 

airlock. This allows the astronauts to 

complete their work before starting 

the spacewalk without using the 

limited quantities in the spacesuit. 

These consumables include oxygen 

and water, as well as power to avoid 

battery usage, “hardline” (i.e., not 

using radio) communication, and 

crew member cooling via an 

umbilical that attaches to the EMU 

on one end and an airlock panel on 

the other. When the team is ready 

to start the EVA, the astronauts 

disconnect the umbilical. If need 

be, the crew members can return to 

the airlock during an EVA to briefly 

connect the umbilical and refill 

oxygen, but this might not fit into a 

tight timeline if the worksites are far 

from the airlock.

Figure 19. The EMU 

is donned by putting 

on the pants (Lower 

Torso Assembly) and 

then coming up from 

the bottom of the shirt 

(Hard Upper Torso). The 

crew member puts his 

or her arms through the 

sleeves and puts his or 

her head in the neck of 

the suit. The astronaut 

is usually assisted by an 

unsuited crew member 

when putting on the 

communications cap, 

mating the pants and 

shirt, and installing 

helmet and gloves. The morning of an EVA, the crew 

members get into the EMU by 

putting on the Maximum Absorption 

Garment, then a two-piece thin 

body undergarment resembling long 

johns for comfort under the LCVG, 

which will be put on next, followed 

by the pants (i.e., the Lower Torso 

Assembly) (Figure 19). The crew 

member gets into the upper portion 
298 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

of the suit by putting his or her 

arms through the suit arms mounted 

on a Hard Upper Torso, as if 

putting on a shirt over the head. 

The pants mate up to that Hard 

Upper Torso and seal in a ring 

around the crew member’s waist. 

Then, the communications cap, 

helmet, and gloves are donned 

as the suit gets powered up 

(Figure 20). After suit up, a leak 

check is performed to ensure the 

suit does not have any unexpected 

gas leakage—something as small as 

a human hair in between two seals 

will cause a noticeable leak and 

result in the crew having to doublecheck the connections. A leak check 

is accomplished by monitoring the 

pressure in the suit for 1 minute 

and verifying the pressure doesn’t 

change unexpectedly. 

Figure 20. Astronauts Steve Smith and Rex Walheim are suited up in the Equipment Lock during 

STS-110/ISS-8A. Walheim, on the right, already has a Mini-Workstation of tools installed on his 

chest. Jerry Ross, seen in the Crewlock in the background, helped as an intravehicular crew member 

One of the last things installed on for this EVA. 

the EMUs before an EVA is the 

SAFER, which the crew can use to 

fly back to the structure if tethering 

fails (Figures 2, 21, and 22).

Figure 21. The SAFER on the right is attached to the EMU before the crew gets into the Crewlock 

for airlock depress. A hand controller, similar to a joystick, stays tucked into a storage area. If a crew 

member needs to rescue himself or herself by flying back to the ISS structure, the hand controller can 

be removed from storage quickly. 

Prior to each EVA, an oxygen 

prebreathe is conducted to prevent 

the crew from getting the bends 

after depressurization of the 

airlock (i.e., when the absolute 

suit pressure drops to 222 mm Hg 

[4.3 psi]). This is the same DCS 

that ascending scuba divers as 

well as aviators at high altitudes 

must also prevent. Breathing 

100% oxygen forces nitrogen to 

migrate out of tissues and is exhaled. 

If done for long enough, the chances 

are greatly reduced that these gases 

will create harmful bubbles that 

can lodge in joints or travel in the 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 299

bloodstream to critical organs, 

resulting in pain, severe medical 

EMU Life Support issues, and even death. 

System Backpack

SAFER tower 

with upper 

thrusters at 

height of crew’s 

shoulders

(second tower 

on crew’s 

right side)

SAFER main body 

sits under the 

EMU life support, 

housing lower 

thrusters and 

nitrogen 

Figure 22. SAFER installed during a test on Space Shuttle flight STS-64. 

Multiple prebreathe protocols have 

been available and used on the Space 

Shuttle and the ISS. The various 

protocols can involve oxygen masks, 

exercise in the suit or on a bicycle 

machine, reduction in cabin pressure 

to 528 mm Hg (10.2 psi) (~equivalent 

to 3 km [10,000 ft] altitude) for a 

period of time, and/or prebreathe in 

the spacesuit. Prebreathe methods 

have evolved to incorporate 

reductions in crew day length and 

reduced complexity. For example, 

at one point, prebreathe (Figure 23) 

involved having the EVA crew 

sleep in the Joint Airlock overnight 

at a reduced cabin pressure; however, 

this had its pitfalls. In addition to 

sequestering the extravehicular 

crew members from their crewmates 

and the toilet, certain failures such 

as a fire alarm on the ISS will cause 

a repress of the airlock and will 

interrupt the prebreathe process. 

This can be frustrating when the 

alarm is false, as has happened in 

the past, since any interruptions in 

prebreathe protocol require strict 

penalties to “buy back” the time. 

Depending on the situation, the crew 

might have to breathe pure oxygen 

for twice the number of minutes than 

was the interruption. 

Figure 23. Astronaut Chris Cassidy is shown prior to an EVA during one portion of his prebreathe of 

pure oxygen to prevent DCS. In addition to an oxygen mask, he is wearing his LCVG, with small waterfilled tubes throughout and larger ventilation ducts, as seen on his left arm and on his right waist. The 

Crewlock that goes to vacuum (located behind Cassidy) is filled with tools and storage bags. The suit 

umbilicals are attached to an umbilical interface panel in the Crewlock on one end and the EMUs on the 

other end. The EMUs are in the Equipment Lock in the foreground. One suit umbilical is routed under 

Cassidy’s arm and is connected to a suit, seen in the lower right corner of the photo.

If a crew member exhibits DCS 

symptoms during an EVA, he or she 

will be brought inside as quickly as 

possible (with assistance from the 

other crew member, as required). The 

airlock will be repressurized, which 

immediately aids in recovery. The suit 
300 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

can also be pumped up to 413 mm Hg 

(8 psi) beyond the standard cabin 

pressure to help collapse bubbles in 

the crew member’s body. The flight 

surgeons in the control center will 

make medical recommendations 

while the EVA flight controllers work 

with the other crew members on the 

steps for installing and operating a 

device to allow the pressure of the 

suit to get this high. 

Quite a bit of overhead is involved 

in performing spacewalks 

(Figures 24 and 25), with more 

than 100 on-board crew hours 

logged before and after EVAs. 

Time is spent configuring the suits, 

preparing the tools with the exact 

complement needed (the astronaut 

cannot go back inside the ISS to 

grab a missing tool), studying the 

spacewalk (which may take place 

months after the last training run 

or is a contingency timeline that 

the crew never actually simulated), 

conducting refresher training on 

failures that could occur, discussing 

the robotics interaction with the EVA 

crew, and discussing the details with 

the ground team. The EVA flight 

control team will also collectively 

spend hundreds of hours planning 

and executing these activities. 

Airlock Umbilical that 

mates to the front of the 

EMU before and after EVA

Airlock Control Panel 

(bags of tools are 

floating above it)

Figure 24. The Crewlock is crowded with two crew members, tools, bags, and spare parts. Shirtsleeve crew members essentially stuff the crew in, with one 

crew member facing the hatch to be able to open it for egress to space and the other crew member facing a panel to operate the airlock. This is a photo of 

astronaut Rick Mastracchio (astronaut Clay Anderson’s feet are also shown) during STS-131/ISS-19A while the Space Shuttle was docked to the ISS.

The Wall of EVA needed for ISS 

assembly required countless hours 

of preparations both on the ground 

and in space—and that was after all 

of the preflight ground testing and 

training. With the ISS in steadystate operations, science objectives 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 301

compete with these EVA-related 

hours. Two or three EVAs are 

often grouped over the course of 

a couple of weeks, which reduces 

some of the overall number of hours 

spent. For example, if a suit will be 

reused by the same crew member 

on one increment, it doesn’t have 

to be resized. In addition, the crew 

members are more current on their 

training (e.g., SAFER flying, suit 

emergencies, no-touch areas of ISS 

due to sharp edges), making the 

process more efficient.

Figure 25. Astronaut Dan Tani is shown sleeping among the equipment between EVAs on STS-120/ ISS-10A. Notice the sign pointing into the airlock on the 

left. Some EMU equipment and unused EMUs are moved out from the larger part of the airlock where the crew suits up.

Executing Extravehicular 

Activities: Managing 

the Risks

EVAs are exciting and intense for 

the on-board crew and for the flight 

control team. The crew and the ISS 

are in a more-risky situation during a 

spacewalk, and the suit consumables 

are limited so time is of the essence. 

Crew members are exposed to the 

potential of DCS, a feeling of vertigo 

looking at the Earth, and extreme 

fatigue that could hinder their ability 

to get back to the airlock. The crew 

is less protected from MMOD than 

when inside the ISS, so there is a 

greater risk of MMOD penetrating 

the suit and injuring the crew 

member. Although crew training 

and good equipment should prevent 

a disconnect, a crew member may 

become untethered and have to use 

SAFER to fly back to the structure. 

Robotic arm maneuvers, while 

offering spectacular views, require 

EVA crew members to wedge their 

heels against the foot restraint to 
302 CHAPTER 17 SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION

keep from disengaging and floating 

away from the robotic arm. The crew 

members would remain attached 

to the ISS via their long retractable 

tethers, but this would be quite 

a debacle if a crew member was 

carrying a large piece of hardware. 

Risks to the ISS occur during 

EVAs due to the very nature of the 

human element and the potential 

for additional failures. A suit 

problem could force an EVA to be 

terminated (ended expeditiously) or 

aborted (ended extremely quickly 

in an emergency fashion to save a 

crew member’s life). For example, 

the control team terminated an 

EVA during STS-118/ISS-13A.1 

(2007) due to unexpected glove 

damage, and during US EVA 23 

(2013) when water entered a crew 

member’s helmet (see sidebar: US 

Extravehicular Activity 23 Waterin-Helmet Incident). In some cases, 

ending an EVA early could mean 

that bags or tethers block rotation 

of critical appendages such as the 

solar arrays or could block robotic 

movement. Also, if a large piece of 

the ISS is not tied down adequately 

with tethers, then it is possible that 

vehicles such as Soyuz could not 

dock or undock safely without the 

risk of having equipment fall off and 

impact other structures or vehicles. 

The EVA console in Mission Control 

Center (MCC) provides a status to 

the flight director and flight control 

team on the amount of consumables 

left in each EMU. The consumables 

include the oxygen quantity in the 

primary tanks, the capacity of the 

CCC in terms of ability to continue 

to remove carbon dioxide, water 

available for sublimator use, and 

battery power. The quantity of 

available oxygen is directly measured 

and sent to MCC in telemetry. The 

CCC does not put out telemetry of 

its capacity. This is derived based on 

how much oxygen a crew member 

is using, which is an indicator of 

his or her metabolic rate. From this 

metabolic rate over the course of the 

EVA, the team can determine the 

remaining CCC capacity based on the 

predicted capacity and subtracting 

out the already-used quantity. Water 

usage is not known until the reserve 

water comes on (automatically 

turned on due to reduced line 

pressure when the primary water is 

used up). In that case, the crew and 

ground will receive an alert that 30 

minutes remain, assuming a hole is 

not causing leakage, which would 

reduce the available time. Battery 

power is predicted and voltage can be 

measured for unexpected reduction in 

the remaining time available. 

The flight control team works to 

ensure the critical tasks get done 

while keeping an eye on consumables 

and crew health. Sometimes, 

predicting what the consumables will 

be is a challenge in this regard. For 

example, the limiting consumable 

(the one with the least amount 

of time remaining) is often the 

CCC. However, a crew member’s 

metabolic rate varies over the course 

of an EVA, with lower metabolic 

rates when on the Space Station 

Robotics Manipulator System. But 

high-effort tasks increase metabolic 

rate. Thus, determining whether 

a task is achievable in that EVA 

requires some predictive skills before 

an astronaut starts the task. Training 

runs in the NBL help establish trends 

for specific crew members. Oxygen 

can be recharged (refilled) by having 

the crew go into the airlock and 

connect to the umbilical, although 

this could significantly alter the 

choreography of the EVA.

EVAs involve the human element 

both in space and on the ground. 

Crew member height and arm 

length can make a big difference 

in whether that crew member can 

perform a particular task. Mechanical 

aptitude is critical as well. The ISS 

needs someone who knows how 

to turn a wrench as much as they 

know science. Some complex tasks 

require very good back-and-forth 

communication between the crew 

and the ground, so language and 

patience are also factors. Assembly 

mission EVAs used the on-board 

crew (called “IV” for intravehicular) 

to read the instructions to EVA crew 

members and keep them on task; for 

standard increment operations EVAs, 

a “Ground IV” relays the details of 

each step from MCC.

EVAs are physically demanding; 

therefore, crew fatigue is a major 

consideration during a spacewalk. 

Sometimes an EVA will go longer 

than planned because a task at the 

end of an EVA takes longer than 

anticipated due to crew member 

fatigue. Ground discussion among 

themselves and what information is 

exchanged with the crew on board is 

often key in decision making and the 

success of an EVA.

Exposure to toxic chemicals during 

a spacewalk is another hazard that 

is carefully managed. The external 

coolant on the ISS is ammonia that, 

even in very small amounts, could 

be lethal if it gets stuck on the EMU 

or tools and the crew member brings 
SYSTEMS: EXTRAVEHICULAR ACTIVITIES—BUILDING A SPACE STATION CHAPTER 17 303

it back into the cabin. Several times, 

the spacewalking crew has been 

exposed to ammonia. The potential 

to bring ammonia back inside can 

be reduced by requiring the crew 

“bake out” before coming through 

the airlock (i.e., spend additional 

time outside to allow sublimation 

of the ammonia into vapor form, off 

the suit). If there is doubt that crew 

members might still have ammonia 

crystals on their suits, NASA may 

elect to have the crew use a piece of 

sampling equipment called a Draeger 

tube to test for the presence of 

ammonia. Partially repressed airlock 

air would mix with ammonia on the 

crew member’s suits and tools, and 

visibly turn reactant chemicals in the 

glass vial tube from yellow to blue.

Equipment that is “dropped” 

overboard due to missing a tether 

connection or other problem is 

tracked by ground radar, if the item 

is big enough to be picked up on 

radar. However, there is potential 

for these objects to re-contact 

the ISS, contact another vehicle 

approaching or leaving the ISS, or 

in some cases survive reentry into 

Earth’s atmosphere and potentially 

harm people on the ground. Also, 

the now-missing equipment may be 

critical to the repair or task at hand, 

and the team will have to determine 

whether it can be accomplished on 

that EVA. Lost equipment in the past 

has included tools, a bag full of tools, 

and a camera. Occasionally, the ISS 

Program will approve an object to 

be dropped overboard intentionally 

as a jettison if it can be thrown in a 

particular direction and proven to 

result in extremely minimal risk to 

the ISS and people on the ground. 

The largest object ever jettisoned 

from the ISS was the Early Ammonia 

Servicer, a 544 kg (1,200 lb) tank of 

ammonia in 2007.

The US Segment assembly of the ISS 

often involved robotic installation 

or partial installation of a major 

element when a Space Shuttle first 

arrived, followed by a series of three 

to four EVAs to structurally secure 

the element, hook up power and data 

connections, and perform related 

tasks. These EVAs were sometimes 

nail-biters, because a small issue had 

the ability to trip up the team and 

amount to an element freezing or 

the inability to fully safe the systems 

(Chapter 4). The mission time was 

limited and the Space Shuttle crew 

was specifically trained for some of 

the tasks, so changes to the EVAs 

during the docked Space Shuttle 

timeframe were often added into that 

short period with incredibly fast EVA 

development time. Over the years, 

many small issues (e.g., stuck bolt that 

would not release) as well as major 

issues (e.g., the entire tray of electrical 

and fluid lines that would not initially 

deploy while the equipment was 

waiting for power) were overcome by 

the crew and ground team to complete 

the mission at hand. 

Post-assembly, the intensity remains 

for many tasks, especially those 

that involve repair of a critical ISS 

systems unit. One example of critical 

EVAs to repair the ISS is the set of 

two EVAs that followed the external 

pump failure that occurred in 2013, 

which required the EVA team and 

crew to prepare and execute EVAs 

within a period of a couple of weeks. 

Further details of this situation are 

provided in Chapter 20.

International Space Station 

Extravehicular Activities—

A Benefit to Humanity

This chapter was written as a general 

overview, but the real ISS hardware 

build-up for Space Station assembly 

transpired with extremely great 

detail at all steps along the way. 

Every part of the EMU is carefully 

maintained and rotated. Every 

aspect of every EVA is carefully 

planned (to the extent possible on 

Earth) and executed. The team of 

people involved is extensive, from 

the ISS hardware engineers to the 

suit engineers to the divers in the 

NBL—and the dedication to safety 

and great detail from everyone is 

awe-inspiring. 

Two chapters in this book 

(Chapters 18 and 20) highlight 

the critical role an EVA can have 

in keeping the ISS functioning. A 

peripheral benefit to the experience 

is also gained by building the ISS 

by hand. The intensity, quantity, 

and complexity of ISS EVAs could 

be considered a drop in the bucket 

compared to a program such as an 

exploration mission to Mars. The ISS 

provides many benefits to society. 

Through the ISS, NASA is learning 

ways to improve EVA efficiency, 

reduce overhead in preparations, and 

improve spacecraft design so that 

fewer failures occur. The training and 

experience gained in doing these lowEarth orbit EVAs will be invaluable 

for exploration of other worlds.

Chapter 18 Day in the Life:

Risky and Rewarding 

Spacewalks—

Space Shuttle Mission 

STS-120/ISS-10A
306 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

Doug Wheelock and Scott Parazynski (in the spacesuits—left and right, respectively) are assisted in the airlock during Space Shuttle mission 

STS-120/ISS-10A by European Space Agency astronaut Paolo Nespoli and International Space Station Commander Peggy Whitson.

The International Space Station 

(ISS) Program always presents 

new and sometimes daunting 

challenges. Each morning, the 

individuals working in Flight 

Operations never know whether 

the day might present one of the 

most critical problems in the history 

of the space station—whether the 

team will have to do something that 

has never been attempted. 

Scripting and training a spacewalk 

(i.e., extravehicular activity [EVA]) 

in advance is a major effort; however, 

the real-time execution of spacewalks 

usually requires deviating from the 

original plan. Problems with the 

ISS systems that require an EVA 

fix can arise, tasks may take longer 

than expected, or a spacesuit issue 

might end an EVA early. Quickdecision moments are fairly common. 

Spacewalks are physically rigorous. 

The “human-in-the-loop”—both 

in space and on the ground—often 

necessitates flexibility. None of the 

space station parts were ever able 

to be tested preflight by a suited 

crew member in space-like thermal, 

zero-g, and vacuum conditions. 

When these factors come together in 

space, problems such as stuck bolts 

or problematic hinges can occur. The 

critical decisions made in the midst of 

never-before-seen technical or human 

problems during EVAs intensely draw 

upon the Foundations of Mission 

Control (see Introduction). 

Take one Space Shuttle mission 

to the ISS, as an example. Space 

Transportation System (STS)-120/

ISS-10A launched late in October 

2007. Despite extensive EVA 

choreography preparations for the 

mission objectives, the planned 

spacewalks changed dramatically 

once the mission was under way. This 

chapter discusses the work that was 

done preflight and how it changed—

not once, but multiple times—as the 

flight control team adapted to an everchanging situation. 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 307

The Original Mission

One of the top objectives for 

STS-120 was to deliver the 

pressurized module called Node 2 

by robotically removing it from the 

Space Shuttle cargo bay and installing 

it on a temporary location on Node 1. 

The Node 2 module was a critical 

element in that the European Space 

Agency (ESA) and Japan Aerospace 

Exploration Agency modules would 

attach to it, making way for new 

countries to have permanent presence 

on the ISS after the many years they 

spent building their respective part 

of the station on the ground. The 

10A mission and subsequent stage 

operations to move Node 2 to the 

forward position had to be completed 

prior to the much-anticipated shuttle 

mission carrying the ESA Columbus 

module, which was due to launch in 

December 2007. 

Another key assembly objective 

was the transfer (relocation) of truss 

segment P6 from the central zenith 

(i.e., upper) part of the ISS, where 

it had temporarily been placed for 

7 years, to its final assembly-complete 

location at the far-port end of the truss 

(Figure 1). Prior to this mission, the 

large P6 solar array blankets had to 

be retracted (i.e., folded, accordionstyle) so they would not sway or flap 

and possibly break when P6 was 

moved to the port side. During the 

STS-120 mission, the team would 

perform the robotic transfer and EVA 

bolting of P6 (Figure 2) onto the end, 

followed by commanding re-deploy 

of the arrays (Figure 3). 

Figure 1. The ISS as seen from the Space Shuttle as it departed during STS-118, the mission immediately prior to STS-120. P6 is located in the center of 

the truss, with its solar arrays folded up in the long blanket boxes (as shown in the inset photo). 
308 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

Folded 

Blanket 

Boxes

Mast 

Canister

Figure 2. Graphic of the installation of the P6 module onto P5 during STS-120/ISS-10A. The solar arrays are folded up, accordion-style, in the long blanket 

boxes that are protruding from the cylindrical mast canister. Left image shows the P6 being maneuvered into position, whereas the right image shows it just 

prior to mating. Graphic generated using Johnson Space Center’s Virtual Reality Laboratory software. 

Mobile Transporter, 

Base System, and 

Robotic Arm.

Furthest point to port 

side to which the Mobile 

Transporter can travel. 

P6 in final location. 

These two blankets are 

together called “4B.”

These two blankets 

are together 

called “2B.”

Figure 3. The huge solar arrays give the ISS an impressive wingspan, as seen here overlaid on an American football field. The Mobile Transporter is 

constrained to the middle truss sections by the large rotating Solar Array Alpha Joints. After the P6 truss module relocation to the far-port end of the ISS, 

the arrays are not accessible by an EVA crew member standing on the robotic arm due to the Mobile Transporter limitations. This lack of reach created a 

challenging circumstance during the STS-120 mission. 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 309

Original Pre-Mission 

Spacewalk Planning

Most of the United States On-orbit 

Segment EVAs that occurred during 

ISS assembly were planned to occur 

during shuttle missions using shuttle 

crews, despite the fact that qualified 

spacewalking ISS crew members 

were constantly manning the ISS. 

This occurred for several reasons. 

First, the shuttle launched new ISS 

elements and pieces of hardware that 

usually needed specialized training 

for assembly or deploy choreography, 

and crews had to dedicate a lot of 

time to study for some assembly 

EVAs. Training time was not as 

available for ISS crew members 

since they had an extensive multiyear 

training plan just to learn how to 

run the day-to-day operations on the 

ISS. This training included Russian 

language study and extensive 

international travel. Furthermore, 

ISS crew members were often 

committed to launching in a Russian 

Soyuz vehicle, and the Soyuz 

launch schedules were not typically 

tied directly to the shuttle launch 

schedule. In some cases, ISS crew 

members had used precious time to 

train for shuttle-present EVAs, only 

to see shuttle missions moved out of 

their Expedition due to launch slips. 

As a result, assembly EVAs were 

assigned to shuttle crew members 

that would launch with the new 

elements. Shuttle crews performing 

these EVAs could dedicate a large 

amount of time training for EVAs, 

which meant greater efficiency 

during the tasks—e.g., less time 

was spent in space discussing the 

preferred location for a tether since 

crew members had already tried out 

a few locations while in training and 

decided upon the best approach. 

Figure 4. The crew on orbit in the ISS during STS-120/ISS-10A: Top row: (left to right) Dan Tani, (extravehicular [EV] number 3, EV-3), Scott Parazynski 

(EV-1), Doug Wheelock (EV-2). Middle row: (left to right) Stephanie Wilson (robotic arm operator), Pam Melroy (shuttle commander and robotic arm operator), 

Paolo Nespoli (primary intravehicular (IV) crew member that aids the EVA crew during suit-up and the EVA). Bottom row: (left to right) Clay Anderson (ISS crew 

member), Peggy Whitson, (ISS commander, EV-4), Yuri Malenchenko (cosmonaut, EV-5), George Zamka, (robotic arm operator).
310 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

For these reasons, the STS-120 

mission was initially planned with 

three spacewalks to be performed 

by crew members coming up in the 

shuttle (Figure 4). 

n EVA 1. The first EVA was required 

to disconnect and prepare Node 2 

so it could be robotically unberthed 

from the shuttle cargo bay using the 

Space Station Robotic Manipulator 

System. Also, the first of the truss 

element P6 connections were to 

be demated to allow for its later 

release from the central truss 

element Z1. Shuttle astronauts 

Scott Parazynski and Doug 

Wheelock (nickname “Wheels”) 

were trained to perform this EVA.

n EVA 2. The second EVA was 

needed to release the remaining 

connections and bolts for a final 

disconnect of P6 from Z1. This EVA 

was also needed to install critical 

exterior parts onto the outside of 

Node 2 before the operations in the 

stage and next shuttle missions. 

Parazynski and Dan Tani were 

trained to perform this EVA. 

Between EVAs 2 and 3, extensive 

robotic operations were needed to 

move the P6 segment close to its 

final location on the P5 truss. 

n EVA 3. The third EVA was needed 

to align, bolt, and connect up P6 

as well as ready a radiator for 

deploy. At the end of the third 

EVA, while the EVA crew was still 

outside, Mission Control CenterHouston would start deploying the 

radiator and P6 solar arrays 2B 

and 4B to begin generating power 

for ISS use. Shuttle astronauts 

Parazynski and Wheelock were 

trained to perform this EVA.

Several secondary objectives were 

included with the three EVAs. 

One task was to remove a failed 

antenna called the S-band Antenna 

Support Assembly, which weighed 

103 kg (228 lbs), from the ISS and 

install the antenna in the shuttle cargo 

bay for return to the ground. The 

crew also took a new spare power 

distribution unit called a Main Bus 

Switching Unit, which is 238 kg 

(525 lbs), out of the cargo bay and 

placed it near the ISS airlock to be 

used in case of future failures of this 

type of unit. These operations and 

other tasks were built in as part of 

the three EVAs.

Originally, three other ISS EVAs 

were planned after the STS-120 

mission. These EVAs were needed 

for the Node 2 move to its final 

location on the forward end of the 

laboratory. The ISS crew had been 

training for these “stage” (i.e., 

shuttle not present) EVAs. See the 

Introduction for more details about 

stage EVAs.

Last-minute Spacewalks 

Added to the Mission 

Preflight

After the STS-120 mission was 

initially planned, the shuttle orbiters 

were changed from Atlantis to 

Discovery due to a delay in preparing 

Atlantis for flight. Discovery had 

been outfitted with the capability 

to draw power from the ISS after 

docking, thus the mission could 

be extended and the number of 

EVAs to be performed during the 

mission could be increased. EVAs 

during shuttle docked mission 

were advantageous because the 

combined number of crew members 

on board would be 10 (seven shuttle, 

three ISS); therefore, more crew 

hours would be available to get 

the spacewalkers ready. The same 

strategy is discussed in Chapter 4 

with respect to STS-130/ISS-20A. 

As a result, in the spring of 2007, a 

pre-planned stage EVA by the ISS 

crew was moved into the shuttle 

docked time frame to bring the total 

number of EVAs during the mission 

to four. Two already-trained ISS 

crew members (Peggy Whitson and 

Yuri Malenchenko) would conduct 

this EVA. They would perform 

the EVA while the shuttle was 

present instead of after the shuttle 

departed. The team knew that if 

high-priority EVA tasks went long 

or new tasks were required during 

the shuttle docked time frame, the 

fourth planned spacewalk could be 

deferred until after shuttle departure. 

Whitson and Malenchenko, along 

with the required tools, would still 

be on board. The main purpose of 

this EVA was to get a step closer 

to the Columbus module mission 

by prepping for a robotic transfer 

of Pressurized Mating Adapter 2 to 

Node 2 and the eventual relocation 

of Node 2. The EVA crew would be 

demating connectors between the 

Pressurized Mating Adapter and the 

Laboratory, and removing a cover 

from Node 2. 

After this change, and about a month 

prior to the flight, another spacewalk 

was developed and added to the 

mission in unusually quick fashion. 

This EVA was to be performed by 

Parazynski and Wheelock to test some 

material that could repair the Space 

Shuttle orbiter tiles, if damaged. Ever 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 311

since the Columbia accident in 2003, 

NASA had worked hard to develop a 

method to repair the delicate heatdissipating tiles that protected the 

orbiter during reentry into the Earth’s 

atmosphere. (This was in addition 

to wing leading edge repairs, which 

required different materials.) The 

tile repair material was a consistency 

somewhere between peanut butter 

and toothpaste. The crew would apply 

the repair material to damaged tiles, 

and the material would harden to 

the firmness of a pencil eraser and 

insulate (via specifically formulated 

properties) the orbiter during its 

super-heated reentry. This material 

was squirted out of a container called 

the Tile Repair Ablator Dispenser 

(T-RAD). The new EVA was labeled 

the T-RAD Detailed Test Objective. 

Most EVAs are planned, preflight, 

over the course of months or even 

years; however, the operations 

team was asked to quickly finalize 

a tile repair test procedure because 

of the criticality of the test and the 

familiarity of the team and crew 

with the tile repair testing. A debris 

strike had damaged a tile during 

the STS-118/ISS-13A.1 mission 

that flew in August 2007. The level 

of speculation about tile repair 

capability prompted Space Shuttle 

Program management to conduct an 

official test as soon as possible. The 

team was able to develop this EVA 

within a few short weeks using some 

already-developed techniques that 

were familiar to the crew. Parazynski 

happened to be on the EVA 

Thermal Protection System repair 

collaborative team, as was the STS120 lead EVA officer Dina Contella. 

Putting the experiment on this flight 

with quick turnaround was acceptable 

for the STS-120 operations team in 

terms of the limited training required. 

In fact, it seemed serendipitous that 

the team that worked so hard on 

creating this capability would get to 

execute the on-orbit test.

The team agreed to insert the tile 

repair test spacewalk after P6 

installation (EVA 3) and before the 

increment crew Node 2 EVA. As 

discussed in Chapter 4, long missions 

with a number of spacewalks can be 

very tiring to the crew. This Detailed 

Test Objective EVA would be shorter 

than usual (4 hours) to better allow 

for spacewalks on back-to-back days 

without exhausting the crew.

When Discovery lifted off on 

October 23, 2007, the spacewalks 

had evolved from the original 

three planned EVAs to five EVAs. 

It was to be the first ISS docked 

mission with five planned EVAs and 

the first mission with five different 

EVA crew members. 

Flight Days 1-3 (Tuesday, 

October 23 through 

Thursday, October 25)

Outboard (rotates)

S3 SARJ 

(covered in MLI)

Inboard

Figure 5. S3 SARJ (circled) rotates the outboard segments to point the solar arrays at the sun. The 

EVA crew was tasked with inspecting this SARJ to determine the source of increased motor current. 

STS-120 launched on Tuesday, 

October 23, 2007. The mission 

proceeded with a normal early mission 

timeline, including checkout of the 

spacesuits on October 24 (Flight 

Day 2). On October 25, the day the 

shuttle was performing a rendezvous 

with the ISS, the operations team 

was approached about adding a new 

EVA task to the mission to have 

the crew look at the starboard Solar 

Array Rotary Joint (SARJ) (Figure 5). 

This huge round gear measures 4 m 

(13 ft) in diameter and is driven by 

a motor to enable the solar arrays on 

the end of the truss to track the sun 

via rotation of the entire end of the 

truss. The engineering community had 

seen some slightly increased currents 

(~0.1 amp, with intermittent changes 

up to 0.8 amp) associated with the 

motor. Video indicated that the arrays 
312 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

sometimes shook, as if there was 

increased friction somewhere on the 

circular travel surface or in a drive 

mechanism. It was speculated that 

this could be caused by a piece of 

thermal blanket that was dragging, 

the presence of foreign object debris 

(i.e., something that is not supposed 

to be there such as a piece of wire or 

washer), or something misaligned 

in one of two drive lock assemblies 

that houses the motor and lockdown 

mechanism. The starboard rotary joint 

had been on orbit a significantly less 

amount of time than the port side, 

which did not show any increased 

current; thus, age was not causing the 

starboard side to degrade.

The biggest concern was that 

friction would eventually increase 

to the point that either the motor 

couldn’t overcome the force or the 

motor would fail, resulting in the 

inability to position the solar arrays. 

In addition to needing good array 

pointing to generate enough power, 

the arrays needed to be pointing 

in “safe” directions so they could 

endure the shaking and jet forces 

from visiting vehicle dockings 

and undockings (see Chapter 9). 

In fact, to ensure the arrays would 

be pointed in a good direction for 

the docking of Discovery, the team 

had preemptively “parked” (i.e., 

stopped rotation of) the starboard 

SARJ before the mission with the 

arrays aligned in a position that 

would allow for the docking and also 

have adequate power generation for 

that time of year while minimizing 

potential wear and tear. 

After so much speculation about 

what could be causing the SARJ 

issue, the engineering team wanted 

to have the EVA crew look at it. 

The flight control team worked 

with the SARJ hardware experts 

on an external inspection plan 

(Figure 6) and the removal of at least 

one protective panel to get a good 

look at the rolling surface and gears. 

Space Station Program management 

initially requested this to be a task for 

a later spacewalk, but the EVA team 

identified a good time frame in the 

middle of EVA 2, requiring deferral 

of only one lower-priority task to a 

later EVA. The flight control team 

was already adapting to the changing 

needs of the flight. 

If MLI Cover is 

removed, race rings 

(2), trundle bearing 

assembly (TBA) and 

SARJ ring structure 

are visible.

• Inspect all hardware 

for scoring, damage 

or foreign object debris

• Inspect race rings for 

missing/damaged teeth

Outboard Race Ring

Inboard Race Ring

Trundle Bearing Assy

Race Ring Gear 

Teeth – inspect for 

visible damage and 

foreign object debris

What You Will See With MLI Cover Removed

P3 SARJ with All MLI Covers Removed

Figure 6. Instructional information that the Mission Control team sent up to the crew members to 

study before they performed an EVA to inspect the S3 SARJ. This SARJ hardware would be seen under 

the white multilayer insulation (MLI). Photo credit NASA-JSC/John Ray, taken at the Kennedy Space 

Center prior to S3 launch. 

Flight Days 4-5 

(Friday, October 26 and 

Saturday, October 27)

EVA 1 was executed as planned. 

EVA crew members encountered 

relatively minor anomalies; e.g., 

some bolts were sticky (i.e., difficult 

to remove) and some ammonia ice 

flakes had floated out during the 

initial crew disconnection of P1 from 

Z1. As discussed in Chapters 4 and 

17, the ground team had to track that 

the crew spent enough time baking 

out (i.e., allowing the ammonia to 

sublimate off of the suit) and had the 

crew members perform a test in the 

airlock to verify the absence of toxic 

quantities on their suits, which could 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 313

contaminate the ISS atmosphere. 

The Node 2 module was robotically 

moved out of the shuttle payload bay 

to its temporary location on the port 

side of Node 1. Applause erupted 

in the engineering room over this 

important new module for the ISS.

The day between EVAs 1 and 2 was 

spent preparing the suits and tools 

for the next EVA. This day also 

allowed time for the flight control 

team to get information to the crew 

members about their new task to 

inspect the SARJ and for the crew 

members to study the slightly altered 

choreography for the EVA.

Flight Days 6-7 

(Sunday, October 28 and 

Monday, October 29)

The flight control team had its hands 

full of small EVA surprises during 

the second spacewalk on October 28. 

Detaching the P6 truss segment 

went well, but some of the shorter 

planned tasks had to be cancelled 

(i.e., put into later EVAs) due to 

the issues encountered throughout 

the day. For example, the display 

locked up on Tani’s spacesuit, and 

he had to perform a “reboot,” as one 

would with a locked-up computer 

display. Also, the crew had difficulty 

operating some of the connectors, 

small o-rings floated out of some of 

the connectors, and a pin dislodged 

and couldn’t be extracted from an 

area at a Node 2 berthing mechanism. 

Figure 7. Photos of tape that the EVA 2 crew used to pick up metal particles seen on the SARJ. The 

tape was initially adhered to a caddy (top photo) that resembled a book with slick paper. The crew 

peeled the tape off of the caddy and made a loop with the sticky side out to pat the area and pick up the 

particles (bottom photo). The tape was put into a bag that came back down to the ground on the shuttle.

The starboard SARJ inspection 

revealed major news that would 

heavily affect the next few days. 

When Tani removed the cover, he 

saw what appeared to be magnetized 

metal shavings on the passive ring 

of the SARJ (Figure 7). Shavings 

indicated pieces of the joint were 

grinding so hard that small metal 

pieces, also known as Foreign 

Object Debris, were coming off and 

creating some amount of permanent 

damage. Tani’s electronic still 

camera was not working, so the 

ground sent Parazynski to retrieve 
314 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

a spare camera; however, that one

did not work either! The live video 

from Tani’s helmet camera was not 

detailed, but it was the best footage 

the ground team was going to get 

that day. The team had Parazynski 

gather a pouch with some adhesive 

tape while at the airlock. The crew 

was able to use the tape to pick up 

shaving samples by touching the 

adhesive side to the shavings. These 

could not be analyzed until they 

were brought home after the mission, 

but they would eventually allow 

the engineering team to identify the 

source of the material. 

Before EVA 2 was even over, the 

operations and engineering teams 

were already thinking about what 

they could accomplish during this 

mission to continue searching for the 

root cause of the issue. Although the 

starboard SARJ could be positioned 

for this particular mission, analysis 

had not yet been completed to show 

there were adequate SARJ angles 

obtainable for the stage time frame 

after Discovery left and during 

the next shuttle mission that was 

planned for a few weeks later. The 

next mission would bring up the 

first ESA module: Columbus. Due 

to undesirable sun angles (called 

a “beta cutout,” as discussed in 

Chapter 9) starting mid-December, 

having to add EVAs to the stage 

before that mission would likely 

push the Columbus launch 

significantly until after the sun 

angles became more favorable for 

both spacewalks and dockings. 

A group called Team 4 was formed 

(see also Chapter 20) after EVA 2. 

Led by a flight director, Team 4 was 

tasked to assess whether it would 

be possible for the EVA crew to 

remove the 22 thermal covers that 

protected the SARJ and perform 

a detailed inspection of the entire 

SARJ to find the culprit hardware 

interference scraping the SARJ. This 

effort involved experts from across 

the country who were associated 

with the design and function of the 

SARJ, many of whom were also 

the solar array experts. The team 

quickly realized an inspection of 

this magnitude would take an entire 

EVA since the covers were bolted 

on and unbolting takes time. Team 4 

started working around the clock 

on new SARJ inspection spacewalk 

procedures. The console team worked 

the overall plan to incorporate this 

EVA into the mission. 

EVA 3 had to continue as planned 

on Flight Day 8 with the P6 segment 

released from the Z1 section and 

needing to be bolted onto the port 

end of the truss. The new SARJ 

spacewalk would have to take 

the place of either the tile repair 

experiment on EVA 4 or the stage 

EVA 5. This was an interesting 

trade because the Space Shuttle 

Program was highly motivated to 

complete the tile repair experiment 

that required shuttle hardware/

tools, and which was to be stowed 

in the payload bay for return. The 

ISS Program needed to complete 

the high-priority stage tasks before 

the December launch of Columbus; 

otherwise, Node 2 would not be in 

the right place for the Columbus 

attachment. In the end, this interim 

debate was superfluous. None of 

these three EVAs (SARJ, tile, or 

stage) would occur during STS-120. 

The mission was about to encounter 

a major setback.

Flight Days 8-9 

(Tuesday, October 30 and 

Wednesday, October 31)

The EVA crew bolted on the P6 

truss during EVA 3. The ground 

commanded the P6 arrays to slowly 

unfurl (i.e., deploy) from their foldedup condition (see Chapter 9) in a 

manner fairly similar to what had 

been done 7 years earlier on STS-97/

ISS-4A. An array deploys via motor 

in the central mast, which lifts the top 

half of a blanket box, resulting in the 

unfolding of the arrays. This re-deploy 

was to be done during orbital day so 

that crew members could directly 

watch and command an abort if they 

saw that the array was not deploying 

nominally. Going into the mission, 

the team thought P6 deploy might 

be tricky since other array deploys 

had required real-time procedural 

changes or even EVA assistance in 

the past. The day after EVA 3 was 

planned as somewhat light to enable 

the team to work on slower or fancier 

deploy methods if needed, based on 

what the team saw during the initial 

deploy attempt of the P6 arrays. What 

actually happened was jaw-dropping, 

and completely unforeseen.

The 2B side managed to deploy 

without issues, but the team was 

able to deploy the 4B array only 

approximately 80% before a 0.6- to 

0.9-m (2- to 3-ft) tear developed. 

Video showed that the array was torn 

along an accordion hinge line. Closer 

inspection revealed a smaller tear and 

a tangle in the guidewire that should 

have been assisting a smooth deploy 

(Figure 8). The flight control team 

sent a command to slowly retract the 

array just enough to relieve some 

tension so that the tear would not get 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 315

worse. While the array was parked in 

this partially deployed state, the flight 

control team tried to determine what 

to do next. 

Snag

Snag caused array 

separation along 

the hinge line, like 

a tear along a 

crease on paper

Figure 8. The 4B array damage. The crew and 

ground team aborted the deploy operation when 

the tear was noticed, thus the array did not get 

to the end of the deploy sequence where it would 

have been pulled taut. 

After looking at the video, it seemed 

clear the array could tear more if 

loads (i.e., forces) were put into 

it. One major concern was that 

vibrations and jet firings during the 

shuttle undocking or other visiting 

vehicles coming/going could cause 

the array to sway and rip further. It 

might not be repairable if it worsened. 

Further damage could lead to a need 

for the array to be jettisoned, meaning 

a future crew would have to dismantle 

it at the base and push the array to 

burn up into the atmosphere. This 

would present an extremely complex 

operation in which a jettison would 

leave the ISS with much-reduced 

power. Building another array would 

be costly. Future concerns aside, the 

near-term reality was that a ripped 

array could flap around and cause 

major damage to other components. 

This issue became the top problem to 

solve on this mission. 

4.6 m

(15.0 ft)

4.6 m

(15.0 ft)

2.1 m

Solar Array (16.9 ft)

Blanket

Blanket Box 

lower half

Blanket Box 

upper half

Guidewire

Mechanisms Mast 

(partially 

extended) Mast Cannister 

(holds Mast prior 

to deploy)

Figure 9. Solar Array 

Wing. Each array blanket 

was originally folded up, 

accordion-style, into a 

box. When the arrays were 

deployed, the boxes were 

commanded to unlatch, 

and the center mast that 

was folded up inside a 

canister was commanded 

to elongate. This effectively 

pulled the top half of the 

box (attached to the blanket) 

away from the bottom half 

of the box (attached to the 

other end of the blanket) and 

stretched out the folds in 

the blankets. (ISS Electrical 

Power Systems Training 

Manual - 01.04.05(0)T0005, 

Version 1.0, (supersedes 

TD9707)) 

Solar array retractions and deploys in 

the past had sometimes required EVA 

crew assistance, as the mechanisms 

to unfurl large blankets of solar cells 

are fairly complex. The blankets 

are huge, with each array “wing” 

composed of two blankets—each 

approximately 35 m (115 ft) tall. 

The blankets were originally folded 

up in an accordion fashion inside 

a blanket box that was only 0.5 m 

(20 in.) tall. Often, a fold would 

stick to an adjacent fold when the 

blankets were later stretched out 

(Figures 9-11), or some part of the 

delicate mechanism would need the 

ground team’s creativity to jostle or 

pull it, or it would need an EVA crew 

member to carefully expand the array. 

The P6 arrays were not expected to be 

sticky since they had been deployed 

previously; however, the EVA crew 

had been trained, pre-mission, to 

handle other potential array issues 
316 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

such as freeing up small snags along 

the guidewires that help keep the 

array straight (Figures 11-12). 

Guidewire

(vertical)

Hinge

Solar 

Cells 

(gray)

Blanket

(folded up 

like an 

accordian)

Figure 10. A solar array blanket located in a ground facility. It is 

shown still mostly folded up in the lower half of the blanket box, as 

if the ground had just started to command a deployment. The active 

side of the array (shown) is where the solar cells (gray) are located 

to gather energy from the sun.

“Guidewire” that runs 

between top and bottom 

halves of blanket box 

that guides the array 

during deploy and helps 

keep the array flat while 

deployed

Guidewire

Grommets Hinge

Figure 11. Passive side of the array (solar cells are on the other side of the array). 

The blankets are hinged. When they deploy, small grommets move up the guidewire. 

The guidewire keeps the blankets from swaying and bowing too much when the 

array is fully deployed. 

Team 4 and the console team were 

still working on the SARJ inspection 

EVA but had to start reprioritizing an 

array repair in short order. On Flight 

Day 9, the team decided to change 

EVA 4 from the SARJ EVA to a 

solar array repair EVA. Parazynski 

and Wheelock were chosen to 

perform the spacewalk, with 

Parazynski performing the repair 

since he was the most experienced 

EVA crew member on board. 

The Challenges

Repair of the array would be a highdegree-of-difficulty spacewalk if 

a fix was even possible. The flight 

control team did not have much 

time to create and execute such 

an EVA before the shuttle had to 

undock. Under the direction of the 

Team 4 flight director, multiple 

flight control and engineering 

teams—EVA, robotics, and power, 

to name a few—worked around the 

clock to identify each roadblock and 

devise a fix. Below are some of the 

challenges that the ground team and 

crew faced going into the EVA.

1. The Damage Might Be 

Just Out of Reach

The solar arrays were far, far away 

from the crew modules. P6 was no 

longer in the center of the truss as it 

was at the beginning of the mission. 

The most obvious technical issue was 

going to be reaching the damage. The 

snag could not be reached by an EVA 

crew member on the robotic arm, 

even with the arm fully outstretched. 

The team looked at the potential for 

retracting the array so the damage 

was near the base, but it was too 

risky to move the array that much. 

The damage could get worse, and 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 317

the accordion aspect could not be 

expected to work correctly. 

However, the Space Shuttle had 

a long 15 m (49.2 ft) boom called 

the Orbiter Boom Sensor System 

(OBSS) that the shuttle had been 

flying since the Columbia accident. 

The purpose of the OBSS was for 

up-close inspection of damage on 

the underside and wings of the 

orbiter. A shuttle EVA crew member 

could stand on the tip of the boom 

while the boom was grasped by 

a robotic arm to perform a repair. 

Use of the boom grasped by the 

ISS robotic arm (17.6 m [57.7 ft]) 

looked feasible for reaching the array 

damage—albeit barely—according 

to virtual reality and software models 

of the ISS. The ground team used 

this as the concept for the EVA. 

The ground team set up the robotic 

systems ahead of the EVA, optimistic 

that the computer models were 

accurate in their conclusion that 

Parazynski could reach the array 

damage site. The team prepared 

for the EVA by translating the 

Mobile Transporter with the ISS 

robotic arm on it from the end of the 

truss to the center of the ISS. The 

SSRMS was now ready to take the 

OBSS out of the Discovery cargo 

bay. When the time came, the ISS 

arm would grasp the boom and the 

Mobile Transporter would move 

back to the end of the truss to point 

the tip of the boom toward the truss 

structure so that Parazynski could 

put his feet in a restraint at the tip 

for the ride out to the array. These 

complicated robotics operations 

were not pre-planned. A fairly large 

effort was required to develop the 

procedures and perform the analysis 

to ensure the operation was safe.

2. The Damage Was Not 

Well Understood

Even with the most powerful zoom 

lenses, the damaged portion of the 

array was too far away from the crew 

inside the Space Shuttle and the ISS 

for a detailed look at the problem. 

Using the best crew-taken photos, the 

flight control team tried to map out 

the damage to the extent possible to 

develop a good repair (Figure 12). In 

the end, there were some “if you see 

this then do that” steps in the crew 

repair procedures on the day they 

performed the EVA. As always, the 

flight control team tried to prepare for 

every imaginable scenario. 

Upper Blanket 

Box 

Lower Blanket 

Box 

Panel 37

Panel 38

Panel 36

Panel 35 Panel 34

Large Damage

Hinge Loops and Doubler –

Hinge Wire is inside the Doubler

~ 8–12 inches

Small Damage

Hinge Wire from Lower 

Hinge (sketched in)

~ 8–12 inches

Location of Grommets

Guide Wire

Stbd

Port

Figure 12. 

This was the best 

close-up photo of the 

damage available in 

the days prior to the 

EVA. The ground team 

marked it up with 

white lines and red 

markings, as shown, 

and uplinked it to the 

crew in this training 

documentation. 
318 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

3. Repair Materials Had To 

Be Crafted On Orbit

The solar array specialists, structural 

loads analysts, EVA team, and the 

crew’s maintenance instructors tried 

to find any available materials on 

orbit that could clear a snarl of wires 

and permanently sew together the 

panels that had come apart at the 

hinges. Clearing or cutting the snag 

could likely be done using available 

US and Russian EVA tools; however, 

EVA tools would not do the trick for 

repairing the hinges. 

Looking back, this effort was similar 

to the famous scene in the movie 

Apollo 13 when ground controllers 

had to figure out how to build a 

carbon dioxide filter out of parts 

available to the crew. Using array 

parts on the ground and gathering a 

pile of various materials available 

inside the ISS, the flight control and 

engineering team came up with an 

ingenious solution. Special straps 

that could hold the panels together 

were proposed, taking advantage 

of intentionally designed holes on 

each side of the hinges (a thick pin 

was inserted into these holes to 

stabilize the arrays for launch, but the 

holes were not used after a standard 

array deploy). Five straps of three 

different lengths—89 to 165 cm 

(35 to 65 in.)—would hold the panels 

together the way tuxedo cufflinks 

work. Each end fed through a hole 

on opposite sides of the separated 

hinge lines. Crew members had 

to manufacture the straps out of a 

sheet of aluminum, some wire, and 

some tape. They cut the aluminum 

into 10 cm (4 in.) long and 2 cm 

(0.75 in.) wide strips, punched holes 

in the aluminum using a hand punch, 

created the specific length needed 

using 12-gauge wire, made an EVA 

tether point, and wrapped everything 

in tape (see Chapter 16). The 

developed technique was then tested 

on the ground (Figures 13 and 14). 

The cufflink that was produced on 

orbit is shown in Figure 15.

Launch pin holes that 

are not used after the 

array comes out of its 

blanket box. These 

were used as attach 

locations for the 

straps holding the 

array panels togethe array panels together. 

“Cufflink” straps 

that would hold 

the panels 

together despite 

the damage

Figure 13. Hardware engineers and analysts discuss the repair during STS-120/ISS-10A while 

looking at the solar array ground unit. This photo provides some scale, when the array is compared 

to a human. A full Solar Array Wing would measure 35 m (115 ft) in length. 

4. Electric Shock and 

Sharp Edges Hazards

One of the most challenging aspects 

involved the safety of a spacewalking 

crew member working around 

the solar array. Unlike Orbital 

Replacement Units, which were 

discussed in the Introduction and 

Chapter 16, the arrays were not 

meant to be repaired by an EVA 

crew member. These arrays have 

sharp areas, which could puncture 

or cut the spacesuit. Plus, in this 

case, there were a lot of “unknowns” 

about the damage and what could 

be sharp in that snag point. Most 

significantly, a solar array carries 

enough electric charge to electrocute 

the crew member in the spacesuit. 

Team members had to methodically 

think of everything that could lead to 

an electric current getting to the crew 

member, and to keep those scenarios 

from happening. The electrical 

power systems flight controller can 

reconfigure the electrical power 

system to reject energy from some 

areas, but no one can prevent the solar 

cells from becoming energized. 

The concerns were numerous 

regarding the electrical aspect. 

Could crew members actually be 

electrocuted if they touched the 

damaged area? Could metal parts 

heat up and turn molten, such that 

a drop could come off and burn 

a hole in the spacesuit? Could 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 319

sparking/arcing occur and jump 

between the array and tools or the 

suit? Could the energized “plasma” 

environment of the ISS in its orbit 

aid in this arcing? Was there a better 

time to perform the repair relative 

to orbital sunrise/sunset to reduce 

the risk of shock—and how does 

wait time in the orbit trade against 

the risk of having Parazynski 

remain near the array while waiting 

for the perfect conditions? 

Figure 14. Repair technique development during STS-120/ISS-10A. Hinge stabilizing wires were 

called cufflinks because the crew would insert a thin 10 cm (4 in.) long aluminum plate through a hole, 

where it would catch on the other side. This plate was attached via a long wire to another plate that 

the crew would also thread through the array and into a hole on the other side of the damaged hinge. 

The first two figures show the insertion technique. The third photo shows the backside, where the wire 

is not visible but the aluminum plates are seen flat against the array. In the last photo, astronaut Steve 

Swanson tries out the technique while wearing an EVA glove to test whether Parazynski will be able to 

perform the technique while suited in the Extravehicular Mobility Unit. 

Figure 15. STS-120 pilot George Zamka holds 

up a cufflink that he and ISS Commander Peggy 

Whitson constructed on orbit in preparation for 

the 4B solar repair EVA.

Because sunlight reflects off of the

Earth and the ISS, the array could be 

energized even during orbital night. 

The team quickly decided the crew 

would only work from the passive 

side of the array (solar cells facing 

away from the crew). That did not 

avoid the danger completely—the 

array damage could still point part 

of a cell toward the crew member, 

exposing him to an electric charge. 

Parazynski’s huge suit or his floating 

tools might accidentally come in 

contact with the damage, especially 

if the array was swaying while he 

attempted to enact the repair. The 

team could imagine having him cut 

a wire and releasing some stored 

energy that would “twang” or 

oscillate and move the array. 
320 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

Various experts on electrical shock 

and plasma weighed in. The EVA 

console brought in safety experts to 

brief the EVA team on the hazard and 

how to prevent it. They were told 

the path to shocking the crew could 

be as follows: a hot (i.e., electrically 

energized) part of the array comes 

in contact with a metal tool, the tool 

touches a metal part of the suit such 

as the hard wrist connection, the 

astronaut touches the same part on 

the inside of the suit and is sweaty, 

another sweaty body part touches 

another metal part of the suit such as 

the waist bearing, and that metal part 

touches a grounded part of the array 

such as a guidewire. This scenario 

would result in an electric current 

traveling through the astronaut’s 

body. The EVA team relayed this 

information to the crew, via private 

video conference, to make sure 

everyone understood the hazards.

The team went about ensuring 

this chain of events would not be 

possible. Parts of the suit and the 

tools were taped with insulating 

Kapton orange tape. The tape would 

keep electric charge from conducting 

between the array and the tool. Also, 

the ground had the crew tape up the 

metal wrist area of the Extravehicular 

Mobility Unit where the gloves 

attached. The number of tools 

Parazynski had with him was kept 

to a bare minimum, which provided 

a better chance of preventing tools 

from floating into the array.

One question was whether sparks 

could jump through space, similar 

to lightning, if electrical charge 

differences were present. Although 

there is very little atmosphere at the 

altitude of the space station, charged 

particles surround the Earth. Plasma 

Contactor Units on board the ISS 

are turned on for spacewalks to 

specifically emit electrons into space. 

This creates a “grounding strap” and 

helps avoid the buildup of a large 

difference in electrical potential 

between the ISS structure and the 

surrounding environment. These 

units would be used, but would they 

be enough to mitigate the risk? As 

it turned out, the time of year was 

favorable and the solar cycle was 

closer to a minimum level of activity, 

so there would not be as many 

charged particles at the ISS altitude 

to create the plasma that would allow 

for a significant jumping of sparks/

arcs through space. 

Current flows from the array cells 

to the edges of the arrays, and then 

down to the base, with more and 

more current built up closer to the 

base after gathering input from 

cells along the way down. With the 

damage more than halfway up the 

array, the voltage and current of 

the specific area was known. The 

team determined that a spark could 

not jump more than about half an 

inch between electrically hot spots 

on the array; therefore, a jump 

between the array and Parazynski’s 

metal neck ring on the suit was 

not possible as long as he kept the 

array at a comfortable distance. 

Parazynski might expect to see 

some small arcs, but they wouldn’t 

jump across free space to him. 

Furthermore, the creation of molten 

metal would require a much greater 

level of energy than deemed possible, 

considering where Parazynski could 

potentially come in contact and the 

fact that the tools were taped up.

Many sharp areas on the array could 

nick a glove, or many areas could be 

energized. Parazynski was told not 

to touch the array with his gloved 

hand. Instead, he had with him a tool 

that had been built inside the ISS, a 

few months prior, to keep a swaying 

array from contacting a crew member 

during an EVA on an earlier mission. 

This tool, called the hockey stick, 

was made of nonconductive material 

wrapped in Kapton tape. The hockey 

stick could be used as a defense to 

push the array away if it came near 

(Figure 16). Vibrations, pushing, or 

the act of the repair could cause the 

array to flap and move, like a sail in 

the wind. This complicated the repair 

because Parazynski needed to keep 

the array close enough to perform the 

repair, yet keep the array at a distance 

using the hockey stick—all the while 

trying to enact the repair and holding 

additional tools. 

5. The Boom Might Be Too Bouncy

The plan was to have the ISS robotic 

arm grasp the boom at its center, 

with Parazynski standing in a foot 

restraint on a Worksite Interface 

(WIF) Extender, which would 

add approximately 0.9 to 1.2 m 

(~3 to 4 ft) to the overall reach to the 

damage site. He would essentially 

be on the end of an approximately 

27 m (90 ft) pole. Movement of 

his spacesuit could cause ups and 

downs like a fish caught at the 

end of a fishing pole. The team 

had concerns about how much 

Parazynski would bounce around 

after making small movements and 

his ability to avoid smashing into 

the array, inadvertently. Imagine 

trying to perform delicate surgery 

while bouncing on a trampoline. 

Not easy to accomplish!

Although the Space Shuttle boom 

had not been intended for the purpose 

of getting a crew member close to a 

dangerous solar array, the STS-121/

ISS-ULF1.1 crew in July 2006 had 

performed testing while standing on 

a foot restraint attached directly to 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 321

the tip of the boom (i.e., without a 

WIF Extender). The test was intended 

to prove that an astronaut could 

stand at the tip of a long boom on 

the shuttle robotic arm to repair the 

shuttle, since it was theorized that the 

boom would feel bouncy and move 

quite a bit as the astronaut moved 

his or her heavy spacesuit. In the 

case of STS-121, the shuttle robotic 

arm grasped the end of the boom. 

Figure 16. The team took advantage of a previously constructed tool called the hockey stick, due to its 

shape. It was not as large as a hockey stick, however. It measured 46 by 18 cm (18 by 7 in.). Parazynski 

could use it as a defensive tool if the array swayed near him, since it was made of nonconductive 

material. He would tether to the blue tie wrap loops (redundant in case one of them broke) and hold the 

stick near the end with the tethers. The shorter part of the “L” could be used to push the array away if it 

got too close. The hockey stick is shown floating in the laboratory during Expedition 15.

The proposed configuration for the 

solar array repair was with a stronger 

robotic arm—the ISS robotic arm—

grasping the middle instead of the 

end. Although the configuration was 

not tested at these specific arm angles 

with this arm and WIF Extender, it 

was hoped that Parazynski could 

perform his work safely despite 

some bounciness in the system. Team 

members tested the configuration 

using software in the Virtual Reality 

laboratory just to be sure. They 

crafted into the EVA a small test—

the ground team planned to have 

Parazynski lean in and get a feel for 

the bounciness of his platform before 

starting the repair work.

6. The Airlock Would Be Far Away

Typically, EVAs are choreographed 

such that an EVA crew member 

could get back to the airlock within 

30 minutes in an emergency. If, 

for example, the fan/pump/water 

separator unit in the spacesuit (see 

Chapter 17) were to stop working, the 

EVA crew member could open a valve 

in the suit to help with cooling. In a 

worst-case scenario, the suit would 

have enough oxygen for 30 minutes in 

which the crew member would return 

to the airlock while the suit expended 

oxygen through the valve. 

In this case, it was initially estimated 

that it would take Parazynski up to 

an hour to get back to the airlock in 

an emergency. This was eventually 

refined down to 30 to 45 minutes 

by planning where he would tether 

himself, having a quick robotic 

maneuver to the truss ready to go, 

and making sure the on-board crew 

was ready for such a scenario. But, 

because of the critical ISS need to 

have this repair done, additional risk 

had to be accepted when sending 

Parazynski that far from the airlock. 

This risk was debated extensively in 

Team 4 and program meetings since 

standard crew safety practices would 

have to be waived to accomplish 

the task. The 30-minute emergency 

airlock ingress constraint was used 

throughout the ISS assembly and was 

the basis of many decisions related 

to operations and hardware design 

to avoid delaying crew members 

if they needed a quick translation 

back. Therefore, accepting this 

crew risk was not taken lightly. 

One of the factors in accepting the 

risk was that 30 minutes is often 

not an exact number when it comes 

to EVA. For example, in this case, 

there might be some extra oxygen in 

the main tanks, there might be less 

tethers than normal to disconnect 

to start the return, and Parazynski 

was highly experienced. Inherently, 

spaceflight requires taking risks. 

The final decision was that this 

situation was deemed worthy of the 

elevated risk, with the operations 

team making sure an emergency 

return was very well planned to 

be as efficient as possible, should 

a spacesuit failure occur when 

Parazynski was far from the airlock. 

7. The Boom Sensors Might Break

Using the ISS robotic arm to grab 

the boom instead using of the shuttle 

robotic arm would cause the delicate 
322 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

high-tech imaging sensors at the tip 

to be unpowered for several hours. 

The worry was that the sensors would 

get too cold and become damaged, 

resulting in the inability to inspect 

the thermal protection system of the 

shuttle prior to reentry. The ability to 

perform inspections became important 

after the Space Shuttle Columbia 

accident. The shuttle mission 

management team had to carefully 

consider the possibility that this 

operation might break these sensors. 

Chance Favors the Prepared Mind 

Colonel Doug Wheelock 

STS-120/ISS-10A and Expedition 24/25

The inside of a spaceship offers a level of normalcy. The 

temperature and atmospheric pressure are fairly constant. 

It is easy to get lulled into a false sense of safety. But the 

moment you open the hatch, the rules change. Oblivion 

resides on the other side of your thin helmet visor. You are 

now engulfed in a dangerous environment of chance. And, 

as we know, chance favors the prepared mind.

During our 18 months of intensive training, Scott 

Parazynski and I worked diligently in NASA’s Neutral 

Buoyancy Laboratory and Virtual Reality Laboratory. We 

did whatever we could, as many times as we could, to 

replicate the spacewalking environment, talking through 

every conceivable contingency. I grew up hearing the 

mantra “Practice makes Perfect.” However, when 

preparing for spaceflight, that mantra is more accurately 

“Perfect Practice makes Perfect.” No room for error, and 

complacency is met swiftly with dreadful consequence.

The moment arrived for my first spacewalk. With the 

reduced pressure inside the suit, I could hear a difference 

in my voice, which gets deeper at the lower pressure. 

Scott opened the hatch and said, “Oh wow! Wait until you 

see this, Wheels! We’re over the Himalayas!” 

Nothing quite compares to that first step out into the 

vast universe. Your home planet is far beneath your feet. 

Everything and everyone you have ever known...all on 

that blue planet. And you’re not there. The feeling is quite 

profound, and difficult to put into words. Space is visually 

spectacular and completely breathtaking because of our 

blue planet. It is an explosion of color in the sunlight, an 

oasis of motion and light, suspended in an empty sea 

of darkness. You feel vulnerable. Fragile. Fear is your 

constant companion. The Earth is distracting from this 

vantage point. It is difficult to stay focused, but you have 

to get back to work.

My second EVA was amazing, bolting down the nearly 

19-ton P-6 truss and solar arrays to the far port end of the 

ISS truss. We finished the task and returned to the airlock. 

Our team worked through the deployment commands for 

the solar arrays. Scott and I were cleaning up when the 

“abort” command was broadcast. I knew that couldn’t 

be good, but I had no idea how that moment would 

shape my life and work, as well as teach me lessons 

about leadership, teamwork, and perseverance that have 

changed who I am as an astronaut and leader.

The solar array got snagged by a frayed guidewire, and the 

situation was dire. The next few days were full of confusion, 

doubt, and despair. How could we ever repair a torn array? 

Hours and hours passed. We talked about what was likely 

going on down in Mission Control in Houston. We were sure 

NASA had pulled out all the stops to help us fix the station 

and get us home safely. I remember talking with Scott 

in the intervening days about how it felt like Apollo 13. 

I had worked at NASA for 11 years at this point. A calm 

assurance washed over me in that moment. I realized that 

the reason it was so quiet on the voice loops was because 

they were testing a potential solution. I knew in my heart 

that some sharp engineer turned to our team and said, 

“Hey...what if...”? I knew that one day we would look back 

and remember this as one of NASA’s finest hours.

Initially, the team estimated the boom 

sensors would be unpowered for 

12 hours, with the sensors getting 

too cold after being unplugged 

between 5 and 8 hours. The robotics 

plan was changed so that the shuttle 

robotic arm would hold the boom 

for some of the preparations, thereby 

reducing the exposure to around a 

predicted 8 hours. After looking at the 

environment, the analysts concluded 

it might remain warm enough to 

prevent the sensors from becoming 

damaged. Because of the criticality 

of the boom usage for this repair and 

some conservatism in the thermal 

analysis, the mission management 

team agreed to use the boom. They 

accepted the risk that these sensors 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 323

Sure enough, our next video conference with our team 

on Earth involved a box full of makeshift parts, fashioned 

together and dumped out on a table, just like in the 

movies! They explained what we were going to do. They 

gave us vectors on where to find cable, pieces of metal, 

and sheet metal tools needed to build “cufflinks” to sew 

the torn solar array. Though years have slipped by since 

that day, it still amazes me that someone thought of this 

solution. It made me grateful to be alive, and grateful to 

be part of the NASA team. The plan was full of danger 

and unknowns. We taped everything metal on our 

spacesuits, including the neckring of our helmets, which 

really got my attention. I was going to be responsible 

for keeping Scott safely clear of the billowing array, so 

it wouldn’t fry the electronics in his suit and electrocute 

him. I was also responsible for feeding the guidewire 

cleanly into the inertial reel, while maintaining control of 

the wire. The engineers told me to keep my suit clear of 

the wire, since it retracts at 10 feet per second. They were 

concerned that if I lost control of the wire, it would tear 

through the solar array and even through my suit! Trust 

me, they had my undivided attention!

It was game day, November 3, 2007. Scott was stoic 

and focused. I was full of fear, but if I was purposed and 

methodical, I would increase my chances of success. 

There is a saying we have in the astronaut corps, that 

there is no situation in space so bad that you can’t make 

it worse. Spacewalking demands a balanced level of logic 

and impulse, and the clear recognition of danger. 

When I exited the airlock, I felt like a machine. I knew what 

I had to do, and I wanted to get on with it while adrenaline 

still coursed through my veins. Mission Control told us 

they were going to maneuver the ISS to shadow as much 

of the array as they could to reduce the electrical power 

generation of the arrays, resulting in me being in shadow 

for the next 7+ hours. Scott was in position to cut the 

frayed part of the guidewire. I reached inside of the array 

with the needle-nose pliers to control the guidewire and 

give Scott a “go.” I held a metal tool mere inches away 

from the array power strip that carried 200 amps of current, 

and I was a bit nervous. But, everything went smoothly and 

the cable retracted fully into the inertial reel well. 

Scott finished installing the five cufflinks. We were ready 

to clear the area. The robotic arm operator maneuvered 

Scott away from the array and back to structure. I was 

asked to return to the airlock. By this time, my teeth were 

chattering and I couldn’t wrap my fingers around anything. 

My heart was pounding, and I had to figure out a way to 

warm my hands. I noticed a sliver of sunlight on the top 

of the mast canister, so I crept up the mast and stuck my 

hands into the sunlight. It took a couple minutes, but my 

hands warmed enough to grip the handrails and my tools, 

and make my way back to the airlock.

Our repair worked! The array fully deployed, and the 

cufflinks are still holding to this day, years later. 

Now when I am asked what it is like to do a spacewalk, 

the answer is not so simple. It is mentally and 

psychologically the toughest yet most rewarding work I 

have ever been a part of. I have never felt more mortal 

than when I was out on a spacewalk. I have never felt as 

cold as I did that day in November 2007. But the sense of 

pride I will feel to the end of my days, of being a part of 

something great, is overwhelming. 

might not survive, which would result 

in an inability to check the thermal 

protection system of the shuttle before 

reentry into Earth’s atmosphere.

8. Spacesuit Failures

A hole was discovered in the outer 

layer of Wheelock’s right glove 

at the end of the third spacewalk. 

Wheelock’s gloves were changed 

out with a backup pair for the next 

EVA, but the team questioned 

whether something sharp outside 

could puncture a hole in a glove 

during this upcoming EVA, possibly 

even creating a hole into the bladder 

of the suit and springing an oxygen 

leak. Several items that were 

theorized could cause the issue, but 

nothing was the obvious source. 

One leading suspect was a pair of 

foot restraints with difficult-to-turn 

knobs—they possibly had a defect 

or micrometeoroid orbital debris had 

damaged them. The team wanted to 

bring those inside, if possible, on 

this repair EVA for inspection. In 

the meantime, how could the team 

ensure the crew would stay safe from 

sharp edges? This was one more 

complicating factor that had to be 

discussed at length before the EVA.
324 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

A set of “overgloves” was planned 

into the EVA to provide for this 

sort of protection. Overgloves were 

mittens that fit over the index finger 

and thumb and covered the most-used 

glove areas. They were somewhat 

loose, thereby reducing the overall 

dexterity of the crew member’s hands 

even more than the spacesuit gloves. 

The team members expressed many 

concerns about using overgloves 

when doing fine detailed EVA work—

they didn’t want Parazynski unable 

to perform the repair, snagging the 

overglove, or having hand fatigue. It 

was agreed that both Parazynski and 

Wheelock would wear these gloves, 

but when Parazynski got on the tip 

of the boom, he would remove his 

overgloves to perform the repair. 

Also on EVA 3, Parazynski’s 

spacesuit exhibited increasing 

temperatures due to a theorized failure 

of his sublimator (the component 

that rejects heat). The team declared 

his primary suit “no-go” for use on 

this upcoming EVA. The crew had to 

spend extra time to size a different 

spare suit to fit him.

9. Lack of Time

To pull off this kind of repair 

spacewalk could take weeks of 

preparation in various ground 

facilities; however, only a handful 

of days remained before the shuttle 

would run out of consumables and 

have to depart. Even simple EVAs 

are usually trained in the Neutral 

Buoyancy Laboratory several times 

before attempted in space. With so 

little time, a lot of “gut feel” from 

engineers, flight controllers, and 

experienced crew would have to be 

used to assess robotic motions and 

unknown array dynamics during 

the repair. Unfortunately, the same 

people who had worked so hard 

(i.e., electrical power experts, EVA 

teams), day and night, to come up 

with the SARJ EVA had to now work 

the solar array issue day and night 

until it was fixed. 

The array snag occurred on 

Tuesday, October 30, after EVA 3. 

On Wednesday, the team changed 

direction, completely dropping 

all work on the SARJ and instead 

working exclusively on the repair 

EVA. Highly optimistic thinking 

put the repair EVA on Friday, with 

a second EVA possible before 

undocking. Everyone felt the pressure 

to perform a successful repair before 

the shuttle and its boom departed.

Flight Day 10 

(Thursday, November 1)

As Friday approached, flight 

controllers worked around the 

clock (many working 12 hours or 

more at a time), and things were 

coming together the night before 

the spacewalk. Almost. The team 

struggled to get the final procedures 

on board, the console positions in 

mission control were not feeling 

ready, and the team working the 

repair EVA details was exhausted. 

The flight directors involved 

recognized these clues as “links in 

the error chain” building up. Accident 

investigations often point at links 

in the error chain where a series of 

events led to the accident—if any 

one event had been recognized and 

stopped, the accident could have been 

prevented. In this case, the team was 

not meeting all of the deadlines, and 

people were heads-down writing the 

details to the point of not looking 

ahead to keep important big-picture 

issues in mind. Flight controllers 

might have pulled off the EVA that 

Friday, but that sick feeling that 

everything was not under control 

meant an error chain was perhaps 

developing. The team needed one 

more day. The flight directors 

and program management agreed 

to move the EVA from Friday to 

Saturday. This meant the array had 

to be repaired on a single EVA—no 

falling back on a second EVA since 

there would not be time for a followon EVA before the shuttle would 

have to undock with its remaining 

consumables to make it home. 

Flight Day 11 

(Friday, November 2)

With the EVA now scheduled for 

Saturday, the final conferences 

were conducted on Friday with the 

crew to discuss the repair details 

and robotics. EVA crew members 

had procedures on board that they 

printed out and taped to their cuff 

checklist so that Parazynski would 

have a graphic representation of 

where he would install the cufflinks 

(Figures 17-19). Tani and Wilson 

would be the station robotics crew 

members, and they had procedures 

on board and were feeling ready. 

The general order of events was to be 

as follows:

1. The IV crew would robotically 

position the tip of the boom near 

the port side of the truss, ready for 

the EV crew.

2. The EV crew would install the 

WIF Extender and a foot restraint 

onto the tip of the boom, and 

Parazynski would put his feet into 

the foot restraint.
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 325

3. The IV crew would robotically 

move Parazynski to the damage 

while Wheelock translated 

“free-float” (i.e., using his hands, 

grabbing handrails) to the base 

of the array to help provide 

clearance calls to Parazynski 

about his distance to the array.

4. Parazynski would install the 

first cufflink to carry some 

load in case the array started 

moving significantly.

5. Parazynski would clear the snag 

using his best judgment by pulling 

parts of it free using pliers, flicking 

small parts using a spatula, or 

trimming a hinge wire. Among 

other tools, he had with him a pair 

of borrowed Russian cutters called 

“dinocutters,” due to the dinosaurlike shape of them.

6. Only if necessary, Parazynski 

would cut out the snag by cutting 

the long vertical guidewire and 

allowing it to retract into a spooled 

reel at the base of the array 

where Wheelock would ensure 

a good feed into the reel. There 

was a concern that it would have 

trouble reeling in and snag some 

more; therefore, the team had 

contingency procedures developed 

in case of additional loose wire to 

deal with. After the snag was in 

Parazynski’s trash bag, this would 

leave the top of the guidewire free, 

which was deemed acceptable. 

7. Parazynski would shape the array 

back into a loosely accordion shape.

8. Parazynski would install the other 

four cufflinks.

9. Mission Control would command 

the array deploy very slowly 

with the crew watching (and the 

helmet camera sending back live 

in-situ video).

Upper Blanket 

Box 

Lower Blanket 

Box 

Cut Hinge Wire as req’d –

Leave ~ 8 inches of wire

protruding from Hinge

Guide Wire

Stbd

Port

Upper Blanket 

Box 

Lower Blanket 

Box 

After the Hinge Wire has been 

cut and crimped, 

fold the blanket at the large 

damage site back in place

Crimp Hinge Wire

~ 6 inches from Hinge

Crimp Hinge Wire

~ 2 inches from the end

Guide Wire

Stbd

Port

Figures 17. High-level instructions sent to the crew based on the imagery available. Detailed 

procedures were also sent up. 
326 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

WARNING

WARNING

WARNING

Minimize contact between metal array components and exposed damaged solar cells on active side. Note

some sparking may be expected.

Avoid contact with solar panels except with insulated tools.

Sharp edges likely present at damage locations.

1. Verify glove gauntlets cover wrist disconnects

1. Sharp edges:

a. SABB (skirt, swing bolts)

b. Solar cells

c. Springs along tension bar

d. Panel hinges

e. Guide cable burrs or frays

f. Mast Canister roller guides

g. Braided cables

h. Fastener exposed threads

i. Exposed bolts in rib cavities on mast canister

2. Shock hazard:

a. Avoid EMU contact with FCC and Kapton part of solar array panels

b. EV crew will only contact energized surfaces with approved tools that have been insulated with 

 Kapton tape to prevent molten metal and shock

c. Solar array to be manipulated will be shunted prior to EV crew entering worksite

3. Pinch:

a. Lower SABB exposed reels and pulleys (guide wire and tensioning mechanisms)

b. Solar array mast during deploy/retraction

4. Avoid inadvertent contact with:

a. SSU, ECU, beta gimbal platform, mast canister, SAW blanket boxes unless the beta gimbal is

 locked and the motor is turned off

Figure 18. 

Detailed warnings sent up 

to crew to study in advance 

of the EVA. 

(SABB = Solar Array Blanket Box; 

EMU = Extravehicular Mobility Unit; 

FCC = Flat Collector Circuit; 

SSU = Sequential Shunt Unit; 

ECU = Electronics Control Unit; 

SAW = Solar Array Wing)

Upper 

Blanket Box

STBD

PORT

Lower

Blanket Box

Small

Damage

Cuff#1-

Medium

STIFF#1

STIFF#2

STIFF#3

STIFF#4

STIFF#5

STIFF#6

40

39

38

37

36

35

34

33

32

Cuff#2-

Short

Cuff#3-

Long Cuff#4-

Short

Cuff#5-

Medium

Large

Damage

EV1 EVA 4 Cuff Checklist – Page 1

Figure 19. Graphics that the crew printed out on board and taped to Parazynski’s cuff checklist. He could look down at his wrist to make sure he knew 

exactly where each end of each cufflink was installed. The nomenclature “stiff” refers to strips of material called “stiffeners” that run the length of the 

blankets, somewhat helping to rigidize the array. These and the bay numbers 32 through 40 were there to help the control center and crew have a common 

nomenclature if they noted an issue with a particular area. None of the bay numbers were physically marked on the arrays. 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 327

Flight Day 12 

(Saturday, November 3) – 

Solar Array Repair 

Extravehicular Activity Day

The EVA was pretty spectacular.

When the EVA crew members went 

out to the truss, they found the boom 

was fairly stable (Figure 20). The tip 

was positioned farther from the truss 

than it would normally be so as to not 

impact the truss, which created some 

challenging moments. The EVA crew 

members had to assist each other in 

getting back and forth to the tip, even 

crawling on one another’s backpack 

for reach (showing that even when 

meticulously planned, the crew and 

flight control team still need to adapt). 

The WIF Extender on the tip of the 

boom resulted in some flex, but the 

crew found it manageable.

Space Station Remote 

Manipulator System 

(SSRMS)

Orbiter Boom 

Sensor System Worksite Interface 

Extender 

(WIF Extender)

Figure 20. Parazynski riding on the OBSS—“the boom”—to perform the array repair. The boom 

is grasped by the ISS robotic arm. The other end of the arm is grasping part of the Mobile Remote 

Servicer Base System on the truss. This photo was taken by the crew inside the ISS, whose main task 

at this time was operating the arm and monitoring the EVA crew. Wheelock is not shown in this photo 

because he is translating along the truss structure using his hands. 

Figure 21. Parazynski is being hoisted to the repair site, approximately halfway up the array. 

Wheelock is at the base of the array, looking up to give clearance calls so the loose array would not 

come in contact with his crewmate. 

Parazynski had an incredible 

40-minute ride to the damage site, 

with sweeping views of the ISS from 

a distance. Upon arrival, he described 

the damage for the ground team and 

called it a “hair ball.” Based on this 

description, the team knew it would 

require the more complex of the 

repairs envisioned, and he would 

have to cut the long guidewire. 

When it came time to cut the

guidewire, the video was not 

transmitting to the ground due to 

blockage of the Ku-band antenna 

(see Chapter 13). While the Mission 

Control team held its collective 

breath, Parazynski cut the wire and 

Wheelock controlled the speed as 

it zipped into the reel at the bottom 

of the array. When Wheelock 

reported the array had successfully 

retracted, the team in the control 

center literally cheered. 
328 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

Figure 22. Parazynski, partway through 

the repair. Three of the five required cufflinks 

are installed.

Figure 23. Parazynski is watching the array unfurl and photographing the final state of the cufflinks 

(top right) after performing the repair. The control center watched the repair sites during the array 

deploy to determine whether the repair was working. The control center view was from a video camera 

mounted on Parazynski’s helmet. 

Figure 24. The repair was successful in bridging the gaps in the array, with the white cufflink cords 

holding together the pieces so the hinge areas did not zipper open any further. 

The cufflinks installed pretty easily, 

thanks to a good ground design 

and build-up by the crew. But the 

installation into the upper holes 

required more reach than the robotic 

arm possessed. Some truly tense 

Mission Control moments occurred 

when the arm was stretched as far as 

it could go, yet Parazynski needed to 

go a little bit higher even though he 

is a tall individual. This situation felt 

like a simulation in Mission Control 

when instructors throw a really hard 

malfunction in to see if the flight 

controllers sweat. In the end, the 

ground agreed to have Parazynski 

pull the upper part of the array 

down some using his tools, thereby 

allowing him to install the upper 

end of the cufflinks. Figures 21-25 

show the view on the ISS during the 

spacewalk, whereas Figure 26 shows 

the activities going on inside Mission 

Control during the EVA.
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 329

Figure 25. This photo of Parazynski just after cufflink installation was taken by Wheelock, who was at the base of the array. The cufflink repairs are the 

white cords partway up the array. 

A B C

D E

Figure 26. Photos of Mission Control during 

the EVA. (A) Flight Director Derek Hassman 

leaning on console, with Capcom Steve Swanson. 

(B) Some Team 4 key players: (left to right) Flight 

Director Annette Hasbrook, astronaut Joe Tanner, 

EVA specialist John Ray, and Mission Evaluation 

Room manager Becky Tures. (C ) Robotics officer 

Sarmad Aziz. (D) (left to right) Flight Surgeons 

Dr. Sean Roden and Dr. Robert Haddon, 

Biomedical Engineer Chris Goetter, and EVA 

officer Dina Contella (2 years later, Contella was 

selected as a flight director). (E ) (left to right) 

Electrical Power experts at the PHALCON position, 

Tamara Cougar and Scott Stover (2 years later, 

Stover was selected as a flight director). 
330 CHAPTER 18 DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A

The team predicted the EVA would 

be fairly long. The EVA team in 

the control center had to balance 

reserving the consumables of the 

spacesuit with the criticality of 

having Parazynski (and his helmet 

camera) watch deploy of the array. 

After a lot of discussion about the 

suit consumables while Parazynski 

cut the guidewire and installed the 

cufflinks, the team decided enough 

spacesuit consumables remained 

to have the EVA crew watch as the 

array successfully deployed. The 

spacewalk ended up with a duration 

of 7 hours 19 minutes, which was 

not too exceptional, due to quick 

work by the crew to clean everything 

at the end of the EVA. The crew 

even managed to retrieve the two 

suspect foot restraints so that 

they could be inspected inside for 

sharp edges. 

The tools worked great, and 

Parazynski used the hockey stick 

like his “best friend” to keep the 

array at a safe distance. During the 

EVA, a pair of needle nose pliers 

was lost overboard (i.e., floated 

away from the ISS) due to the way a 

tether line was routed. However, the 

Trajectory Operations Officer quickly 

analyzed the trajectory of the tool, 

and determined the pliers did not 

pose a risk for coming around and 

hitting the ISS on a later orbit. Weeks 

later, the team discovered during 

video review that another tool had 

been lost—the Russian dinocutters. 

This loss was not noticed during the 

mission, which is unusual. The crew 

and ground team missed doublechecking the presence of this tool 

during the post-EVA tool review, 

probably due to the last-minute 

nature of the activity and the need 

to focus on the end of the mission 

and shuttle undocking. Also, a 

camera did not work on that EVA. 

The camera had the same signature 

as the camera failure on EVA 2, 

which was later theorized to be a 

blanket holding down the shutter 

button and draining the battery. The 

boom sensors had been unpowered 

around 9 hours, but a checkout later 

confirmed they were working. 

The array deployed to its highest 

tension mode (i.e., the regular 

operational mode for the array) and 

rotated nominally. It was generating 

217 amps, which is 3 amps less than 

what would be expected normally. 

This was probably due to damage of 

some of the cells, but only a small 

fraction of the power generation 

capability had been lost. As of this 

writing, the array repair with its 

cufflinks has held together well for 

several years—a testament to those 

who worked so hard to put it in 

working order.

With this success, the shuttle could 

undock. The next EVAs were 

already being put on the plan for 

the ISS crew, including the deferred 

stage EVA that Whitson and 

Malenchencko were to perform after 

the shuttle departed. The European 

Columbus module ultimately flew up 

during the STS-122/ISS-1E mission 

in February 2008.

Looking Back

Adaptation was key. Before flight, 

the team meticulously pre-planned 

for three spacewalks (one of which 

was altered in flight to examine 

a failing truss rotary joint), then 

added a fourth and fifth spacewalk 

pre-mission, neither of which was 

actually executed during that mission. 

That mission was altered by adding 

a new spacewalk in flight due to a 

major failure in a rotary joint. That 

spacewalk was not executed during 

the mission either. Ultimately, 

through an enormous effort by a large 

technical international community, 

flight controllers and engineers 

executed an entirely new spacewalk 

to repair a damaged solar array. 

Preparations for the unexecuted EVAs 

were not wasted, however. That hard 

work created a solid team that was 

able to change the spacewalks, in 

the moment, and execute them as if 

they had been planned and tested on 

the ground, preflight. Even though 

some additional risk was accepted for 

one of the most critical spacewalks 

done to date, the flight directors and 

mission management team ensured 

that the team was properly ready and 

no unnecessary risks were taken by 

the team or the crew.

In hindsight, a combination of factors 

came together in a perfect way to 

enable this success. For example, the 

Space Shuttle boom was available, 

enabling reach to a distant place that 

would not have been possible before 

the Columbia accident decisions 
DAY IN THE LIFE: RISKY AND REWARDING SPACEWALKS—SPACE SHUTTLE MISSION STS-120/ISS-10A CHAPTER 18 331

that led to flying a boom for shuttle 

repairs. Additionally, a history of 

smaller but also critical past solar 

array deploy issues seasoned the 

electrical power and EVA teams, 

readying them in advance for this 

incredibly daunting challenge. A 

skilled robotic and EVA crew, strong 

leadership on board the shuttle and 

ISS as well as on the ground, and 

experienced flight controllers in 

Mission Control were all contributing 

factors in this success. These factors 

were not “dumb luck.” NASA and 

Flight Operations spend a lot of time 

preparing for the unforeseeable. Even 

in the best of conditions, factors do 

not always come together, which 

is why this team was relieved and 

exuberant with the outcome. 

It had been an incredible spacewalk 

and mission. Cheering had erupted in 

Mission Control, and the celebration 

was well earned. However, the next 

spacewalk by the ISS crew was only a 

few days away, which meant the team 

would soon get back to business.

Chapter 19 Systems: 

Environmental 

Control and 

Life Support System—

Supporting the 

Human Element 

of the International 

Space Station
334 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

Astronauts drink water that has been recycled from urine and sweat on the International Space Station.

If Command & Data Handling is the 

brains of the International Space 

Station (ISS), the Environmental 

systems are the heart and lungs of 

the vehicle. 

Adding humans to a spacecraft brings 

a significant overhead in terms of 

life support. An atmosphere must be 

provided for humans to survive in the 

harsh frontier that is space; living in a 

space suit would be neither practical 

nor supportable for any significant 

amount of time. 

A fundamental aspect of the 

ISS is to provide a shirtsleeve 

environment in which astronauts 

can conduct research. To this end, 

the Environmental Control and 

Life Support System (ECLSS) 

provides a breathable atmosphere at 

a normal atmospheric pressure. This 

means the system provides oxygen 

(O2

) and nitrogen (N2) at the same 

ratio as on Earth while removing 

contaminates such as carbon dioxide 

(CO2) and other impurities in the 

gas. As on Earth, water is the most 

critical consumable after O2. Water 

is required for survival, rehydrating 

food, bathing, and waste removal. 

Early space stations such as Skylab 

required the astronauts to carry with 

them all the gas and water, which 

were consumed. On the United 

States On-orbit Segment (USOS), 

the goal is to recycle and generate 

as much of these commodities in as 

closed loop as possible. For example, 

drinking water turns into perspiration 

and urine. In turn, sweat is collected 

out of the atmosphere by a 

dehumidifier while urine is separated 

from other waste and stored. The 

sweat and urine are then carefully 

processed back into drinking water. 

These types of technologies and 

processes will need to be well 

established and reliable if humans 

are to travel to Mars.

The ISS life support system is 

designed to handle seven crew 

members routinely and can support 

a surge of up to 11 for a brief period 

of time. Pressure on the ISS is 

normally maintained between 724 to 

770 mm Hg (14.0 to 4.9 psi), which 

is equivalent to what is experienced 

around sea level on Earth. For 

crew comfort, temperatures are 

maintained at 22oC to 26oC (72oF to 

79oF). Humidity can be controlled 

to whatever level is desired, but it 

is generally kept low (~45%) for 

crew comfort and to minimize water 

condensing on critical surfaces of the 

space station.

The Environmental and Thermal 

Operating Systems (ETHOS) 

flight controller is responsible 

for monitoring these systems 

continuously; ETHOS carefully 

tracks O2

, CO2, and every drop of 

water. Many of these same systems 

are found on the Russian Segment 

(RS); therefore, careful coordination 

is required between the two teams. 

Since most emergencies (i.e., fire, loss 

of atmosphere, chemical spill) affect 

the atmosphere, ETHOS has one of 

the most critical jobs on the flight 

control team: emergency response. If 

any of these problems occur, ETHOS 

guides the flight control team and 

astronauts through the procedures, 

thereby ensuring crew safety. Of all 

the areas in which the flight control 

team trains, emergencies get the 

most attention. Fortunately, to date, 

no serious problems have occurred, 

mainly due to the vigilance of the 

ETHOS team.
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 335

Atmosphere Control 

and Supply/Atmosphere 

Revitalization

On the ISS, O2 and N2 levels are 

maintained to values typical of those 

on the surface of Earth at sea level. 

Dry air consists of about 78% N2

and 20% O2, by volume. Human 

respiration takes O2 into the lungs, 

which is absorbed in the body, and 

releases CO2; gaseous N2, being 

inert, is not consumed in the process. 

Hypoxia, and eventually death, will 

occur if the O2 levels drop too low. 

In certain cases, humans can survive 

for limited intervals with lower 

levels of O2

. The O2 level may be 

dropped to the equivalent altitude 

of 3048 m (10,000 ft) for up to a 

day in a contingency. As the crew 

members breathe, O2 levels need to 

be replenished over time. In a perfect 

system, N2 would never need to be 

resupplied; however, a small amount 

of leakage occurs on the ISS, as 

well as lost gas, when vestibules are 

depressed to allow vehicles to depart, 

thus necessitating replenishing. 

It is important to keep the level 

of O2 high enough for the crew to 

adequately breathe, but not so high 

as to create a flammability risk, as 

O2 is a highly flammable gas. If the 

concentration of O2 is kept lower 

than approximately 24%, the risk of a 

spark causing a combustion event is 

fairly low at the atmospheric pressure 

on the ISS. Short-term exceptions 

are allowed during preparation for 

spacewalks (see Chapter 17).

Two ways to get these critical gases 

on the ISS include delivering the 

gasses in a tank or generating them 

in situ. Various vehicles—Russian 

Progress, European Space Agency’s 

Automated Transfer Vehicle, Space 

Shuttle, Japan Aerospace Exploration 

Agency’s H-II Transfer Vehicle 

(HTV), Dragon, and Cygnus—

transport O2

, N2, or air (a mixture of 

N2 and O2) to the ISS. Progress and 

the Automated Transfer Vehicle have 

large storage tanks. A valve is opened 

for a predetermined amount of time 

to bleed some O2, N2, or air into the 

main cabin whenever the atmosphere 

on the ISS requires more gas.

Three O2

 tanks are situated outside 

of the airlock. One tank is used to 

resupply the atmosphere, whereas 

the second and third are primarily 

used for the Extravehicular Activity 

(EVA) Mobility Unit (EMU) (see 

Chapter 17) and are intended to be 

used only for the general atmosphere 

in an emergency. A fourth O2

 tank 

is stowed outside on the ISS truss. 

This tank can be accessed via an 

EVA, if the tank is required. The 

Dragon, Cygnus, and HTV vehicles 

can also bring up O2 and N2 tanks, 

which are called the Nitrogen and 

Oxygen Resupply Systems tanks. The 

tanks can either be vented directly 

to the cabin, as above, or be used to 

resupply the external O2 and N2 tanks 

outside of the airlock for future use.

Transporting O2

 to the ISS is costly; 

therefore, it is better to generate 

O2 in situ where possible. Both the 

USOS and the RS have generators 

that can produce O2

 from water using 

electrolysis, which is the process 

of splitting water molecules into 

hydrogen (H2) and O2 using electricity. 

Having two independent systems 

provides redundancy if one suffers 

a problem. The Oxygen Generation 

Assembly (OGA) (Figure 1) performs 

this task on the USOS.

Figure 1. Astronaut Dan Burbank works on the 

OGA during Expedition 30. 

Finally, O2

 can be supplied by the 

Solid Oxygen Generator where 

solid “candles” are burned, thereby 

producing O2 as a by-product. 

Candles have been used in places 

such as submarines for years. These 

candles are used in an extreme 

contingency case due to flammability 

risk (see Dragonfly, 1998). The 

ETHOS flight controllers monitor the 

O2 levels closely and work with their 

Russian counterparts to ensure the 

right levels are always available.

The Pressure Control Assembly 

(PCA) monitors the total pressure 

of the cabin air. Similar sensors are 

present in the Columbus Module and 

Japanese Experiment Module (JEM). 

Not only does the PCA measure the 
336 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

total pressure and trigger an alarm if 

the pressure gets too high or low, the 

PCA can automatically introduce O2

and N2 from the external tanks on the 

airlock. As discussed in Chapter 3, 

pressure above a critical limit can 

rupture the shell of the ISS, thereby 

introducing a catastrophic leak. 

Too low of a pressure can cause the 

astronauts to lose consciousness 

and die. If the pressure gets too high 

(>777 mm Hg or 15.03 psi), the PCA 

uses its Vent and Release Assembly 

(VRA) to release gas outside of the 

spacecraft. In case of a problem 

with the VRA, the Positive Pressure 

Release Assembly (PPRA) can also 

vent the atmosphere. The trigger 

point of the PPRAs (>778 mm Hg or 

15.05 psi) is set higher than the PCA 

and would only vent in a significant 

emergency. The PPRAs are 

essentially large vents on the ISS, 

and they can release about 68 kg/hr 

(~150 lbs/hr) of gas. These might also 

be used in an emergency response 

(see below). However, the flight 

control team monitors the atmosphere 

closely since any gas that is vented 

is a waste of a critical commodity. 

Similar devices are present in the 

Columbus Module and JEM.

Careful measurement of the O2

 and 

N2 quantities in the atmosphere is 

required for the PCA or the ETHOS 

flight controller to know whether 

either levels need to be adjusted. 

Composition of the atmosphere is 

measured by the Major Constituent 

Analyzer (MCA). The MCA consists 

of a mass spectrometer that can 

measure O2, N2, CO2, H2, water, and 

methane in the atmosphere. The 

USOS is lined with tubes that make 

up the Sample Delivery System 

(SDS). The MCA draws in a small 

sample of atmosphere from each 

module and measure the constituents. 

An alarm will be annunciated if any 

component is outside of the expected 

limits. If this occurs, the MCA will 

repeatedly sample the atmosphere in 

that module so the crew and ground 

can monitor the situation. Otherwise, 

the system will move on to the next 

module and keep cycling.

Several handheld devices can also 

be used to measure atmospheric 

contaminants. These devices 

consist of the Carbon Dioxide 

Monitor (CDM), the Compound 

Specific Analyzer-Combustion 

Products (CSA-CP), and the Chip 

Measurement System (CMS). See 

Figure 2. All three devices work 

essentially the same way by pulling 

in cabin air and measuring the 

constituents. The CDM is mainly 

used in situations when a localized 

area needs to be monitored; e.g., if 

a crew is working in an area where 

ventilation is poor. The CSA-CP 

is the main tool to determine the 

constituents of smoke or whether 

there is a fire inside of a rack. 

It measures the levels of carbon 

monoxide, hydrochloric acid, and 

hydrochloric cyanide—typical and 

dangerous by-products of a fire for 

the type of materials used on the 

ISS. The CSA-CP has a long tube 

attachment that can be inserted 

into holes in the racks to measure 

the presence of smoke that may 

not be visible. Finally, the CMS 

on the USOS measures ammonia, 

whereas the Russian CMS detects 

formaldehyde, benzene, styrene, 

ozone, phosgene, carbon monoxide, 

ammonia, and nitrous fumes. 

After O2

 and N2, CO2 is the nextbiggest atmospheric concern. Even 

low levels of CO2 can impair the 

mental acuity of an astronaut, 

especially if the exposure occurs 

over a long period of time. The 

amount of a gas is measured in 

terms of partial pressure, which 

is the amount of the pressure that 

a specific gas contributes to the 

total pressure. The average partial 

pressure of CO2

 at the surface of the 

Earth is less than 1 mm Hg, or about 

one-tenth of a percent of the total 

pressure. On the ISS, the level is 

maintained to be less than 4 mm Hg 

and is typically around 3.5 mm Hg. 

Some astronauts reported headaches 

when the levels went above this 

amount. Exposure to values above 

20 mm Hg can lead to headaches, 

increased respiratory rate, reduced 

performance decrement, and possible 

depression of the central nervous 

system. Recent research may also 

indicate that a person’s sensitivity 

may change in weightlessness. The 

primary way of removing CO2 on 

the USOS is via the Carbon Dioxide 

Removal Assembly (CDRA). See 

also Figure 3. A similar device is 

located on the RS. In the event of 

failure, the crew can load Lithium 

Hydroxide (LiOH) canisters into 

a fan assembly to filter the CO2

as a backup. The LiOH canisters 

absorb CO2 in a chemical reaction. 

However, this is a contingency plan 

only, as it uses a non-regenerative 

consumable. Even maintaining low 

levels is not adequate to keep crew 

members healthy. Gravity causes 

warm gases to rise and cooler ones 

to sink. This helps mix atmospheric 

gases, dispersing those such as 

CO2

. In the absence of gravity, 

fans are needed to perform this 

function on the space station or as 

an astronaut breathes in one place, 

since a local pocket of toxic gas can 

build up. The ventilation on the ISS 

is designed to keep levels of CO2
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 337

uniform. This is even more critical 

in the small phone-booth-sized crew 

quarters where crew members sleep. 

Therefore, redundant fans and an 

alarm system are present in those 

units to ensure the health of the 

sleeping astronaut.

~6”{

Figure 2. CSA-CP (left) attached to the wall of Node 1 and CMS (right). For the CSA-CP, the metal detector (gray), which is about 15 cm (6 in.) in length, 

is placed in the black holder that pumps air in through a tube, which is currently connected to a long rod that can be inserted into racks. 

A CDRA is located in both the 

Laboratory module and Node 3 

module, though only one at a time 

is usually operating. Note that it is 

not practical to operate both CDRAs 

simultaneously to lower the CO2

level further. The CDRA consumes a 

significant amount of power (around 

1 kW) and generates a significant 

amount of heat. Operating a second 

unit can lower the level further, but 

at the expense of wearing out sooner. 

The CDRA is actually two sets of 

filter bed systems that alternately 

operate one set to purify the air 

while the other is being cleaned. Air 

is first pulled into the CDRA from 

the Common Cabin Air Assembly 

(CCAA) over a bed of desiccant to 

remove humidity. The desiccant bed 

uses silica gel and zeolite, and is 

similar to the small packets found 

in food products or shoes. Drying 

the air allows the next filter bed, 

an absorbent material, to remove 

the CO2

 more efficiently. The air 

is then pushed through a second 

desiccant bed that was previously 

used to remove water vapor and 

therefore contains excess water. This 

actually rehydrates the air a little 

before it reenters the cabin. After a 

while, the absorbing bed becomes 

saturated and can no longer remove 

the CO2. At this point, it is taken 

out of the air flow and heated to a 

high temperature, which causes the 

trapped CO2

 to be released. Released 

CO2 is either vented to vacuum 

or piped over to the Sabatier (see 

below). The second set of desiccant 

and absorbent beds remove CO2

while this bake-out is occurring, 

and the cycle keeps repeating.
338 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

Catalytic

Oxidizer

Temp Sensor

RPS

Fan

SD

MCA

RPCM

TCCS

CDRA Charcoal

Bed

Assembly

Figure 3. CDRA and the TCCS in the Atmosphere Revitalization Rack—schematic (left) and actual rack before launch (right). Also seen in the drawing 

are the MCA, the Remote Power Control Module (which powers the rack), and a fan that helps blow smoky air over the smoke detector to determine the 

presence of fires as well as to provide cooling. The Rack Power Switch allows the crew to power off the entire rack quickly in the event of a fire.

Another tool in keeping the air 

clean is the Trace Contaminant 

Control System (TCCS). The TCCS 

(Figure 3) can remove most of the 

more than 200 possible contaminants 

on the ISS, including hydrocarbons, 

ketones, silicones, aldehydes, sulfides, 

and inorganics. The TCCS works 

mainly by pulling air through various 

filter beds that consist of activated 

charcoal, a catalytic oxidizer, or 

LiOH. The TCCS can even absorb 

small amounts of ammonia, but it 

would be inadequate in the event of 

an Interface Heat Exchanger (IFHX) 

breach. Once the filters have absorbed 

as much contaminants as they can 

hold, they are disposed of and new 

ones are installed.

After providing the crew with the 

proper atmosphere needed to live and 

work, the next priority of the ECLSS 

is to offer support for scientific 

payloads. Nitrogen lines are plumbed 

throughout the Laboratory module 

and can be fed into payload racks. 

Nitrogen is usually used to purge 

some other gas from an experimental 

rack, but nitrogen may have other 

uses determined by the researcher. 

Also, two types of vacuum lines are 

available for the payloads. One type 

is the Vacuum Resource System 

(VRS), which is an open line to 

space. Although the space around the 

ISS is not a perfect vacuum, owing 

to small amounts of gas (mostly O2), 

the pressure is about 10 to 100 billion 

times lower than at the surface of the 

Earth and is as good or better than 

the best vacuum chambers on Earth. 

If an experiment requires vacuum to 

operate, it would be connected to this 

system to allow a constant vacuum, 

as needed. This will occur after the 

experiment itself has undergone 

careful analysis to ensure it cannot 

easily leak. If an experiment uses 

chemicals or gasses that need to 

be removed after a trial run (e.g., 

during combustion research), these 
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 339

can be removed by hooking up to the 

Vacuum Exhaust System (VES)—a 

similar line running to space. One 

key difference in the VES is that 

the opening to space is directed 

away from any important structure; 

therefore, residue doesn’t build up on 

critical surfaces. The VES also has a 

diffuser attached so that the escaping 

gas imparts no particular thrust.

A final component of the atmospheric 

control system is the Intermodular 

Ventilation (IMV) shown in 

Figure 4 for Node 2. The IMV 

system is basically a bunch of air 

ducts plumbed around the USOS 

to exchange air between modules, 

thus allowing for good mixing. It is 

critical to mix the O2 generated by 

the OGA; this will allow the crew 

to breathe and will prevent pockets 

of toxic CO2 from forming, as noted 

above. Fans push the air between 

modules through the ducts, whereas 

intramodular air circulation occurs 

within the individual modules via 

the cabin fan or CCAAs. The IMV 

system can recirculate all the air 

inside the ISS in about 2-3 hours. In 

the case of a fire or chemical spill, 

IMV fans are shut off and IMV valves 

actually close to prevent further 

mixing of anything bad throughout 

the vehicle. The hatch can be closed 

to completely isolate a module in the 

event of a serious emergency. The 

pressure on both sides of the hatch 

needs to be the same when opened; 

otherwise, the crew will be unable to 

move it. Even a pressure differential 

of only 0.3% of that at sea level—a 

differential too small for a human to 

detect—can make it impossible to 

open a hatch because the hatch area is 

so large. Therefore, Manual Pressure 

Equalization Valves (MPEVs) are 

located on the hatches to allow the 

air to balance out before opening the 

hatch. An example of the IMV system 

is shown in Figure 4.

Lab IMV Interface

Node 2 Air

Columbus IMV Interfaces

JEM IMV Interfaces

Overhead IMV Interfaces

Forward IMV Interface

Deck IMV Interface

Inactive

IMV Aft 

Starboard Valve

IMV Aft 

Port Valve

IMV 

Starboard 

Aft Valve

IMV 

Starboard 

Forward 

Valve

CCAA Fan 

Assembly

IMV Port 

Aft Valve

IMV 

Overhead 

Forward 

Valve

IMV Port 

Forward 

Valve

IMV Deck 

Forward 

Valve

IMV Deck 

Aft Valve

IMV 

Forward 

Port 

Valve

IMV 

Forward 

Starboard 

Valve

IMV 

Overhead 

Aft Valve

Nadir

Zenith

Aft

Starboard

Port

Forward

Figure 4. An example of the plumbing for the IMV. In this case, for the Node 2. The forward port valve is at the front of the module, whereas the after 

port valve is at the far end, approximately 7.2 m (~24 ft) away. The CCAA is approximately in the middle of the module. Arrows show the flow of air into 

and out of the CCAA. 
340 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

Temperature and Humidity 

Control

Not only does the crew need to 

be comfortable, some equipment 

requires the air in the ISS to remove 

excess heat (i.e., air cooled). 

CCAAs in the Laboratory, Node 2, 

Node 3, and airlock, and similar 

air conditioners in the International 

Partner modules, circulate, cool, 

and dehumidify the air. The CCAAs 

are connected directly to the IMV 

ducting (Figure 4). The ducting 

passes air between all the modules to 

ensure uniform mixing.

Air is pulled into ducts that feed the 

CCAAs and passes through High 

Efficiency Particulate Air (HEPA) 

filters, in the same way as household 

systems do on Earth. Although the 

crew and spacecraft are kept as clean 

as possible on the ground, a fair 

amount of particulates are present 

on the ISS. These filters have to be 

vacuumed fairly regularly since, in 

microgravity, objects collect on the 

inlet of vents and not on the floor. 

This process also acts as a handy 

way to find missing items—e.g., lost 

screws, misplaced washers, small 

tools, or even a pack of gum or a fork.

A fan pulls the air in through the 

HEPA filter and past the Condensing 

Heat Exchanger (HX). The air passes 

over metal layers that are cooled by 

water from the Low Temperature 

Loop (see Chapter 11). When air hits 

the cool plates, the water condenses 

on a plate where it is drawn into 

small holes and separated from the 

air. The cooler and dehumidified 

air is then vented directly into the 

cabin. If the crew members want the 

air temperature to be warmer, they 

(or the ETHOS flight controllers) 

can command the system to slightly 

close doors within the ducting of the 

fan, which reduces the amount of air 

passing over the cooler plates. For 

a cooler cabin, the doors are opened 

more fully, thus more air is passed 

over the plates. 

Since air is used to push the water 

into the collection holes, a mixture of 

water (~90%) and air (~10%) comes 

out the other side. The water enters 

a small centrifuge. As the centrifuge 

spins, the heavier water is pulled out 

from the air. The water is then routed 

to the condensate tubing where it can 

go either to a big condensate tank for 

storage or into the Water Processor 

Assembly (WPA).

Why do we process the urine on the ISS 

instead of taking up fresh water?

The basic answer is cost. Six crew members produce about 9 kg (~20 

lbs) of urine a day. About 70% of that, or 7.7 kg (17 lbs), is processed into 

water. In 2015, it cost about $25,000 to launch 0.5 kg (1 lb) of water to the 

ISS. This translates into approximately $425,000 of cost savings per day, or 

more than $155,125,000 a year in water that doesn’t have to be launched.

Table 1. Types of Water in use on the ISS

Type Use

Potable Water Drinking water via the Russian systems for the crew containing a 

silver-biocide to retard microbial growth and minerals for taste.

Technical Water Contains silver-biocide to retard microbial growth and is used 

for crew hygiene, Russian toilet flush water, and in the Russian 

O2

 generator to produce O2.

Condensate Water recovered from the atmosphere, which is processed back 

into potable water.

Waste Urine or water that was used in the EMU (see Chapter 17).

Special Fluid Water used for the internal cooling system or other uses, and 

which may contain chemicals to retard biological growth or 

chemical reactions and cannot be used for drinking.

Iodinated Similar to technical water but with iodine biocide; this type of 

water is used in the USOS water systems for toilet flush, the 

OGA, and, when stripped of iodine, the crew drinks it.

Water Recovery and 

Management

As on Earth, water is a precious 

commodity in space and, therefore, 

is managed carefully by the flight 

control team. Water is transported to 

the ISS by one of the various cargo 

vehicles. The six types of water on 

the ISS are listed in Table 1. One of 

the key functions of ETHOS is to 

track the various quantities of water 

to ensure an adequate amount of each 

type. This section will discuss the life 

cycle of water on the ISS, which is 

depicted in Figure 5.

As mentioned in the previous section, 

condensate water from the USOS 
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 341

ARFTA – Advanced Recycle Filter Tank Assembly

CCAAs – Common Cabin Air Assemblies 

CDRA – Carbon Dioxide Removal Assembly 

CWC – Contingency Water Container 

EDV - Russian Water Container

EMU – EVA Mobility Unit 

OGA – Oxygen Generation Assembly

Urine Plumbed to UPA

Crew and Hygiene

Condensate

Sabatier

Product Water

Condensate 

from CHX

Payload

Condensate

OGS Reject Water

(iodinated)

Flush 

from N3 CDRA

EDV

(22L)

Waste and 

Hygiene 

Compartment PWD

CWC (20L)

PWR EMU

CCAA

CWC

Payloads

Waste Water Bus

Potable Water Bus

UPA

ARFTA

Urine Processing

Assembly

Water Delivery ORU

Waste Water

Processing

Urine

Processing

SM

EDV-U

(22L)

Archival

Sample

Waste Water Bus

Water Processing

Assembly

WPA

Water

Storage

Tank

(56L)

Condensate

Tank (45L)

WPA

Waste 

Water

Tank

(45L)

OGA

Sabatier

O2

CH4

H2

CO2

Crew

Consumption

EMU Waste Water

UPA

WSTA

(13L)

ORU – Orbital Replacement Unit

PWD – Potable Water Dispenser

PWRs – Payload Water Reservoirs 

UPA – Urine Processor Assembly 

WHC – Waste and Hygiene Compartment 

WPA – Water Processor Assembly 

WSTA – Waste Storage Tank Assemble

Figure 5. A schematic showing the overview of the water processing system. Wastewater from the Waste and Hygiene Compartment (WHC) is transferred to 

the Urine Processor Assembly and the WPA. From the WPA, clean water is placed on the potable bus where it can be transferred to the O2

 generator, the crew’s 

drinking station (Potable Water Dispenser), or the Sabatier, or used for EVA Mobility Units or for flush water in the WHC.

is collected in the WPA wastewater 

tank. If the WPA wastewater tank 

is not available due to a failure, the 

crew can configure some jumpers 

and send the water to be stored 

in a condensate tank. If the tank 

gets too full, it is possible for the 

ETHOS flight controller to open 

a series of valves and vent some 

of the water overboard; however, 

this is a last resort, as it results in 

loss of this precious liquid. The 

crew would offload the water into 

a Contingency Water Container 

(CWC) (Figure 6) prior to being full. 

The CWC is essentially a flexible 

bladder surrounded by fireproof 

fabric material that can hold about 
342 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

Figure 6. A full CWC (left) and the “water wall” in Node 1 (right). Note that a CWC is about 61 cm (24 in.) long with a diameter of 24 cm (18 in.) and can 

hold about 43 liters (12 gal) of water. 

Wastewater Tank

Fluids

Pump

2

3

4

1

5

Urine from Waste and Hygiene Compartment

or Russian Water Container

Recycle Filter Tank Assembly

(Accumulates and stores brine for disposal)

Purge Pump

(Removes gases from

Distillation Assembly)

Coolant

(Promotes condensation

within Purge Pump)

Purge Gas

to Cabin

Separator

(Separates water

from Purge Gases)

Product water

to Water Processor

Assembly

Distillation Assembly

(Distills wastewater)

Figure 7. The Urine Processor Assembly schematic. Water comes from the waste storage tank to the Advanced Recycle Filter Tank Assembly and through a 

distillation process before gases are removed in the purge pump.
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 343

43 kg (~95 lbs) of water. Cargo 

vehicles such as the HTV can also 

deliver water using CWCs, which are 

then stored until they are processed 

by the WPA. Similar containers are 

available on the Russian side.

Additional wastewater comes from 

the Urine Processor Assembly 

(UPA) (Figure 7), which receives 

input from the Waste and Hygiene 

Compartment (WHC). A crew of six 

generates about 9 kg (20 lbs) of urine 

a day. Using flush water, the WHC 

sends the urine to the UPA (solids 

are retained in a tank to be disposed 

of later). Urine consists mostly 

of water but also contains many 

organic and inorganic waste products 

including urea, chloride, sodium, 

potassium, and creatinine. The urine 

is treated with a chemical, called 

pretreat, to prevent the urea from 

crystalizing and potentially plugging 

the plumbing lines. A filter also 

removes any particulates that are left 

behind. Once in the UPA, the urine 

is pumped to the distillate assembly 

where the temperature is raised and 

the pressure is lowered to cause 

water evaporation. This evaporated 

water is compressed back into liquid 

form and is passed along to the 

WPA for further processing. The 

remaining fluid, called brine, is sent 

to the Advanced Recycle Filter Tank 

Assembly (ARFTA) where multiple 

filters pull out any particulates as 

the brine is sent back to the distillate 

assembly where it joins with more 

pretreat urine and more water is 

pulled out.

Accumulator

To Potable

Water Bus

Delivery

Pump

Product

Water

Tank

From

Wastewater

Bus

Reject Line

(Allows reprocessing)

Mostly

Liquid

Separator 

(Removes air)

O2 from

ISS Low Pressure

To Cabin

To Cabin

To/from

Moderate

Temperature

Loop Microbial Check Valve

(Provides isolation)

Gas/Liquid

Separator

(Removes

oxygen)

Particulate

Filter

(Removes

particulates)

Multifiltration Beds

(Removes dissolved contaminates)

Reactor 

Health 

Sensor 

Regen. Heat 

Exchanger

(Recovers heat)

Reactor

(Oxidizes 

organics)

Pump

Filter

Wastewater

Tank

Preheater

(Heats water 

to 275°F)

Ion Exchange Bed

(Removes Reactor by-products)

Figure 8. Schematic of the WPA. Water is drawn from the wastewater tank and passes through a filter that separates gasses from the water since gravity 

isn’t present to facilitate natural separation. The water then passes through various filters including a heater to bake out impurities, a reactor to remove 

organics, and an ion exchange filter bed that will remove by-products of the organic reaction. Clean water is then stored in the product water tank.

The WPA is a key component of the 

water system on the ISS (Figure 8). 

First, water that is stored in the 

wastewater tank passes through a 

centrifugal pump called the Mostly 

Liquid Separator (MLS) similar to 

that used in the CCAA to remove 

air from the water. The water then 
344 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

passes through a particulate filter, 

followed by the Multi-Filtration 

Beds, which removes nonvolatile 

organics and inorganics such as 

soaps and salts. The water then is 

purified more in a catalytic reactor, 

which oxidizes low-molecularweight volatile organics (this process 

uses small amounts of the O2 that is 

stored in the tanks on the airlock). 

Next comes the gas separator, which 

removes gasses created during the 

oxidation process. This gas needs to 

be removed to avoid clogging the 

fine filters downstream that are used 

throughout the potable bus systems. 

This gas is returned to the cabin to 

be breathed by crew, thus preventing 

the waste of any O2

. Small amounts 

of iodine are added to the water 

to prevent microbial growth from 

occurring. This clean water is then 

output to the Product Water Tank 

where it can be fed to the potable 

water plumbing. Crews can extract 

water for drinking or rehydrating 

food via the Potable Water Dispenser 

(PWD) attached to this line. 

Wastewater from the UPA is also 

processed. People are often surprised 

that astronauts drink recycled urine. 

However, the processing is so good 

that what is left is virtually pure 

water. In fact, crew members have 

commented that the water tastes 

funny, which is actually a result of it 

being more pure than the water that 

is consumed on Earth. The OGA also 

uses the water from the potable water 

lines. The WPA can process 13 L 

(29 lbs) per hour.

Oxygen Generation Assembly Water Recovery System Rack 1 Rack 2

Power 

Supply 

Module 

N2 Purge

ORU

Deionizer

Bed

Sabatier

Reactor

Health

Sensor ORU

Particulate

Filter

Urine

Processor

Pumps

Gas

Separator

Catalytic

Reactor

Water

Processor

Pump and

Separator

Water

Processor

Waste

Water

Tank

MultiFiltration

Beds

Advanced 

Recycle 

Filter Tank 

Assembly

Distillation

Assembly

Waste 

Storage 

Tank 

Assembly

Product

Water

Tank

Pumps,

Valves

Firmware

Controllers

Electrolysis

Cell Stack

Water 

Processor

Delivery

Pump

Figure 9. Images showing OGA and the Water Recovery System racks.

As discussed above, the OGA takes 

water and produces H2

 and O2. Prior 

to the arrival of the Sabatier system, 

the H2 was vented overboard. With 

the arrival of the Sabatier rack in 

October 2010, the H2 would no 

longer be wasted. The rack takes 

H2

 and CO2 and uses a catalyst at high 

temperature and pressure to produce 

water and methane via a chemical 

reaction first discovered by chemist 

Paul Sabatier. No further processing 

of the methane is possible on the ISS, 

thus it is vented overboard.

Although water is processed in a 

nearly closed-loop fashion (i.e., 

little water is lost to the system), 

management of this process requires 

a lot of diligence by the ETHOS 

team. Various factors are always 

affecting the balance in the system. 

For example, some crews drink more 

water than others; individuals also 

perspire and urinate at different rates. 

If any of the systems experiences a 

malfunction, part of the processing 

loop stops and input backs up. 

ETHOS can also tune the system to 

adjust water balance. For example, 

the temperature for the Low 

Temperature Loop system can be 
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 345

lowered, which decreases the dew 

point on the station and, in turn, 

causes more water to condense out 

of the air. Another option would be 

to raise the temperature to reduce 

the amount of water collected via 

condensation. If the condensate 

tank is full but the WPA is not 

operating, the crew can drain the 

tank into a CWC, which later can 

be transferred back to the tank 

when it is empty. The OGA uses 

water to generate O2, which also has 

to be carefully balanced, thereby 

further complicating the process. 

The variables change often enough 

that water balance predictions are 

not accurate beyond 3 days in the 

future. Therefore, the ETHOS team 

must evaluate all these variables 

multiple times a day to ensure that 

the crews’ upcoming plan properly 

accommodates the water balance 

needs. The racks that make up the 

Water Recovery System and the OGA 

are shown in Figure 9.

Emergencies

In addition to maintaining life 

support, ETHOS must respond to 

emergencies. The three classes of 

emergencies on the ISS include fire, 

rapid depressurization (“depress”), or 

toxic chemical spill. 

Fire is a serious threat in space. In the 

event of a fire on Earth, one option 

involves quickly exiting a structure. 

By contrast, astronauts who live on 

the ISS can leave the station only 

as a last resort, given this results in 

the costly loss of vehicle utilization. 

Fire detection and suppression is 

part of the ECLSS. The first step 

in preventing fires is assuring the 

materials used on the ISS are fireretardant. Strict rules are enforced 

to ensure the space station contains 

nothing that is highly flammable. The 

most significant way to mitigate fires 

in space is to make it difficult for 

one to start; however, if a fire should 

occur, being in space helps. Fires in 

space are also difficult to maintain, 

due to weightlessness. On Earth, 

convection (the process of lighter, 

warmer air rising while cooler gas 

falls due to gravity) can replenish the 

consumed O2

, thus allowing the fire 

to continue to burn. However, in the 

absence of forced airflow in space, 

convection is nonexistent; once the O2

around a fire is consumed, the fire will 

extinguish. Therefore, electrical parts 

of the ISS are usually located behind 

panels where airflow is not possible. If 

a fire should start for some reason, it 

will likely extinguish itself.

Airflow

Obscuration 

 Photodiode

Beam Dump

Laser Diode

Lens

Hood

Second

Mirror

First

Mirror

Mirror Assembly

Slits

 Scatter 

 Photo-

 diode

Figure 10. Picture of a cabin smoke detector (left) and a schematic (right). Laser light bounces off of several mirrors into a photodiode detector. If particles 

of smoke are present, the beam will be obscured with a reduced brightness. Laser light will also scatter off the particles and into a second photodiode to 

ensure that a false alarm is not triggered by a single problem with the obscuration sensor.

However, an electrical or chemical 

fire can still occur in a location such 

as a systems/payload rack or in the 

open cabin where there is regular 

airflow; therefore, the fire won’t 

quickly extinguish. As a precaution, 

smoke detectors are placed throughout 

the ISS to alert the crew and flight 

controllers to a fire, much in the same 

way smoke detectors are used as a 

precaution on Earth. The detectors 

on the ISS are similar to many in 

terrestrial buildings. Laser light is 

monitored to see whether particles 

of smoke are blocking the light 

(Figure 10). Once smoke is detected, 

the software will automatically 
346 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

annunciate a fire and sound the alarms 

throughout the ISS and on the ground 

in Mission Control. In addition to the 

smoke detectors picking up the event, 

if the crew sees or smells smoke, 

they can manually trigger an alarm 

via the caution and warning panel 

(see Chapter 5). When an alarm is 

annunciated, one of the first responses 

is for the software to turn off all fans 

and close the IMVs to help stifle the 

fire and prevent smoke from being 

transferred to other modules.

If a fire is detected by the smoke 

detectors, the crew will need to 

quickly fight the fire. For a fire 

detected inside a rack, the crew can 

remove power to that rack instantly 

by throwing a switch called the 

Rack Power Switch. Astronauts will 

then use a long rod attached to the 

CSA-CP to measure the smoke within 

the rack for a period of time. If the 

CSA-CP readings hold steady or 

decrease, the fire is declared to be out. 

Readings that continue to increase 

means the fire is still ongoing and 

needs to be extinguished. In this case, 

the crew will use a Portable Fire 

Extinguisher (PFE)—i.e., an orange 

tank that contains about 2.7 kg (6 lbs) 

of CO2

—and a long thin nozzle 

pushed through one of the small holes 

in the front of the rack to put out the 

fire. See Figure 11. By emptying the 

PFE into the rack, O2 is displaced by 

CO2, thereby depriving the fire of a 

critical component needed to burn.

Figure 11. PFE with rack attachment nozzle (left) and open cabin nozzle (right). 

A wide nozzle that is installed on the 

PFE allows the crew to extinguish 

the fire in the event of visible flames 

inside the cabin. Smoke in the 

cabin can be dangerous to breathe; 

therefore, crew members will also don 

a Portable Breathing Apparatus (PBA) 

or a respirator (Figure 12). The small 

PBA tanks hold approximately 7 to 

15 minutes of O2

 (depending on how 

well the mask fits to the individual’s 

face as well as the personal respiration 

rate of the crew member); however, 

the hose can be attached to an O2

port within the USOS and can pull 

O2 from the O2 tanks on the airlock, 

if additional time is needed. Since 

the time for a PBA is so short, and 

because O2 is also introduced locally 

near the fire, use of the respirator 

is preferable. Once the fire is 

extinguished, the flight control team in 

Mission Control assesses the recovery 

to clean the air. If few combustion 

by-products were created, they can be 

dissipated throughout the entire ISS 

volume and cleaned up via the TCCS. 

If large amounts of the by-products 

were created, the crew would set up 

a fan attached to a various filters to 

clean up the smoke and by-products. 

CO2

 from the PFE can be cleaned 

using the CDRA if the CDRA is in the 

same or nearby module.

If sensors such as the PCA detect a 

decrease in atmospheric pressure, 

it is likely that the hull has been 

breached and the vital atmosphere is 

leaking out. In this case, the computer 

systems will annunciate a rapid 

depressurization emergency alarm. 

Alternatively, if the crew members 

feel their ears pop, they can initiate a 

manual rapid depressurization using 

the caution and warning panel. The 

crew will then follow the emergency 

response discussed below to locate 

and isolate or repair the hole. As 

crew members will be losing their 
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 347

atmosphere, they can find themselves 

in a situation in which they do not 

have enough O2 to maintain cognitive 

brain functions. If this occurs, 

they will don a PBA and isolate 

themselves in their return vehicle to 

prevent suffering from hypoxia—the 

result of not breathing enough O2.

Figure 12. PBA (left) and respirator with fire cartridges (right). Different filters (orange boxes on either side) are attached to the respirator when it is being 

used after a fire or a toxic spill release such as ammonia.

Toxic Atmosphere (ATM) represents 

the final emergency that the ECLSS 

supports, and which the ETHOS 

flight controller monitors. Various 

chemicals on the ISS are dangerous 

to the crew. Some of these chemicals 

range from mild irritants, such as the 

acid that can leak out of a damaged 

battery, to materials that can cripple 

or kill a crew member, such as the 

ammonia used for cooling. Except 

in the case of ammonia breaching 

the IFHX (see Chapter 11), there is 

no automatic annunciation of a toxic 

spill. The crew will detect it either 

from sight or from smell, and then 

annunciate the spill via the caution 

and warning panel. As was the case 

for fire, the IMV system is isolated 

to prevent the chemical from being 

dispersed throughout the ISS.

Cleanup response to a toxic spill 

depends on what was spilled. 

All hazardous materials—i.e., 

HAZMATs—are logged into a 

database that lists the toxicity of 

every chemical used on the space 

station. Some are benign, but others 

can be extremely deadly. The flight 

control team and crew look at the 

database to determine the toxicity 

of the spill and the appropriate 

response. Basic response supplies 

are found in the Crew Contamination 

Protection Kit (CCPK). Mild spills 

can be cleaned up with wipes and 

silver shield gloves, which prevent 

absorption into the skin. Dirty wipes 

and towels are put in multiple plastic 

bags and carefully sealed to contain 

the material. In a bad spill, the 

crew members will don a respirator 

(Figure 12) and use the CMS to 

determine the air quality. For a really 

bad spill, the module might have to 

be closed off. 
348 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

Emergency Response

The previous sections outlined the 

basic equipment available to detect 

or respond directly to one of the 

three emergencies on the ISS—fire, 

rapid depress, or toxic chemical 

spill. However, these emergencies 

require time-critical responses from 

the entire crew and ground, and are 

heavily practiced by both. The initial 

response is similar for all three: 

warn others, gather in a safe haven, 

and work the emergency response. 

To warn others means to push the 

appropriate caution and warning 

alarm if an automated one has not 

been initiated. This process is critical 

to alert other crew members, but it 

also allows automated software to 

stop fans and close the IMV system, 

thereby reducing smoke or toxic 

gas from spreading throughout the 

ISS. Communication is also critical 

between the crew and ground. In 

the case of an emergency, both the 

Russian and NASA mission control 

centers spring into action. The crew 

is primed for responding to these 

emergencies, but the ground helps the 

crew as much as possible.

Usually, the crew selects the location 

of the central post computer in the RS 

as the safe haven muster point. This 

is chosen because it is near the Soyuz 

vehicles, which might be needed for 

a quick evacuation if the situation 

is serious and cannot be resolved. 

If there are flames in the cabin 

between the crew and the Soyuz, the 

crew will create a safe haven away 

from the fire and then fight the fire 

as quickly and safely as possible. 

Crew members never want to be cut 

off from their escape vehicle. Once 

assembled, the crew will execute the 

appropriate response procedures, 

under the guidance of the commander. 

Generally, astronauts on the USOS 

use electronic procedures in English 

to perform their tasks, whereas 

cosmonauts use Russian procedures. 

However, emergency procedures are 

printed on paper—in what is called 

“the red book”—in case of computer 

or power problems. One page of the 

red book is in English and the facing 

page is in Russian so that any crew 

member can execute the steps under 

stress. One section of the red book is 

devoted each to fire, rapid depress, 

and toxic chemical spills. 

In the case of fire, the crew will 

begin by taking samples of the air 

in the safe haven with the CSA-CP 

to ensure the area is safe. Once 

safety is established, a team will 

usually go toward the fire, taking 

air samples along the way as the 

team prepares to identify and fight 

the fire. Crew members will don 

a mask if dangerous combustion 

products are detected. The crew 

will then try to locate the fire. This 

can be easy if smoke is visible; 

otherwise, the crew will have to look 

on the Portable Computer System 

Caution and Warning display for 

help (see also Chapter 5). Such help 

can include indications of an alarm 

from a smoke detector or from a 

system, such as a failed piece of 

equipment or a power trip. Power 

is shut down in order to remove the 

ignition source or in case the event 

is caused by an electrical short or a 

smoldering wire. Simultaneously, 

the ground controllers look at the 

same data to help vector the crew to 

a likely location. Once the location 

is identified, the crew will use a PFE 

to extinguish the fire, whether in a 

rack or in the cabin area. Using a 

PFE in an open cabin is a little more 

challenging in microgravity than 

on Earth: the spraying of the CO2

will act as a jet engine, propelling 

the crew member in the opposite 

direction if his or her feet are not 

anchored. The crew will close the 

hatches and seal the module while 

the ground figures out how best to 

clean up the smoke in cases where 

the heavy smoke will put the crew at 

elevated risk.

The response to a possible 

depressurization event is initially 

the same. Once at the safe haven, 

crew members will estimate how 

much atmosphere is available. The 

US flight controllers have tools 

that tell them how quickly the air is 

escaping. The crew has access to a 

manovacumeter—i.e., a handheld 

device that shows the pressure in 

real time—that can be used by 

timing how quickly the pressure is 

decreasing. For holes so large that 

only minutes are available, crew 

members will evacuate to their Soyuz 

and prepare to depart. The ISS is 

about the size of a six-bedroom 

house, thus the hole would have to be 

very large to necessitate a departure 

by the crew. A hole that measures 

0.6 cm (0.25 in.) in diameter will 

cause the ISS to depressurize to 

the minimal atmospheric level for 

supporting human life (490 mm Hg, 

9.5 psi) in about 14 hours, whereas 

a 20 cm (8 in.) hole will reach that 

level in about 50 seconds. If enough 

time is available, crew members 

will look for the source of the leak. 

First, they will enter the docking 
SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS CHAPTER 19 349

compartment attached to the Soyuz, 

close the hatch, and check the 

pressure to ensure the Soyuz itself 

is not leaking. Once the Soyuz has 

been deemed safe, the crew will 

move forward, dividing the ISS into 

sections and measuring the pressure 

to isolate the module that is leaking. 

For holes that are large enough, 

the pushing or pulling pressure on 

a hatch might clearly indicate the 

location of the leak. See Figure 13.

Figure 13. Schematic of the ISS showing all the hatches. In the initial response, each three-person crew gets into the combined Mini-Research Module 

(MRM) with its Soyuz and closes the hatch indicated by the arrows to check whether that area is leaking. If crew members still observe a leak, they will 

isolate themselves to determine the location of the leak within the MRM or Soyuz and prepare to either evacuate or re-ingress the ISS, depending on the 

results. Alternatively, if no leak is identified, crew members will enter the ISS (as represented by the dashed lines) and close the transfer compartment or 

Node 1 hatches (represented by arrows). At this point, the crew should know whether the leak is in the RS or the US Segment. Once isolated to a segment, 

the crew will close various hatches in a methodical process to isolate the module that is leaking. 

If a hole is isolated to a specific

module but cannot be seen, the 

crew can use an ultrasonic leak 

detector and headphones to move 

around inside the module to locate 

the specific spot by listening for 

the faint sound of air escaping. The 

crew can use a couple items to patch 

the hole, once the leak is found 

(see Chapter 3). The hatches to the 

module are shut in cases where the 

hole cannot be located or the amount 

of time before the crew would run 

out of air is too short. Eventually, the 

module will depress to a vacuum. 

Key systems may continue to 

operate, but anything that requires 

air for cooling or that is not rated to 

function in a vacuum (e.g., a laptop 

computer) will break and the ground 

flight controllers will power down the 

equipment in hopes that the module 

can be recovered and the equipment 

can be used again in the future.
350 CHAPTER 19 SYSTEMS: ENVIRONMENTAL CONTROL AND LIFE SUPPORT SYSTEM—SUPPORTING THE HUMAN ELEMENT OF THE ISS

The third emergency scenario is 

that of a toxic chemical release. In 

most cases, the cause would involve 

a chemical released from research 

equipment and would be cleaned 

up as described in the previous 

section. The most serious case is 

that of ammonia entering the cabin. 

This would happen if the IFHX (see 

Chapter 11) fails and the barrier 

between the outside ammonia and 

inside water breaks. In this case, 

poisonous ammonia would get inside, 

which can kill the crew in a matter 

of seconds. Once an ammonia leak 

is detected, the astronauts will don 

a PBA, remove any clothing since 

that could be contaminated, close 

the hatch between the two segments, 

and transition from the PBA to a 

respirator with ammonia filters. 

Since the IFHXs are located in the 

USOS, there is a good chance the 

RS will be safe. Shutting down the 

fans and IMV, which the software 

performs automatically when the 

alarm is initiated, will help prevent 

the ammonia from getting mixed 

into the RS atmosphere. Once in the 

RS, the crew will take a reading to 

determine whether the air is safe. 

If no ammonia is detected (i.e., 

ammonia concentration less than 

30 parts per million [ppm]), crew 

members may remove their masks. 

If ammonia is detected in the RS 

at a level less than 1000 ppm, crew 

members will wait a few hours for 

the ammonia to diffuse throughout 

the RS, thus reducing the levels to 

a safe limit. If the readings show 

high ammonia levels (>1000 ppm), 

crew members will enter their Soyuz 

spacecraft and begin cleaning its 

atmosphere, or prepare for a return 

to Earth. Since the Soyuz volume 

is so small, ammonia can be purged 

using the respirators. This is done by 

breathing in air through the filters of 

the respirator, thereby trapping the 

ammonia. If the Soyuz atmosphere 

contains too much ammonia 

(approximately 1200 ppm), the crew 

will not have enough filters to fully 

clean the Soyuz air and will have 

to quickly return to Earth. Note 

that these procedures will have to 

be updated when the commercial 

crew vehicles begin transporting 

astronauts to the ISS, mainly because 

the crew vehicles will be docked 

very close to the likely source of 

the ammonia—the heat exchangers 

in Node 2. Since this means the 

astronauts will have to pass through 

the highest concentrations of the 

toxic chemical to get to their escape 

vehicle, additional O2

 tanks and a 

scrubber that can remove ammonia 

from the atmosphere will be stowed 

on the commercial spacecraft.

Conclusion

As the heart and lungs of the vehicle, 

the ECLSS allows crew members to 

focus on the important research they 

were tasked to perform. Emergency 

response is a priority on the ISS, as is 

maintaining a comfortable, productive 

environment in which humans can 

live and work. This effort requires 

a plethora of systems, subsystems, 

and experts to monitor and control 

all the elements necessary to not 

only survive, but also to thrive in the 

severe environment of space. 


Chapter 20 Day in the Life:

When Major 

Anomalies Occur
354 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

Expedition 38 astronaut Rick Mastracchio participates in the second of two spacewalks needed to change out a faulty ammonia pump on the International 

Space Station exterior. 

Blockbuster movie themes often 

tell a story about a major obstacle 

that must be overcome, with 

several exciting plot twists and 

difficulties that make tackling the 

challenge even more interesting. 

Experts from many fields come 

together to solve a problem, with 

basic needs such as sleeping and 

eating all but forgotten in their efforts 

to accomplish a perilous undertaking. 

When the issue is solved at the end 

of the movie, the audience breathes a 

collective sigh of relief, and everyone 

feels an enormous sense of joy and 

pride in a job well done. 

Well, working in Mission Control 

sometimes feels like that! Along 

with the added bonus of occasional 

cheering and clapping. One dramatic 

human spaceflight example of this 

occurred when Mission Control 

saved the lives of the Apollo 13 crew. 

However, many extraordinary feats 

in the face of adversity have also 

occurred throughout the International 

Space Station (ISS) Program. 

Imagine sitting in Mission Control, 

performing normal tasks and 

looking at data when something 

unexpected happens. The displays 

do not look like they usually do. 

Warning messages in yellow and red 

splash across the screens, indicating 

issues with various systems. All the 

simulations come to mind, except 

this is not a simulation. This is really 

happening. The adrenaline kicks in. 

Time to figure out what happened and 

what can be done about it.

At least one failure of some kind 

usually happens during each shift in 

Mission Control—sometimes many 

failures. Typically, these failures 

are relatively minor. For instance, a 

laptop computer might lock up and 

the team might have to try a few 

things to get it working again. Other 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 355

times, a failure may significantly 

alter the crew’s timeline for the 

day, as is sometimes the case with 

malfunctioning equipment needed 

for the task at hand. Or, the problem 

could be one that everyone dreads—

an enormous failure that takes out a 

lot of the ISS functionality.

The initial flight control team reaction 

could last anywhere from a few 

minutes to a few days. Sometimes, 

extensive troubleshooting is required 

to test various fixes or even to 

simply diagnosis the problem. Some 

issues need observation over time to 

determine what is wrong, some need 

the engineering designer’s advice, 

and some require complex ISS repairs 

that rely on the guidance of a large 

number of experts.

This chapter outlines one (of 

countless) ISS failures, and the 

reaction from Mission Control. This 

major failure occurred in the ammonia 

system in December 2013. The 

failure took out a lot of ISS capability 

and required many days to repair.

December 2013—

Background

Before discussing the failure, the 

anomaly recovery effort needs 

to be put in context. In 2012 and 

2013, the ISS Program had begun 

successfully launching two different 

types of commercial cargo vehicles 

as part of its move to commercialize 

transportation to low-Earth orbit. 

The competing vehicle types were 

the Space Exploration Technologies 

Corporation (SpaceX) Dragon and the 

Orbital ATK Cygnus (see Chapter 14). 

However, in late 2013, SpaceX was in 

the process of designing an upgrade 

to their Falcon launch vehicle, and 

commercial flights to the ISS would 

be limited for a few months to Cygnus 

cargo vehicles. Cygnus had performed 

a demonstration flight to the ISS; 

however, its first officially contracted 

cargo delivery was to launch in midDecember 2013. Orbital ATK was 

loading more than 1200 kg (2,645 lbs) 

of crew supplies, spare parts, research, 

and extravehicular activity (EVA) 

equipment. NASA wanted the cargo 

on the ISS, and Orbital wanted to 

fulfill its obligations and be paid for 

the flight. A period of “high beta” 

(see Chapters 7 and 9) was starting on 

December 30. During that time, the 

sun angle would not be favorable for 

solar array pointing needs and thermal 

effects on equipment such as antennas, 

which would result in the powering 

down of equipment. Docking during 

these phases is extremely challenging 

due to the limitations these constraints 

impose. Any slips to the Cygnus 

launch would need to skip over this 

period, placing the mission well into 

January, so managers were hoping its 

schedule would hold.

One of the key problems facing the 

space station team at the end of 2013 

had to do with use of the spacesuits. 

The last US EVA in July 2013 had 

ended in a near fatality when water 

entered the spacesuit helmet of 

European Space Agency astronaut 

Luca Parmitano. The water covered 

much of his face and almost drowned 

him. After crew members performed 

some troubleshooting of the 

Extravehicular Mobility Unit (EMU), 

they determined that the water 

separator in the suit’s Primary Life 

Support System had clogged, thereby 

backing up water that ended up 

dumping into the helmet (see sidebar 

in Chapter 17, US Extravehicular 

Activity 23 Water-in-Helmet 

Incident). An official investigation 

was ongoing, and a root cause of the 

water separator clog had not yet been 

found. Something was contaminating 

the water system. If it was systemic 

in the water that was circulating 

inside the airlock, the source was 

possibly contaminating the entire fleet 

of spacesuits. After the incident, the 

EMU team designed an absorbent pad 

for the helmet interior that could be 

constructed by the crew on board, as 

well as a makeshift snorkel to allow 

for breathing from the body of the 

suit if water entered the helmet again. 

However, until the team found the 

source of contamination, the risk of 

drowning due to the same problem 

in any of the spacesuits was a real 

possibility for the crew. Engineers 

on the ground were in the process of 

assessing hardware from a previous 

mission and were seeing a complex 

water chemistry problem with no 

obvious cause.

The plans on board the space station 

for the month of December 2013 were 

filled with science, Cygnus cargo 

transfer operations, and a Russian 

Segment EVA on December 20—but 

that was all about to change.

“Orbit 2” day shift—

Wednesday Dec 11, 2013

It was a “standard” Wednesday 

for the ISS operations team, just 

after 8 a.m. Central Standard Time 

(14:00 Greenwich Mean Time), 

about the middle of the crew’s day. 

The ground team was working with 

the crew in the airlock to get ready 

for installation of a new oxygen 

supply tank and were looking ahead 

to activities to prepare for the arrival 
356 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

of the Cygnus cargo vehicle, which 

was scheduled to launch a week later 

(December 18). The Mission Control 

team was also preparing for an ISS 

reboost to a slightly higher altitude 

(see Chapters 7 and 8), so the team in 

Houston positioned a torn part of the 

Starboard Thermal Radiator Rotary 

Joint (TRRJ) to point away from the 

thrusters due to the forces generated 

when the thrusters fire during a 

reboost (Figure 1). 

Figure 1. Torn sheet on the Starboard TRRJ. This TRRJ is usually pointed away from planned thruster firings unless the radiator needs to point in their 

direction for other reasons. The tear was first noticed in 2008. Since there is ample cooling, the sheet has not been repaired. 

As comes around every so often,

a relatively routine action kicked 

off an unforgettable moment 

for those in Mission Control. After 

moving the radiator, the team 

noticed warning indications. 

Station Power, Articulation, Thermal, 

and Analysis (SPARTAN): “Flight, 

SPARTAN, I see the warning...” 

The flight controller in charge of the 

power and external cooling system, 

SPARTAN, announced the detection 

of an alarm to the team.

SPARTAN and the team quickly 

determined the external cooling 

system Loop A had shut down and 

was no longer circulating fluid to cool 

about half of the equipment on the 

ISS (see Chapter 11, Figure 6). Loop 

A is one of two external cooling lines 

circulating ammonia via an external 

pump. Loop A circulates ammonia 

through the starboard radiator 

(the other string, Loop B, pumps 

fluid through the port radiator). An 

alarm sounded on board due to the 

significance of losing half of the 

external station cooling.

Everyone in all Mission Control 

Centers quickly scanned their data 

and looked for the right procedures 

to address these questions: What 

caused the problem? Are temperatures 

starting to increase? What is the 

correct response to immediately “safe” 

(i.e., protect) systems? The ground 

team had to quickly diagnose the 

warning messages and determine what 

had caused the shut down since about 

half of the US On-orbit Segment 

ISS equipment was cooled by that 

loop and could start to overheat. As 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 357

a smaller-scale comparison on Earth, 

imagine a car suddenly develops a 

problem with its radiator. The driver 

must determine when it is safe to 

pull over to the side of the road and 

turn off the engine to prevent it from 

overheating to the point of incurring 

damage. All of the ISS equipment has 

to be assessed quickly to determine 

what needs to continue operating for a 

while, due to its criticality, and which 

temperature-sensitive items need to be 

shut down as soon as possible. Flight 

controllers took immediate action to 

swap cooling sources for some critical 

equipment that could have overheated 

in a matter of minutes. They knew 

that loss of this loop would also mean 

A failure that could become deadly!

Some of the most critical interfaces on the ISS are 

called Interface Heat Exchangers, so named because 

of the ammonia cooling system and the internal water 

cooling system interface inside these units. The liquids 

do not mix; however, the design allows heat transfer 

from inside the ISS to outside the ISS. Heat is generated 

inside the ISS (e.g., from the many computers that run 

continuously). This heat warms up the water lines that 

circulate inside. At the surface of some key modules, the 

internal water and external ammonia lines come together 

in close proximity inside the heat exchangers, causing 

the internal heat in the water lines to transfer to the 

ammonia lines outside (some components outside the 

ISS are cooled with the ammonia lines). This ammonia is 

circulated externally to the radiators to “reject” the heat 

into space. See Chapter 11 for more system details.

The ground team and the astronauts worry that these 

units will fail. If the ammonia inside a heat exchanger 

is cold enough and ice-like slugs form, a frozen area 

in the heat exchanger could break the thin barrier 

between the external ammonia loop and the internal 

water loop, causing high-pressure ammonia to enter 

the more-delicate water lines and rupture them inside 

the ISS, spilling toxic ammonia into the atmosphere 

(see Chapter 19 for emergencies). When an external 

ammonia loop gets too cold, as it did in December 2013 

when Loop A temperatures were low, flight controllers 

must carefully monitor temperatures and manage how 

and when a loop would be restarted. Fluid system 

experts and safety personnel also participated in the 

discussion over the 2-week timeframe of the Loop 

A repair to ensure safe loop operation relative to the 

Interface Heat Exchangers. (Figure 2.)

Figure 2. (Top) One of two heat exchangers installed on US Lab (EVA 

access panel removed). This unit allows for heat rejection from the internal 

water loops to the external ammonia loops. Heat exchangers such as this 

one are installed on several modules under silver access panels, and they 

are mounted on the pressure shell. Water in the internal cooling loop is fed 

through the shell to the heat exchanger and flows in close proximity to the 

colder external ammonia cooling loop for heat transfer. (Bottom) Spare Heat 

Exchanger on the ground. See also Figure 2, Chapter 11. 
358 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

they would later have to prioritize 

which equipment could stay powered 

and which would need to be turned 

off to avoid over-taxing the remaining 

cooling loop with too much heat load.

The SPARTAN on console in Mission 

Control saw that the software 

intentionally turned off power to the 

pump that circulates the ammonia 

because the ammonia was getting 

too cold. The radiator, which was 

rejecting heat, deliberately reduced 

ammonia temperature; however, 

various parts of the entire loop had 

to be tightly controlled, temperaturewise (see Chapter 11). A Flow 

Control Valve (FCV) controls how 

much of that cold ammonia from 

the radiator enters the primary 

system. That valve is located in the 

same external box as the pump that 

circulates the ammonia in the external 

lines. In this case, the FCV did not 

move properly. The valve should have 

been closed at that point; however, it 

was not. Thus, too much cold radiator 

fluid was entering the primary system. 

Within the hour, the flight control team 

restarted the pump and tried to control 

the FCV movement, but the loop 

remained too cold to flow ammonia 

through the heat exchangers that cool 

the internal water loops (see sidebar 

A failure that could become deadly!). 

The team continued to command 

the valve using various methods 

throughout the day, but to no avail. It 

seemed the valve indicated that it was 

in one position, but it was actually in 

another. The team moved the starboard 

TRRJ to a position that would warm 

it up, pointing at the sun and other 

structure; however, it still was not 

warm enough to allow use of the Loop 

A for cooling internal equipment. 

While the team was troubleshooting 

Loop A, they also had to ensure the 

most critical items received cooling. 

All of the powered equipment 

inside the ISS creates quite a bit of 

heat, and all of that heat was being 

put into Loop B rather than being 

dissipated into two loops. The team 

powered down equipment to reduce 

the overall amount of heat going into 

Loop B, and they also tried to get 

the Loop B port TRRJ fluid as cool 

as possible by pointing that radiator 

in a cold direction, away from the 

sun and structure. The Japanese 

and European module equipment is 

powered through Node 2, but one of 

the Node 2 internal loops could not be 

cooled. Therefore, some of the power 

to these modules had to be shut down 

to prevent overheating the Node 2 

electrical equipment. 

When the crew members’ day 

was wrapping up, they helped by 

performing some of the power-down 

steps that required their intervention. 

Some of the activities for the next 

day were already looking impossible 

to complete, due to lack of powered 

equipment. They were informed of 

some of the changes before they went 

to bed. Meanwhile, the ground team 

still had a lot of work to do, including 

performing the ISS reboost while 

working with a cooling problem. 

On top of that, the team received 

a caution that the reboost did not 

complete due to an unrelated issue, 

so they had to quickly verify that the 

ISS was in a safe orbit! 

The Mission Evaluation Room 

conducted meetings to involve the 

engineering team and they discussed 

what could possibly be done to correct 

the FCV problem. Meanwhile, the 

flight control team spent the next 

several hours trying unsuccessfully to 

move the valve, continuing to power 

down equipment and discussing what 

would happen if something else failed. 

More on that below. This is about as 

busy as the flight control team can get, 

and the flight director was trying to 

keep everything from getting worse. 

Thursday, Dec 12, 2013

By the next day, the magnitude of 

the situation was weighing heavily 

on not only the console team but 

also a much bigger team of thermal 

experts, visiting vehicle programs, 

EVA experts, scientists, international 

partners, and other space station 

stakeholders. Loop A was still 

actively flowing, but the FCV was 

unable to be driven out of its cold 

position. The ammonia was about 

30 Celsius degrees (54 Fahrenheit 

degrees) too cold. The team would 

either need to find a new way of 

warming up the ammonia in the 

loop, or have to perform a series of 

spacewalks to change out the valve. 

Warming up the loop would be a 

challenge, but the operations and 

engineering teams had some ideas. 

Options included tricking the FCV by 

telling it to move outside its normal 

limits, warming the lines via heaters, 

or trying to unconventionally use a 

different radiator valve to modulate 

the temperatures enough to allow for 

some heat exchanger use. 

Any of these “commanded from the 

ground” options would be desired 

over having to perform multiple 

EVAs. Spacewalks are risky and 

they require a lot of valuable crew 

time working with the spacesuits 

and tools. In this case, the time 

required for the EVAs to fix Loop 

A would probably mean the Cygnus 

mission would have to move to the 

following year. The spacewalks 

would entail change-out of a Pump 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 359

Module, which is a large external 

box on the starboard truss that houses 

the ammonia pump and the FCV. In 

2010, the pump failed in a different 

way and was changed out via a series 

of three spacewalks. 

To avoid the EVAs, the team’s initial 

focus was on the “commanded from 

the ground” options. With the help 

of the Mission Evaluation Room 

members, the flight control team 

worked hard at characterizing the 

FCV failure and started to discuss 

other ways to control the loop 

temperatures. For example, they 

might be able to partially close a 

different valve—the Radiator Return 

valve—which would cause less flow 

from going to the cold radiator. 

The ISS Program management and 

Flight Director’s Office agreed that 

if these solutions were not looking 

feasible by morning, preparations 

for the EVAs would need to kick off. 

The chief of the Flight Director’s 

office named a flight director to 

lead the effort that would be called 

“Team 4” (see sidebar, Calling in 

the Reinforcements: Team 4). A few 

flight directors and some other key 

personnel met to start discussing the 

big picture in terms of personnel and 

EVA timing. 

One of the major tasks to discuss 

before starting to lead a big team 

was the timeline of events that 

would drive the deadlines for the 

team. December 30 through January 

8 was the high beta period, which 

would not be good for either an 

EVA or a Cygnus mission, due 

to additional power-downs of 

equipment. Squeezing in repair 

EVAs before December 30 would 

be difficult. Even more daunting 

would be squeezing in the EVAs 

plus a Cygnus mission with launch, 

rendezvous, capture, and berthing. 

The Russian EVA that was planned 

for December 20 would need to be 

renegotiated if a series of US EVAs 

was added to the schedule or the 

Cygnus capture happened to fall on 

that date. Even if a way was found 

to wedge two major events into 

the same day, two dynamic events 

(e.g., EVAs and visiting vehicle 

captures) are not typically planned 

on the same day due to overall 

crew and ground team workload.

Calling in the Reinforcements: Team 4

The operations team and the ISS Program management may determine that 

it is necessary to formally call together a larger-than-normal group of people 

to resolve a time-critical problem “off-console.” This type of team is called 

“Team 4” (see also Chapter 18), and it is led by a flight director. Team 4 is 

so named because it usually takes three shifts of teams to work 24-hour 

operations and an off-console team would be the fourth team. Although it 

implies a single shift of people, Team 4 usually requires two to three shifts 

over a few days to produce the required results. In the case of a Team 4 

call-up, all available resources are made available, including facilities and 

the Mission Evaluation Room engineering personnel, hardware providers, 

and contractors. The lead Team 4 flight director brings recommendations for 

risk- or cost-related ISS decisions to program management and keeps the 

ISS Program informed throughout the course of events. 

Since Team 4 is able to leave the flight control function to the other three 

teams, it can work on new procedures or perform analysis uninterrupted, 

work in mock-up facilities to determine what could be constructed on orbit, 

support the ISS Program meetings, or go try out spacewalk techniques in 

the Neutral Buoyancy Laboratory. Sometimes, members of Team 4 work 

together in a “War Room” setting, working in a dedicated conference 

room for hours each day with technical experts, discussing solutions or 

performing analysis. Team 4 is most successful when the console team is 

closely following the activities of Team 4. Team 4 creates official console 

documentation such as Flight Notes for new procedures and changes in 

the way the ISS should be operated. Team 4 members try to speak with the 

console team frequently throughout the day, and cell phones are always in 

hand in case console needs to reach someone on Team 4.

Friday, Dec 13, 2013—

Team 4 Is Called In 

The next morning, the console 

team continued to struggle with 

ground commanding to control the 

ammonia loop temperature. It was 

officially announced that a Team 4 

effort would be required to integrate 

all the teams and plan for EVAs. 

The Team 4 structure and logistics 

were discussed at a kickoff meeting. 

Several parallel efforts would be 
360 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

occurring in various sub-teams, with 

seven key sub-teams listed below:

n EVAs: Planning spacewalks to fully 

restore the system by replacing the 

degraded Pump Module with a new 

spare; this included writing down 

detailed steps to solve ammonia 

Quick Disconnect (QD) problems 

(connections in the system can 

be tricky) and planning for 

operations if the spacesuits become 

contaminated with ammonia

n Cygnus: Determining whether the 

Cygnus launch and berthing could 

be safely accomplished without 

Loop A fully restored, especially if 

the EVAs take a while to develop

n Troubleshooting: Continuing 

ground commanding to the system 

to see if temperatures could be 

controlled enough to allow for some 

temporary internal cooling, possibly 

allowing the Cygnus mission to 

occur before the EVAs, if needed

n EMUs: Continuing the investigation 

into what had caused the water 

separator to clog in an EMU, which 

spacesuit components would be 

best to use, and any other actions 

needed for the spacesuits

n Analysis: Predicting thermal 

and structural behavior of the 

systems with software modeling, 

known hardware performance 

and engineering experience; for 

example, predicting the behavior of 

the ammonia in the loop at different 

temperatures and pressures

n Planning: Planning the complex 

set of crew tasks and ground 

commanding sequence of events 

that would lead up to either a 

Cygnus-first scenario or an EVAfirst scenario

n Next Worst Failure: Determining 

impacts to the ISS and actions in 

case of a “Next Worst Failure,” 

essentially planning for the worst 

thing that could happen next before 

the loop was fixed 

The EVA officer, robotics officer, 

and SPARTAN briefed the expected 

operations for the spacewalks. It 

was by no means already figured out, 

but the teams had already changed 

out a Pump Module in 2010 and since 

then the procedures and crew training 

briefing had been updated and were 

fairly current. 

The flight director leading Team 4 

announced the preliminary EVA 

schedule (should EVA be required) 

that had been sketched out on a 

whiteboard by the team the day 

before. The first spacewalk would 

need to be planned for December 19, 

just 6 days later, with the second and 

third EVAs occurring approximately 

December 21 and December 23, 

thus avoiding the high beta period 

starting December 30, and with the 

potential for three or more EVAs 

(Figure 3). This would leave a little 

bit of margin in the system if more 

time was needed between EVAs or if 

a fourth EVA was required. The EVA 

tasks that were involved are outlined 

Figure 3, assuming they could all be 

accomplished in three spacewalks. 

Normally, EVAs are planned over the 

course of months or years. Although 

a Pump Module was changed out in 

2010, several issues had occurred 

during the last change-out that would 

need to be resolved, and teams had 

estimated 16 days for the ground 

team and crew preparations needed 

to prep the suits and tools and study 

for the EVAs. Pulling it off in 6 days 

was difficult to imagine. With the 

holidays quickly approaching, many 

wondered whether they would be 

working instead.

U.S. Spacewalks Overview

EVA 1:

• Set up

• Degraded Pump Module preparation: Quick Disconnect (QD) 

demate, Pump Module Jumper install, electrical connector demate

• Spare Pump Module preparation: Multilayer insulation (MLI) open

EVA 2:

• Remove degraded Pump Module, install on Payload ORU 

Accommodation (POA)

• Install spare Pump Module - bolts and electrical connectors only

EVA 3:

• Finish spare Pump Module installation (Quick Disconnects)

• Slow degraded Pump Module

• Clean up

Figure 3. This was the plan going into the series of EVAs. Astronauts would conduct three spacewalks. 

However, some tasks could take longer than anticipated; thus, the team understood that up to four 

spacewalks could be needed to complete the repair. 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 361

Expedition 38 Spacewalkers

Rick Mastracchio

Flight Engineer

ExtraVehicular 1

Mike Hopkins

Flight Engineer

ExtraVehicular 2

Koichi Wakata

Flight Engineer

Robotics Operator

Figure 4. The spacewalkers: Rick Mastracchio and Mike Hopkins. Robotic arm operator: Koichi Wakata. 

Prior to launch, the Flight Operations 

Directorate and the ISS Program 

had determined who would perform 

spacewalks during the increment, 

if needed. In December 2013, the 

full six-crew-member team on 

board included US astronauts Rick 

Mastracchio and Mike Hopkins, 

Japanese astronaut Koichi Wakata, 

and Russian cosmonauts Oleg Kotov, 

Sergey Ryazanskiy, and Mikhail 

Tyurin. Prior to the mission, it had 

been discussed that if an EVA was 

required for an unplanned repair on 

the US Segment, Mastracchio and 

Hopkins would perform the necessary 

spacewalks and Wakata would 

operate the robotic arm (Figure 4).

Cygnus Considerations

The Cygnus mission was scheduled 

to launch in a few days; however, 

Team 4 and the ISS Program 

management had not yet finalized 

whether the mission could take place 

as planned or whether the ammonia 

loop needed to be working before 

Cygnus arrived. The health of the ISS 

would of course remain the priority, 

but until the decision to slip was 

required, the ISS Program wanted to 

keep their December launch options 

open. The ISS Program research 

team determined that the decision 

“need date” was a couple of days 

before launch day. The research group 

wanted to load the short-life science 

such as ants and a vaccine experiment 

into the Cygnus just prior to launch 

to ensure the science would last the 

entire mission. The Cygnus team had 

another couple of days to thoroughly 

consider their situation should Loop A 

not yet be repaired when they arrived. 

Among other things, the current loss 

of heat rejection from Node 2 meant 

that one of the two close-proximity 

communication units (see “Ship-toShip Communication Systems” in 

Chapter 13) between the ISS and 

the Cygnus would not be powered 

up. If the one unit that was powered 

had a problem during rendezvous, 

the Cygnus vehicle would abort as it 

approached the space station. Also, 

after berthing, half of the power feeds 

to the berthing mechanism on Node 2 

and half of the power feeds to Cygnus 

itself would not be available, thus 

exposing the mission and the ISS 

to bigger problems if the remaining 

systems experienced a failure. 

Next Worst Failure Concerns

The overall state of the ISS was 

concerning. The ability to perform 

science was severely impacted since 

a lot of equipment was powered 

off. This was especially true in the 

Japanese and European research 

modules. Some critical-but-redundant 

items were not operational. For 

example, the United States On-orbit 

Segment (USOS) oxygen generator 

was not being used; therefore, the 

station relied on the Russian oxygen 

generation system for the time being. 

Also, any time the ISS is not in 

an expected configuration, a lot of 

little-used or not-yet-created analysis 

comes into play—e.g., whether 

cooling loops can handle more or 

less heat load, and how long some 

boxes can sit in a certain environment 

without overheating. 

To determine what level of risk the 

ISS Program was willing to accept 

and how quickly repairs needed 

to be performed depended on the 

answer to this question: “What is 

the worst thing that could happen 

right now?” These potential watch 

items were called the “next worst 

failures,” and some of them would 

put the ISS in a precarious position. 

A large team scoured the various 

scenarios, but the most significant 
362 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

issue would be a subsequent failure 

of the Loop B pump (or failure of 

its power supply), which would 

cause a loss of heat rejection for all/

most internal components on the 

USOS. This would mean all of the 

computers, pumps, lights, etc., would 

need to be turned off. There might be 

some available limited capability if 

power could be supplied via jumpers 

(such as extension cords) from 

the Russian Segment and cooling 

ducts could be set up to blow air 

from the Russian Segment to keep 

US components from overheating. 

However, the Russian Segment was 

not designed to support six crew 

members or cooling of US equipment 

for long periods of time. Also, we 

would have to rely on a Russian EVA 

using Orlan spacesuits to change 

out components on the other end of 

the ISS if the USOS airlock had to 

be powered down. The team would 

be extremely handicapped if the 

previously designed spacewalks using 

the EMU and Space Station Remote 

Manipulator System (SSRMS) could 

not be used for changing out a large 

Pump Module. Waiting to fix the 

current problem meant spending more 

time at risk that a problem could 

develop with the second ammonia 

loop, and a repair in that situation 

would be much more difficult. 

Pump Module Locations

External 

Stowage 

Platform 3

ExPRESS 

Logistics 

Carrier 2 Loop A Pump 

Module

ExPRESS 

Logistics 

Carrier 1

Final EVA Pump Module Worksites

External Stowage Platform 3

Spare Pump Module

Loop A 

Pump Module

Figure 5. The degraded Loop A Pump Module was installed on the forward face of the truss on the 

starboard side of the ISS. The chosen spare was located on the External Stowage Platform #3, also 

on the starboard side of the ISS but below the failed pump (top). The going-in plan was that the two 

would eventually be swapped so that the degraded Pump Module would be placed on External Stowage 

Platform #3 (bottom). 

Extravehicular Activity Decisions

Some important decisions would 

need to be made over the course of 

the next few days. With a lot of open 

questions flying around, “collapsing 

trade space” was needed so that the 

team did not spend too much time 

performing unnecessary work. Trade 

space referred to risk assessment 

of the pros and cons for each of 

the options. Narrowing the options 

meant less work and a faster end 

result. In this case, the spacewalk 

crew members could spend a lot 

of EVA time stowing the degraded 

Pump Module neatly in a spot on the 

truss, or they could throw it out into 

space and let it burn up on reentry 

through the Earth’s atmosphere. Each 

option trades some risk to the ISS 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 363

(e.g., What if the degraded spare 

could be re-used in some way later?), 

to the astronauts (e.g., What if water 

comes into the helmet again, and 

why were we unnecessarily spending 

time stowing this degraded pump?), 

or to the human population on the 

ground (e.g., What if the old pump 

does not fully burn up and a chunk 

hits a populated part of Earth?). The 

leadership reviewed the trades and 

worked to make decisions quickly 

so that the team could move forward 

with little wasted work.

One immediate decision needed was 

which spare Pump Module would be 

used to replace the degraded pump. 

Three spares were stowed on the ISS 

exterior, none of which was in the 

same place as during the 2010 EVAs. 

That decision had to be made later that 

day or at least by the next morning 

since it drove the robotics (e.g., to 

drive where the Mobile Transporter 

or the SSRMS was to be located) and 

EVA procedure development. As it 

became apparent after looking into the 

situation, the procedure development 

would be simplified if one spare in 

particular was chosen, which made 

the decision fairly easy. The chosen 

location was a starboard stowage 

platform that was “hanging” nadir 

from the truss (Figure 5). The location 

of the robotic arm also worked well 

for positioning one of the astronauts 

for the actual repair (Figure 6).

Starboard Pump Module Removal

Pump 

Module

Figure 6. This graphical representation shows how the EVA crew would be positioned when removing 

the large Pump Module from the truss. The crew member holding the Pump Module would have his or 

her feet in a foot restraint and would be holding onto the handrails in front. The Pump Module was very 

large and the crew members could not easily see around it while holding on. 

Figure 7. The crew would need to manipulate several interfaces on the Pump Module, including 

electrical connectors, bolts (“fasteners”), and fluid QDs, which open and close off flow to allow for 

disconnecting ammonia lines for the Pump Module change-out without fluid spraying all over the place. 

Another key decision the team 

worked on for the next several days 

was how low the ammonia loop 

pressure could be allowed to get for 

the EVAs. When the Pump Module 

was changed out in 2010, the EVA 

crew had a difficult time working 

to disconnect and connect the large 

stiff fluid lines between the Pump 

Module and the truss. As when filling 

a hose with water, higher pressures 

would make it more difficult for an 

EVA crew member to manipulate the 

lines. Lowering the pressure might 

significantly reduce the overall EVA 

time spent struggling with the QDs 

(Figure 7). In fact, if they struggled 

too much, another spacewalk might 

be required, adding crew risk of 

exposure to water entering the helmet. 

On the other hand, if the system 

pressure dropped too low, cold slugs 

of ammonia could move around and 

damage the heat exchangers, thereby 
364 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

introducing the potential for lethal 

ammonia to leak into the crew cabin 

(see Sidebar: A failure that could 

become deadly!). 

A multitude of other decisions were 

going to be necessary. For example, 

several things went wrong on the 

last series of 2010 EVAs that were 

discussed in the standard post-event 

Lessons Learned meetings that now 

needed to be addressed, including one 

of the QDs that was stubborn on the 

last set of spacewalks. The crew had 

to literally bang on it with a heavy 

tool. What would happen if that 

technique did not work? 

New Extravehicular Mobility Unit 

Information

The spacesuit teams received new 

data during the Team 4 effort, and 

they had to use this fresh information 

to sort out which spacesuit parts 

were the least likely to have cloggedup water separators if there was a 

problem with the water system of the 

entire fleet. The data were from some 

water filters that had been used on 

orbit, and they indicated that some 

filters were contaminated. These 

filters could have put particles in the 

system that made their way to the 

EMU water separator, creating the 

clog that backed up the water that 

spilled into the helmet. The EMU 

team started digging through the 

historical usage of those filters to 

determine which spacesuits had been 

exposed to those filters. 

Ironically, a spare water separator 

was being flown to the ISS. However, 

it was loaded into the Cygnus 

vehicle and would not be available to 

install into an EMU as a clean spare 

until after the vehicle arrived. This 

presented yet another item to consider 

when looking at the order of events. 

The Next 3 Days, 

Dec 14-16, 2013

Troubleshooting Team Progress

The team at this point had turned 

its focus to trying to control the 

temperature of Loop A by partially 

closing off flow to the radiator using 

the Radiator Return valve. This 

valve is not intended to be stopped 

at incremental positions; however, 

the team members realized that they 

could start to move the valve and 

then remove power before it reached 

its final position with a goal to find a 

good partially open state for various 

temperatures. However, “fine” 

control this way would require new 

software to help with managing the 

temperatures through orbital day and 

night cycles and constantly changing 

internal heat loads. The initial shortterm goal was to be able to bring 

the temperatures up high enough 

in Loop A to temporarily allow for 

the heat exchangers to be used for a 

couple of weeks. The team was on its 

way to doing so, but a large-enough 

temperature swing occurred and Loop 

A shut down again. The team was 

learning a lot about how to control 

the system, but it was becoming 

more and more clear that controlling 

the system with these techniques 

was just “buying time.” Eventually, 

the Pump Module would need to be 

replaced to keep the complexity down 

for operating the Thermal Control 

System. Unfortunately, as predicted, 

the thermal control experts were 

getting stretched very thin, working 

too many things at once.

Cygnus Team Progress

The Cygnus launch needed to slip 

for other reasons by 1 day, so it 

was announced that the mission 

would launch on December 20. 

This provided some relief for the 

team. The increment, Cygnus, and 

engineering teams were working on 

how to fly the mission by having the 

crew install power jumpers to the 

communication system and berthing 

system to provide redundancy 

during rendezvous and installation, 

respectively. Once the Cygnus was 

berthed, the crew would have some 

new cooling fluid jumpers that could 

be hooked up to provide internal 

cooling for the power distribution 

boxes. Parallel planning for the 

Cygnus mission and the EVAs were 

going to come to a decision point 

around Tuesday evening. The crew 

and ground would begin operations 

that would be needed for either EVA 

or Cygnus and would preclude the 

other (e.g., moving the SSRMS to 

support the EVAs was required on 

Wednesday; jumper install for Cygnus 

occurred on Wednesday). These 

operations could possibly be pushed 

back a day or two, resulting in a delay 

in one of the operations; however, the 

loss of days in the increasingly tight 

window of opportunity this month 

was a concern.

Extravehicular Activity and Analysis 

Team Progress

The team uplinked preliminary 

procedures for the crew members to 

study, and they started getting the 

suits ready. The crew members got 

way ahead in their work, which kept 

the work that the ground teams had to 

complete as the long pole in the tent 

in terms of schedule. 

To answer the question about whether 

a low ammonia line pressure is 

required for EVA crew manipulation 

of the lines, a team of EVA specialists, 

ammonia line experts, and astronauts 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 365

tested QDs at various pressures to 

determine how much pressure it 

would take to make it too difficult 

for the EVA crew member to perform 

the necessary line movements, 

disconnections, and reconnections. 

The team designed a test with an 

astronaut in a sling hanging from the 

ceiling of a large high bay to try out 

the manipulation as if he were in zerogravity. The team wanted to know 

how much his body moved around 

when he was tugging and pushing on 

stiff ammonia lines. The problem with 

this decision is one often faced with 

spaceflight in that it has to be based on 

inexact testing and analysis. It would 

be ideal to have the microgravity, 

vacuum, and thermal conditions at 

which the ISS is flying to understand 

how the hardware actually moves, 

However, the test subject would need 

to be in space for that to occur. The 

terrestrial test is shown in Figure 8. 

The Neutral Buoyancy Laboratory—a 

large swimming pool for EVA 

training—could not be used since the 

high-fidelity lines and QDs, of which 

there are precious few in existence 

on the ground, would corrode in 

the water, thereby resulting in an 

inaccurate reflection of the forces and 

actions that astronauts would have to 

take in space.

Figure 8. Astronaut Doug Wheelock is testing fluid QDs at varying line pressures to determine 

which pressures make it too hard for the spacewalking crew to perform the task. Doug had performed 

a similar task while on a spacewalk in 2010, so he was the natural choice to perform the testing. 

A harness allowed his body to move left and right when he put in forces on the connectors, somewhat 

simulating the way it would be in space. 

The teams also pulled out real 

emergency gas masks and tested out 

how they could transition a crew 

member in a water-soaked EMU 

helmet to an emergency mask in 

the event ammonia contamination 

on the spacesuit is released into the 

ISS atmosphere after the spacesuit is 

inside. Water attracts the ammonia, 

so after repressing the airlock, the 

spacewalking crew member would 

close his or her eyes while an 

assisting crew immediately removed 

the EMU helmet, wiped the crew 

member’s face, and applied the 

emergency mask. One of the moredifficult decisions would be whether 

to hurry the crew members inside or 

have them wait longer at vacuum. 

When water in the helmet is not a 

concern, the ground would normally 

instruct the contaminated EVA crew 

members to stay at vacuum, letting 

any stuck-on ammonia “bake off”—a 

term that describes the sublimation of 

solid ammonia to vapor, which would 

effectively result in contamination 

lifting away from the spacesuits. If a 

crew member has water in his or her 

helmet, this might be more urgent 

than the ammonia contamination 

issue if the water moves onto the 

astronaut’s face. The worst case 

would be an astronaut who has 

ammonia contamination (which is 

fairly common) and water leaking 

into the helmet (which was thought 

to be more likely to occur if the water 

system was contaminated). Each case 

might dictate a different response, but 

the team did its best to generalize and 

write down actions that could be used 

for quick decision-making for the 

different situations.

The concept of jettisoning the 

Pump Module (i.e., throwing it into 

space, where it would eventually 

deorbit and burn up in the Earth’s 

atmosphere) was one of those 

concepts that by Monday needed 

to either be pursued as the primary 

course of action or dropped as a 

concept. It was requiring a lot of 

work in parallel with a non-jettison 

option. Multiple team members 

came to the Team 4 meeting that day 

with good information and analysis 

related to jettisoning the degraded 

Pump Module. The latest trajectory 

analysis with new data showed that 

because of the mass, diameter, and 

external shape of the Pump Module 

and the various ways it could be 
366 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

thrown by the EVA crew, it would be 

difficult to ensure the Pump Module 

would not come around and hit the 

ISS on a future orbit based on orbital 

mechanics. Also, it would need to be 

thrown in a direction that the EVA 

team thought would be tricky for the 

crew members, given the position 

of having their feet in the SSRMS. 

Reasons for keeping the degraded 

Pump Module were also surfacing in 

that the engineering team had been 

brainstorming ways to repair it in 

the future. So, the team turned off all 

work on jettison as part of a nominal 

course of action. Contingency 

jettison would still need to be worked 

in case a spacesuit emergency came 

up while the crew was holding the 

Pump Module.

Tuesday, Dec 17, 2013—

Decision Day

The Radiator Return valve effort 

was not looking as promising as 

the EVA effort, so the ISS Program 

management decided to commit 

to performing the EVAs. Because 

there was risk to the Cygnus mission 

with Loop A unable to control 

temperatures, the ISS Program made 

the decision that the EVAs would 

occur first and the Cygnus mission 

would launch in January so that 

it would arrive after the high beta 

cutout. A fresh complement of ants 

and vaccine-related science would be 

loaded into the vehicle just prior to 

that January launch. 

At this point, a decision needed to 

be made regarding when the team 

would actually be ready for the first 

EVA. One key area in the “trade 

space” of the schedule was the issue 

of which spacesuit components 

would be worn by the crew and how 

much time it would take to get them 

ready. Over the course of the previous 

few days, the team looked at which 

spacesuit components had been 

exposed the least to contaminated 

water filters over the past few 

months. Ironically, the Primary Life 

Support System (PLSS) used by 

Parmitano (designated “3011”) had 

recently had a lot of components 

changed out due to the investigation 

of the water in the helmet. With all 

of its new spare parts, PLSS 3011 

was actually considered one of the 

cleanest (i.e., not as contaminated), 

and one of the recommended 

spacesuit parts to be worn for the 

EVAs to recover Loop A. 

However, use of 3011 would require 

another 2 days to get the suit ready, 

which would push the first EVA to 

Saturday, December 21. Unlike the 

other recommended spacesuit, a 

spacesuit using PLSS 3011 would 

need to be resized using different 

modular parts to fit the current crew 

on board and change out of some of 

the components. The Hard Upper 

Torso and Secondary Oxygen Pack 

would need to be removed and 

replaced (see also Chapter 17). Hard 

Upper Torso sizing changes drive 

other changes, sometimes causing 

the need for different legs for the 

arms and legs, and the new parts 

and tweaks take time to put together. 

Despite the fact that a delay in the 

EVAs meant extending the risky 

posture of the ISS, the team agreed 

that these modifications and the use 

of that suit was the right thing to do to 

reduce the risk to the on-board crew. 

The teams working the crew schedule 

and EVA were relieved to have 2 more 

days and a single, manageable plan. 

Working Out the Extravehicular 

Activity Details

As for the EVAs themselves, the team 

continued testing and finalizing the 

details. Some of the EVA issues that 

had to be addressed throughout this 

effort are shown in Table 1. 

An EVA team performed a test in 

the Neutral Buoyancy Laboratory 

to verify each crew member would 

be able to get back into the airlock 

quickly from each of the planned 

worksites in the event of another 

water-in-helmet scenario. The 

scenario is tricky since it combines 

several already-hazardous areas 

of spacewalking—turning off the 

water shuts off the cooling fan so 

the astronaut’s body might literally 

overheat; taking steps to prevent 

overheating involve purging the 

oxygen in the suit, which significantly 

increases the risk of running out of 

oxygen. The team walked through 

the scenarios for these specific 

locations and to determine whether 

the crew needed help getting back 

to the airlock. Crew members had to 

get to the airlock approximately 30 

to 40 minutes after the emergency 

was declared, depending on how 

much energy they were expending 

and how hot they might get (e.g., 

if they are “riding” on the SSRMS, 

or working harder by using their 

hands to translate). Mission Control 

simulations such as those described 

in Chapter 10 were also planned—

i.e., a water-in-helmet case, along 

with ammonia contamination and 

simulating what would happen if a 

Next Worst Failure occurred. 

Also, the team began to discuss what 

would happen if the EVAs were 

not complete on time and whether 

an EVA would be needed to finish 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 367

Pump Module installation during 

the high beta period that started 

December 30. The team was worried 

that the solar arrays would not be 

able to generate enough power 

where they would have to be placed, 

that external boxes would heat up 

too much, and that the Ku antenna 

(see also Chapter 13) that supplied 

critical video during the EVAs would 

not be usable.

Table 1. Examples of the Bigger Issues that Required Resolution by Team 4

# Questions, Issues Method for Resolution Final Conclusion

1 Which of the three spare pump 

modules should be used?

Determine whether any are considered better 

spares based on their history; look at ease 

for robotics and EVA to access each of them.

Use spare on External Stowage 

Platform #3 on the starboard nadir 

truss.

2 Which spacesuit components are the 

safest to use (i.e., the least likely to 

cause water to enter the helmet)?

Look at the history for the components and 

choose the components that seem to be the 

least-contaminated. 

Use PLSS numbers 3011 for Hopkins 

and 3010 for Mastracchio. 3011 use 

requires additional time for sizing and 

component changes.

3 Can the crew get back to the airlock 

safely if there is another water-inhelmet scenario?

Perform a test in the Neutral Buoyancy 

Laboratory to verify each crew member 

would be able to get back into the airlock 

quickly from each of the planned worksites.

Both crew members would be able to 

get to airlock in the required time from 

different places on the ISS 

4 What will the team do if water enters 

the helmet, therby necessitating 

quick airlock ingress, but the crew is 

contaminated with ammonia?

Write down expected responses based on 

the severity of the water or the severity of 

the contamination. Perform a test with a 

real emergency mask and EMU. Perform 

a simulation of such an event in Mission 

Control.

Test and simulation were instructive 

and procedures were created as a 

result. The final procedures were sent 

to the crew and published on the 

ground.

5 Should we jettison the degraded 

Pump Module or spend time putting 

it back in a stowage location?

Determine the ISS risk for jettison based 

on the potential for re-contact of the Pump 

Module with the ISS; determine the ease for 

the EVA crew to perform the jettison and EVA 

time it would save; determine future use for 

the degraded Pump Module, or whether 

it can just burn up in the atmosphere on the 

way down to Earth.

Jettison risk and complexity too high; 

decision made to stow the Pump 

Module and only jettison in case of 

quick crew emergency that would 

necessitate it.

6 Which ammonia loop pressure 

should be used—a very low pressure 

to help the EVA crew’s work or 

a higher pressure to ensure the 

ammonia does not form pockets 

of vapor that could break the heat 

exchangers.

Perform testing with previously flown 

astronauts to determine which line pressures 

are acceptable. Have ammonia and safety 

teams analyze pressures that could result in 

heat exchanger damage. Choose a pressure 

that is acceptable to both, and best balances 

the risks.

Agreed on middle-ground pressure 

that would avoid concerns about heat 

exchanger damage but was a little 

more challenging for the EVA crew. 

7 What if more EVA planning or 

execution time is needed, and an 

EVA slips into the high beta period?

If this happens, weigh the risk of the ISS 

situation at hand (with a Pump Module 

partially installed) against the risk of high 

beta (not having much power and thermal 

issues that might take down critical items 

such as video).

EVAs did not slip into the high beta 

period; therefore, no risk trade was 

required.

Two key decisions were made this 

day. The team would not know 

whether those decisions were good or 

bad until the EVAs were in progress. 

First, the EVA team had requested 

the lowest possible line pressure 

to allow the EVA crew to perform 

operations with the fluid lines and 

QDs. However, the risk was that at 

low pressures below 12,412 mm Hg 

(240 psi), ammonia vapor could form 

near the interface heat exchangers 

(see sidebar: A failure that could 
368 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

become deadly!). When the loop 

would be pressurized back to normal 

temperatures, a cold, “icy” slug of 

ammonia would move into those 

areas of vapor and freeze the interface 

heat exchangers, thereby breaking 

the heat exchanger and pushing 

toxic ammonia into the crew cabin. 

After much discussion, the team 

agreed to an ammonia line pressure 

that was a compromise reduced 

pressure of 9,309 mm Hg (180 psi) 

that would make it easier for the 

spacewalking crew manipulating 

the QDs but keep the loop pressure 

high enough to avoid too much 

vapor in the lines. The team would 

not know whether the pressure was 

low enough for the EVA crew until 

they were out on the spacewalk, and 

the pressure would take too long 

to be lowered, real-time, during 

the spacewalk. Therefore, another 

EVA would likely have to be added 

if the decision was conservative.

The other key decision had to do 

with how much testing would be 

done after the new Pump Module 

was installed. Ideally, the new 

pump would be checked out before 

the Pump Module (which did not 

contain any ammonia) was filled with 

ammonia from the tanks. The team 

did not want to waste the ammonia 

if for some reason the Pump Module 

that was installed would not work. 

However, because a real-time test 

would delay the EVA crew’s work, 

the decision was made that the test 

could be skipped if it looked as 

though other critical work could not 

be completed in time to fully close 

out the last EVA.

Wednesday - Friday, 

Dec 18-20, 2013

With the exception of the EMU 

team that had to work on readying 

PLSS 3011, the members of the 

bigger team felt as though they were 

given a gift with two additional days. 

This meant they could focus on really 

dotting the i’s and crossing the t’s 

on the plan, and then get some rest 

before the first EVA. By this point, 

the team was very tired. When there 

is a problem and the dedicated folks 

in Mission Control need to solve it, 

they often spend 12 or more hours a 

day working the issue (and sometimes 

many more hours), and it can feel like 

finals week in school. 

On Wednesday and Thursday, the 

ground team finalized the procedures 

and the crew readied the suits, tools, 

and themselves. It is difficult to 

even imagine the number of tools 

required to go out with the crew—

approximately 40 tethers were needed 

to hold the equipment onto the crew 

and the ISS (Figure 9). That number 

does not even include the tools needed 

to do the actual work. Multiple bags 

full of tools, as well as individual 

tools, were tethered all over the suits. 

Some of those tools were to be used 

in the EVA, and some were backup 

tools in the event the original tools 

encountered problems. Some of the 

tools were needed specifically for the 

difficult QDs for the ammonia system. 

The crew members were sent video 

on their operation. They practiced 

their use inside, and they had video 

conferences with their instructors 

to prepare for the use of these 

specialized tools.

Figure 9. View of Rick Mastracchio during EVA 25. Several tethers can be seen on the front of his suit, 

with the cinch straps floating in various directions. These tethers are for general purpose use to attach 

equipment to the ISS structure, and equipment to his spacesuit tool caddy on his chest. A small, round 

trash bag is also visible. 

Not all of the work is technical. 

Another task for the team is to 

support press conferences to brief the 

media about what is planned during 

spacewalks. Ideally, this would not 

take much effort since the technical 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 369

issues that were resolved and 

what will be done on the EVA had 

been summarized. However, some 

overhead in preparing is needed to 

frame the situation for the public, just 

as any presentation takes some work 

(Figure 10).

Figure 10. A press conference held December 18, 2013, prior to the first spacewalk. From left to 

right: NASA moderator Josh Byerly, ISS Program Manager Mike Suffredini, Flight Director Dina Contella, 

and Lead EVA Officer Allison Bolinger. 

An ISS Mission Management Team 

(IMMT) meeting was held on Friday 

to determine the readiness to proceed 

with the spacewalks (aka, a “Go or 

no Go” poll). 

The Team 4 lead flight director briefed 

the IMMT on all the completed work 

and conclusions they had reached, 

and the international partners and 

representatives from all of the key 

organizations reported on their 

readiness and agreement. The IMMT 

then decided how to proceed forward.

The EVA timeline of events was 

ready to go. Mastracchio would “ride 

the arm” (i.e., put his boots into a 

foot restraint on the robotic arm) and 

be the one to work with the difficult 

fluid QDs. If the QD operations went 

smoothly, he could move on to tasks 

planned for the second spacewalk 

to remove the massive failed Pump 

Module and temporarily stow it on 

the Mobile Remote Servicer Base 

System. Hopkins was going to “free 

float,” moving himself by grasping 

handrails and assisting Mastracchio. 

Wakata was the primary robotic arm 

operator, with Kotov helping him at 

the Robotic Workstation. 

As the EVA approached, a concern 

surfaced that the Interface Heat 

Exchanger for the Columbus 

module (similar to the Lab version, 

shown in Figure 2) might have been 

accidentally exposed to freezing 

temperatures that could result in 

an ammonia leak into the internal 

thermal cooling system after 

activation of the new Pump Module 

during repressurization of the external 

loop. The concern was raised based 

on thermal analysis, not actual 

temperature telemetry, so the team 

was trying to work through whether 

this was a real concern or if something 

was slightly wrong or overly 

conservative in the analysis. The team 

was also working on a Loop A repress 

procedure that accounted for this 

potential problem with the Columbus 

heat exchanger. However, everyone 

agreed that a solution would be found 

and the EVAs should continue.

The ISS Mission Management 

team agreed on Friday morning that 

everything was ready and the team 

was Go for the EVA on Saturday. To 

prevent fatigue during the critical 

EVAs, almost everyone working in the 

control center for Saturday’s EVA was 

encouraged to take Friday off to rest. 

Saturday, Dec 21, 2013—

The First EVA (ISS EVA 24)

The moment had arrived for the 

first EVA. The night before, the 

lead EVA officer and flight director 

for the spacewalk marked up their 

procedures with notes such as 

“discuss EMU consumables” at 

various points, to agree in advance 

how often they would make standard 

calls and generally study what 

information exchange would be 

necessary. The team was fairly well 

rested and ready to go. 

The crew worked efficiently 

that morning in “EVA prep” and 

prebreathe, with Wakata and Tyurin 

helping to suit up Mastracchio and 

Hopkins and allow them to purge the 

nitrogen from their blood by breathing 

pure oxygen before depressing the 

airlock (see Chapter 17). The EVA 

crew members tethered themselves 
370 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

in the small crewlock, Wakata shut 

the hatch between the crewlock 

and equipment lock, and the crew 

performed a crewlock depress to 

vacuum. They opened the hatch 

around 6:00 a.m. Houston local time, 

about 10 minutes earlier than planned. 

These types of events are a big 

deal in Mission Control, with 

photographers and, in this case, a 

videographer walking around in the 

room. The excitement in the crew 

members’ voices could be heard as 

they experienced a spacewalk “live.” 

Their helmet camera views as they 

looked at the Earth and took photos 

of each other could be seen. Their 

time in the spacesuit was limited—

they would deplete their suit of 

consumables and be very fatigued at 

the end of the day—so every minute 

counted. The team in Mission Control 

was hypersensitive of time, since 

they might have the opportunity to 

get ahead on this first spacewalk and 

actually pull the Pump Module out of 

the truss to temporarily stow it. That 

would mean the new Pump Module 

could be installed and working with 

only one more spacewalk. Due to 

all the training and preparation, the 

flight control team might appear calm 

to the casual observer. However, 

everyone is on high alert and is 

highly vigilant. Figures 11, 12, and 

13 show the crew and flight control 

team working the EVA.

Figure 11. Koichi Wakata, representing the Japan Aerospace Exploration Agency, is shown “driving” 

the SSRMS at the Robotic Work Station in the US Laboratory during one of the EVAs. 

A few curve balls were thrown at the 

crew and Mission Control during the 

spacewalk with respect to the tools, 

the Pump Module and its QDs, the 

spacesuits, and other space station 

items. For example, a foot restraint 

was difficult to remove from the 

location where it had been stowed 

for quite some time in the harsh 

space environment, but it eventually 

came free. Also, some of the fluid 

QDs (Figure 7) were difficult to 

manipulate, and one of them leaked 

a small amount of ammonia. This 

leak looked like floating snowflakes 

bouncing off of both spacesuits. 

This occurred early enough in the 

spacewalk that the crew was outside 

a long time after this point, giving 

the ground team confidence that any 

ammonia had baked off. The flight 

director at the end of the EVA waived 

the Flight Rule that indicated a test 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 371

should be done in the airlock to 

check for ammonia, due to the small 

quantity of flakes, length of time the 

ammonia had been “baking off” the 

spacesuit, and history with these test 

results in similar conditions. 

Figure 12. The ISS flight controllers during the first spacewalk to repair the faulty Pump Module. From Left to right: videographer, Flight Director Dina 

Contella, CAPCOMs Aki Hoshide and Doug Wheelock, and Lead U.S. EVA Officer Allison Bolinger. 

The spacesuits generally performed

well; however, at one point, Hopkins 

noted that some of the outer layer of 

material was missing from his left 

glove (see also Figure 6, Chapter 17). 

The ground team discussed the 

situation and the Flight Rules that 

govern glove damage and decided that 

the EVA could continue because the 

underlying bladder-protecting material 

had not been damaged. The outer 

layer was for better grip of the tools 

and handrails, but the parts of the suit 

that held its shape and kept oxygen 

from leaking out were still intact.

The ISS also happened to experience 

some unrelated failures during the 

EVA. For instance, a smoke alarm 

rang on board the ISS. The ground 

team and crew had to quickly reprioritize what they were working 

on so that a potential fire could 

be discussed. The EVA crew 

members and their work were 

frankly lower priority than any 

possible fire. However, this smoke 

alarm was determined to be a false 

smoke indication in the Service 

Module. The smoke detector was 

set off when the crew kicked up 

some dust while cleaning. Another 

unrelated failure occurred with 

the Carbon Dioxide Removal 

Assembly, which had to be manually 

restarted by ground command after 

a failure. These sorts of surprises 

kept the flight control team on edge. 

Thanks to similar training during 

simulations and similar failures seen 

in the past, the team was able to 

work through them fairly quickly and 

continue the spacewalk.

The entire team, including the 

seasoned crew, did very well that 

day, and there was time to pull the 

degraded Pump Module out of the 

truss and temporarily stow it in a 

designated location on the Mobile 
372 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

Transporter. By anticipating all of 

the critical decisions, and because 

nothing serious had happened, the 

team was able to actually get ahead 

of the planned schedule. That was 

half the content of the next EVA. 

The team in Mission Control was 

excited to be this far along in 

repairing the space station. The EVA 

ended after 5 hours and 28 minutes. 

After repress, one of the spacesuits 

had its water switch inadvertently 

flipped to the “on” position for 1 to 

2 seconds, causing water to flow into 

the sublimator when not at vacuum. 

The switch is normally protected with 

a “guard” to prevent bumping. In this 

case, the guard had yet to be installed. 

The EVA experts were worried 

that the sublimator would become 

damaged during the next EVA, since 

pockets of water that would not be 

able to evaporate in time might cause 

uneven freezing after airlock depress, 

thereby warping or cracking the 

sublimator. Mission Control had the 

crew open the flap on the EMU to 

allow for dry-out. The team realized 

it would be impossible to tell, before 

the next EVA, whether the sublimator 

would be acceptable since water 

could be hidden from the crew’s view. 

The team quickly concluded that this 

suit could not be used, and had to 

choose from the on-board complement 

of modular suit components available. 

It was decided to resize PLSS 

3011 for Mastracchio and then use 

a new suit sized specifically for 

Hopkins. This resizing had to be 

done before the next spacewalk.

Figure 13. Expedition 38 Flight Engineer Rick Mastracchio, as seen behind part of the degraded 

Pump Module that was removed from the S1 truss during EVA 24. He is temporarily stowing the Pump 

Module by guiding it to be grasped by its grapple fixture by a robotic end effector that is housed on the 

Mobile Remote Servicer Base System. 

Sunday and Monday, 

Dec 22-23, 2013

The next EVA (EVA 25—the 25th 

increment spacewalk during the 

program) was originally intended 

to occur on Monday, December 23. 

However, with this additional suit 

resizing and given that the team 

had possibly reduced the number 

of EVAs from three to two, EVA 25 

was moved to December 24. The 

crew and ground team slept in a little 

on Sunday, worked on suit resizing 

and changing tools, and generally 

preparing for EVA 25. Until that 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 373

point, everyone had been focused 

on the first spacewalk. Now, that 

same level of attention and diligence 

was needed to safely complete the 

job. The flight controllers and the 

engineering team provided their 

final approvals for the procedures 

to be used on this EVA, and the 

crew went to work studying these 

procedures and gathering the tools 

needed. The flight control team had a 

brief tag-up in a conference room in 

Mission Control on Monday to make 

sure everyone was well versed on 

the robotic arm movements, system 

changes, and EVA procedures. 

Another issue related to hydraulically 

locking an ammonia line had come 

up. If a section of line heats up and 

no relief valve is in the system in 

that area, the line could break and 

become permanently damaged. 

Agreements had to be put in place 

about how many minutes the sections 

of line could be closed off during 

parts of the orbital cycle when the 

line could heat up, and whether the 

crew members had to shade the line 

with the shadow of their body or 

bags. The valve choreography (i.e., 

opening and closing) during the EVA 

had to be perfectly timed between the 

crew and the ground. 

Tuesday, Dec 24, 2013—

The Second EVA (ISS EVA 25)

The team prepped again, as they had 

for the first spacewalk. Everyone 

came to the Houston control center 

on the morning of Christmas Eve, 

determined to recover Loop A that 

day. The main tasks of the EVA 

would include retrieving the spare 

Pump Module from the External 

Stowage Platform-3 and moving it to 

the S1 truss. The crew would install 

it, bolt it in, and connect it to Loop A. 

EVA preparations went smoothly. 

The crew depressed and egressed the 

airlock about 15 minutes early. 

On this spacewalk, Mastracchio 

would be the “free float” crew 

member. Hopkins would have the 

experience of riding on the arm and 

holding the Pump Module. Although 

one might imagine it as a relaxing 

ride, it is difficult to determine 

whether the boots are fully engaged 

in the foot restraint. This would be the 

first time Hopkins had been in a foot 

restraint on the tip of the 17-m (57-ft) 

robotic arm in space. He would have 

to indirectly feel that his boots were 

engaged, somewhat like a snow skier. 

However, the degree of difficulty 

was increased since he would not be 

able to see his boots due to spacesuit 

mobility, and because he would be 

holding a massive new Pump Module 

that would almost completely block 

his view, as seen in Figure 14. 

Source: NASA TV

Figure 14. Astronaut Mike Hopkins rides the robotic carrying the 354-kg (780-lb) ammonia Pump 

Module as the ISS flies over South America. 

The crew prepared the new Pump

Module and moved it robotically 

over to the S1 truss installation, 

but the timeline was running about 

30 minutes behind schedule. Because 

of this, the flight controllers on the 

ground were discussing what could 

be done with the timeline while 

Hopkins was maneuvering the Pump 

Module. To avoid the need for a 

third spacewalk, the ammonia fluid 

QDs had to be mated to allow the 

ammonia to flow through the system 

after this EVA. However, the crew 

could not perform this task late in 

the EVA without running the risk of 

the suit getting contaminated with 

ammonia just before crew members 

come into the airlock at the end of 

the EVA, when their consumables 

would be near their limit. The flight 

control team made the decision to 

have them mate the fluid QDs before 

they mated the electrical cables—a 

change to the procedure that the crew 

was able to accommodate. 
374 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

Some interesting and nail-biting 

moments occurred in space and 

in the Mission Control during this 

part of the EVA. First, one of the 

critical fluid QDs would not come 

free from its temporary location, 

thus it could not be connected to 

the new Pump Module. The button 

that needed to be pushed on the top 

of the QD could not be depressed. 

The crew and the ground team 

(Figure 15) worked together for 

quite some time on tool and other 

solutions, and eventually the QD 

came off. During the QD operations, 

some ammonia flakes came out, 

possibly causing suit contamination. 

However, when Mission Control 

sent a command to vent part of the 

system, a more-disturbing “cloud” of 

flakes surrounded both Hopkins and 

Mastracchio, clearly giving them both 

a good chance of having ammonia 

on their spacesuits. The vent was 

not expected to have this effect, and 

the surprise was not welcomed. The 

crew looked at the spacesuits and did 

not see visible ammonia ice crystals 

on the suits. The ground team later 

had the crew members perform a 

An Unexpected Walk in Space 

Colonel Michael Hopkins, Expedition 37/38

December 11, 2013, started out like most days on station. 

Rick [Mastracchio], Koichi [Wakata], Oleg [Kotov], Sergey 

[Ryazansky], Mikhail [Tyurin] and I woke up at our normal 

times, ate breakfast, drank coffee, cleaned up, and 

began executing the scheduled activities. Later that day, 

a warning alarm sounded, which brought us all floating 

to one of our Personal Computer System computers to 

determine what had gone wrong and what actions we 

needed to take as crew. However, before we even had 

a chance to open any corrective procedures, Mission 

Control Center-Houston called with a message: “We 

see the warning on the board, no action for the crew at 

this time.” This direction from the ground team was not 

unexpected because they are often able to correct failures 

from their work stations allowing those of us on-orbit 

to continue executing the planned science experiments 

and maintenance events. This teamwork between the 

astronauts and flight controllers is one of the strengths of 

ISS operations because the on-board crew can focus on 

those items that can only be accomplished by someone 

physically located with the equipment in space, and 

the true system experts—i.e. the flight controllers—can 

diagnose and often resolve ISS issues with little to no 

actions from the crew. 

My crewmates and I went back to the schedule and 

continued chasing the red line (the daily schedule uses 

a red line to indicate current time and astronauts try to 

complete their tasks before the red line crosses the 

activity). We did not have a full understanding of the scope 

of the problem, and we certainly did not understand the 

flurry of activity taking place on the ground. However, later 

in the day when Mission Control asked for assistance with 

some hardware power-down and cross-coupling activities, 

we knew this was not a run-of-the-mill malfunction that 

would be resolved by morning Daily Planning Conference 

(see Chapter 2). At some point over the next couple of 

days, we had a video conference with our lead flight 

director, Judd Frieling, and he explained the scope of the 

malfunction with the Pump Module of one of the external 

cooling loops, and the multiple options being considered 

by the ground teams, including the launch of Cygnus or a 

possible EVA solution. Now we did not have any scheduled 

EVAs as part of our increment, particularly with the 

ongoing investigation of water in the helmet. Therefore, any 

discussion of going out the door was very exciting while 

also highlighting the gravity of the situation. We informed 

the ground team that we were ready to support all of 

the options, that we were well rested, and that activities 

supporting both Cygnus capture and EVAs should be 

put on the schedule and task list. As a crew, we were 

determined to do what we could to keep all options on the 

table as long as possible. This started a 2-week period that 

was probably the most exciting time of Expedition 38, and 

was described by Rick, who had previously flown on the 

Space Shuttle three times, as a close representation of one 

of those 2-week missions. Over the next 10 days, there 

would be no days off, and work would often start before 

breakfast and continue well into the evening. 

During this time of uncertainty on the course of action, 

my crewmates and I often discussed the odds and made 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 375

“bake-out” (ammonia sublimation) 

outside the airlock (see Chapter 17). 

After the Pump Module was installed 

and all of the umbilicals were mated, 

the ground began checking it out by 

sending commands to fill the system. 

Before the EVA, one of the major 

discussion points was whether the 

team would spend time doing a short 

checkout of the Pump Module before 

filling it with ammonia. However, the 

EVA timeline was intertwined with 

the commands, and the EVA was 

running long. So, the flight director 

made the difficult decision to skip the 

checkout and starting filling the Pump 

Module full of ammonia instead, 

which saved EVA time but would 

mean a lot of ammonia would be 

wasted if the new pump did not work. 

The SPARTAN on console sent the 

appropriate commands to do so. 

The spacewalk ended with the team 

focused on a safe repress of the 

airlock. The crew performed a test in 

the airlock to see whether ammonia 

could be detected by passing airlock 

air though an ammonia-sensitive 

predictions on whether we were going to capture Cygnus 

in December or whether we were going to repair the 

Pump Module with several spacewalks. In fact, the night 

before Mission Control informed us of the decision to 

delay Cygnus and execute the EVAs, we had put Cygnus 

capture as the more likely option, given our reading of 

the tea leaves. Despite owing the bookie, we were happy 

to have a decision, and life on board station took on a 

new intensity level. Though I was trained and qualified 

to execute any EVA required, the final days before 

hatch open were less stressful because my two USOS 

crewmates, Rick and Koichi, were a veteran spacewalker 

and a veteran robotic arm operator, respectively. Their 

calm demeanor and methodical preparation gave 

everyone confidence that the team would be ready to 

execute the Pump Module remove and replace (R&R) in a 

few days’ time. 

On December 20, 2013, after 9 days of intense 

evaluations, meetings, decisions, and preparation, 

and 1 day before the first of three planned EVAs, the 

ground team was able to give us the afternoon off. 

Everyone was ready and it was time to relax. Then fate 

intervened with a little humor, and another problem 

occurred on the ISS. The separator fan for the toilet 

in the US Segment failed and a replacement unit would 

have to be installed before the bathroom was open for 

business again. However, the flight control team wanted 

to keep our schedule clear since the EVA was the next 

day and we could use the toilet in the Russian Segment. 

For Rick and me, the failure was a blessing because 

it gave us something to do rather than float around and 

think about the spacewalk. After a quick conference 

with the ground team, the flight director gave a go and 

we quickly had procedures on board to make the repair. 

So, the afternoon before one of the biggest days of 

our lives, Rick and I put on our plumber hats and repaired 

the space toilet. 

The Pump Module R&R in December 2013 showcased 

what happens when NASA goes into crisis mode. The 

preparations were superb, the procedures well written, 

the decisions spot on. With assistance from our Russian 

colleagues, Rick, Koichi and I followed the detailed 

instructions from Mission Control and completed 

the repairs in two instead of the three EVAs we were 

planning for totaling almost 13 hours outside station. 

Problems were encountered during the course of the 

R&R, but in all cases a solution was found. Staring out 

the airlock hatch at the vacuum of space before my first 

EVA was one of the most profound moments I’ve ever 

experienced, and climbing back into the airlock after the 

second EVA with words from Mission Control that the 

R&R was successful was one of the proudest moments 

I’ve ever had. NASA’s operation of the ISS provides daily 

reminders of the complexity of the job and the talent 

of the people assigned to the task. However, when a 

contingency happens, NASA takes it to another level and 

the accomplishments are truly amazing. For the crew of 

Expedition 38, the knowledge that the ground team put 

forward a super-human effort to solve the Pump Module 

failure drove us to do our small part with as much care 

and accuracy as possible, and together we had one of 

the best Christmas gifts ever.
376 CHAPTER 20 DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR

substance that would turn from 

yellow to blue in the presence of 

ammonia. The test turned out to be 

negative—no ammonia was present. 

During repress of the airlock, 

Mastracchio’s communication cap 

lost audio in the right ear, giving the 

team even more to discuss. 

The EVA ended up lasting 7 hours 

and 29 minutes, about an hour 

longer than was planned, but with 

an incredibly successful installation 

of a new Pump Module. The 

degraded Pump Module was left out 

on the truss, where it could remain 

for several months (Figure 13).

Figure 15. The ISS flight controllers during the second spacewalk to repair the faulty Pump Module. From left to right: SPARTAN Flight Controller Bill 

Kowalczyk, the NASA videographer, Capcoms Aki Hoshide and Doug Wheelock, Flight Director Dina Contella, BioMedical Engineer Lawrence Baitland, and 

Lead US EVA Officer Allison Bolinger, with John Mularski assisting. On the far right: Norman Knight, chief of the flight director’s office. 

The ground team began activation

of the new Pump Module and 

confirmed that it was working. The 

ground team told the crew of the 

successful results—the CAPCOM 

told them, “It’s the best Christmas 

ever!” Smiles and handshakes were 

exchanged among the proud and 

exhausted teammates. For many 

of those who had been working 

the EVAs, Christmas was certainly 

going to be a happy day off.

Tuesday, Dec 25, 2013, 

and Beyond

A lot of work remained to be done 

to bring the entire loop back up to 

full functionality. The ammonia loop 

was at a lower pressure than nominal, 

and it would take quite some time 

to bring it back to normal pressure. 

Christmas was not a day of rest. 

Many intricate procedure details had 

been worked out in terms of adding 

nitrogen to part of the system to 

increase the pressure of the ammonia 

(see Chapter 11), and the issue 

with the Columbus heat exchanger 
DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 377

would need to be worked around 

by isolating it from the system until 

it could be exonerated from any 

damage. The loop actually had to be 

completely shut down at one point 

so the crew could remove an internal 

power jumper and reconfigure the 

power system. 

The team eventually managed to 

work through the details and bring the 

ISS back up to full functionality. This 

cleared the way for the later Cygnus 

mission, which launched successfully 

on January 9, 2014, after the high 

beta cut-out. 

The lead Team 4 flight director 

summed up the teamwork that had 

occurred over the previous 2 weeks 

in this way:

Throughout this huge team 

effort, I was incredibly 

impressed by those that I 

have worked with before 

and those that I hadn’t yet 

met. This was international 

spaceflight at its finest! 

Thank you!

And so went the story of just one of 

many human spaceflight victories. 

For each person in Mission Control 

in December 2013, the victory was 

fought on a personal front. Sacrifices 

were made by so many personnel 

and their families, upending their 

daily schedules, weekends, and 

vacations. But there was a personal 

reward, as well—the satisfaction 

of knowing they worked a really 

difficult human spaceflight problem 

and saw it end in success!

Figure 16. (Top) Flight Director Dina Contella leads the team in Mission Control during the repair of 

the Pump Module on Christmas Eve, 2013. The spacewalking astronauts are visible in the live video 

downlink on the left. (Bottom) Full view of the team controlling the spacewalk. 

Appendix
380 APPENDIX

Acronyms and Nomenclature

A Approved

AC Alternating Current

ACE Atmosphere/Consumables Engineer

ADCO	 Attitude Determination and Control Officer

APAS	 Androgynous Peripheral Attachment System

ARFTA	 Advanced Recycle Filter Tank Assembly

ARO	 Automated Rendezvous Officer

ATA	 Ammonia Tank Assembly

ATCS	 Active Thermal Control System

ATLAS	 Atmosphere Lighting Articulation Specialist

atm atmosphere, standard 

ATM	 Toxic Atmosphere

ATV	 Automated Transfer Vehicle

Audio Terminal Unit

AVENGER Assembly Video Engineer

BC Bus Controller 

BCDU	 Battery Charge/Discharge Units

BGA Beta Gimbal Assembly 

BME	 BioMedical Engineer

C&C Command and Control

C&DH Command and Data Handling 

C&T	 Communication and Tracking

C&W Caution and Warning 

CAPCOM	 Capsule Communicator

CATO	 Communications and Tracking Officer

CBCS Centerline Berthing Camera System 

CBM	 Common Berthing Mechanism

CCAA Common Cabin Air Assembly 

CCC Contaminant Control Cartridge

CCPK	 Crew Contamination Protection Kit

CCS Command and Control System 

CDM Carbon Dioxide Monitor

CDRA Carbon Dioxide Removal Assembly 

CD-RW	 Compact Disk-Rewritable

CIO	 Cargo Integration Officer

cm	 centimeter

CMG	 Control Moment Gyroscope

CMS Chip Measurement System 

COLBERT Combined Operational Load Bearing External 

Resistance Treadmill

COTS	 commercial off-the-shelf

CO2	 carbon dioxide

CRONUS	 Communications Radio Frequency Onboard

Networks Utilization Specialist

CRS	 Commercial Resupply Services

CSA	 Canadian Space Agency

CSA-CP	 Compound Specific Analyzer for

Combustion Products

CSG Columbus Support Group

CTO	 Chief Training Officer

CWC	 Contingency Water Container

DAM	 debris avoidance maneuver

DC	 Direct Current

Docking Compartment

DCS	 Decompression Sickness

DCSU	 Direct Current Switching Unit

DDCU DC-to-DC Converter Unit

DJOPS Degraded Joint OPerationS

DoD Department of Defense

DPC	 Daily Planning Conference

DVD-RW	 Digital Video Disc-Rewritable

EBCS External Berthing Camera System 

ECLSS Environmental Control and Life Support System 

eDPC	 evening Daily Planning Conference

EETCS Early External Thermal Control System

ELC	 ExPRESS Logistics Carrier

EMU	 Extravehicular Mobility Unit

EPS	 Electrical Power System

ESA	 European Space Agency

ESP External Stowage Platform

EST External Stowage Platform

ETCS External Thermal Control System

ETHOS Environmental and Thermal Operating Systems

EV	 extravehicular

EVA	 extravehicular activity

ExPRESS	 Expedite the Processing of Experiments

to the Space Station

EXT External

FCR Flight Control Room

FCT Flight Control Team

FCV Flow Control Valve

FDIR	 Failure Detection Isolation Recovery

FGB	 Functional Cargo Block
APPENDIX 381

FIR	 Fluids Integrated Rack

FWD forward

Gb gigabyte

GC Ground Controller

GGR&C	 Generic Groundrules, Requirements,

and Constraints 

GHz gigahertz

GMT	 Greenwich Mean Time

GNC	 Guidance, Navigation, and Control

GPC General Purpose Computer

GPS Global Positioning Satellite 

GPRV Gas Pressure Regulating Valve

Gr&C Groundrules and Constraints

GUI	 Graphical User Interface

HCS Hub Control Software

HCZ Habitation Control Zone 

HDR high data rate

HEPA	 High Efficiency Particulate Air

HGA high-gain antenna

HRS	 Heat Rejection Subsystem

HSG Houston Support Group

HTV	 H-II Transfer Vehicle

H2 hydrogen

H20 water

HX	 Heat Exchanger

IAC Internal Audio Controller

ICC Integrated Cargo Carrier

IDRD	 Increment Definition and Requirements Document

IEPT	 International Execute Planning Team

IFHX	 Interface Heat Exchanger

IFM	 in-flight maintenance

IMMT	 International Space Station Mission

Management Team 

IMV Intermodular Ventilation

in.	 inch

INT Internal

IO Information Only

I/O Input/Output

IP	 Internet Protocol

IR In Review

ISE Integration and Systems Engineer

ISO	 Integrated Stowage Officer

Inventory Stowage Officer

ISS	 International Space Station

ITCS Internal Thermal Control System 

ITS Integrated Truss System 

IV	 intravehicular

JAXA	 Japan Aerospace Exploration Agency

JEM Japanese Experiment Module 

JEM-EF	 Japanese Experiment Module Exposed Facility

JEM-PM Japanese Experiment Module -Pressurized Module

JEM-RMS	 Japanese Experiment Module Robotic Arm

JOP Joint Operations Panel 

JPM Japanese Pressurized Module 

JSL	 Joint Station Local Area Network

JSpOC	 Joint Space Operations Center

kbps	 kilobits per second

kg	 kilogram

kN	 kilonewton

kPa	 kilopascals

kW	 kilowatt

LAB Laboratory

Lab C/O	 laboratory checkout

LAN	 Local Area Network

LA-1 MDM US Lab 1 Multiplexer/Demultiplexer

lb pound

LCA Loop Crossover Assembly 

LCD	 Liquid Crystal Display

LCVG	 Liquid Cooling and Ventilation Garment

LDR low data rate

LEE	 Latching End Effector

LEO low-Earth orbit

LiOH Lithium Hydroxide 

LRP long-range planning

Long Range Planner

LT Low Temperature

LTA	 Launch-to-Activation

LTL Low Temperature Loop 

LVLH	 Local Vertical/Local Horizontal

MB megabyte

MBM	 Manual Berthing Mechanism

MBS	 Mobile remote servicer Base System

MBSU	 Main Bus Switching Unit

MCA Major Constituent Analyzer

MCC Mission Control Center

MCC-H Mission Control Center-Houston

MCC-M	 Mission Control Center-Moscow
382 APPENDIX

MCC-X	 SpaceX Mission Control Center

MCS Motion Control System 

MDM Multiplexer/DeMultiplexer 

MER Mission Evaluation Room

Metox metal oxide

MHz megahertz

MLI Multilayer Insulation

MLM Multipurpose Laboratory Module

MLS	 Mostly Liquid Separator

MMC Mission Control Center

mm Hg	 millimeters of mercury

MMOD	 Micrometeoroid and Orbital Debris

MPEV	 Manual Pressure Equalization Valve

MPLM	 Multi-Purpose Logistics Module

MRM	 Mini Research Module

MSD	 Mass Storage Disk

MSS	 Mobile Servicing System

MT Moderate Temperature

MTL Moderate Temperature Loop 

N1 Node 1

N2 nitrogen

NBL	 Neutral Buoyancy Laboratory

NCS Node Control System 

NTA	 Nitrogen Tank Assembly

O2 oxygen

O3 Orbit 3

OBSS Orbiter Boom Sensor System

OCA	 Orbital Communications Adapter

OCM	 Orbital Conjunction Message

ODIN	 Onboard Data Interfaces and Network

OGA Oxygen Generation Assembly 

OOS On-orbit Operations Summary

OPS PLAN Operations Planner

OPTIMIS Operations Planning TIMeline Integration System

ORU 	 Orbital Replacement Unit

OSO	 Operations Support Office

Operations Support Officer

OSTP Onboard Short Term Plan

OSTPV Onboard Short Term Plan Viewer

PAS	 Payload Attachment System

PBA Portable Breathing Apparatus 

Pc	 probability of collision

PCA Pressure Control Assembly

PCS Portable Computer System

PDAM	 Predetermined Debris Avoidance Maneuver

PDGF Power and Data Grapple Fixture

PFCS Pump and Flow Control Subassembly

PFE Portable Fire Extinguisher 

PHALCON	 Power, Heating, Articulation, Lighting Control

PL Payload

PLSS Primary Life Support System

PLUTO	 Plug-in-Plan and Utilization Officer

PMA Pressurized Mating Adapter 

PMCU Power Module Control Unit 

PMM Permanent Multipurpose Module 

POA	 Payload Orbital Replacement Unit

Accommodations

PPCR	 Planning Product Change Request

PPL Pre-Positioned Load

PPRA Positive Pressure Release Assembly 

ppm parts per million

PPR Positive Pressure Relief

PRO	 Power Resource Officer

psi 	 pounds per square inch

PTCS Passive Thermal Control System

PTR Port Thermal Radiator

PV	 PhotoVoltaic

PVCU	 PhotoVoltaic Control Unit

PVM	 Photo-Voltaic Modules

PVR	 PhotoVoltaic Radiator

PVTCS	 PhotoVoltaic Thermal Control System

PWD Potable Water Dispenser 

QD	 Quick Disconnect

R&R	 remove and replace

RAM	 Random Access Memory

RAVEN	 Resource Avionics Engineer

RBI Remote Bus Isolator

RIO	 Remote Interface Officer

RF	 radio frequency

RFG	 Radio Frequency Group

RGA Rate Gyro Assembly

RM	 Redundancy Management

ROBO	 Robotics Officer

ROS Russian Orbital Segment

Roscosmos	 Russian Federal Space Agency

RPC Remote Power Controller

RPCM Remote Power Control Module 

RPE	 Resource Planning Engineer
APPENDIX 383

rpm revolutions per minute

RS Russian Segment

RT Remote Terminal 

RTL	 Ready to Latch

RWS	 Robotics Workstation

SAFER	 Simplified Aid for EVA Rescue

SARJ Solar Alpha Rotary Joint

SAW Solar Array Wing

SDS Sample Delivery System 

SIGI	 Space Integrated Global Positioning System/

Inertial Navigation System

S/G	 Space-to-Ground

SM	 Service Module

SMCC	 Service Module Central Computer

SMTC	 Service Module Terminal Computer

SOC	 state of charge

SOP	 Secondary Oxygen Package

SPARTAN	 Station Power, ARticulation, Thermal,

and ANalysis

SPDM	 Special Purpose Dexterous Manipulator

SPOC Station Power Operations Controller

SRMS Shuttle Remote Manipulator System

SSC Station Support Computer

SSIPC	 Space Station Integration and Promotion Center

SSG SSIPC Support Group

SSMMU Solid State Mass Memory Unit 

SSN	 Space Surveillance Network

SSRMS	 Space Station Remote Manipulator System

SSU	 Sequential Shunt Unit

STARCOM	 STAtion Radio frequency COMmunications

STCR Starboard Thermal Control Radiator

STP Short Term Plan

STS	 Space Transportation System	

SVS	 Space Vision System

TBA Trundle Bearing Assembly

TBD To Be Determined

TCA Thermal Control Radiator

time of closest approach

TCCS	 Trace Contaminant Control System

TCON Thermal Control

TCS Thermal Control System

TDRS	 Tracking and Data Relay Satellite

TEA	 Torque Equilibrium Attitude

THC Temperature and Humidity Control 

THOR	 Thermal Operations and Resources

TIG time of ignition

TITAN Telemetry Information Transfer and 

Attitude Navigation

TMG	 Thermal Micrometeoroid Garment

TOPO	 Trajectory OPerations Officer

T-RAD Tile Repair Ablator Dispenser

TRRJ Thermal Radiator Rotary Joint

T2 Treadmill 2

TTCR Trailing Thermal Control Radiator

TWMV Three-Way Mixing Valve

3-D three-dimensional

UCCAS	 Unpressurized Cargo Common Attachment System

UHF	 ultra-high frequency

ULD	 Ultrasonic Leak Detector

ULF	 Utilization Logistics Flight

UMA	 Umbilical Mating Assembly

UOP Utility Outlet Panel

UPA	 Urine Processor Assembly

USOS United States On-orbit Segment 

USTO USOS Thruster Only

UTA utility transfer assembly

UTC Coordinated Universal Time

ЦВМ	 Russian Segment Central Computers

V volt

VES	 Vacuum Exhaust System

VRA Vent and Release Assembly

VRS	 Vacuum Resource System

VVA	 Visiting Vehicles Officer

VV DYN	 Visiting Vehicle Dynamics

WHC Waste and Hygiene Compartment

WIF	 Worksite Interface

WLP	 Weekly Lookahead Plan

WPA	 Water Processor Assembly

XPOP	 X-Perpendicular Out of Plane

YPR	 Yaw, Pitch, and Roll
384 APPENDIX

References

Castel, F. Novelli, A. ATV The European Spaceship: 

Stories Behind The Scenes Of An International Success, 

The European Space Agency, 2015.

Catchpole, J.E. The International Space Station: Building 

for the Future, Springer-Praxis, 2008.

Harm, D., Ruttley, T. Research in Space: Facilities 

on The International Space Station, NASA, 

NP-2009-08-604-HQ, 2012.

Herd, A., Dempsey, R., van Leeuwen, W. “Mission 

Control Center Design and Operations,” in Safety Design 

for Space Operations, Editor in chief: Sgobba, T. Editors:

Allahdadi, F.A., Rongier, I., Wilde, P.D. The International 

Association for the Advancement of Space Safety,

Butterworth-Heinemann, 2013.

Houston, R., Heflin, J.M. Go, Flight!: The Unsung Heroes 

of Mission Control, 1965–1992, University of Nebraska

Press, 2015.

Kraft, C. Flight: My Life in Mission Control, Dutton 

Adult, 2001.

Kranz, G. Failure Is Not an Option: Mission Control From 

Mercury to Apollo 13 and Beyond, Simon & Schuster,

2000.

Ryan, C. The Pre-Astronauts: Manned Ballooning on the 

Threshold of Space, Naval Institute Press, 2003.

Uhlig, A. Nitsch, J. Kehr, H. Wie Columbus fliegen lernte, 

Thomas 2010.

Selected Readings

Barker, D. International Space Station: 1998-2011 

(all stages) Owners Workshop Manual, Haynes 

Publishing, 2012.

Burrough, B. Dragonfly: NASA and The Crisis Aboard 

Mir, HarperCollins, 1998. 

Chamitoff, G., Vadali, S.R. Lessons Learned from More 

Than 50 Years in Space, AIAA Press, 2018.

Jean, P.M., Braithwaite, T.H. Canada’s Human Presence in 

Space: Past, Present and Future, IAC, 2014.

Johnson, M.P. Mission Control: Inventing the Groundwork 

of Spaceflight, University Press of Florida, 2015.

Lunney, G., et al. From the Trench of Mission Control 

to the Craters of the Moon: Stories from the Men of 

Mission Control’s Flight Dynamics Group: The Trench, 

CreateSpace Independent Publishing Platform, 2011.

Reference Guide to the International Space Station: 

Assembly Complete Edition, NASA, 

NP-2010-09-682-HQ, 2010.

RF Spectrum: http://kalonjiperry.wordpress.

com/2014/04/30/rf-spectrum/

General References on the International 

Space Station

Current overview with reference material, photographs

and video of the ISS:

http://www.nasa.gov/mission_pages/station/overview/

index.html

Facts and Figures of the ISS:

http://www.nasa.gov/mission_pages/station/main/

onthestation/facts_and_figures.html

Research on the ISS:

http://www.nasa.gov/mission_pages/station/research/

experiments/987.html

Orbital debris shielding:

http://orbitaldebris.jsc.nasa.gov/protection

Reference Guide to the International Space Station:

https://www.nasa.gov/sites/default/files/atoms/files/np2015-05-022-jsc-iss-guide-2015-update-111015-508c.pdf

NASA Technical Publications

Bond, R.L. “Application of Skylab Workday Analysis to

Future Programs,” JSC 12856. Johnson Space Center,

Houston, TX. 1977.

Hornstein, R.S., Shinkle, G.L., Weiler, J.D.,

Willoughby, J.K. “An Innovative Approach for Distributed

and Integrated Resource Planning for the Space Station

Freedom,” 41st Congress of the International Astronautical

Federation, Oct. 6-12, 1990 (IAF-90-084).

Korth, D.H., Leblanc, T.P., “International Space Station

Alpha Operations Planning,” 3rd International NASA 

Workshop on Planning and Scheduling for Space,

Oct. 27-29, 2002.
APPENDIX 385

Kranz, E.F., “STS Flight Operations– Concept Versus

Reality,” AIAA Shuttle Environment and Operations 

Conference II, November 13-15, 1985.

McCormick, R.J. “International Space Station Execution

Replanning Process: Trends and Implications,”

AIAA SPACE 2007 Conference and Exposition,

Sept. 18-20, 2007 (AIAA 2007-6241).

Smith, N., Van Cise, E. “Contingency Planning for

Removal and Replacement of Critical Equipment During

Stage Extra-Vehicular Activity,” AIAA SpaceOps

Conference, 2008. http://dx.doi.org/10.2514/6.2008-3287

Van Cise, E., Kelly, B., Radigan, J., Cranmer, C. 

“Experiences with Extra-Vehicular Activities in Response

to Critical ISS Contingencies,” AIAA SpaceOps

Conference, 2016, http://dx.doi.org/10.2514/6.2016-2462

“Space Station Operations Planning” presentation for New

Flight Director training. Updated 2014.

Watson, J., Ivins, M., Robbins, W., Van Cise, E., 

Cunningham, R., Rust, R., Curell, P., Roy, W. 

“Supportability Concepts for Long-Duration Human

Exploration Missions,” AIAA SpaceOps Conference,

2003, http://arc.aiaa.org/doi/abs/10.2514/6.2003-6240

Biomedical Results from Skylab, NASA SP-377,

NASALyndon B. Johnson Space Center, 1977.

	 Chapter 2: Flight Control Experiences, pp. 20-21

	 Chapter 3: Skylab4 Crew Observations, pp. 22-26

Chapter 4: Skylab2 Crew Observations and

Summary, pp. 27-29

Chapter 17: Crew Efficiency on First Exposure to

Zero-Gravity, pp. 155-162

Lessons Learned on the Skylab Program (JSC-09096 and

NASA-TM-X-72920), July 18, 1974.

NASA Technical Note MSC-05296 Apollo Experience

Report- Flight Planning for Manned Space Operations,

January 1972 (NASA S-319).
386 APPENDIX

Acknowledgments

The authors would like to thank 

numerous individuals and 

organizations for their support 

in creating this book. We were 

especially fortunate to draw upon the 

experience, insight, and resources 

of the following individuals (unless 

otherwise noted, all work for NASA 

at Johnson Space Center):

Sarmad Aziz (European Space Agency), Dr. Michael Barratt, Bill Barry

(NASA Headquarters), Brad Bell, Ray Bigonesse, Allison Bolinger,

Timothy Braithwaite (Canadian Space Agency, Johnson Space Center),

Kyle Brewer, Curt Carlton (Boeing), Donald Carter (Marshall Space

Flight Center), Traci Charles, Bryan Corley, Philip Curell, Amy Dill,

William “Bill” Ehrenstrom, Edward Fein, William M. Foster, Susan Freeman 

(Boeing), John Garr, Leslie K. Goss, Jose Guzman, Jean Haensly,

Garrett Hahn, Wayne Hale, James Hartsfield, Victor Herod, Kyle Herring,

Alexandros Kanelakos, Ginger Kerrick, Gary Kitmacher, Amit Kshatriya,

Roger Launius (Smithsonian Institution), Dorothea Lerman (University of

Houston Clear Lake), Dwight Link (Boeing), Stephanie Martin (Kennedy

Space Center), Joshua McQuinn, Evelyn Miralles, Michael Misiora,

Alexander Nitsch (European Space Agency), Dwight Osborne, George Palacios

(Boeing), Robert Pickle, Todd M. Quasny, Kyle Richard, Michael Rodriggs,

Emily Schulte, Donna Shafer, Kirk Shireman, Debra Simmons, Joseph Simon,

Dr. Philip Stepaniak, Arthur Thomason, Barry Tobias, Thomas Uhlig (DLR),

Paula Vargas, Jessica Violetta, Lisa Voiles, Michael Way, Mary Wilkerson,

Rebecca Wright, German Zoeschinger (DLR)

For management, contract, financial, and printing support, we appreciate

the outstanding efforts of Vicki Cantrell, Rosalie Carpenter, Susana Grossman,

Julie Karr, Geraldine Martisek, Julius Mayhorn, Marshall Mellard,

Chrystal Nevels, Kathy Padgett, Jalisa Sims, Sherrill Smith, Kristin Tauber, 

and Chrystal Wiseman.

The authors are grateful to Catherine “Cat” Bole’s careful review for export

control compliance.

Special thanks also to the Canadian Space Agency for providing

graphics and data.

Much gratitude to Helen Lane, for her editorial expertise and contribution,

and to Paul Hill and Brian Kelly for their gracious support and vision.

We also gratefully acknowledge the guidance and support of Susan Breeden

for technical editing, Cynthia Bush for illustrations, and Perry Jackson for

graphic design and layout.
APPENDIX 387

About the Authors

This book was written by flight 

directors working on the 

International Space Station (ISS) 

Program. Collectively, the authors 

have nearly 45,000 hours sitting 

in the flight director chair in 

Mission Control while working 

numerous Space Shuttle assembly 

missions, visiting vehicle dockings 

and undockings, software upgrades, 

and both Russian and American 

spacewalks. In keeping with the 

tradition of the first flight directors 

at NASA, each has a unique call 

sign that he or she uses for the 

team name during these activities. 

Specific details of each author 

are as follows:

Lead Author/Executive Editor:

Robert C. Dempsey, “Galileo Flight,” a former 

astronomer, has worked on the ISS Program since

1997. He served as a flight controller (Command and

Data Handling and in Communications and Tracking)

for 7 years before being selected as a flight director

in 2005. Dr. Dempsey holds BS degrees in astronomy

and physics from the University of Michigan (1984),

as well as an MS and a PhD in physics from the

University of Toledo (1986 and 1991, respectively).

Contributing Authors:

Dina E. Contella, “Steel Flight,” has worked on

the ISS Program since 1995, serving as a Space

Shuttle and ISS flight controller (Extravehicular

Activity) and astronaut instructor prior to being

selected as a flight director in 2009. Ms. Contella

holds a BS in aerospace engineering from Texas

A&M University (1992).

David H. Korth, “Odyssey Flight,” has worked on

the ISS Program since 1990. He served as a flight

controller (Planning) for 14 years before being

selected as a flight director in 2007. Mr. Korth

holds a BS in aerospace engineering from the

Texas A&M University (1990) and is currently

working on an MS in statistics from the University

of Houston – Clear Lake (2017).

Michael L. Lammers, “Saturn Flight,” has been 

involved in ISS operations since 1996. He worked

as a crew trainer before becoming a flight controller

(Motion Control) in 2001. After managing the

Communications and Tracking group, he was

selected as a flight director in 2008. Mr. Lammers

holds a BS in aerospace engineering from Iowa

State University (1996) and an MS from the

University of Houston (2004).
388 APPENDIX

Courtenay R. McMillan, “Tranquility	Flight,”	has	worked	

on	the	ISS	Program	since	1996,	initially	as	a	flight	

controller	in	the	Motion	Control	Systems	group.	After	a	

stint	with	the	ISS	Program’s	Moscow	Technical	Liaison	

Office,	she	returned	to	the	operations	world	to	serve	

as	lead	for	the	Avionics	Systems	Integration	group	and	

technical	assistant	for	the	robotics	and	extravehicular	

activity	division	before	being	selected	as	a	flight	

director	in	2007.	Ms.	McMillan	holds	a	BS	in	aerospace	

engineering	from	Pennsylvania	State	University	(1992).

Emily Nelson,	“Peridot	Flight,”	has	worked	on	the	

ISS	Program	since	1998,	serving	as	a	flight	controller	

(Thermal	Control	Systems)	and	as	station	duty	officer	

before	being	selected	as	a	flight	director	in	2007.	

Ms.	Nelson	holds	a	BS	in	mechanical	engineering	

from	the	University	of	Texas	(1998).

Royce J. Renfrew, “Tungsten	Flight,”	has	worked	in	the	

ISS	Program	since	1997,	originally	as	a	robotics	instructor	

in	the	Mechanical	and	Robotics	Systems	group,	then	in	

the	Robotics	Operations	group	in	2001.	After	serving	as	

the	Onboard Data Interfaces and Network (ODIN)	group	

lead,	he	was	selected	to	the	flight	director	class	of	2008.	

Mr.	Renfrew	holds	a	BS	in	computer	science	from	Trinity	

University	(1995).	He	also	earned	a	BA	in	history,	as	well	

as	secondary	teaching	certificates	from	Trinity	University	

(1987).	

Brian T. Smith,	“Liberty	Flight,”	began	working	in	flight	

control	in	1998	on	the	Interim	Control	Module	(which	

never	flew)	before	becoming	a	flight	controller	in	the	

Communications	and	Tracking	group.	He	was	selected	as	

a	flight	director	in	2005.	Mr.	Smith	holds	a	BS	in	

electrical	engineering	from	Villanova	University	(1993),	

an	MS	in	electrical	engineering	from	the	University	

of	Pennsylvania	(1996),	and	an	MS	in	aerospace	

engineering	from	the	University	of	Houston	(2004).
APPENDIX 389

Scott A. Stover, “Keystone Flight,” has worked on the

ISS Program since 2000, serving as a flight controller

(Electrical Power Systems) for 9 years before

becoming group manager in 2008. He was selected for

the flight director class of 2009. Mr. Stover received

a BS in aerospace engineering from the Pennsylvania

State University (2000) and an MS in space

architecture from the University of Houston (2004).

Edward A. Van Cise, “Carbon Flight,” has worked

on the ISS Program since 1998, serving as a flight

controller (Operations Support Officer, Telemetry

Information Transfer and Attitude Navigation) for 8

years and group lead (ISS Mechanisms & Maintenance

Training group) for 2 years before being selected

as a flight director in 2009. Mr. Van Cise received a

BS in aerospace engineering from the University of

Michigan (2000).
390 APPENDIX

Index

Note: All terms are listed only at spelled-out 

version. See page 380 for list of acronyms and 

abbreviations.

A

abandoning ship. See decrewing the ISS

accumulators, fluid loop pressure management,

	 197, 199–201

Active Thermal Control Systems (ATCSs)

	 External Thermal Control Systems (ETCSs),

	 	 192, 194, 197–204

	 Internal Thermal Control Systems (ITCSs),

	 	 205–207

Advanced Recycle Filter Tank Assembly

	 (ARFTA), 343

Advanced Resistive Exercise Device, 13

aerodynamic drag force impacting MCS, 128,

129

air conditioning, 340. See also Thermal Control 

	 Systems (TCSs)

Aircraft Operations Division, 32

air leaks, troubleshooting and fixing, 271–272,

349. See also depressurization

airlocks

	 air leaks into, 271

	 distance from P6 solar array, 321

	 EVA use of, 296–301

	 Joint Airlock (Quest), 49–50, 272, 283,

	 	 296–297, 298, 299

	 and spacesuits, 283

	 umbilical, 297, 300

air tank deliveries, 335

alarm tones from ATUs, 229

alternating current (AC) vs. direct current

	 (DC), 157–158

ammonia-based thermal transfer system

	 Ammonia Tank Assembly (ATA), 201

	 challenges for Node 3 relocation and Cupola

	 	 installation, 71, 72–75, 76–77, 79, 84

	 detection system for ammonia, 336

	 function in Thermal Control System (TCS),

 197, 202

	 hydraulically locking, 373

	 InterFace Heat eXchanger (IFHX)

	 	 breaching, 174–175, 184, 217, 347, 350

	 leak simulation, 178

major failure of Pump Module, handling of, 

	 	 354–377

	 risk of bringing in from EVA, 205, 302–303,

	 	 365

	 standard procedures for changes and repairs,

 69

	 TCCS’s limited capability to remove, 338

	 and water loop system, 357

Ammonia Tank Assembly (ATA), 200, 201

Anderson, Clay, 309

Androgynous Peripheral Attachment System

	 (APAS), 46, 47

anodized coatings to reflect heat, 195

Apollo 1 fire, xii

Apollo 13 (film), x

Apollo Program, spacewalks, 281

array erosion, solar arrays, 170

Assembly Complete configuration of ISS, 36

Assembly Contingency Subsystem. See S-band

	 communication system

assembly of ISS. See also ExtraVehicular

	 	 Activities (EVAs); making of a mission

	 and availability of thermal control, 197–198,

 201

	 Canadarm2’s role in, 251–252

	 C&DH System, 106–107

	 centerline camera system for aligning

	 	 components, 44

	 Columbia accident’s impact on, 78

	 complexities of multiple EVAs for, 303

	 Control Moment Gyroscopes (CMGs), 121

Cupola, 63, 79

	 flight missions, xx–xxi

	 importance of EVAs to, 281

	 MCS, 135

mission designation system for, xix

	 need for human manual effort in, 291–292

Node 3, 63

	 pressurized modules, 38–41

	 sequence of assembly, xvii–xxiii

	 solar arrays, xix, xxi, 157, 164–165

stages in, xix

TCS, 194

astronauts. See crew

Atlantis, Space Shuttle, 75, 253

atmosphere control, supply and revitalization.

 See also depressurization

	 ammonia breach of IFHX, 174–175, 184,

	 	 217, 347, 350

	 atmospheric pressure in ISS habitat, 37, 336,

	 	 346–347

	 Common Cabin Air Assembly (CCAA),

 337, 339, 340, 343

	 humidity levels, 199, 213–215, 337

	 monitoring contaminants, 336

	 Toxic Atmosphere (ATM), 217, 347

	 workings of, 334, 335–339

Atmosphere Revitalization Rack, 338

attitude control

	 auto handover process, 183

	 calculating attitude, 123–124

	 Control Moment Gyroscopes (CMGs), 128,

	 	 129–131, 132

	 with Control Moment Gyroscopes (CMGs),

 128

	 overview, xxiv, 127–128

	 Russian Service Module, 120, 121

	 thrusters’ function in, 129, 131, 133–134

attitude hold controllers, 133

attitude rate, 132

audio baseband communication, 228–229

Audio Terminal Units (ATUs), 228–229

auto handover process, 183, 185

Automated Transfer Vehicle (ATV), ix, xvi,

	 xviii, 46, 133, 235–236, 244

avionics racks, 54, 57. See also Command and 

	 Data Handling (C&DH) System

awards and prizes, ix

Aziz, Sarmad, 329

B

backpack, nitrogen-propelled. See SAFER 

	 backpack unit

Backup state, MDM, 100

Baikonur, Kazakhstan, 20

Baitland, Lawrence, 376

Barratt, Michael, 20, 33

Baseband Communication System, 228–231

Baseband Signal Processor, 223

batteries

	 discharging, 161–162

monitoring during EVAs, 302

	 primary power system, 165

	 for solar energy collection, 157, 165

	 thermal control process, 199

Battery Charge/Discharge Units (BCDUs),

	 165, 166

Behnken, Bob, 75, 76, 78

berthing/unberthing operations

	 CBCS, 45, 271

	 CBM, 39–41, 44, 45, 259, 261

	 coordination and process, 243–244, 245

port for berthing, 239

	 robotic systems’ role, 239–240, 242

beta angle (β) for ISS noon vector and sun

	 vector, 124, 125, 161–162, 168, 171

Beta Gimbal Assemblies (BGAs), 111, 125,

	 163, 169–170

biasing of solar array position, 171

bidirectional UHF communication system,

	 227–228, 287–288

Bigelow Expandable Activity Module, xviii,

	 259

Black orbital debris risk level, 146

Boeing Company, xxvii, 62, 246

Bolinger, Allison, 369, 371, 376

Boom A, Canadarm2, 254

Boom B, Canadarm2, 254

Bowen, Steve, 226

Bowersox, Ken, 274

breathing environment, EMU, 283, 285

Brewer, Kyle, 88

Buchilin, Alexei, 26

Burbank, Dan, 28, 114, 115, 152–153, 295, 335

bus controller (BC), 100

Byerly, Joe, 369

bypass line and valves, ATCS, 197, 202
APPENDIX 391

C

call signs for control centers, xiii

Canadian robotic arm (Canadarm).

See Space Station Remote Manipulator

	 	 System (SSRMS)

Canadian Space Agency (CSA), xiv, xxviii,

	 251, 259, 260–262

capsule communicator (CAPCOM), 175, 178

capture operations for visiting vehicles

	 crew’s role in, 239–240, 241–243, 260–261

	 Cygnus (Orbital ATK), 237

	 Dragon (SpaceX), 243, 245

	 graphics overlay for capture operations, 243

	 H-II Transfer Vehicle (HTV), 258, 260–261

	 SSRMS’s role in, 239, 254

Carbon Dioxide Monitor (CDM), 336

Carbon Dioxide Removal Assembly (CDRA),

	 275, 336–338, 346

care packages for crew, 243

cargo delivery and loading, xviii. See also

	 visiting vehicles

cargo teams, role of, 240

Cargo Transport Carrier, 256

Cassidy, Chris, 244, 290, 299

Caution and Warning (C&W) system, xxiv,

	 104–105

Centerline Berthing Camera System (CBCS),

	 44, 45, 271

Central Computer (Russia), 121–122

Chamitoff, Greg, 56

Chang-Diaz, Franklin, 263

change, managing in mission planning, 62

chemical/toxic spill, 347

Chief Training Officer (CTO), 179

Chip Measurement System (CMS), 187, 336,

347

closeout panels, 58–59

CMG/Thruster Assist control mode, 134

code life cycle, and handling change, 111–112

Colbert, Stephen, 73

“cold cross-tie,” power channels, 160

coldplate system, 204, 207

Collier Trophy 2009, ix

Columbia Space Shuttle accident, 78, 211, 246,

311, 322

Columbus module (ESA)

	 ammonia leak risk during Pump Module

	 	 change out (2013), 369, 376–377

	 closeout panels in, 58

	 cooling valve issue on STS-130/ISS-20A

	 	 (2010), 82

	 failure during STS-130/ISS-20A (2010), 84

need for Node 2 installation prior to 

 delivery, 307

overview, xvii

	 shifting plans for delivery (2008), 314, 330

Command and Control System (CCS), USOS

	 as global timekeeper for ISS, 100–101

and MDM upgrades, 99

overview, 93, 94

and software upgrades, 112

	 transition from Node software to, 106–107

upgrade transition, 117

Command and Data Handling (C&DH)

	 System, 92–107

	 assembly of, 106–107

	 Caution and Warning (C&W) system, xxiv,

	 	 104–105

	 Electrical Power System (EPS), 158–159

	 Motion Control System (MCS), 121–122

	 Multiplexer/DeMultiplexers (MDMs),

	 	 97–101. See also individual MDMs by 

 name

	 overview, xxiv, 93–97

	 Portable Computer System (PCS), 93,

	 	 101–103, 111, 112–113, 216

	 Thermal Control System (TCS), 193

	 User Application Software, 105–106

Command & Control Multiplexer/

	 	 DeMultiplexers (C&C MDMs)

failures during SSRMS installation, 262

	 in-flight maintenance, 273

	 Motion Control System (MCS) role,

	 	 121–122

and software upgrades, 113

	 styles, 98–99

	 summary, 95–97

	 timekeeping for, 100–101

transition of software during assembly, 

	 	 106–107

Command & Data Handling Position (ODIN),

xxv

commanders, designation for, xix

Commercial Crew Program, xix, 17, 21, 246

commercial off-the-shelf (COTS) equipment,

	 158

Commercial Resupply Services (CRS), 114,

	 245–246. See also Cygnus (Orbital ATK)

	 	 cargo vehicle; Dragon (SpaceX) cargo

	 	 	 vehicle

Common Berthing Mechanism (CBM), 39–41,

	 44, 45, 259, 261

Common Cabin Air Assembly (CCAA), 337,

339, 340, 343

communication

	 EMU equipment for, 287–288

overview, xxiv

	 TDRS scheduling challenges, 13

	 training for, 176, 177–179

Communication and Tracking (C&T) system,

	 	 222–231

	 baseband communication systems, 228–231

	 linking with Command and Control System

	 	 (CCS), 93

	 RF links, 223–228. See also RF (radio

	 	 frequency) links

Communications and Tracking Position

	 (CATO), xxv, 93

Communications Radio Frequency Onboard

	 Network Utilization Specialist (CRONUS)

 position, 93

Compound Specific Analyzer-Combustion

	 Products (CSA-CP), 336, 337, 346, 348

computer network, 92–97

computer systems. See Command and Data 

	 Handling (C&DH) System

condensate, 340–341

condensation, controlling, 194–195

Condensing Heat Exchanger (HX), 340

conduction method for removing heat, 193

conference calls on ISS, 28, 229

configuration management, planning the ISS,

	 11–13

conjunction, ISS and debris orbits, 142

consoles in Flight Control Room (FCR)

	 daily log checking, 23–24

	 functions of, xxiv

	 training for console management, 177

Constellation Program, 89

consumables, managing for increment, 3

Contaminant Control Cartridge (CCC), EMU,

	 285, 287

Contella, Dina, 31, 36, 311, 329, 369, 371, 

376, 377

Contingency Water Container (CWC),

	 341–342, 343, 344

control centers, worldwide locations, xxviii

controllers. See Flight Control Team (FCT)

Control Moment Gyroscopes (CMGs)

	 arrival on orbit, 135

assembly of, 121

	 attitude control with, 128, 129–131, 132

	 in Debris Avoidance Maneuvers (DAMs),

 148

	 failures, 135–136

	 momentum management, 132–133

	 in robotic arm, 120, 132

convection, 193, 345

converter units, direct current (DDCUs),

	 165–166

core completion phase of ISS, xv

Corrective Maintenance, 269

Cougar, Tamara, 329

Creamer, T. J., 27

crew. See also environmental control; specific 

 crew members by name

	 assigning to increment, 4

C&C MDM rebuild, 273

	 Commercial Crew Program, xix, 17, 21, 246

	 core systems for crew support, xxiv

	 Daily Execute Package, 8, 13

	 decrewing, planning for, 210–219

	 EVA preparation duties, 369–370, 372–373.

 See also Extravehicular Activities (EVAs)

	 exercise preferences, accommodating, 13

	 flexible activities for, 16

Houston and Canadian Ground Control 

	 	 coordination case study, 260–262

	 importance of phone call capability for, 226

	 increased efficiency with time on orbit, 15

	 increment operations, 20–33

	 initial capacity, xv

jumper installation duty, 161

	 new transport vehicles, 246

	 Nodule 3 relocation time management, 67
392 APPENDIX

as on-board eyes and ears for FCT, 29, 

	 	 216–217

personnel origin mix, xix

	 physical differences affecting choreography

 of EVA, 302

	 preparation for in-flight maintenance (IFM),

 269

	 psychological support for, 3–4, 24, 27–28, 29

	 public relations activities, 82, 86

	 return to Earth activities, 32

	 Robotic Workstation (RWS), 258

	 role in robotic arm troubleshooting during

 installation, 262

	 safety issues for EVAs, 302, 318–320, 321

	 schedule management, 3–4, 9, 14–16

	 Soyuz Spacecraft transport of, 235

	 spacesuit care and use. See Extravehicular

	 	 Mobility Unit (EMU)

	 standard complement on ISS, 20–21

in STS-120/ISS-10A mission, 309

	 transport to and from ISS, 20–21

	 visiting vehicle coordination role, 239–240,

	 	 241–243, 260–261

	 worksite preparation time, allowing for, 15

Crew Contamination Protection Kit (CCPK),

347

Crew Dragon (SpaceX), 246

Crewlock portion of Joint Airlock, 49–50,

	 296–297, 298, 299

crew support racks, 54

crisis simulations, 174–188

	 communications, 178–179

	 debrief, 187–188

	 emergency simulation, 182–187

	 failure scenarios in simulator, 179–182

purpose for training, 188

	 real-world ammonia leak crisis, 174–175

	 training process, 175–178

	 value of simulations, 175

CSA Space Operations Support Center, St.

	 Hubert, Quebec, xxix

CST-100 Starliner, 246

Cuff Checklist, EMU, 288

Cupola

installation of, 37, 63, 79

opening of shutters on, 86, 87

	 relocation of, 64, 69, 71, 73, 83, 84, 85

	 Robotic Workstation (RWS) in, 258

	 structure and function of, 51

	 visiting vehicle role, 242

current, voltage, and mass, EPS, 157–158

Current Stage Requirements Document, 26–27

cyclogram script for Debris Avoidance

	 Maneuvers (DAMs), 148

Cygnus cargo vehicle (Orbital ATK)

	 ammonia pump change-out impact, 355,

	 	 356, 358, 360, 361, 364, 366, 377

	 capture and berthing operation, 237, 242, 243

	 crew monitoring of launch, 234

loss of, 289

	 preparation for, 237–245

	 and timing in visiting vehicle operations, 244

cylindrical pressurized habitat modules, 37, 54

D

daily console log checking, 23–24

Daily Execute Package, 5, 7–9, 13

Daily Planning Conference (DPC), 22–23, 24

Daily Summary, 13, 22–23

data transmission

	 MDMs, 99–100

	 S-band system’s role in, 224–225

day in the life (of Flight Operations)

	 crisis simulations, 174–188

	 debris avoidance, 140–153

	 decrewing the ISS, 210–219

	 increment crew operations, 20–33

	 in-flight maintenance, 268–277

	 major anomaly, handling, 354–377

	 making of a mission, 62–89

	 software update and handling change,

	 	 110–116

	 spacewalks profile (STS-120/ISS-10A),

	 	 306–331

	 visiting vehicles, 234–246

Day of Execution, 9

DC-to-AC inverters, 158

DC-to-DC Converter Units (DDCUs), 158,

	 161, 165–166

debris avoidance, 140–153

	 conjunctions and relative velocities, 141

	 danger from orbital debris, 46–47

	 evaluating risk of collision, 145–147

	 growing problem of orbital debris, 151–153

	 maneuvers to avoid debris, 148–151

	 MMOD risk, 48, 283, 286, 301

	 nature of threat, 140–141

	 protection methods, 46–49, 53, 141–143

	 screening of debris, 145

	 tracking of debris, 143–144, 146–147

Debris Avoidance Maneuver (DAM), 145–151

decompression sickness (DCS), 285, 298–300

decrewing the ISS, 210–219

	 emergency response, 217–218

	 framing the discussion, 211–212

	 history of concept, 211

	 recrewing, 218

	 system changes, 213–216

training, 218

Degraded Joint OPerationS (DJOPS), 264

delta-V (orbital velocity), 149

Dempsey, Robert, 84, 88

demultiplexing, defined, 97

depressurization

	 preparing for, 47–48, 143

	 prior to EVA, 298–299

	 responding to, 213, 217, 346–347, 348

desaturation, Control Moment Gyroscope

	 (CMG) system, 131

desaturation thruster firings, 134

Dettwiler, MacDonald, 264

De Winne, Frank, 20

diagnostic equipment for in-flight maintenance

	 (IFM), 270

Diagnostic Maintenance, 269

Direct Current Switch Unit (DCSU), 163, 166

Direct-Current-to-Direct-Current Converter

	 Units (DDCUs), 158, 161, 165–166

direct current (DC) vs. alternating current

	 (AC), 157–158

directed position mode for rotating solar arrays,

170

discipline lead, role and responsibilities, 63

Discovery, Space Shuttle. See STS-120/ISS-10A

Display and Control Module, EMU, 288

distributed vs. non-distributed electrical

	 system, 157

docking systems

	 coordinating with solar arrays, 157

	 ground control for undocking, 213, 244

	 new commercial cargo vehicles, 242, 246

	 Progress supply vehicles, 46, 235

	 ship-to-ship communication, 228

	 Soyuz spacecraft, 31, 46, 235

	 Space Shuttle, 39, 41, 46, 235

	 structural, 39–41, 46

domains and redundancy, EPS, 159–160

Draeger tube, 303

Dragon (SpaceX) cargo vehicle

	 ammonia pump failure impact on schedule

	 	 for, 355

	 capture and berthing, 242, 243, 245

	 cargo delivery and loading, 240–241

	 crew training, 240

	 day of arrival, 241–245

	 flight controller training, 238–239

	 Flight Control Team perspective, 241

loss of, 289

overview, 236

	 preparation for, 237–245

	 scheduling, 237–238

	 SpaceX Dragon D1, 114

Dream Chaser cargo vehicle, 245, 246

drink bag, EMU, 289, 290

dry vs. wet cargo, 235

Dyer, Jason, 259

E

Early Communication System, 106

Early External TCS (EETCS), 198, 199, 201,

	 203, 205

Earth-facing science window, 51

effectors

C&DH system, 94

	 USOS Motion Control System, 129–130

Electrical Power System (EPS), 156–171. See 

 also batteries; solar arrays

	 design decisions, 157–159

	 domains and redundancy, 159–160

feedthroughs for power in habitat modules, 

	 	 37–38

heat transfer role, 200

	 jumper operations, 161, 215–216

	 overview, xxiv, 159–163

	 planning, energy balance, and load sheds,

	 	 161–162

	 power channels, 159, 160, 163

	 primary power system, 163–165
APPENDIX 393

	 redundancy, 159–160

	 secondary power system, 165–171

	 shock challenge when repairing solar array,

	 	 318–320

	 SPARTAN flight controllers’ planning role,

	 	 161, 162, 171, 356, 358

	 and Thermal Control System (TCS), 193, 204

Electrical Power Systems Position

(PHALCON), xxv

electrolysis to produce oxygen, 335

Ellington Field, 32

emergency equipment, 345–347

emergency response

	 crisis simulations, 182–187

	 decrewing the ISS, 217–218

	 environmental control, 348–350

	 fire, 217–218, 270, 336, 345, 346, 348

	 Rapid Depress, 47–48, 143, 213, 217,

	 	 346–347, 348

	 scenario exercise planning, 21

	 Toxic Atmosphere (ATM), 174–175, 178,

	 	 184, 217, 336, 347, 350

Endeavour, Space Shuttle, ix, 37, 80, 235, 252

energy balance, maintaining for EPS, 162

Engineering team, FCT’s coordination with, x

engineer training as common for flight

	 controllers, 175

Enhanced MDMs, 98–99

Enhanced Processor and Integrated

	 Communication (EPIC) controller card, 97,

	 	 114–115

Environmental and Thermal Operating Systems 

	 	 (ETHOS)

	 atmospheric humidity management after

	 	 decrewing, 213

	 operator level of certification for flight

	 	 controller, 177

	 responsibilities of, 334, 335, 336, 340, 341,

	 	 344–350

	 Toxic Atmosphere scenario, 174

Environmental Control and Life Support 

	 	 System (ECLSS), 334–350

	 atmosphere control, 335–339. See also

	 	 atmosphere control

	 emergency equipment, 345–347

	 emergency response, 348–350

	 planning for STS-130/ISS-20A, 64, 70–71

	 Regenerative ECLSS, 213–215

	 STS-130/ISS-20A issues, 85

	 temperature and humidity control, 340. See 

 also Thermal Control Systems (TCSs)

	 water recovery and management, 340–345

Environmental Control and Life Support 

	 Systems Position (ECLSS), xxv

Equipment Lock, 297

European Attached Pressurized Module. See

Columbus module

European Robotic Arm, 250

European Space Agency (ESA). See also

 Columbus module

	 Automated Transfer Vehicle (ATV), ix, xvi,

	 	 xviii, 46, 133, 235–236, 244

	 importance of Node 2 for, 307

role in ISS Program, xiv

EVA 1, STS-120/ISS-10A mission, Node 2 

	 temporary installation, 310, 312–313

EVA 2, STS-120/ISS-10A mission, SARJ 

	 inspection during, 311–312, 313–314

EVA 3, STS-120/ISS-10A mission, P6 segment 

release, 310, 314

EVA 4, STS-120/ISS-10A mission, focus

	 changes in, 310–311, 314, 316

EVA 5, STS-120/ISS-10A mission, planned

Node 2 preparation for Columbus module, 

 310

EVA 23, water-in-helmet incident, 290

EVA 24, Pump Module change-out, 360,

	 369–372

EVA 25, Pump Module change-out, 360,

	 372–376

EV hatch, 49

execute planning by Flight Control Team, 5,

	 7–11

Execute Planning Groundrules and Constraints

	 (Gr&C), 5

execution of a mission (“fly”), 63, 80–87

exercise sessions, scheduling challenges, 13, 24

Expedite the Processing of Experiments to the

	 Space Station (ExPRESS), xxiii, 46, 57

Expedition 1, US Laboratory, 54

Expedition 6, in-flight maintenance (IFM), 274

Expedition 7, exercising during, 25

Expedition 8, detecting leaks in windows, 52

Expedition 16, closeout panel, 58

Expedition 17, rack installation, 56

Expedition 18, robotics, 258

Expedition 19/20, hanging the plaque, 33

Expedition 22, relocating Cupola, 83

Expedition 24/25 (STS-120/ISS-10A), 51,

	 322–323

Expedition 26, robotics, 257

Expedition 27, Soyuz photo of Space Shuttle

	 docked to ISS, 235

Expedition 28, preparing to abandon ship, 

	 214–215

Expedition 29

	 payload rack, 58

	 preparing to abandon ship, 214–215

Expedition 30

free time during, 28

	 software upgrade story, 114–115

Expedition 31

	 graphics overlay usage, 243

	 software upgrade story, 114–115

video system management, 231

Expedition 32, EMU equipment, 296

Expedition 34, exercising on COLBERT, 73

Expedition 36, visiting vehicles, 244, 258

Expedition 37, visiting vehicles, 244

Expedition 38

	 Pump Module change out, 354, 361–377

	 visiting vehicles, 242

Expedition 39, visiting vehicles, 242

Expedition 41

	 ammonia leak warning, 184

	 visiting vehicles, 242

Expedition 42, ammonia leak warning, 184

Expedition 43, return to Earth landing, 31

Expedition 45

free time during, 28

	 visiting vehicles, 234

Expedition 46

	 Mobile Transporter repair activity, 30

	 Soyuz crew docking, 31

Expedition 47

	 Cygnus capture, 237, 259

	 Soyuz crew docking, 31

Expedition 49, pre-increment planning, 21

expedition designations to ISS, xix

Exposed Pallet (EP), 46

External Berthing Camera System (EBCS),

	 45–46

external DC-to-DC Converter Units (DDCUs),

166

External Operations (EVA) mode, 106. See also

	 ExtraVehicular Activities

External Stowage Platforms (ESPs), xxiii

External Television Camera Group, 230

External Thermal Control Systems (ETCSs),

	 	 197–204. See also ammonia-based 

 thermal transfer system

	 components and flow paths, 200

	 heat exchangers, 201–202. See also

	 	 InterFace Heat eXchangers (IFHXs)

	 loads and radiators, 202–204

overview, 194

	 pumps and accumulators, 199–201

	 radiators, 157, 159, 160, 161, 202–204

	 temperature and humidity control, 199, 334,

 340

external torques, managing, 132–133

External Wireless Instrumentation System, 42

ExtraVehicular Activities (EVAs), 280–303.

 See also spacewalk in detail

	 ammonia leak (outside) solution, 205

assembly of ISS, xv, xix

	 communication system for, 227–228

	 Control Moment Gyroscope (CMG) use in

	 	 robotic arm, 120

	 Cupola relocation, 85

	 EVA console at MCC, 269, 302

fatigue from, 301, 302

	 go-ahead tasks for, 292

	 historical perspective, 281–283

	 impact on daily routine, 30–31

	 importance of robotic arm for, 250

	 new Joint Airlock delivery, 272

	 Node 3 change in location, 66–67, 68–69,

	 	 72–75

	 physical dangers of, 280

	 planning and training for, 68–69, 290–292

	 PMA-3 relocation, 86

	 preparations and airlock, 296–301

	 Pump Module change-out (2013), 360,

	 	 364–365, 366–376

	 repair of robotic arm, 263–264

	 risk management, 301–303

	 testing and training, 77, 293–295

	 timelines for (STS-130/ISS-20A (2010)), 82
394 APPENDIX

	 tools, 295–296, 325, 330

	 unsticking of hardware, 274

	 value for further space exploration, 303

Extravehicular Mobility Unit (EMU), 283–289,

 290, 291

	 components and operation of, 283–289

	 failures during STS-120/ISS-10A, 323–324

	 fitting system, 288–289

gloves, 283, 286, 289, 371

	 life support in, 283, 285

	 managing risks of using, 302

monitoring from MCC, 302

preparing for P6 4B solar array repair, 320

	 Pump Module change out mission, 360, 366,

 371, 372

storage of, 301

	 water-in-helmet incident, 289, 290, 291,

	 	 355, 364, 365, 366

Eyharts, Leopold, 58

F

Failure Detection, Isolation, and Recovery

	 software, 105

failure scenarios in simulator, 179–182,

	 180–183

“false ammonia event,” 175

Fan/Pump/Separator (FPS), EMU, 290, 291

“feathering” of solar arrays, 161

feedthroughs for power, data, gas, liquids in

	 habitat modules, 37–38

Fengyun-1C weather satellite, destruction of,

	 151, 152

Fincke, Michael, 258, 289

fire

	 CSA-CP’s role in detecting, 336

	 decrewing the ISS, 217–218

ISS Post-Fire Cleanup Kit, 270

	 responding to, 345, 346, 348

flexible activities, use of, 16

“flexures,” defined, 169

flight control, history of, xxiii

Flight Control Center Houston, integration 

	 responsibility for execute planning, 14

Flight Controller Part Task Trainer simulator,

	 175, 176

flight controllers. See also Flight Control Team 

	 	 (FCT)

	 assignment to an increment, 21

	 certifications, xxvii–xxviii, 177

	 coordination of shifts, 23

	 engineer training as common for, 175

	 qualifications and training, xxvii–xxviii

SPARTAN planning role, 161, 162, 171, 

	 	 356, 358

	 visiting vehicle training, 238–239

Flight Control Room (FCR), xxiv, 23–24, 177

Flight Control Team (FCT). See also flight

	 	 controllers; flight director

	 attitude control coordination, 134–135

	 camaraderie for every increment, 33

	 communication methods among operators,

	 	 xxvi–xxvii

	 coolness under emergency scenario, 175

	 coordination of schedule and task

	 	 completion with crew, 16–17

	 crew as on-board eyes and ears for, 29,

	 	 216–217

EVA role, 302

	 evolution of schedule and daily operations,

 xxvi

	 foundations of, xii–xiii, 306

	 hierarchy of, xxiii

	 holiday celebrations with crew, 27

	 increment crew operations, 21–27

	 introduction, ix–xiii

	 major anomaly handling, 354–377

	 making adjustments for decrewed ISS,

	 	 217–218

	 mission role, 62–63

	 naming conventions, xxx

	 planning process, 4–7

power planning, 161

	 Pump Module repair Team 4, 359–376

	 robotics operations, 258–260

	 shift management, 25, 63–64

	 simulation training, 174–188

	 software upgrade role, 111–115

	 special teams for complex operations, 30

	 STS-120/ISS-10A Team 4, 314–318, 324,

	 	 329, 330–331

	 STS-130/ISS-20A mission execution, 80,

	 	 82–89

	 visiting vehicle operations, 244

Flight Crew Operations, merging with Mission 

Operations, xi

flight director “Flight”

	 assignment of, 21, 63–64

	 crew and FCT coordination role, 28

	 as crisis leader, ix–x

	 daily console log checking, 23–24

	 daily meeting planning activities, 27

leadership role, xxiii

	 mission execution role, 80, 82, 85

	 mission-making role, 62

	 qualifications for, xxviii

	 role of, ix–x

	 selection of, 177

	 training role, 76, 182–183

Flight Director Position (FLIGHT), xxv

Flight Director’s Suite, 24

flight engineers, designation for, xix

flight-like units, for testing software upgrades,

111

Flight Operations, x–xi. See also day in the 

	 life; Flight Control Team (FCT)

Flight Operations Directorate, xv, 251

Flight Readiness Reviews, 22

flight rules, xxiii–xxiv

flight-specific simulations, 177–180

flight surgeon conference with crew members,

28

FLIGHT voice loop, 178

Flow Control Valves (FCVs)

in Thermal Control System, 197, 199, 200, 

 203

	 troubleshooting 2013 failure, 358, 359

fluid loops, 188, 196, 206

Fluids Integrated Rack (FIR), 58

Fluid System Servicer, 270

Foale, Mike, 52, 65

food, psychological benefits of communal

eating, 29

foot restraints, EVA, 295–296

forced convection, 193

Foreign Object Debris, on P6 SARJ, 313–314.

See also debris avoidance

Fossum, Mike, 58, 214–215

Foundations of Flight Control, xii–xiii, 306

4-Box computer architecture, MCS, 121

“four-box testing,” and software upgrades, 112

“frankenhoses,” 75

Free Drift/Indicator control mode, 134, 239

Functional Cargo Block (FGB), xix, 135

G

Garr, John, 88

Gas Pressure Regulating Valve (GPRV), 201

Gemini Program, spacewalks, 281

General Purpose Computers (GPCs) on Space

Shuttle, 97

Generic Groundrules, Requirements, and

	 Constraints (GGR&C), 3, 9

Gennady Padalka, 20

geosynchronous transfer orbit, 142

Gerst, Alexander, 242

Gerstenmaier, William, 22

Getzelman, Hal, 84

Global Positioning Satellite (GPS)

	 antenna array to access, 126

in attitude determination, 127

for ISS navigation, 93

Motion Control System’s use of, 120

	 Russian Segment receivers, 126

	 and ship-to-ship communication, 228

	 as timekeeper, 101

	 US Segment receivers, 125–126

gloves, spacesuit, 283, 286, 289, 324, 371

Goetter, Chris, 329

Graphical User Interface (GUI), PCS, 102–103

graphics overlay for capture operations, 243

grapple fixtures, SSRMS, 254–255, 256, 257

gravity gradient forces impacting Motion

Control System, 129

Green debris risk level, 145, 146

Ground-based Electro-Optimal Deep Space

	 Surveillance system, 144

ground-based telescopes, debris tracking by,

144

ground control. See Flight Control Team (FCT)

ground determination of ISS location, 122–125

Ground Systems and Networks Position (GC),

xxv

Guidance, Navigation and Control Multiplexer/

	 	 DeMultiplexer (GNC MDM)

	 attitude control, 130
APPENDIX 395

attitude determination, 127, 128

	 and Beta Gimbal Assembly control of Solar

 Array Wings, 169

	 desaturation request, 131

	 function of, 93, 121–122

GPS adjustments, 126, 127

high-gain antenna, 224

Gulfstream G3 aircraft for returning crews to

USA, 32

H

Haddon, Robert, 329

Hadfield, Chris, 205

Ham, Ken, 56

handover training from crew to crew, 215, 218

“hanging the plaque” duty, 32–33, 88, 89

Hard Upper Torso, EMU, 297–298

Hasbrook, Annette, 329

Hassman, Derek, 329

hatches

	 air leak management role of, 349

as feedthroughs, 38

	 secondary structure components, 49–50

hatch windows, 50

heartbeat software, 105

heater patches to control condensation, 194, 195

heat exchangers. See InterFace Heat

	 eXchangers (IFHXs)

heat pipes, 166, 194

heat rejection point. See radiators

Heat Rejection Subsystem (HRS), 202, 203

heat transfer. See Thermal Control Systems 

	 (TCSs)

Heflin, Milt, xi

helmet cam video, EMU, 228

helmet lights, EMU, 289

Helms, Susan, 92

hemispherical antenna, LDR mode, 225

Herrington, John B., 228

high-data-rate (HDR) mode, S-band system,

	 224–225

High Efficiency Particulate Air (HEPA) filters,

340

high-gain antenna (HGA), 224, 225

high-level manifest, planning for the increment,

3

H-II Transfer Vehicle (HTV), Japan, 236,

	 	 237–245

	 cargo delivery and loading, 240–241

	 coordination for HTV5 mission, 258,

	 	 260–262

	 crew training, 240

	 day of arrival, 241–245

	 flight controller training, 238–239

overview, xviii

	 scheduling, 237–238

hobbies, pursuing on ISS, 27–28

hockey stick tool to prevent electrocution, 320,

321, 330

holidays and time off for crew, 3–4, 27–28

home control center, visiting vehicle missions,

	 238–239, 241

Hopkins, Mike, 242, 280, 361, 373, 374–375

Hoshide, Aki, 296, 371, 376

“hot cross-tie,” power channels, 160

Houston Support Group in Russia, xxvii

HTV Berthing Camera System, 46

humidity levels in ISS atmosphere, 199, 

	 213–215, 337

humor, need for in ISS environment, 29

Huntsville Control Center, xiii, xxvi, xxix, 294

hypergolic propellant, 121

hypervelocity impacts, 141. See also debris 

	 avoidance

I

IBM T61 laptop as PCS, 101

increment crew operations, 20–33. See also

	 	 making of a mission

	 complex operations, 30–31

	 conferences, crew to ground, 28

	 controllers and crew daily routine, 22–27

	 ground preparations, 21–22

	 increment defined, xix, 3

	 planning of increment, 2–11, 26–27

	 Red Line, chasing of in daily activities, 29

	 return to Earth, 32–33

	 time off for crew, 27–28

Increment Definition and Requirements

	 Document (IDRD), 3, 7

Increment Overview, 5, 6

Increment Requirements Definition Document,

	 26–27

in-flight maintenance (IFM), 268–277

	 air leaks, 271–272

Carbon Dioxide Removal Assembly 

	 	 (CDRA), 275

Centerline Berthing Camera System 

	 	 (CBCS), 271

Command & Control MDMs, 273

	 EVA activity for, 280, 303

methodology, 269

	 mod kit, 277

	 tools and diagnostic equipment, 270

	 unsticking hardware, 273–274, 276

inhibits to electrical voltage, for safety, 158

input/output cards, Multiplexer/DeMultiplexer

	 (MDM), 99

insulation, Internal Thermal Control System 

	 (ITCS), 194, 195

Integrated Truss System “the truss”

	 attachment sites, 39, 43

	 components color-coded by country, xvii

	 Mobile Transporter parking, 257

naming of segments, 43

	 overall structure of, xv, 36–46

	 Photo-Voltaic Modules (PVMs), 159

	 Radiator Beam Truss Structure, 203, 204

	 robotic arm’s role in assembling, 252

	 Space Vision System (SVS) for connecting,

	 	 45

	 thermal control components, 198

Integration for Visiting Vehicles Position (ISE),

xxvi

Intel 386 processor, 97

InterFace Heat eXchangers (IFHXs)

	 ammonia leak, 174–175, 184, 217, 347, 350

and limits of TCCS, 338

	 in Node 3 modification, 66

	 and Pump Module failure, 357

	 schematics, 196, 200

	 structure and thermal process role, 201–202

InterModular Ventilation (IMV), 213, 217, 339,

340, 347

Internal Audio Controllers (IACs), 178

internal DC-to-DC Converter Units (DDCUs),

166

Internal Thermal Control Systems (ITCSs),

	 194, 205–207, 216. See also InterFace Heat

	 	 eXchangers (IFHXs)

Internal Wireless Instrumentation System, 42

International Docking Adapter extensions, 46

International Execute Planning Team (IEPT),

	 5–11

international nature of ISS operations, naming 

	 conventions and language issue, xxx

international partner presence. See also

	 	 Canadian Space Agency (CSA);

	 	 	 European Space Agency (ESA); Japan

	 	 	 	 Aerospace Exploration Agency

	 	 	 	 	 (JAXA); Russian partner agency

	 Canada’s robotics contribution, 251

	 DPC participation, 22

at MCC-H, xxvii

International Partners Liaison Position (RIO),

xxv

International Space Station (ISS). See also

 assembly of ISS

	 Assembly Complete configuration, 36

	 components by contributing country, xvii

	 composite images, xvi

	 historical overview, xiii–xv

	 logistical complexities, 234

	 modularity of, xxi–xxii

with Node 3 and Cupola installed, 87

	 orbit compared to space debris, 142

	 planning of, 2–17

radiator panels, 192

size of, xviii

	 solar arrays image, 156

	 structural overview, xv–xvii

	 technical names for components, xv, xvii

internet

	 access on ISS, 27

live-streaming video from ISS to, 230

Inventory Management System, rack location

	 designations, 58

iodinated water, 340

Iridium 33 communications satellite, 141, 151,

	 152

isolation software, 105

Isolation Valve, IFHX, 202

ISS Flight Control Positions, xxv, xxx

ISS Leak Kit, 270

ISS Management Console, xxvii

ISS mission designations. See entries 

beginning with STS
396 APPENDIX

ISS Mission Management Team (IMMT), xxiii,

9, 24, 30, 369

ISS Post-Fire Cleanup Kit, 270

ISS Program Office, xxiii, xxvii

ISS Research Integration Office, xv

ISS Toolbox, 270

J

Japan Aerospace Exploration Agency (JAXA),

xiv, 307

Japanese Airlock hatches, 49

Japanese Experiment Module (JEM)

	 External Exposure Facility, xv, 46, 262

	 racks in, xxii, 55, 56

Remote Manipulator System Main Arm and 

	 	 Small Fine Arm, 250

	 windows in, 51

Japanese H-II Transfer Vehicle. See H-II 

	 Transfer Vehicle (HTV)

“job jar” activities, 27

Joint Airlock (Quest), 49–50, 272, 283,

	 296–297, 298, 299

Joint Operations, in visiting vehicle operations,

	 239, 241–243

Joint Operations Panel (JOP), 21, 25–26, 32

“joint sims,” 63

Joint Space Operations Center (JSpOC), 145,

147, 148

Joint Station Local Area Network (JSL), 216

“Jules Verne” (ESAATV), 244

jumpers

	 crew installation of, 161

	 Launch-To-Activation (LTA), 68

	 role in Electrical Power System (EPS),

	 	 215–216

UOP Bypass Jumper, 216

	 for video connection problem, 271

K

Ka-band communication system, 222

Kelly, Scott, 28, 33

Kharmats, Paul, 26

Knight, Norman, 376

Kononenko, Oleg, 28

Kopra, Tim, 33

Kornienko, Mikhail, 28

Kosmos 2251 military communications

	 satellite, 141, 151

Kotov, Oleg, 27, 361, 369

Kounotori (White Stork). See H-II Transfer 

	 Vehicle (HTV)

Kowalczyk, Bill, 376

Kraft, Christopher Jr., xi, xii, xxiii

Kranz, Gene, xi, xii

Krikalev, Sergei, 54

Ku-band communication system, 97, 127, 216,

	 223, 224, 225–227

Ku Communications Unit (inside ISS), 226

Kuipers, Andre, 230, 231

L

Laboratory (Destiny) module (USOS)

	 activating computers on, 107

	 and Control Moment Gyroscopes (CMGs),

 121

development of, xv

	 Expedition 1 installation of, 54

	 ground construction of, 37

	 Robotic Workstation (RWS), 258

	 Thermal Control System elements, 195, 198,

	 	 205–206

and user-friendly naming of modules, xvii

	 window in, 51

Lammers, Michael, 24, 26, 33

Latching End Effector (LEE), 254–255, 260,

261, 263

Launch-To-Activation (LTA) jumpers, 68

L-band communication system (for GPS), 222

Lee, Andrew, 33

Lee, Mark, 282

Lessons Learned reviews

	 making of a mission, 87–88

	 planning the ISS, 14–17

	 software update and handling change, 116

	 spacewalk (STS-120/ISS-10A), 330–331

life support, xxiv, 70, 334–350. See also

Environmental Control and Life Support 

 System

Life Support System Backpack, 299

Lindgren, Kjell, 23, 33, 242, 262

Liquid Cooling and Ventilation Garment

	 (LCVG), 287, 297, 299

Lithium Hydroxide (LiOH) canisters, 336

loads and radiators, ETCS, 202–204

load sheds, controlling, 105

Load Shed Table, 117

Local Vertical, Local Horizontal (LVLH), 123,

	 124, 125

locating the ISS. See Motion Control System 

	 (MCS)

longeron shadowing, 170–171

long-range planning (LRP) team, 7–8, 12–13

Loop Crossover Assembly, 188, 206

Lopez-Alegria, Michael E., 228

loss of supply missions, dealing with

Cygnus, 289

	 multiple losses challenge (2014–2015),

	 	 234–235

	 Progress 44P, 210, 211, 214–215, 218–219

lost items on ISS, 4

low-data-rate (LDR) mode, S-band system,

	 224–225

low-Earth orbit, forces impacting Motion

	 Control System (MCS), 128–129. See also

	 	 debris avoidance

Lower Torso Assembly, EMU, 289, 297

Low Temperature Loop (LTL), ITCS, 177–178,

	 206, 216, 340, 344–345

Lu, Ed, 25

M

Main Bus Switching Units (MBSUs), 160, 163,

167, 310

maintenance activity category, 29

major anomalies, handling, 354–377

Major Constituent Analyzer (MCA), 336

making of a mission, 62–89

	 execution of mission (fly phase), 63, 80–87

	 Lessons Learned review, 87–88

	 planning, 62, 63–75

	 training, 62–63, 75–79

Malenchenko, Yuri, 309, 310

manual berthing mechanism, 40

manual free mode for rotating solar arrays, 170

Manual Pressure Equalization Valves

	 (MPEVs), 339

Marshburn, Tom, 73

Mass Storage Disk (MSD), 99

Mast Camera, 256

Mastracchio, Rick, 280, 300, 354, 361, 368,

369, 373

Maximum Absorption Garment, 297

McMillan, Courtenay, 33

mechanical radars, debris tracking, 144

Medical support position (BME), xxv

Melroy, Pam, 309

metabolic rate, monitoring during EVAs, 302

microgravity

	 difficulty of maintaining fire, 193, 345

	 managing atmospheric mixing in, 336–337

	 Neutral Buoyancy Lab approximation of, 293

	 thruster use impact on, 132

Vomit Comet’s training in, 294

Microgravity mode, 106

MicroMeteoroid and Orbital Debris (MMOD),

48, 283, 286, 301

microphone, EMU, 288

Mighty Mouse software, 107

Military Standard 1553 communication

	 protocol, 99

Millstone/Haystack radar complex used to

	 track orbital debris, 143

mini simulations, 175–176

Mini-Workstation, EMU, 296, 298

Minnie Mouse software mode, 107

Mir space station, xiv–xv, 46

mission cognizance, training for, 177

Mission Control. See Flight Control Team 

	 (FCT)

Mission Control Center CST-100, 246

Mission Control Center – Dulles (MCC-D),

xiii, xxviii

Mission Control Center – Houston (MCC-H or

	 	 Houston)

	 international partner presence, xxvii

overview, xiii

propulsion to higher orbit for debris 

	 	 avoidance, 148–149, 151

	 visiting vehicle mission role, 239, 241, 244
APPENDIX 397

Mission Control Center – Moscow (MCC-M

	 	 or Moscow)

overview, xiii

propulsion to higher orbit for debris 

	 	 avoidance, 148–149, 151

	 visiting vehicle mission role, 239

Mission Control Center – SpaceX (MCC-X),

xiii

Mission Evaluation Room (MER), xxvii

Mission Operations, merging with Flight Crew 

Operations, xi

Mission Operations Support, xv

mission patch, x–xi

mission planning. See planning the ISS

Mobile remote servicer Base System (MBS),

	 37, 256–257

Mobile Servicing System (MSS), 258–264

	 crew operations and Robotic Workstation,

	 	 258

	 ground/crew coordination case study,

	 	 260–262

	 ground operations and FCT, 258–260

	 operational challenges and triumphs,

	 	 262–264

Mobile Transporter, 30, 37, 256–257, 308

Moderate Temperature Loop (MTL), ITCS,

	 177–178, 206, 216

Moderate Temperature Thermal Control 

	 System rack, 57

mode transitions, computer system support

for, 106

momentum management, 132–133

Monthly Calendar Plan, 5, 15–16

Montreal Control Center, xiii, 259

Moscow Support Group at MCC-H, xxvii

Mostly Liquid Separator (MLS), 343

Motion Control Position (ADCO), xxv

Motion Control System (MCS), 120–136

	 assembly of, 135

	 attitude control, 93, 120–121, 128, 129–136

	 attitude determination, 127–128

	 computer system elements, 121–122

	 control modes, 134–135

	 ground determination of ISS location,

	 	 122–125

	 orbit determination of ISS location,

	 	 125–127, 135

	 rocket thruster control, 128–129

	 Russian Segment attitude control, 133–134

	 US Segment attitude control, 132–133

	 vectors, 122–125

Mularski, John, 376

Multi-Filtration Beds, 344

MultiLayer Insulation (MLI), 48, 311, 312

Multiplexer/DeMultiplexers (MDMs). See also

 individual MDMs by name

failure of, 84, 106, 262

	 function in computer system, 94, 95–101

simulation failure, 177

and software upgrades, 111

multiplexing, defined, 97

Multipurpose Laboratory Module (RSA), xxi,

	 250

Multi-Purpose Logistics Modules (MPLMs),

	 xviii, 252, 271

Multipurpose Support Room, xxiv

Munich or Columbus Control Center, xiii, xxviii

N

NASA, integration responsibility for ISS, xv

NASA Johnson Space Center, pre-increment

	 planning, 5

NASA/Marshall Space Flight Center, xxviii

Nespoli, Paolo, 235, 309

Neutral Buoyancy Laboratory (NBL), 66, 77,

	 79, 293, 365, 366

Neutral Buoyancy Simulator, Huntsville,

Alabama, 294

Next Worst Failure analysis, 361–362, 366

Nitrogen Introduction Assembly, 206

Nitrogen Tank Assembly (NTA), 200, 201

Node 1 (Unity)

CBCS wiring, 271

	 modification to accommodate Node 3, 64,

	 	 65–67

	 relocation of, xxi

Node 2 (Harmony)

delivery and temporary installation, 307, 

	 	 310, 312–313

	 InterModular Ventilation (IMV), 339

	 in making of a mission, 64

preparing for Columbus module, 310

	 relocation of, xxi

Node 3 (Tranquility)

	 activation of, 84–85

	 assembly mission to attach, 63

	 change in planned location of, 64–66

	 and Cupola relocation, 83

on Endeavour, 80

	 EVA planning for, 66–67, 68–69, 72–75

	 remodeling activities around installation of,

	 	 70–73

	 in Space Shuttle, 37

Node Control System (NCS), 106–107

Node Multiplexer/DeMultiplexers (Node

	 MDMs), 106

Noguchi, Soichi, 27

non-distributed vs. distributed electrical

	 system, 157

Nyberg, Karen, 244, 258

O

Obama, Barack

	 Constellation Program redirection, 89

	 linkup with ISS crew, 82, 86

Okuda, Mike, xi

Onboard Data Interfaces and Network (ODIN)

team, 93, 106, 262

Onboard Short Term Plan (OSTP), 5, 9, 10–11

On-orbit Operations Summary (OOS), 5–9

on-the-job training, flight controller, 177

Operational state, MDM, 100

Operations Planning TIMeline Integration 

	 System (OPTIMIS), 10–11, 16–17

Operations Support Officer (OSO) team, 64,

66, 69, 84, 269

operations team, software upgrades, 111–116

operator level of certification for flight

	 controller, 177

OPS PLAN team

	 execute planning, 7–8, 12–13

	 monthly calendar plan, 15–16

Planning Position, xxv

	 post-increment analysis, 17

orbital adjustments to accommodate visiting

	 vehicle schedule, 237, 240

orbital altitude of ISS, 122–123

Orbital ATK Control Center (MCC-D), xxviii.

See also Cygnus cargo vehicle

Orbital Conjunction Message (OCM), 146

orbital debris, density by altitude, 152. See also 

	 debris avoidance

orbital-raising maneuver to avoid debris. See

Reboost mode

Orbital Replacement Units (ORUs), xxii–xxiii,

	 36, 223, 257, 273

orbit determination of ISS location, 125–127,

	 135

orbiter, defined, xiv

Orbiter Boom Sensor System (OBSS), 317,

	 320–322, 323, 327, 330

Orlan spacesuit, Russian, 281, 283, 289

oxygen. See also atmosphere control

	 supply to EMU, 285, 335

usage during EVAs, 302

Oxygen Generator Assembly (OGA), 82, 335,

	 339, 344, 345, 361

P

P6 PhotoVoltaic Control Unit (PVCU) MDMs,

106

P6 solar arrays

	 location of, xvii

	 plans for movement of, 308–308, 310

P6 4B solar array repair (STS-120/ISS-10A),

	 	 314–330

	 airlock distance from, 321

	 boom sensor break risk, 321–323

	 bounciness of boom issue, 320–321

	 crafting repair materials on orbit, 318

	 cuff link solution, 318–319, 328

	 damage location challenge, 316–317

	 electric shock and sharp edges hazards,

	 	 318–320

	 EVA operation, 327–330

	 images of damage, 315, 317, 325

mysteries in damage, 317

	 planning for, 324–326

	 spacesuit failures, 323–324

	 time constraints for, 324
398 APPENDIX

Padalka, Gennady, 33

Parazynski, Scott, 309, 310, 311, 313–314,

	 316, 320, 321, 322, 324–329

Parmitano, Luca, 244, 290, 355

Part Task Trainer simulator, 175, 176

Passive Thermal Control Systems (PTCSs),

	 192, 194–195

patch, mission, x–xi

Patrick, Nick, 75, 78, 83, 84, 85

Payload Multiplexer/DeMultiplexers (Payload

	 MDMs), 98–99, 273

payload operations director, xxvi

Payload Operations Integration Control Center, 

Huntsville Alabama, xxvi, xxix

Payload Orbital Replacement Unit

	 Accommodation (POA), 256, 257

payload racks, 54, 57, 58

Peake, Tim, 33

Permanent Multipurpose Module (PMM), xviii,

	 38, 50, 72–73

Perrin, Phillippe, 263

Pettit, Donald, 114–115, 258, 274

phased array radars, debris tracking, 144

phasing portion of visiting vehicle mission, 241

phone calls, crews’space-to-ground, 28

Photo-Voltaic Modules (PVMs), 159, 163, 164,

	 168–169

PhotoVoltaic Radiator (PVR), 202–203

PhotoVoltaic Thermal Control System

	 (PVTCS), 198, 199, 201, 203, 205

pin kits for resolving electrical failures, 161

Pistol Grip Tool, 296

“pizza box” around ISS for close debris

	 encounters, 145

Planning Product Change Request (PPCR),

	 11–12

planning the ISS, 2–17

	 components of mission plan, xxiii

	 configuration management, 11–13

	 increment planning, 5–11

	 lessons learned, 14–17

	 long-range planning, 2–5

	 scheduling changes, 13–14

Plasma Contactor Units, 320

PLug-in-plan and UTilization Officer

	 (PLUTO), xxv, 93, 216

plume impingement, 170

Pointing position of the ISS Position 

	 (Pointing), xxv

pointing systems, 168–170

	 Beta Gimbal Assemblies, 111, 125, 163,

	 	 169–170

	 Solar Alpha Rotary Joints, 168–169. See 

 also Solar Alpha Rotary Joints (SARJs)

Portable Breathing Apparatus (PBA), 346, 347,

	 350

Portable Computer System (PCS), 93,

	 101–103, 111, 112–113, 216

Portable Fire Extinguisher (PFE), 346, 348

Positive Pressure Release Assembly (PPRA),

336

Positive Pressure Relief (PPR), 186, 217

postflight crew activities, 32

Post Increment Evaluation Report, 17

post-sleep time on ISS, 22–23

potable water, 340

Potable Water Dispenser (PWD), 344

Power and Data Grapple Fixture (PDGF),

	 254–255, 256, 257

power buses, 168

power channels

	 cross-ties, 160

diagram of, 163

EPS design, 160

	 role in EPS, 159, 163

variations in output of, 161

power distribution, 166

power planning, 161

power system. See Electrical Power System

	 (EPS)

power tools, 270

prebreathe of oxygen prior to EVA 

	 depressurization, 298–299

Predetermined Debris Avoidance Maneuver

	 (PDAM), 148, 149–151

Pre-Positioned Load (PPL), 105

presleep time for crew, 24

Pressure Control Assembly (PCA), 335–336

pressure level of fluid lines in TCS

	 accumulator management, 197, 199–201

	 movement challenges, 363–365, 367–368

pressurized habitat modules

	 assembly of, 38–41

	 internal cooling loops for, 205

	 in overall structure, 37

Pressurized Mating Adapter (PMA) modules

movement of, xxi

PMA-2, xv, xvi, 40, 271

PMA-3, 67, 69, 70, 71, 72, 73, 86, 271

Preventive Maintenance, 269

Primary Power System, 163–165

	 batteries, 165

	 Battery Charge/Discharge Units (BCDUs),

	 	 165

	 overview, 156–157

	 power channel cross-ties, 160

	 sequential shunt units (SSUs), 165

	 solar arrays, 163–165

Primary state, MDM, 100

primary structure components, 36–46. See also

 Integrated Truss System

	 pressurized module assembly, 37, 38–41, 205

	 ready-to-latch requirement, 44–46

	 structural health, 42–43

privacy for crew during off-time, 24, 28

probability of collision (Pc), 145

Probability of No Penetration, 48

“probe-and-cone” docking system, Russian

modules, 38

problem recognition, training for, 177

Product Water Tank, 344

Program Office, USOS, xv

Progress supply vehicles

	 attitude control from Russian Service

 Module, 120, 133

	 decrewing plan for, 213

	 docking system, 46, 235

	 loss of 44P and decrewing discussion, 210,

	 	 211, 214–215, 218–219

overview, xv, xvi, xviii

propellant transport for reboost activities, 235,

236

Proximity Operations mode, 106

psychological support for crew

daily routines, 24, 29

	 holidays and time off, 3–4, 27–28

	 privacy during off-time, 24, 28

public relations

	 Obama’s call to crew, 82, 86

	 as role for crew and flight controllers, 29, 369

	 video live-streams to internet, 230–231

pump accumulator quantity, 178

pump and control valve package, 200

Pump and Flow Control Subassembly (PFCS),

197, 199, 203

Pump Module

	 changing out, 354, 358–359, 360, 362–363,

	 	 368, 370–376

	 jettison option, 365

	 location of, 362

	 process schematic, 200

	 workings of, 199–201

Q

Quick Disconnect (QD) problems, 360,

	 363–365, 367, 369, 370, 373–374

R

Rack Power Switch, 346

racks, 54–58

	 Atmosphere Revitalization Rack, 338

	 avionics, 54, 57

	 crew support, 54

	 Fluids Integrated Rack (FIR), 58

	 installation process, xxii

	 Moderate Temperature TCS, 57

	 Node 3 installation, 84–85

	 payload, 54, 57, 58

	 Sabatier rack, 337, 344

	 and stowage space, 54

	 Window Observation Rack Facility, 51

Radiator Beam Truss Structure, 203, 204

Radiator Return valve, 359, 364, 366

radiators

	 coordination with solar arrays, 157

	 process schematic, 200

radiator panels, 192, 202

	 role in Thermal Control System, 196–197,

	 	 202–204

	 Thermal Radiator Rotary Joint (TRRJ), 187,

	 	 200, 204, 356, 357, 358

	 Trailing Thermal Control Radiator (TTCR),

	 	 202, 203, 205

Radio Frequency Group (RFG), 223

radio frequency spectrum, 223. See also RF 

	 (radio frequency) links
APPENDIX 399

Rapid Depress, 47–48, 143, 213, 217, 346–347,

348

Rassvet (“Dawn”) Mini Research Module

	 (MRM)1, 253

Rate Gyro Assemblies (RGAs), 127

rate mode for rotating solar arrays, 169–170

Ray, John, 329

Ready to Latch (RTL) indicators, 39, 44–46

Reagan, Ronald, 251

Reboost mode

	 propellant transport for, 235, 236

purpose of, 106

	 time of ignition (TIG), 134, 151

recirculation loops in Regenerative ECLSS, 215

recovery software, 105

recrewing, 218

Red orbital debris risk level, 145–146, 147

Redundancy Management (RM), 106

Regenerative ECLSS, 213–215

Regenerative Heat Exchanger, 206

Remote Bus Isolators (RBIs), 166, 167

remote control in EPS, 158–159

remote login to ISS, 227

Remote Power Controllers (RPCs), 166

Remote Power Control Modules (RPCMs), 94,

	 168, 216, 255–256

Remote Terminal (RT), 100

Renfrew, Royce, 261

research. See scientific research

respirators, 346, 347, 350

resupplying ISS. See visiting vehicles

return line, Active Thermal Control System, 197

return to Earth, 31, 32–33

RF (radio frequency) links, 223–228

	 Ku-band, 97, 127, 216, 223, 224, 225–227

	 S-band, 223–225

ship-to-ship, 228

	 UHF, 227–228, 287–288

	 Wireless External Transceiver Assembly,

 228, 230

robotics, 250–264. See also Space Station

	 	 Remote Manipulator System (SSRMS)

	 crew and ground control coordination case

	 	 study, 260–262

	 ground operations and FCT, 258–260

	 Mobile Servicing System Operations (MSS),

	 	 258–264

	 operational challenges and triumphs,

	 	 262–264

	 Robotic Workstation (RWS), 46, 230,

	 	 242–243, 258

	 Space Station Remote Manipulator System,

	 	 252–255

	 Special Purpose Dexterous Manipulator,

	 	 255–256

	 working with Ready to Latch indicators, 44

robotics and spacewalks activity category, 29

Robotics Officer (ROBO) team, xxvi, 258–260,

261, 262, 264

Robotic Workstation (RWS), 46, 230, 242–243,

	 258

Rocketdyne Truss Attachment System, 42

rocket thrusters. See thrusters

Roden, Sean, 329

roll ring structure, 169

Romanenko, Roman, 20

Ross, Jerry, 298

rotating joints for solar array adjustment, 

	 168–169

rotational control. See attitude control

Russian Functional Cargo Block (FGB), 157

Russian partner agency. See also Soyuz crew

	 	 vehicle

	 Daily Planning Conference participation, 22

	 investigation of Progress 44P loss, 218–219

at MCC-H, xxvii

as partner in ISS, xiv

	 role in ISS development, xiv–xv

Russian Segment (RS), xiv. See also Service

	 	 Module (SM)

	 ammonia leak response, 175, 350

	 Command and Control System interface, 93

	 computer network, 93, 97

debris shielding in, 49

	 docking system, 31, 46, 235

	 ETHOS coordination for life support

 system, 334

	 GPS receivers, 126

	 impact on solar array constraints, 170–171

Motion Control System, 120, 121, 128, 

	 	 133–135

	 multiple duplicate units in computer system,

 100

	 power design differences from USOS, 156

	 Rassvet (“Dawn”) Mini Research Module

	 	 (MRM)1, 253

	 round hatches of, 49

	 structural comparison to USOS, 38–39

	 systems backup limitations for USOS, 362

Russian (Orlan) spacesuit, 281, 283, 289

Ryazanskiy, Sergey, 361

S

Sabatier, Paul, 344

Sabatier rack, 337, 344

safe haven procedures, 151, 153, 175

SAFER backpack unit, 282–283, 295, 298,

299, 301

“safing function” in managing EPS, 158

Sample Delivery System (SDS), 336

S-band Antenna Support Assembly, 310

S-band communication system, 223–225

scheduling changes

	 generic skill-based training for crews, 4

	 planning the ISS, 13–14

	 tools for dealing with, 5, 15–16

science activity category, 29

Scientific Linux, 101

scientific research missions

	 and crew time constraints, 14

development of, xv

life support for, 338

	 microgravity maintenance for, 132

	 NASA’s job in facilitating, xii–xiii, xv

	 need for higher Ku-band link rate, 226

	 negative impact of ammonia pump failure,

 361

	 planning of, 3, 5, 14

	 Rassvet Mini Research Module 1, 253

	 windows used for experiments, 51

Scopemeter, 270

“scratch pane” of window, 52

Secondary Power System, 165–171

	 Direct Current Switch Unit (DCSU), 163,

 166

	 Direct-Current-to-Direct-Current Converter

	 	 Units (DDCUs), 158, 161, 165–166

	 jumpers, 68, 161, 215–216, 271

	 longeron shadowing, 170–171

	 Main Bus Switching Units (MBSUs), 160,

 163, 167, 310

	 overview, 157

	 pointing systems, 168–170

power buses, 168

power distribution, 166

	 Remote Power Control Modules (RPCMs),

 168

	 solar array constraints, 170

secondary structure components. See also

docking systems

	 closeout panels, 58–59

	 hatches, 38, 49–50, 349

	 orbital debris shielding, 46–49, 53, 141–143

	 racks, 54–58. See also racks

	 windows, 38, 50–53

Segment-to-Segment Attachment System, 42

sensors

in Command & Data Handling System 

	 	 (C&DH), 94, 99

	 dedicated and collateral for debris tracking,

	 	 143–144

	 Orbiter Boom Sensor System (OBSS), 317,

	 	 320–322, 323, 327, 330

Sequential Shunt Units (SSUs), 163, 165

Service Module (SM), Russian Segment. See 

 also thrusters

attitude determination, 128

	 Debris Avoidance Maneuver (DAM),

	 	 148–149

	 Electrical Power System design for, 157

	 Motion Control System for, 120, 121, 135

	 windows of, 50

Service Module Central Computer (SMCC),

93, 97

Service Module Terminal Computers (SMTCs),

97

Shepherd, Chelsea, 33

ship-to-ship RF link, 228

Short Term Plan (STP), 5, 9–10, 11–12

“ShRECs,” xix

Sierra Nevada Corporation, 245

Simplified Aid for EVA Rescue (SAFER),

	 282–283, 295, 298, 299, 301

simulations. See also crisis simulations

	 for decrewing, 218

mission training role, 63, 76
400 APPENDIX

	 robotic arm maneuvers, 239–240

software upgrade, 111

	 visiting vehicle missions, 239

single-loop configuration, ITCS, 206–207

Single MT or Single LT mode for pumps, 178

Skylab, xiii, 135

sleep time for crew, 24

Smith, Brian T., 243

Smith, Steve, 298

smoke detectors, 345–346

“Snoopy” cap, EMU, 288

software

	 state of charge (SOC) calculations, 162

	 updates to, 110–116

	 User Application Software, 105–106

Solar Alpha Rotary Joints (SARJs)

	 Electrical Power System function, 160, 163,

	 	 168–169

issue with during STS-120/ISS-10A, 

	 	 311–312, 313–314

and software upgrades, 111

	 structure of, 311, 312

	 vs. Thermal Radiator Rotary Joint (TRRJ),

 204

	 in truss structure, 42

solar array blankets, 163, 164, 316

solar array masts, 163, 164, 170

solar arrays, See also P6 solar arrays; P6 4B

solar array repair; Solar Alpha Rotary Joints

	 	 (SARJs)

	 in assembly of ISS, xix, xxi, 157, 164–165

	 battery charging/discharging, 157, 165

deployment of, 164

	 as electrical power sources, 156–157

	 location and size, 308

	 longeron shadowing, 170–171

	 motion control considerations, 124, 125

	 parking to accommodate visiting vehicles,

 111, 170

power output, 161

power planning for, 162

	 in primary power system, 159–160, 163–165

	 retraction problems, 164–165

	 Sequential Shunt Unit (SSU) operation, 165

and software upgrades, 111

	 structure of, 164, 315–316

	 surface-on image of all, 156

	 thruster impact on, 131–132

	 and torque compensation, 132

Solar Array Wing (SAW), 163, 164, 169, 315

solar inertial attitude, 192–193

solar radiation pressure impacting motion

	 control, 129

Solid Oxygen Generator “candles,” 335

Solid State Mass Memory Units (SSMMUs), 99

Soviet Union, xiv

Soyuz crew vehicle

	 as crew transport, xix, 20–21

	 docked at ISS, xvi, 235

	 docking system, 31, 46, 235

	 as emergency escape vehicle, 348, 349, 350

landing of, 31

Soyuz U and FG rockets, investigating fault

with, 210

space-based optical surveillance, debris

	 tracking, 144

Spacecraft Communicator Position

	 (CAPCOM), xxv

Space Integrated GPS/Inertial Navigation

	 System (SIGI) receivers, 121, 126

space junk. See orbital debris

Space Operations Support Center (SOSC),

xxviii

Space Shuttle Program. See also making of a

	 	 mission; entries beginning with STS

and C&C MDM triple failure, 273

	 crew contribution to ISS assembly, 309

	 debris tracking and evaluation, 146

	 docking system, 39, 41, 46, 235

	 EMU design vs. ISS, 283, 285

	 EVA training vs. ISS, 294, 295

	 flight control vs. ISS, xxvii

planned EVA to test repair of orbiter tiles, 

	 	 310–311

	 program defined, xiv

	 role in ISS development, xiii–xiv, xv

	 spacewalk role in ISS assembly, 281–282

transport role for ISS, xviii

Space Shuttle Program Office, xv

Space Station Freedom, xiii, xiv, 43, 44–45,

	 170–171, 225

Space Station Integration and Promotion

	 Center (SSIPC) (Tsukuba, Japan), xxviii

Space Station Remote Manipulator System

	 	 (SSRMS) (“big arm”), 251–255

	 in capturing visiting vehicles, 239, 254

	 challenges of bringing into operational

	 	 status, 262–264

	 controlling from Cupola Workstation, 242

	 Control Moment Gyroscopes (CMGs) in,

 120, 132

	 vs. EVA in planning ISS assembly tasks,

 290, 291

	 grapple fixtures, SSRMS, 254–255, 256, 257

handling of OBSS during solar array repair, 

 317

	 ISS assembly role, 68, 252

	 joints and rotations, 252, 253, 254

	 location and appearance, 37, 252

	 in operation, 257

	 summary of properties, 251

	 vehicle berthing role, 239–240

	 working with during EVA, 250, 301–302

Space Surveillance Network (SSN), 143, 145

Space-to-Ground Antenna, 226

Space-to-Ground Subsystem. See Ku-band 

	 communication system

Space-to-Ground (S/G) voice loops, xxvii, 178,

224

Space Transportation System (STS)

designations, xiv, xix. See also entries 

 beginning with STS

Space Vision System (SVS), 44

spacewalk in detail (STS-120/ISS-10A),

	 	 306–331

	 flight days 1–3 (launch, rendezvous, motor

	 	 check of SARJ), 311–312

	 flight days 4–5 (EVA 1: payload, Node 2),

	 	 312–313

	 flight days 6–7 (small scale distractions and

	 	 SARJ inspection), 313–314

	 flight days 8–12 (P6 solar array repair),

	 	 314–330

	 last-minute added spacewalks, 310–311

	 lessons learned, 330–331

	 original mission, 307–308

	 planning, 309–310

	 Wheelock’s personal perspective, 322–323

Spacewalks Position (EVA), xxvi

SpaceX Control Center (MCC-X), xxviii, 246.

See also Dragon (SpaceX) cargo vehicle

Special Purpose Dexterous Manipulator

	 (SPDM), 43, 255–256

Standard MDMs, 98

Standard mode, ISS, 106

Standby state, MDM, 100

Starboard Thermal Control Radiator, 202, 203

Starboard Thermal Radiator Rotary Joint 

	 (TRRJ), 356, 357, 358

Starliner crew vehicle, 246

star mappers on Service Module, 128

state of charge (SOC) software calculations, 162

state vector in orbit determination, 125

Station Power, Articulation, Thermal, and

	 Analysis (SPARTAN), 161, 162, 171, 356,

	 	 358

Station Support Computer (SSC), 93

Stover, Scott, 36, 215, 329

Stowage Officers (ISOs), 4

stowage space, managing with racks, 54

Stowage Tracking Position (CIO), xxv

Structural Dynamics Measurement System, 42

structures and mechanisms, ISS, 36–59

	 primary structure, 36–46, 205

	 secondary structure, 46–59, 141–143, 349

Structures and Mechanisms Position (OSO),

xxv

STS-2, 251

STS-92/ISS-3A, 39, 135

STS-97/ISS-4A, 198, 252

STS-98/ISS-5A, 40, 45, 54, 107, 135, 198, 252

STS-100/ISS-6A, 47, 252, 259, 262, 271, 273

STS-102/ISS-5A.1, 271

STS-104/ISS-7A, 262, 272

STS-110/ISS-8A, 135, 264, 292, 298

STS-111/ISS-UF-2, 256, 263–264

STS-113/ISS-11A, 228

STS-114/ISS-LF-1, 78, 135, 274

STS-115/ISS-12A, 203

STS-118/ISS-13A.1, 120, 286, 311

STS-119/ISS-15A, 156

STS-120/ISS-10A, 164, 271, 301. See also

	 spacewalk in detail

STS-121/ISS-ULF1.1, 320–321

STS-122/ISS-1E, 58, 330
APPENDIX 401

STS-123/ISS-1J/A, 78–79, 255

STS-124/ISS-1J, 56

STS-126/ISS-ULF-2, 258

STS-127/ISS-2J/A, 227

STS-128/ISS-17A, 67

STS-129/ISS-ULF3, 46

STS-130/ISS-20A, 37, 40, 62. See also making

of a mission

STS-132/ISS-ULF4, 226, 253

Stuffed Whipple Shield design, 48

sublimator, EMU cooling, 287

Suffredini, Mike, 369

sun, ISS orbit with respect to, 124–125

sun visor, EMU, 289

supply management, packing and loading, 3,

	 240–241. See also visiting vehicles

Suraev, Maxim, 27

Surgeon position (SURGEON), xxv

Survival mode, 106

Swanson, Steve, 291, 329

synchronizing watches for ground/space

	 coordination, 22

System Flow Control Assembly Modulation 

	 Valve, 205

systems

	 Command and Data Handling (C&DH),

	 	 92–107

	 Communication and Tracking (C&T),

	 	 222–231

	 Electrical Power System (EPS), 156–171

Environmental Control and Life Support 

	 	 System (ECLSS), 334–350

	 ExtraVehicular Activities (EVAs), 280–303

	 Motion Control System (MCS), 120–136

	 robotics, 250–264

	 structures and mechanisms, 36–59

	 Thermal Control Systems (TCSs), 192–207

T

Tani, Dan, 301, 309, 310, 313, 324

Tanner, Joe, 329

Team 4

	 for ammonia pump failure, 359–376

	 structure and function of, 359

	 for STS-120/ISS-10A issues, 314–318, 324,

	 	 329, 330–331

team interactions, training for, 177

technical water, 340

telemetry data, sending from ISS, 224

television on ISS, 27

temperature and humidity control. See Thermal 

	 Control Systems (TCSs)

Terminal Computer (RS), 121–122, 128, 134

tethers, EVA, 286, 291, 295, 296, 301

thermal control, EMU, 285, 287

Thermal Control Systems (TCSs), 192–207.

 See also ammonia-based thermal transfer 

 system

	 Active Thermal Control Systems (ATCSs),

	 	 192, 195–204

	 and computer systems installation, 107

	 decrewing adjustments to deal with humidity

	 	 change, 213–215

in failure simulation, 178

jumper method for failures in, 161

overview, xxiv

	 Passive Thermal Control Systems (PTCSs),

	 	 192, 194–195

Thermal Control Systems Position (THOR), xxv

Thermal Radiator Rotary Joint (TRRJ), 187,

	 200, 204, 356, 357, 358

Thirsk, Bob, 20

Three Way Mixing Valve (TWMV), 196–197

thruster plume impingement, solar arrays, 170

thrusters

	 attitude control with, 129, 131, 133–134

	 higher orbit for debris avoidance, 148

	 location control with, 128–129

	 microgravity effect of, 132

	 motion control during assembly, 135

	 visiting vehicle rendezvous role, 240

Thrusters control mode, 134

Tier 1 of C&DH system (CCS), 93, 94, 95

Tier 2 of C&DH system (local tier), 93, 94,

	 95, 106

Tier 3 of C&DH system (user tier), 93–94,

	 96–97

“tiger team” (panel of experts), 75

Tile Repair Ablator Dispenser (T-RAD), 311

time, as critical parameter for C&DH, 100–101

Time Division Multiple Access digital system,

229

time of closest approach (TCA), orbital debris

	 tracking, 145

time off for crew, 3–4, 27–28

time of ignition (TIG), reboost, 134, 151

time of single orbit, 122

time zone synchronization for ground/space

	 coordination, 22

Todd, Kenneth, 24

tools

	 EVA, 294, 295–296, 303, 325, 330

	 in-flight maintenance, 269, 270

Torque Equilibrium Attitudes (TEAs), 133

Toxic Atmosphere (ATM)

	 ammonia leak, 174–175, 178, 184, 217, 347,

	 	 350

	 detection system for ammonia, 336

toxic chemical exposure, managing during

	 EVAs, 205, 302–303, 365

Trace Contaminant Control System (TCCS),

338, 346

Tracking and Data Relay Satellite (TDRS), 13,

126, 183, 223, 227

tracking of debris, 143–144, 146–147

trade space, Pump Module change out,

	 362–363, 366

Trailing Thermal Control Radiator (TTCR),

	 202, 203, 205

training. See also simulations

	 communication, 176, 177–179

	 decrewing the ISS, 218

	 for EVAs, 68–69, 77, 290–295

	 flight controller, xxvii–xxviii, 175, 238–239

	 flight director as trainer, 76, 182–183

	 generic skill-based training for crews, 4

	 handover, 215, 218

	 making of a mission, 62–63, 75–79

	 microgravity, 294

	 scenario development, 179–181

	 spacesuit training in US and Russia, 283

STS-120/ISS-10A mission, 309

	 visiting vehicle, 238–239, 240

Trajectory Operations Officer (TOPO), xxv,

	 145, 146, 147, 151

Transmitter/Receiver/Controller, 226

Transponder, 223

trash bag, EMU, 296

trash removal at ISS, 235, 236

truss system. See Integrated Truss System

Tsukuba Control Center, xiii

Tures, Becky, 329

two-way video, 226–227

two-way voice/audio, UHF, 227–228, 287–288

Tyruin, Mikhail, 361

U

UHF (Ultra-High Frequency) RF link,

	 227–228, 287–288

Ultrasonic Leak Detector (ULD), 52, 272

umbilical, airlock, 297, 300

Umbilical Mating Adapters, 256

United States On-orbit Segment (USOS). See 

 also Command and Control System 

	 	 	 (CCS); Laboratory (Destiny) module

	 ammonia leak response, 350

	 Audio Terminal Units (ATUs), 229

	 and Common Berthing Mechanism

	 	 interface, 41

	 computer network, 93

	 Daily Planning Conference participation, 22

debris shielding, 142

	 docking system, 46

	 evacuation for toxic atmosphere, 217

	 EVA role of, 281–282

	 GPS receivers, 125–126

life support system development, xv

	 Motion Control System (MCS), 120, 121,

	 	 128, 129–130, 132–135

overview, xiv

power system design and operation, 

	 	 156–171

	 rack configuration in, 54

	 Rate Gyro Assemblies (RGAs), 127

	 structural comparison to Russian Segment,

	 	 38–39

	 USOS Thruster Only (USTO), 133

Unity, computer network, 93

unsticking hardware (fit issues), 273–274, 276

UOP Bypass Jumper, 216

uplink procedure for software upgrade, 112–113

Urine Processor Assembly, 341, 342, 343

US Commercial Crew Program, xv
402 APPENDIX

US Common Hatch, 49

US Department of Defense, orbital debris 

	 tracking by, 141

User Application Software, 105–106

USOS to RS power converters, 167

utility connections in vestibule, 40

Utility Outlet Panels (UOPs), 216

Utility Transfer Assembly (UTA), SARJ, 169

utilization time for crew (research), 3, 5

V

vacuum chambers, EVA training, 294

Vacuum Exhaust System (VES), 339

Vacuum Resource System (VRS), 338–339

Van Cise, Ed, 36

vectors, Motion Control System (MCS),

	 122–125

Venable, Mitch, 33

Vent and Release Assembly (VRA), 336

vestibule components, 40–41

VHF communication system, 222, 223

video

	 baseband communication, 230–231

	 of daily crew activities, 23

	 Ku-band transmission of from ISS, 226–227

	 wireless helmet cam, 228

wiring troubleshooting, 271

video cameras, 230–231

Virts, Terry, 31, 83

Virtual Reality laboratory, 294, 295

visiting vehicles, 234–246. See also specific 

 vehicles by name

	 air tank deliveries, 335

	 capture and berthing operations. See

	 	 berthing/unberthing operations; capture

 operations

	 cargo delivery and loading, 240–241

	 Commercial Crew Program, xix, 17, 21, 246

	 constraints on launch and return of, 237–238

	 crew coordination role, 239–240, 241–243,

	 	 260–261

	 day of arrival, 241–245

	 docking activity. See docking systems

	 importance of accurate positioning for, 123

loss of supply missions, dealing with, 210, 

	 	 211, 214–215, 218–219, 234–235, 289

	 orbital adjustments to accommodate, 237,

 240

	 parking of solar arrays to accommodate,

 111, 170

Proximity Operations mode, ISS, 106

	 purpose and importance of, 234–235

	 scheduling, 237–238

	 software update planning, 113–114

	 timing importance of, 244

	 training for, 238–239, 240

	 unloading time, 243–244

Visiting Vehicles Position (VVO), xxvi

voice loops in control room, xxvi–xxvii, 178,

224

Volkov, Sergei, 28

“Vomit Comet” aircraft, 294

von Braun, Wernher, xiii

W

Wakata, Koichi, 20, 33, 242, 361, 369, 370

Walheim, Rex, 298

Walker, Shannon, 270

“Wall of EVA,” 281, 300–301

Walz, Carl, 135

Waste and Hygiene Compartment (WHC), 57,

341, 343

waste water, 340, 341, 342, 343, 344

water

	 recovery and management, 340–345

	 recycled from urine and sweat, 334, 340

water-based thermal transfer system. See

	 Internal Thermal Control Systems (ITCSs)

water-in-helmet incident

	 concerns about during Pump Module change

	 	 out mission, 355, 364, 365, 366

details of, 289, 290, 291

Water Processor Assembly (WPA), 340,

	 341–345

Water Recovery System, 344

Weekly Lookahead Plan (WLP), 5, 7–9

Weekly Plan Review, 27

Weightless Environment Test System, Japan, 

294

weightlessness. See microgravity

welcome-back events for returning crews, 32

wet vs. dry cargo, 235

Wheelock, Doug

	 ammonia line movement testing, 365

	 in Cupola, 51

	 emerging from EVA hatch, 297

P6 4B solar array repair, 309, 310, 316, 

	 	 322–323, 325, 327–328

	 Pump Module change out role, 371, 376

Whipple Shield, 53, 142

Whitson, Peggy, 78, 309, 310, 319

Williams, Dave, 120, 136

Williams, Jeffrey, 27, 83, 238

Williams, Sunita, 29, 296

Wilmore, Barry “Butch,” 184

Wilson, Stephanie, 309, 324

Window Observation Rack Facility, 51

windows, 38, 50–53

Wireless External Transceiver Assemblies,

228, 230

Wiseman, Reid, 242

Wolf, Dave, 227

Worksite Interface (WIF) Extender, 320, 327

worksite preparation time, allowing for, 15

Worksites along truss, 257

X

X-Perpendicular Out of Plane (XPOP)

	 reference frame, 125, 192–193

Y

Yaw, Pitch, and Roll (YPR) definitions, 123

Yellow orbital debris risk level, 145, 146, 147

Yui, Kimiya, 33

Z

Zamka, George, 309, 319

Zvezda thrusters, 133

National Aeronautics and Space Administration 

Lyndon B. Johnson Space Center 

2101 NASA Oarkway

Houston, Texas 77058

www.nasa.gov

NASA-SP-2017-634