Aerospace 

Safety 

Advisory 

Panel

Annual Report 

for 2017

NASA AEROSPACE SAFETY ADVISORY PANEL

National Aeronautics and Space Administration

Washington, DC 20546

Dr. Patricia Sanders, Chair

January 11, 2018

The Honorable Robert M. Lightfoot, Jr.

Acting Administrator

National Aeronautics and Space Administration

Washington, DC 20546

Dear Mr. Lightfoot:

Pursuant to Section 106(b) of the National Aeronautics and Space Administration Authorization Act 2005 (P.L. 109-155), the 

Aerospace Safety Advisory Panel (ASAP) is pleased to submit the ASAP Annual Report for 2017 to the U.S. Congress and to 

the Administrator of the National Aeronautics and Space Administration (NASA).

The Report is based on the Panel’s 2017 fact-finding and quarterly public meetings; insight visits and meetings; direct observations of NASA operations and decision-making; discussions with NASA management, employees, and contractors; and the 

Panel members’ past experiences.

It is clear to the Panel that NASA is at a critical juncture in human space flight development. Both the Commercial Crew 

Program and the Exploration Systems Development are well beyond paper design with hardware being produced, testing 

underway, and first flights—uncrewed test flights followed by crewed test flights—on the horizon. This is a time when it is 

important to retain focus on program details; to maintain a sense of urgency while not giving in to schedule pressure; and to 

continue with program plans without neglecting, shortchanging, or deleting planned content. Important decisions are facing 

NASA leadership in certifying these platforms for human space flight that should be based on a strong foundation of test and 

engineering data. 

The ASAP reiterates once again the need for constancy of purpose as NASA is on the verge of realizing the results of years of 

work and extensive resource investment in these programs. This includes making sure that the appropriate resources are provided to complete the job. We continue to strongly caution that any wavering in commitment negatively impacts cost, schedule, 

performance, workforce morale, process discipline, and—most importantly—safety.

The Panel believes that NASA is addressing safety properly, but space can be a decidedly hostile environment and human space 

flight is inherently risky. There is no excuse for negligence in the safety arena, but it is impossible to control, eliminate, or mitigate every risk. We particularly note that potential for damage from micrometeoroids and orbital debris has become recognized 

as a major issue in every program. The United States government should seriously consider expanding its efforts to lead in 

developing international strategies to reduce debris generation and the hazards posed by existing debris.

Recognizing that space flight holds inherent hazards, there is always a probability of mishaps needing rigorous and disciplined 

investigation to avoid future incidents and to return to flight as safely and as soon as possible. We believe it is important to have 

mechanisms and procedures in place before a mishap event occurs to enable expeditious and effective investigation. To that 

end, we propose a change to the language in the NASA Authorization Act of 2005 that prescribes a Presidential Commission 

for Human Space Flight Independent Investigations.

I submit the ASAP Annual Report for 2017 with respect and appreciation.

Sincerely,

Dr. Patricia Sanders

Chair, Aerospace Safety Advisory Panel

Enclosure
NASA AEROSPACE SAFETY ADVISORY PANEL

National Aeronautics and Space Administration

Washington, DC 20546

Dr. Patricia Sanders, Chair

January 11, 2018

The Honorable Michael R. Pence

President of the Senate

Washington, DC 20510

Dear Mr. President:

Pursuant to Section 106(b) of the National Aeronautics and Space Administration Authorization Act 2005 (P.L. 109-155), the 

Aerospace Safety Advisory Panel (ASAP) is pleased to submit the ASAP Annual Report for 2017 to the U.S. Congress and to 

the Administrator of the National Aeronautics and Space Administration (NASA).

The Report is based on the Panel’s 2017 fact-finding and quarterly public meetings; insight visits and meetings; direct observations of NASA operations and decision-making; discussions with NASA management, employees, and contractors; and the 

Panel members’ past experiences.

It is clear to the Panel that NASA is at a critical juncture in human space flight development. Both the Commercial Crew 

Program and the Exploration Systems Development are well beyond paper design with hardware being produced, testing 

underway, and first flights—uncrewed test flights followed by crewed test flights—on the horizon. This is a time when it is 

important to retain focus on program details; to maintain a sense of urgency while not giving in to schedule pressure; and to 

continue with program plans without neglecting, shortchanging, or deleting planned content. Important decisions are facing 

NASA leadership in certifying these platforms for human space flight that should be based on a strong foundation of test and 

engineering data. 

The ASAP reiterates once again the need for constancy of purpose as NASA is on the verge of realizing the results of years of 

work and extensive resource investment in these programs. This includes making sure that the appropriate resources are provided to complete the job. We continue to strongly caution that any wavering in commitment negatively impacts cost, schedule, 

performance, workforce morale, process discipline, and—most importantly—safety.

The Panel believes that NASA is addressing safety properly, but space can be a decidedly hostile environment and human space 

flight is inherently risky. There is no excuse for negligence in the safety arena, but it is impossible to control, eliminate, or mitigate every risk. We particularly note that potential for damage from micrometeoroids and orbital debris has become recognized 

as a major issue in every program. The United States government should seriously consider expanding its efforts to lead in 

developing international strategies to reduce debris generation and the hazards posed by existing debris.

Recognizing that space flight holds inherent hazards, there is always a probability of mishaps needing rigorous and disciplined 

investigation to avoid future incidents and to return to flight as safely and as soon as possible. We believe it is important to have 

mechanisms and procedures in place before a mishap event occurs to enable expeditious and effective investigation. To that 

end, we propose a change to the language in the NASA Authorization Act of 2005 that prescribes a Presidential Commission 

for Human Space Flight Independent Investigations.

I submit the ASAP Annual Report for 2017 with respect and appreciation.

Sincerely,

Dr. Patricia Sanders

Chair, Aerospace Safety Advisory Panel

Enclosure
NASA AEROSPACE SAFETY ADVISORY PANEL

National Aeronautics and Space Administration

Washington, DC 20546

Dr. Patricia Sanders, Chair

January 11, 2018

The Honorable Paul D. Ryan

Speaker of the House of Representatives

Washington, DC 20510

Dear Mr. Speaker:

Pursuant to Section 106(b) of the National Aeronautics and Space Administration Authorization Act 2005 (P.L. 109-155), the 

Aerospace Safety Advisory Panel (ASAP) is pleased to submit the ASAP Annual Report for 2017 to the U.S. Congress and to 

the Administrator of the National Aeronautics and Space Administration (NASA).

The Report is based on the Panel’s 2017 fact-finding and quarterly public meetings; insight visits and meetings; direct observations of NASA operations and decision-making; discussions with NASA management, employees, and contractors; and the 

Panel members’ past experiences.

It is clear to the Panel that NASA is at a critical juncture in human space flight development. Both the Commercial Crew 

Program and the Exploration Systems Development are well beyond paper design with hardware being produced, testing 

underway, and first flights—uncrewed test flights followed by crewed test flights—on the horizon. This is a time when it is 

important to retain focus on program details; to maintain a sense of urgency while not giving in to schedule pressure; and to 

continue with program plans without neglecting, shortchanging, or deleting planned content. Important decisions are facing 

NASA leadership in certifying these platforms for human space flight that should be based on a strong foundation of test and 

engineering data. 

The ASAP reiterates once again the need for constancy of purpose as NASA is on the verge of realizing the results of years of 

work and extensive resource investment in these programs. This includes making sure that the appropriate resources are provided to complete the job. We continue to strongly caution that any wavering in commitment negatively impacts cost, schedule, 

performance, workforce morale, process discipline, and—most importantly—safety.

The Panel believes that NASA is addressing safety properly, but space can be a decidedly hostile environment and human space 

flight is inherently risky. There is no excuse for negligence in the safety arena, but it is impossible to control, eliminate, or mitigate every risk. We particularly note that potential for damage from micrometeoroids and orbital debris has become recognized 

as a major issue in every program. The United States government should seriously consider expanding its efforts to lead in 

developing international strategies to reduce debris generation and the hazards posed by existing debris.

Recognizing that space flight holds inherent hazards, there is always a probability of mishaps needing rigorous and disciplined 

investigation to avoid future incidents and to return to flight as safely and as soon as possible. We believe it is important to have 

mechanisms and procedures in place before a mishap event occurs to enable expeditious and effective investigation. To that 

end, we propose a change to the language in the NASA Authorization Act of 2005 that prescribes a Presidential Commission 

for Human Space Flight Independent Investigations.

I submit the ASAP Annual Report for 2017 with respect and appreciation.

Sincerely,

Dr. Patricia Sanders

Chair, Aerospace Safety Advisory Panel

Enclosure

Annual Report for 2017 v

Aerospace Safety Advisory Panel

Contents

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

I. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A. Aerospace Safety Advisory Panel 2017 Activities and Overall Observations. 

B. Micrometeoroids and Orbital Debris. 

C. Mishap Investigations. 

D. Future Work. 

II. Exploration Systems Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

A. Exploration Mission-1 Crewed Mission Feasibility Study. 

B. Safety Benefits Resulting from the Study. 

C. Test and Verification Schedule. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

D. Orion Heat Shield. .

E. European Service Module. .

F. Micrometeoroid and Orbital Debris Risk. .

G. Significant Incidents and Close Calls in Human Spaceflight:

A Study in Their Applicability to Exploration Systems Development. .

III. Commercial Crew Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

A. Certification for Crew Flights to the International Space Station. .

B. Probabilistic Risk Assessment for Loss-of-Crew. .

C. Falcon 9 Helium Tank Redesign and Qualification. .

IV. International Space Station . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

A. Overview. .

B. Test Bed for Exploration. .

C. Aging Hardware. .

D. Commercial Resupply. .

E. Deorbit Planning. .

V. Deep Space Exploration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 
vi Annual Report for 2017

Aerospace Safety Advisory Panel

VI. Aviation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

A. Introduction. .

B. NASA Aircraft Management Information System. .

C. Aircraft Operations and Fleet Updates. .

D. New Aviation Horizon. .

VII. Enterprise Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

VIII. Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 

Appendix A: Significant Incidents and Close Calls in Human Spaceflight. .

Appendix B: Summary and Status of Aerospace Safety Advisory Panel (ASAP) 

Open Recommendations. .

Appendix C: Closure Rationale for Recommendation Closed in 2017. .

CD Table of Contents

Attachment 1: ASAP Charter

Attachment 2: ASAP 2017 Recommendation, NASA Response, and Status

Attachment 3: ASAP 2017 Quarterly Meeting Minutes

Attachment 4: ASAP Activities in 2017

Attachment 5: ASAP Members and Staff
Annual Report for 2017 1

Aerospace Safety Advisory Panel

Preface

The Aerospace Safety Advisory Panel (ASAP) was established by Congress in 1968 to provide advice 

and make recommendations to the NASA Administrator on safety matters. The Panel holds quarterly 

fact-finding and public meetings and makes “insight” visits to NASA Field Centers or other related 

sites. It reviews safety studies and operations plans and advises the NASA Administrator and Congress 

on hazards related to proposed or existing facilities and operations, safety standards and reporting, 

safety and mission assurance aspects regarding ongoing or proposed programs, and NASA management and culture issues related to safety. Although the Panel may perform other duties and tasks as 

requested by either the NASA Administrator or Congress, the ASAP members normally do not engage 

in specialized studies or detailed technical analyses. The ASAP charter is included as Attachment 1 on 

the enclosed CD.

This report highlights the issues and concerns that were identified or raised by the Panel during 

its activities over the past year. The Panel’s open recommendations are summarized in Appendix B, 

and the full text of the recommendation submitted to the Administrator during 2017 is included 

as Attachment 2 on the CD. The Panel’s issues, concerns, and recommendations are based upon the 

ASAP fact-finding and quarterly public meetings; insight visits and meetings; direct observations of 

NASA operations and decision-making; discussions with NASA management, employees, and contractors; and the Panel members’ expertise.
2 Annual Report for 2017

Aerospace Safety Advisory Panel

I. Introducti

A. Aerospace Safety Advisory Panel 2017 Activities 

and Overall Observations

During 2017, the Aerospace Safety Advisory Panel (ASAP) conducted quarterly meetings hosted by 

Kennedy Space Center (KSC), Marshall Space Flight Center, NASA Headquarters, and Johnson Space 

Center (JSC). ASAP members also made insight visits to Glenn Research Center, Langley Research 

Center, and Jet Propulsion Laboratory, as well as insight visits to the commercial space facilities of 

Boeing, SpaceX, Lockheed Martin, United Launch Alliance, and Sierra Nevada. We held focused 

reviews—in-depth dialogues—with NASA engineers, safety personnel, and other relevant workinglevel staff addressing NASA aircraft operations and some specific aspects of the Commercial Crew 

Program (CCP). Two members participated in the Inter-center Aircraft Operations Panel (IAOP). The 

ASAP and the NASA Advisory Council continued their cross-coordination efforts and participation in 

each other’s respective meetings.

We commend the affected Centers—particularly JSC and KSC, as well as the Michoud Assembly 

Facility—and the NASA workforce on their resilience and dedication in the face of Hurricanes Harvey 

and Irma and the tornado in Mississippi. While they were fortunate in not bearing as much of the 

storms’ brunt as could be feared, it is a credit to the workforce, to excellent planning, and to some 

well-placed facility investments that the crucial missions and critical programs were uninterrupted 

by the events and no casualties were experienced. Still, damages were sustained that require restoration resources.

The assessments drawn from this year’s activities will be provided in the following sections of this 

report, but we have some overall observations. It is clear to the Panel that NASA is at a critical juncture in the development of human space flight programs. Both the CCP and the Exploration Systems 

Development (ESD) are well beyond paper design and are at the stage where hardware is being produced, testing is underway, and first flights—uncrewed test flights followed by crewed test flights—

are on the horizon. This is a time when it is important to retain focus on program details; to maintain 

a sense of urgency while not giving in to schedule pressure; and to continue with program plans without neglecting, shortchanging, or deleting planned content. To date, the ASAP has been pleased to 

note that there is no indication across NASA that schedule pressures are driving decisions that will 

adversely impact safety. Important decisions are facing NASA leadership in certifying these platforms 

for human space flight. These decisions will necessitate careful weighing of all the technical and operational aspects of the risk-benefit trades. It is important that the leadership base its decision-making 

process on a strong foundation of test and engineering data.

The ASAP reiterates once again the need for constancy of purpose, as NASA is on the verge of realizing the results of years of work and extensive resource investment in these programs. This includes 

making sure that the appropriate resources are provided to complete the job. We continue to strongly 

caution that any wavering in commitment negatively impacts cost, schedule, performance, workforce 

morale, process discipline, and—most importantly—safety. Also, we continue to be concerned with 
Annual Report for 2017 3

Aerospace Safety Advisory Panel

the pressure induced by the lack of budget certainty due to the ongoing use of continuing resolutions 

(CRs). The budget uncertainties associated with partial year CRs adds complexity to program management and inefficiency to execution. This detracts from maintaining the requisite focus on safety 

and mission assurance.

NASA Continuing Resolution (CR) History—Fiscal Year (FY) 2008–2018 (as of 12/26/2017)

CR-1 CR-2 CR-3 CR-4 CR-5 CR-6 CR-7 CR-8

Final 

Appropriations

Date 

Enacted

Months 

Under 

CR

FY 2008 PL 110-92 PL 110-116 PL 110-137 PL 110-149 PL 110-161 12/26/07 3

FY 2009 PL 110-329 PL 111-6 PL 111-8 03/11/09 6

FY 2010 PL 111-68 PL 111-88 PL 111-117 12/16/09 3

FY 2011 PL 111-242 PL 111-290 PL 111-317 PL 111-322 PL 112-4 PL 112-6 PL 112-8 PL 112-10 PL 112-10 04/15/11 12

FY 2012 PL 112-33 PL 112-36 PL 112-55 PL 112-67 PL 112-68 PL 112-55 11/18/11 2

FY 2013 PL 112-75 PL 113-6 03/26/13 6

FY 2014 PL 113-44 PL 113-67 PL 113-73 PL 113-76 01/17/14 4

FY 2015 PL 113-164 PL 113-202 PL 113-203 PL 113-235 12/16/14 3

FY 2016 PL 114-53 PL 114-96 PL 114-100 PL 114-113 12/18/15 3

FY 2017 PL 114-223 PL 114-254 PL 115-30 PL 115-31 05/05/17 7

FY 2018 PL 115-56 PL 115-90 PL 115-96 TBD TBD TBD

FIGURE 1. The history of CR usage shows constant budget uncertainty over many years.

B. Micrometeoroids and Orbital Debris

The Panel believes that NASA is addressing safety properly, but human space flight is inherently risky. 

Space can be a decidedly hostile environment, and while there is no excuse for negligence in the safety 

arena, it is impossible to control, eliminate, or mitigate every risk. For example, we note that potential for damage from micrometeoroids and orbital debris (MMOD) has become recognized as a major 

issue in every program. In fact, damage from MMOD is the dominant contributor to the calculations 

of loss-of-crew (LOC) predictions for both commercial crew vehicles as well as Orion, and to two of 

the top three safety risks for the International Space Station (ISS).
4 Annual Report for 2017

Aerospace Safety Advisory Panel

Given the increased congestion in orbit and the recent announcement of plans to launch many 

mega-constellations in low-Earth orbit (LEO), with hundreds or even thousands of satellites, the U.S. 

government should seriously consider implementing significant improvements for Space Situational 

Awareness analyses and the provision of Space Traffic Management services, as well as expand its 

efforts in developing international strategies to reduce orbital debris generation in the future. This 

topic was addressed in the 2010 National Space Policy and has only increased in criticality since then. 

When appropriate, U.S. Strategic Command (STRATCOM) contacts space operators from over 50 

countries and provides collision warnings when it determines that a conjunction of two space objects 

is possible. Meanwhile, NASA conducts its own collision analysis for the satellites for which it is 

responsible—using information provided by STRATCOM—at the Conjunction Assessment Risk 

Analysis Center at Goddard Space Flight Center. Because this is a critical safety issue that involves 

multiple departments and agencies—as well as all countries with space assets—it would appear to be 

a very worthwhile issue for the U.S. to take a leadership role and for the National Space Council to 

address. We believe that the Council should assign a lead Agency in the U.S. to spearhead and coordinate efforts to prevent the generation of new debris and reduce the hazards posed by existing debris.

C. Mishap Investigations

Recognizing that space flight holds inherent hazards, there is always a probability of mishaps. When 

mishaps do occur, they will need rigorous and disciplined investigation to learn what can be done 

better to avoid future incidents, maximize learning, and to return to flight as safely and as soon as 

possible. The ASAP believes that it is important to have mechanisms and procedures in place, as 

NASA currently has, before a mishap event occurs to enable expeditious and effective investigation that leads to corrective action. In December 2015, we recommended that the language in the 

NASA Authorization Act of 2005—requiring a Presidential Commission for Human Space Flight 

Independent Investigations—be reviewed and revised considering today’s systems and environment. 

This recommendation remains open. We have several concerns with the current language:

• The process prescribed in the NASA Authorization Act of 2005 has the potential to slow the 

initiation of mishap investigations, which impacts the effectiveness of mishap investigation 

actions.

• The Commission—as defined in the language of the Act—would be composed of people who 

are not required to have investigative experience or experience relative to human space flight. 

A newly formed Presidential Commission may require a learning curve that further extends 

the investigation timeframe or degrades its credibility. It is clear to us that Congress intends to 

demand independent investigations, i.e., investigations that are free from any perceived NASAdirected influence. This does not mean that NASA should relinquish substantive responsibility related to investigation of its own human space flight mishaps. NASA will ultimately be the 

entity that must learn from the results of the investigation, decide on whether to accept the 
Annual Report for 2017 5

Aerospace Safety Advisory Panel

investigation results, and determine what corrective actions to take. It also does not mean that 

government personnel or contractors with relevant knowledge and expertise should be prohibited from participating in an appropriate role.

• The current requirement only applies to Government missions which would result in different investigation regimes, depending on the type of flight being conducted. We recognize 

that up until present day, human space flight in this country has primarily been under the 

Government’s purview. However, soon private organizations, acting on behalf of their own 

pursuits, will also be engaging in sending humans into space. Changes to the law should establish a framework that reflects these changing times.

The ASAP believes that the establishment of a Presidential Commission should be discretionary 

and that, regardless of the composition of the independent body conducting the investigation, NASA 

should not be precluded from conducting parallel investigations, as defined in NASA regulations. We 

offer a possible alternative framework for investigations. The National Transportation Safety Board 

(NTSB) should lead the investigation for any commercial space mishaps that occur on non-Government missions. However, for mishaps involving loss of life or high value assets where NASA has authorized the mission, is responsible for the rules under which the mission was conducted, and accepted 

the risk—we recommend using an independent, standing mishap investigation body based on the 

existing Mishap Interagency Investigation Board (MIIB) model. We recommend this approach based 

on the mission owner, not necessarily the hardware provider, and regardless of the mission phase in 

which the mishap occurs. We propose that:

• The current inter-agency MIIB composition should be expanded to include, at least, a standing 

member from the NTSB and the Federal Aviation Administration (FAA). Standing members 

are important to the timeliness of a competent investigation process. Inclusion of the NTSB 

and the FAA, especially the NTSB, would enable those organizations to gain expertise in spacerelated investigations, which could increasingly be needed in the commercial sector.

• The Chair of any specific investigation could be selected by the President, Congress, or members of the MIIB, as deemed necessary. In any case, MIIB standing members could designate an 

Interim Chair to facilitate timely investigation startup.

• The expanded MIIB’s independence should be maintained.
6 Annual Report for 2017

Aerospace Safety Advisory Panel

D. Future Work

In the coming year, the ASAP plans to spend focused effort on the CCP human certification efforts, 

looking closely at the progress of both commercial providers. We will also be looking attentively at 

ESD as that program prepares for the Exploration Mission (EM)-1 test flight.

Another planned focus area for 2018 is the safety culture status within NASA. Throughout 2017, 

in our discussions with NASA, we have noted some indicators that warrant a closer look. For example: 

Are the safety-related NASA Procedural Requirements fully adopted and enforced? Are safety practices truly “owned” by the workforce, or is there a “check the box” mentality in some areas? Are mishap 

investigations and corrective actions addressing true root cause, as opposed to proximate cause? Is the 

Office of Safety and Mission Assurance Technical Authority (TA) function sufficiently robust and fully 

performing in an independent manner? Is the NASA Safety Center living up to expectations? At this 

point, the ASAP has no clear and compelling evidence related to an overarching concern with NASA’s 

safety culture, but this is an area that will garner our attention in 2018.

The ASAP reviewed some aspects of aircraft operations this past year, but our plan of work in 2018 

will include more emphasis on aircraft operations safety, unmanned aerial systems safety, and NASA’s 

new aircraft technology development.

Looking beyond the near-term challenges, the ASAP sees a window of opportunity for how the 

Nation views its future in space. NASA’s development of the Space Launch System (SLS) and Orion 

will provide a heavy-lift, deep-space exploration capability not seen since Apollo. Meanwhile, the 

ISS has not only served as an on-orbit laboratory to study technology, operations, and the impacts of 

long-duration spaceflight on the human body; it has also allowed us to gain valuable experience using 

international partnerships in the pursuit of challenging scientific endeavors. The Deep Space Gateway 

(DSG) concept provides an important next step and could be a flexible and critical enabler for human 

exploration beyond LEO. At the same time, we may be finally reaching a tipping point regarding commercial space capabilities. There is a range of U.S. and international commercial systems either already 

flying or currently under development for suborbital space tourism, cargo delivery, crew transportation, commercial space stations, satellite servicing, lunar landers and rovers, asteroid mining, and even 

human missions to Mars. This presents a real potential for public-private partnerships that could benefit both government and industry as well as international relations.

With this rather broad and forward-looking vision, the U.S. may have an opportunity to transition to an “all-of-the-above” approach for space, rather than having NASA focus on a specific program 

or a single destination. Such an approach would involve joining forces with industry and the international community to a much greater extent and could enable the growth of a true space economy. 

But it will also bring greater complications and challenges for risk management, mission assurance, 

and the safety-benefit trade-off balance. It will also bring a unique opportunity for NASA to develop 

safety processes and mechanisms for the future as they guide and learn from new partners. As NASA 

navigates its future through this evolving environment, the ASAP envisions significant engagement 

in understanding and advising on those challenges that come with new ways of doing business and 

approaching shared safety responsibilities.
Annual Report for 2017 7

Aerospace Safety Advisory Panel

II. Exploration Systems Developme

A. Exploration Mission-1 Crewed Mission Feasibility Study

At the request of the new Administration, NASA was asked to assess the feasibility of flying crew on 

EM-1, the first flight of the SLS rocket with the Orion Capsule. Redefining EM-1 as a crewed mission, while at the same time maintaining a reasonable risk posture, required examination of the hardware development schedule and the validation and verification testing required to assure crew safety.

FIGURE 2. Comparison above illustrates significant size of ESD rockets. 

Hardware of this scale is always a technical and safety challenge.

NASA concluded 

that it would be feasible to move the crewed 

flight forward to EM-1; 

however, to do so would 

require a substantial 

immediate increase in 

resources in addition to 

increasing crew risk. An 

example of increased 

crew risk would be the 

lack of appropriate testing for the Orion heat 

shield. EM-1 is the first 

opportunity to perform 

a rigorous flight test of 

the Orion heat shield 

that protects the crew 

from the atmospheric 

heating during reentry. 

Moving crew to EM-1 

exposes them to increased risk should the heat shield fail on its first trial. Additional concern for crew 

safety arises from the maturity level of the Environmental Control and Life Support System (ECLSS) 

design. EM-1 as an uncrewed mission does not currently contain an ECLSS suite. Consequently, the 

ECLSS development would need to be accelerated, potentially leading to less rigorous testing.

In summary, NASA found that while flying crew on EM-1 was technically feasible, it would add 

significant crew safety risk and demand considerable additional resources that could not be guaranteed. The ASAP concurred with that finding.
8 Annual Report for 2017

Aerospace Safety Advisory Panel

B. Safety Benefits Resulting from the Study

Conducting the study did reveal 

new information and opportunities to reduce risk. For example, the team found that the 

EM-1 upper stage—the nonhuman rated Interim Cryogenic 

Propulsion Stage—was more tolerant of MMOD than previously assessed. Further, two key 

safety-related items were identified. First, execution of the ascent 

abort test sooner than currently 

planned would provide early 

insight into that critical safety system. The test could more quickly 

inform the design about needed 

improvements, thus increasing 

safety as well as saving time and 

money. As a consequence, the 

Orion program decided to put 

the necessary FY 2017 decisions and funding in place to support this acceleration.

FIGURE 3. Modification of MLP: 13 meters = Big Changes. The items 

shown in red are major pieces of the MLP that must be removed, 

altered, or added.

The second item focused on the schedule gap of some 33 months between the EM-1 and EM-2 

launches, due in part to the time required to modify the Mobile Launch Platform (MLP) for the 

Exploration Upper Stage (EUS). EM-2 and all follow-on crewed missions are designed to use the 

EUS, as it is a fully human rated upper stage. However, it raises the stack height some 30 plus feet. 

If the existing MLP is modified rather than building a new MLP specifically designed for EUS, an 

operational launch gap is created, because no launches can take place while the MLP is under modification. This creates potential safety risks as the skills and number of the ground and launch workforce may naturally attrit over such a long inactive period, resulting in a critical loss of experience and 

knowledge. While other critical path items from EM-1 to EM-2 must be watched, building a second 

MLP mitigates that risk as construction can begin independent of the EM-1 mission. Having a second 

MLP allows focus to remain on other safety items and reduces distraction from a time-critical hardware build. In addition to operational risk mitigation, the Nation would have operational flexibility 

with two differently configured MLPs. The ASAP strongly recommends that NASA be resourced and 

begin construction of a second MLP as soon as possible.
Annual Report for 2017 9

Aerospace Safety Advisory Panel

C. Test and Verification Schedule

From initiation, all three Exploration program elements—Orion, SLS, and Ground Systems 

Development and Operations—have been on a very tight schedule. In last year’s ASAP report, we 

documented our concern that schedule pressure could cause an erosion of the ground and flight testing content that had been planned to prove out the various subsystems and their integration prior to 

the first flight. We officially recommended that the Agency consider schedule relief as an alternative 

to reduced test content. Although the Panel will continue to monitor the situation, NASA has taken 

our recommendation seriously and is maintaining test content. The Panel strongly encourages the 

Program to continue to keep safety its priority and maintain its stated intent of “We will not fly until 

we are ready.”

When considering schedule, it is well to remember that some of the test articles, when assembled, 

are many stories high and have required the construction of enormous rigs to carry out the required 

testing. Structural test article (STA) testing, one of the most complex types of testing, is currently taking place at multiple locations. For example, the Integrated Spacecraft and Payload Element structural 

testing was completed in April 2017, and testing of the Engine Section STA was begun in September 

2017. The huge liquid hydrogen (LH2) and liquid oxygen (LOX) tank test stands are complete, and 

the STAs will ship to test in mid-2018 in order for testing to begin around the end of the year. The 

need to move such large objects to their testing location and then install them into equally large and 

complex test facilities represents a technical and safety challenge of its own, even in the problem of 

transportation and handling. Such challenges always put the program schedule at risk, increasing the 

pressure to reduce content to save schedule.

FIGURE 4. LH2 Tank Test Stand FIGURE 5. LOX Tank Test Stand
10 Annual Report for 2017

Aerospace Safety Advisory Panel

In summary, testing continues and has been very successful so far. The current EM-1 launch date 

is the end of 2019, but further slips are possible, even though the Program continues to have successful technical accomplishments.

D. Orion Heat Shield

In the ASAP’s 2016 report, we noted that the original Avcoat monolithic honeycomb design exhibited cracks in the gore seams and reduced acreage 

material strength in early testing. As a result, NASA 

decided to switch to a molded block Avcoat design. 

This new design has now been under development 

for the last two years. Given the significant design 

switch, the ASAP raised a concern as to how NASA 

would be able to detect a critical flaw in the bond 

between the molded block tiles and the substructure. In 2017, we continued to track the development of both the block form factor heat shield 

and the advancement in non-destructive examination (NDE) techniques needed for flaw detection. Recent observations this year conclude that newly developed NDE now allows a thorough bond 

inspection, and block component testing has shown a significant increase in heat shield strength. 

While EM-1 remains the first full flight test of the complete shield and may reveal unknown challenges, these developments are positive and currently indicate a lower risk than previously assessed.

FIGURE 6. Avcoat Block Heat Shield Installation 

Underway

E. European Service Module

The ASAP has previously reported that some systems in the European Service Module (ESM) were 

zero fault tolerant, hence representing potential single point failures. In general, these problems arose 

due to the plumbing and valving configuration associated with the fuel system feeding the propulsion 

and reaction control system (RCS). In addition, some of the individual components were zero fault 

tolerant due to their seals and bellows configurations. NASA currently lists some 14 specific system 

issues relating to the ESM propulsion and RCS systems.

We have previously reported that these existing system designs could represent additional safety 

risk to the crew. However, for the 14 specific system issues documented, NASA has worked with the 

European Space Agency and has committed to either incorporating design changes or conducting 

detailed risk reviews leading to formal risk acceptance by appropriate leadership levels. To reduce risk 

as quickly as possible, NASA has agreed to incorporate some of the identified actions prior to EM-2. 

To date, four systems have been redesigned, two detailed risk analysis and subsequent acceptance of 
Annual Report for 2017 11

Aerospace Safety Advisory Panel

low risk have been carried out, and two additional changes are now in final review. Thus, 8 of the 14 

issues will be addressed before EM-2. In addition, NASA has committed to additional risk reduction 

for EM-3 and EM-4 with the incorporation of the mitigation action on the remaining issues.

F. Micrometeoroid and Orbital Debris Risk

MMOD remains a top program risk for EM-1 and EM-2. In part, the risk is being mitigated through 

a tradeoff between remaining in LEO, where systems and equipment can be more easily checked and 

the crew could be quickly returned to Earth in an emergency; or making an early transition to high 

Earth orbit—or even a lunar transit orbit—where the MMOD risk is lower. From a crew safety perspective, the LEO checkout period is especially important for EM-2, as it will be the first flight of the 

ECLSS. As reported last year, the ASAP believes that the Program team has done a reasonable job of 

designing mission profiles as optimally as possible, balancing both concerns against crew and vehicle safety. In the future, although MMOD will remain a high-risk item, operations will continue to 

reduce LEO time as the system matures and experience is gained. Eventually, since the system is to be 

used primarily for deep space exploration, it will pass quickly out of LEO and reduce the exposure to 

MMOD danger.

G. Significant Incidents and Close Calls in Human Spaceflight:

A Study in Their Applicability to Exploration Systems Development

The ASAP compliments the Safety and Mission Assurance (S&MA) TA and members of the ESD 

safety team for their initiative in conducting a comprehensive study of past significant incidents 

and close calls that have occurred in human space flight. The basis for the study was the document, 

“Significant Incidents and Close Calls in Human Spaceflight” published by JSC. Principal authors 

are Dr. Nigel Packham, JSC S&MA Flight Safety Officer (FSO) and Mr. Bill Stockton, Science 

Applications International Corporation lead, FSO Support Team.1 This document chronicles some 

186 safety incidents going back to the 1960s and includes operations by SR-71, X-15, Soyuz, Shuttle, 

and ISS (See Appendix A to this Report).

1 See https://spaceflight.nasa.gov/outreach/SignificantIncidents/index.html for interactive graphic.

The ESD S&MA team examined all documented incidents and in a two-phase study determined 

their applicability to EM-1 or EM-2. That applicability was categorized as either “directly” (Phase 

1-same system, environmental, human error) or “generically” (Phase 2-similar system). The results 

showed 67 events were applicable from Phase 1 and 90 from Phase 2. The team then prepared recommendations for the Program to mitigate the risk for each event.
12 Annual Report for 2017

Aerospace Safety Advisory Panel

III. Commercial Crew Progr

A. Certification for Crew Flights to the International Space Station

The CCP continues to make steady progress toward providing the capability for crew transportation 

to LEO and ISS. Both providers are planning for test flights in 2018, with the first Post Certification 

Missions to ISS no earlier than November 2018. NASA has procured seats onboard Soyuz 58 and 59 

for transportation of U.S. Astronauts to ISS through late 2019. The following table summarizes the 

current planning dates for U.S. crew access to ISS.

Event Planned (as of Nov. 2017)

SpaceX Demo 1 (No Crew) March 2018

SpaceX Demo 2 (Crew) August 2018

Boeing Orbital Flight Test (No Crew) August 2018

Boeing Crewed Test Flight November 2018

SpaceX PCM 1 November 2018

Soyuz 58 Launch March 2019

Soyuz 59 Launch May 2019

Boeing PCM 1 May 2019

Soyuz 58 Land September 2019

Soyuz 59 Land November 2019

FIGURE 7. SpaceX’s Merlin 1D Full Thrust Testing

While the Panel is unaware of any efforts to purchase additional Soyuz seats after Soyuz 59, the 

current planning dates would allow NASA to utilize the commercial providers to maintain uninterrupted access to ISS. However, based on 

the quantity, significance, and associated 

uncertainty of work remaining for both 

commercial providers, the Panel believes 

there is a very real possibility of future 

schedule slips that could easily consume 

all remaining margin. There are several 

major qualification and flight test events 

that historically are schedule drivers 

or could reveal the need for additional 

work. These include pyro shock qualification tests, parachute tests, engine 

hot fires and qualification runs, abort 

tests, and both uncrewed and crewed 
Annual Report for 2017 13

Aerospace Safety Advisory Panel

flight tests. Also, SpaceX is still working the redesign and qualification of the Composite Overwrap 

Pressure Vessel (COPV) helium tanks for the 

Falcon 9 (F9), in response to the F9-29 mishap. 

This issue, which has significant work ahead, is 

covered in more detail in a subsequent section.

In addition to the technically complex test 

and qualification work remaining for the providers, NASA also has a significant volume of work 

remaining. The final phase of the NASA Safety 

Review process, where verification evidence of 

hazard controls is submitted by the provider and 

dispositioned by NASA, remains ahead. This is 

in addition to the majority of CCP 1130 and 

ISS 50808 requirements verifications, where the 

provider submits the verification evidence via 

Verification Closure Notices (VCNs) for NASA 

review and disposition. Even though it is common 

for verification packages to be completed late in 

the certification process, the sheer volume of work 

that remains to adequately review and disposition 

the VCNs is significant. If NASA were to determine that the evidence submitted does not meet 

the verification standard on some requirements or 

hazard controls, additional time would likely be 

required to resolve the issue with the provider.

FIGURE 8. Boeing Structural Test Article

Despite the volume of remaining work, technical challenges, and end of the Soyuz transportation 

for U.S. crews, the ASAP sees no evidence that the CCP leadership is making decisions that prioritize schedule over crew safety. However, we expect to see several significant certification issues brought 

to culmination in the next year that will require NASA risk acceptance decisions at a very high level 

within the Agency. It is possible that in some cases, the most favorable schedule options will require 

a decision to accept higher risk. The Panel advises NASA to maintain awareness of potential schedule pressure. We note that the strategy of funding two providers was adopted, in part, to avoid a situation where NASA would be forced to accept undesired risk to maintain crews on ISS. Maintaining 

U.S. presence on ISS, without acquiring additional Soyuz seats, requires one provider be certified and 

ready to fly crew to ISS by mid to late 2019. Certification of the second provider could happen after 

that time.

It is worth noting that certification represents the foundation upon which the safety, reliability, 

and performance of the system rests. It encompasses a validation that all requirements have been properly covered and adjudicated between the provider and NASA. It means that the system configuration 
14 Annual Report for 2017

Aerospace Safety Advisory Panel

is known and fixed. The hardware and software in question must have complied with the adjudicated 

requirements, and its performance must have been verified in accordance with agreed-to testing, analysis, and/or other certification artifacts as delivered and approved. Each vehicle flown under the certification must have the hardware properly accepted (without violating the qualification limits) and the 

configuration verified to comply with the certified configuration. Successful achievement and compliance with certification requires that the provider have disciplined engineering and operations processes along with adequate controls to prevent process escapes. Traditionally, this is considered part 

of systems engineering, but disciplined processes can also be applied by providers employing nontraditional approaches. In February, the ASAP made the following formal recommendation to NASA:

The Panel recommends that NASA require the Commercial Crew providers to produce verifiable 

evidence of the practice of rigorous, disciplined, and sustained system engineering and integration (SE&I) principles in support of the NASA certification and operation of commercial crew transportation services to the ISS.

In response to the recommendation, NASA assessed its insight into and oversight of both providers’ engineering practices. NASA reported the following action plan to the Panel:

• Review latest SE&I-related plans and processes

• Increase audits of compliance to SE&I-related plans and processes

• Conduct system-level design reviews to ensure interfaces and inter-relationships of subsystems 

have been adequately addressed

While the Panel commends NASA for these actions and its acknowledgement of the need for 

increased surveillance of at least one provider, NASA should expect both providers to exhibit a safety 

culture appropriate for human space flight. This requires each provider to internalize the value of 

highly disciplined processes and controls and engrain them into the company culture. We intend to 

hold this recommendation open until we see evidence of achieving this outcome. The investigation 

into the recent mishap during Merlin engine qualification and execution of critical qualification and 

validation tests will provide an opportunity to gauge the progress of this effort at SpaceX.

B. Probabilistic Risk Assessment for Loss-of-Crew

The CCP Probabilistic Risk Assessment (PRA) requirement for LOC covering a 210-day mission to 

ISS is 1 in 270. In clarifying the requirement, the CCP allocated 1 in 200 to the providers’ systems, 

with the remainder allocated to operational mitigations such as on-orbit inspection. There is also a 

specific PRA requirement for the ascent and entry phases–1 in 500 (combined). The Panel has been 

monitoring the providers’ progress in working toward the LOC requirements, and it appears that neither provider will achieve 1 in 500 for ascent/entry and will be challenged to meet the overall mission 

requirement of 1 in 200 (without operational mitigations).
Annual Report for 2017 15

Aerospace Safety Advisory Panel

Loss of Crew (LOC) Probabilistic Risk Assessment (PRA) Requirements

ISS Mission (1 in 270)

Commercial Crew Transportation Systems (1 in 200)

Operational Mitigations

Ascent & Entry Mission Phase (1 in 500) Orbital/Docked Phase

PRA is a well-recognized tool that allows the assessment of hazards and their relative contribution 

to risk to assist in the design and development process. History has shown that the PRA values should 

not be viewed as an absolute measure of the actual risk during operations. When developing new 

human space flight vehicles, the unique nature of these systems and limited test data results in large 

uncertainties in the PRA numbers. In our opinion, the most valuable element of the PRA analysis is 

the identification of the major risk drivers, which can then be mitigated by design changes, additional 

testing, or other controls. While there are large uncertainties around the specific numbers resulting 

from the analysis, the primary risk drivers identified are the same for both commercial systems:

• MMOD damage during docked phase (affects overall mission requirement)

• Parachute performance (affects overall mission and ascent/entry requirements)

Based on the PRA identification of these risk drivers, NASA and the providers have applied 

resources to improve the capability to withstand MMOD impacts, better understand the ability to 

tolerate MMOD damage, and perform additional parachute tests. Operational mitigations such as 

on-orbit inspection and abort weather Launch Commit Criteria were also directly informed by the 

PRA results. Ultimately, the NASA PRA requirements were established to set an analytical risk standard for the Commercial Crew systems that was significantly better than the Space Shuttle and challenge the providers to make their systems safer by focusing resources on critical areas of the design and 

operations. The Panel commends the NASA team and providers for using the PRA tool to effectively 

improve the risk posture. However, the likelihood remains that the providers will not meet all the PRA 

requirements, and NASA will need to determine if the risk portrayed by the analysis, with its large 

uncertainties, is acceptable. We encourage NASA to fully consider all factors, including the rationale 

and environments used to derive the original requirements, when evaluating the final PRA LOC numbers for both providers and making any risk acceptance decision.

C. Falcon 9 Helium Tank Redesign and Qualification

At the publication of last year’s ASAP report, the investigation for the F9-29 mishap was ongoing. 

SpaceX conducted the investigation with NASA, the U.S. Air Force, and FAA participation. NASA 

also conducted its own independent analysis of the evidence. Early in 2017, an ASAP member attended 

SpaceX’s briefing to NASA, covering the investigation results and conclusions. The Panel also received 

a copy of the mishap report and was briefed separately by SpaceX. The SpaceX investigation did not 

find a single most probable cause of the initiating event, instead identifying several credible causes 
16 Annual Report for 2017

Aerospace Safety Advisory Panel

involving the COPV helium tanks. All credible causes were similar in that they involved LOX trapped 

between the overwrap and the liner with subsequent ignition through friction or other mechanisms. 

The evidence recovered from the mishap showed indications of buckles in the COPV liner where LOX 

was likely trapped. Acting from the report findings, SpaceX was able to recreate a buckle event during a COPV test. Additional testing allowed SpaceX to identify specific conditions which would cause 

a buckle and trap oxygen in the gap between the liner and overwrap. Using this data, SpaceX modified its helium loading configuration, process, and controls to ensure that the COPVs would not be 

exposed to these identified conditions and, accepting any residual risk, successfully resumed commercial launches with the existing COPV design. However, to further improve safety, SpaceX and NASA 

agreed that a redesign of the COPV was necessary to reduce the risk for missions with crew onboard.

Using what they learned from the mishap investigation, SpaceX redesigned the COPV and NASA 

started a rigorous test program to characterize the behavior of the new COPV in the cryogenic oxygen 

environment. The Panel considers this to be the most critical step in clearing the COPV for human 

space flight, as it allows NASA and SpaceX to identify the credible failure mechanisms, hazard scenarios 

and controls, as well as understand the safety margins on the system. With this information, SpaceX can 

develop a proper qualification program and NASA can decide on the acceptability of the hazard controls and residual risk. The Panel strongly supports this effort and notes that this is another example of 

the commercial providers and NASA working together to solve a very difficult technical issue. In our 

opinion, adequate understanding of the COPV behavior in cryogenic oxygen is an absolutely essential precursor to potential certification for human space flight. It also should be noted that NASA and SpaceX 

are working on an alternative helium tank design should the COPV certification efforts fail. However, 

the heavier weight of the alternative design could require significant modifications to the supporting structure to handle the additional loads. Additionally, if the alternative tanks are only flown for 

NASA missions, the potential hazards and impacts arising from operating a unique F9 vehicle at a relatively low flight rate (as compared to SpaceX launches for other customers) would need to be carefully assessed.

The discussion of COPVs would not be complete without a mention of SpaceX’s plan to load densified propellants after the crew is onboard the Dragon2 (often referred to as “load and go”). In last 

year’s report, the Panel urged NASA and SpaceX to focus on “...understanding how the system functions in the dynamic thermal environment associated with ‘load and go’ so that...previously unidentified hazards can be discovered.” While the COPV efforts are consistent with that advice, we advise 

NASA not to discount the other potential hazards associated with loading cryogenic propellants—

particularly LOX. Fully assessing all the hazards is critical in determining the best time to load the 

crew onboard the Dragon2 for launch after considering the risks and benefits associated with such 

a decision.
Annual Report for 2017 17

Aerospace Safety Advisory Panel

IV. International Space Stati

A. Overview

The ISS remains the centerpiece of NASA’s 

currently operating human space flight 

program. It is presently the only humanoccupied space vehicle that NASA, or its 

supporting contractors, have in operation. 

Despite this fact, some in the general public may not be aware that it has been continuously occupied and operated by U.S. 

crews since Expedition 1 arrived in 2000. 

During that time, it has circled the Earth 

almost 100,000 times, traveling over 2 billion miles without a significant injury. This 

is an impressive record, especially considering the challenges of operating such a complex vehicle 24 

hours a day, 7 days a week, in LEO’s hostile vacuum, thermal, and radiation environment. This record 

is a testament to the ISS Program’s continuing excellent management. These challenges continue to 

grow as the ISS components gradually progress towards their life limits, and the threat of MMOD 

impact grows every year.

FIGURE 9. ISS on Orbit

B. Test Bed for Exploration

FIGURE 10. BEAM Deployment

In addition to the well-publicized, scientific research that is carried out on the ISS daily, an additional major benefit is serving as a “Proving Ground” to develop and test the technologies that will 

be required for humans to travel into deep space, including to Mars. The capabilities that must be 

developed or better understood include both the hardware that must operate for long periods of time 

without support from the Earth and the 

psychological and physiological responses 

and capabilities of the humans who will 

one day conduct exploration. One example 

of the type of technologies currently being 

explored on the ISS that could lead to more 

efficient and safer habitat on the journey to 

Mars is the Bigelow Expandable Activity 

Module (BEAM), currently operating successfully attached to the ISS. Others include 

highly reliable environmental control technologies that will be required to provide a 
18 Annual Report for 2017

Aerospace Safety Advisory Panel

safe environment for astronauts on their long journey to the Red Planet and research into the longterm effects of microgravity.

C. Aging Hardware

ISS begins its 18th year of hosting crews on-orbit during 2018, and is slated to continue service into 

2024 with the potential to serve as long as 2028. Day-to-day operations on Station are not without 

occasional challenges related to unanticipated equipment failures. While there have been no incidents 

to date which have risen to the level of a recordable mishap, many of the emergent failures have been 

successfully mitigated due in large part to the rigorous training and adaptability of the ISS crew, as 

well as the sound engineering, spares planning, and technical guidance from ground control personnel. A recent extravehicular activity (EVA) to repair a leaking External Active Thermal Control System 

Loop serves as one example of the type of maintenance requirement aboard ISS that will clearly 

require an effective Extravehicular Mobility Unit (EMU) maintenance program. During this EVA, 

astronauts were able to stop a persistent ammonia leak by isolating and venting a Radiator Beam Valve 

Module. This leak had been closely monitored by the ISS Program since its initial discovery in 2013, 

and was resolved after a thorough technical analysis of both risk and feasibility. As Station continues to 

mature toward its eventual retirement, we can foresee a potential for more frequent equipment anomalies and associated EVAs to support repairs. The ASAP will continue to closely monitor the ISS program for any indications of negative trends in this regard.

The Panel believes that EMU readiness and availability will become increasingly important to ISS 

sustainment through scheduled retirement. This year, we will closely monitor EMU readiness, particularly on-orbit EMUs and their critical subsystems, including Orbital Replacement Units (on-orbit 

interchangeable components). A number of documented anomalies have been observed since the 

EMUs entered service and, although there has not been a specific negative trend identified to date, 

these have impacted on-orbit maintenance capability. NASA’s Human Exploration and Operations 

Mission Directorate should closely examine EMU sustainment plans and practices to ensure that 

ISS can maintain continuous operations until the ISS retirement plan is executed. Once the third 

Commercial Cargo provider demonstrates initial capability, there should be increased opportunity for 

EMU rotations, which will allow for maintenance to be conducted in ideal cleanroom conditions at 

JSC as needed. Additionally, the Agency’s plan to develop a replacement EMU for future exploration 

missions beyond LEO should consider the ISS retirement timeline. As ISS approaches the end of its 

service life, it is critical to the success of the follow-on EMU program to capitalize on the ISS availability as a flight testbed.

D. Commercial Resupply

ISS’s continued safe operation has been made possible in large part by the ongoing Commercial 

Resupply Services (CRS) flights that have been in operation for the last five years. Both Orbital/ATK 

and SpaceX have successfully delivered essential consumables as well as other logistical support to ISS 
Annual Report for 2017 19

Aerospace Safety Advisory Panel

during this period. Without this support, the ISS would have to be de-crewed, which would present both immediate and longer-term safety concerns: the inability to perform essential ISS maintenance tasks on orbit, and the absence of efforts to reduce risk in future operations due to lost learning 

opportunities. In addition, SpaceX has the capability to return cargo to Earth to support both required 

maintenance on ISS equipment, such as EMUs. Two CRS providers have supplied the ISS program 

with redundant capability to deal with mishaps by one of the providers that would have otherwise 

threatened ISS resupply continuity and possibly ISS continuous operation. In the early 2020s, robust 

commercial resupply will be further enhanced when Sierra Nevada begins cargo resupply missions to 

ISS. Not only will this expand supply robustness, but Sierra Nevada’s Dream Chaser will also be able 

to bring back cargo and equipment. This will be particularly valuable for various equipment maintenance tasks.

FIGURE 11. Cygnus Approaches Canadarm2 FIGURE 12. Dragon Berthed to ISS

FIGURE 13. Dream Chaser on Armstrong Runway at Dawn

E. Deorbit Planning

When ISS construction began in 1998, NASA and its International Partners planned to eventually 

develop a controlled reentry capability before the scheduled termination of the Program. Until such a 

capability could be developed, they recognized that a catastrophic emergency could potentially result 
20 Annual Report for 2017

Aerospace Safety Advisory Panel

in a subsequent uncontrolled 

vehicle reentry,2 and the 

potential debris impact zone 

would be at a random spot on 

Earth somewhere within the 

Station’s 51.6-degree orbit 

inclination limits as shown 

by the magenta-colored latitudes indicated in Figure 14. 

While many of the ISS components are low-density and 

would simply tear off and burn up in the atmosphere upon reentry, many are much higher density 

and would be expected to reach the Earth at a relatively high energy, potentially resulting in damage 

or injury on the ground if impact were in a populated area. A common practice at the time ISS was 

begun was to rely on the low probability of orbital debris impacting a populated area to protect those 

on Earth from its effects. Since that time, international norms and treaties have made this approach 

unacceptable, and efforts have been underway for several years to provide for the controlled reentry of 

the ISS to a safe impact location when it is deorbited. Everyone hopes that the need for this process 

will be many years from now at the end of the ISS useful life. But the potential for a catastrophic failure and need to evacuate the crew—such as significant MMOD impact or an uncontrolled fire or hull 

breach—must be recognized and dealt with now to prevent an uncontrolled reentry. NASA estimates 

that the probability of a need to evacuate the Station is approximately 1/60 per year,3 or an approximate 12 percent chance during the seven remaining years of the currently projected Station life. That 

probability increases proportionally if Station life is extended.

2 “Final Tier 2 Environmental Impact Statement for International Space Station” May 1996, https://ntrs.nasa.gov/archive/nasa/casi.ntrs.

nasa.gov/19960053133.pdf

3 Draft ISS Deorbit Strategy and Contingency Action Plan, SSP 51066

FIGURE 14. Area within which surviving ISS debris has potential to impact

NASA has been working for several years to develop the planning, software, and hardware changes 

that are necessary to provide a controlled deorbit capability as soon as possible. Last year, the ASAP 

commended NASA’s commitment that established a new ISS Deorbit Strategy Program Manager 

position to oversee these efforts. This year, NASA has taken several actions to prepare, as best it can, 

for the potential for an emergency deorbit situation. The Program has developed a notional timeline 

for the various actions that need to be accomplished to prepare for this eventuality. An “ISS Deorbit 

Strategy and Contingency Action Plan” has been drafted and is nearing approval. The most recent 

action is to develop and soon send to orbit and install “gas trap plugs” that will prevent leakage of propellants needed for deorbit if there is a hull breach.

The actions accomplished to date will give some limited control of the reentry zone but do not yet 

provide for the accurate, reentry-point control needed to limit the debris field to a desired location. 

While several required actions are still ongoing at NASA, much of the significant remaining actions 
Annual Report for 2017 21

Aerospace Safety Advisory Panel

to prepare the emergency deorbit capability now rest with the ISS Russian partner. Until these planning actions are completed, the capability to accurately deorbit the ISS to a specific safe location in the 

event of an emergency does not yet exist. We strongly encourage these precautionary measures to be 

completed in a timely manner. Firm planning and capability should be in place in the unlikely event 

that emergency deorbit might be required at any given moment without notice. These actions should 

include the hardware and software requirements for deorbit, as well as the international decision process for Station abandonment that would be necessary at the highest levels within a short time period.

V. Deep Space Explorati

The 2017 Transition Authorization Act reinforced the direction that NASA had been given by the previous Administration to focus on sending humans to Mars. During the past year, NASA has continued to identify capabilities, technologies, and risk reduction approaches towards that objective. In last 

year’s report, the Panel acknowledged the positive progress that NASA had achieved in this endeavor. 

However, we noted that a more focused evaluation of potential mission architectures was required 

to gain confidence in the overall plan viability and sustainability, as well as the appropriate risk posture. We were encouraged to see substantial progress made in 2017 in the framework for exploration 

beyond LEO that advances the level of detail for the journey to Mars. This framework has been titled 

“Deep Space Gateway” (DSG).

FIGURE 15. Deep Space Gateway Concept

The DSG framework defines an 

exploration approach that appears to 

be flexible and include both industry 

and international collaboration, while 

addressing the risk management and mitigation activities necessary for journeying 

on to Mars. The DSG, stationed in cislunar space, takes advantage of the nearEarth lunar neighborhood to push the 

boundaries of human engagement further 

from LEO, while still remaining within a 

few days of home in the event of an emergency. The framework design flexibility 

provides NASA and its collaborators the 

potential of experimenting and testing 

multiple technologies and operational paradigms. It is an appropriate next step in the long series of 

activities that will lead humans to the Red Planet.

Concurrent with NASA’s definition of the DSG project, the new Administration has been coalescing around its approach for space policy. The newly reinstated National Space Council met for the first 

time on October 5, 2017. At that first meeting, a new vision for human exploration was announced:
22 Annual Report for 2017

Aerospace Safety Advisory Panel

“The United States shall lead an innovative and sustainable program of exploration with commercial and international partners to enable human expansion across the solar system and to bring back 

to Earth new knowledge and opportunities. Beginning with missions beyond low-Earth orbit, the 

United States will lead the return of humans to the Moon for long-term exploration and utilization, 

followed by human missions to Mars and other destinations.”

The DSG framework has the flexibility to accommodate this policy direction. However, the 

larger question is related to available resources. The addition of new hardware development programs 

will challenge an already constrained resource environment. For example, if NASA were directed to 

develop a lunar lander in addition to maintaining schedule and content on its existing programs, it 

would need additional resources to do so, regardless of whether or how NASA might choose to implement international or industrial partnerships. In addition, the implementation choice could potentially affect the risk posture and safety of some existing programs.

Consequently, the ASAP has two major areas of concern that will be receiving attention as the 

dynamics of the policy change and the development of the DSG moves forward:

• As the DSG concept is matured and implemented and the roles for NASA, industry, and international partners are identified, we are looking forward to understanding the integrated scope 

and priorities for the testing and risk reduction activities that will be undertaken in cislunar 

space, and potentially, on the lunar surface.

• If the direction for NASA in cislunar space now includes a mandated return to the Moon’s surface and no additional funds are supplied, it will create inevitable pressures on existing programs to execute safely.

Regarding the first concern, the Panel is interested in the testing or methodologies targeted for 

mitigating risks related to expanding human presence to Mars. Clearly articulating the connections 

between the requirements for a Mars mission to milestones for the DSG—and other forms of “proving grounds”—will also give NASA an understanding of the priorities and criticality of activities, 

allowing the Agency to make better decisions on collaboration potential. Included in the discussion on 

risk mitigation should be the role of any lunar surface activities.

Regarding the second concern, budget and resource allocation remains a challenging area for 

the Agency. NASA has more projects in development than at any time in the last several decades. 

All are critical for the future trajectory of human space flight in the U.S., and all are hitting important milestones in the next two years. The additional requirement to develop a lunar lander to support surface activities, without the commensurate funds, potentially threatens the sustainability of 

existing programs. The DSG concept facilitates NASA’s ability to work in collaboration with industry and international partners, and that flexibility should be exercised. If NASA would have to provide a portion of the development funds for a vehicle designed for sending and returning humans 

from the lunar surface, the funding source needs to be identified such that existing programs are not 

compromised. However, by collaborating on lunar surface exploration—with industry or one of the 
Annual Report for 2017 23

Aerospace Safety Advisory Panel

international partners providing the necessary transportation system—the budget impact may be minimal. Nevertheless, if NASA expects to use the results of the surface studies to enhance its Mars mission, it will still need to ensure any risk reduction activities planned will be timely.

Initial concepts for the DSG include a proposed new concept on human rating space systems as 

well as achieving redundancy. The DSG is a collection of multiple modules and includes the Orion 

crew capsule when crew is present. (The Orion transports the crew between LEO and the DSG.) The 

Orion capsule will be fully human rated, with appropriate redundancies in design and operation to 

mitigate loss of crew and minimize loss of mission. NASA is proposing a system-level design concept 

for the DSG that incorporates stringent human rating when the Orion is present, but proposes some 

relief when Orion is absent. Human rating of the DSG will be achieved, fundamentally, by the combined capabilities of the modules and the presence of the Orion vehicle; all components of the system 

are important, no single piece is enough. The operational concept being proposed is that if a critical 

system that irreparably impacts crew survivability fails, the crew response will be to egress the DSG, 

ingress Orion, and depart. The system-level concept being proposed thus increases risk for loss of mission while maintaining the stringent human rating standards to protect against loss of crew. The Panel 

acknowledges the new approach and looks forward to hearing more details about its implementation.

NASA has also reported that it will be considering alternative design approaches for achieving 

redundancy in the DSG. Taking advantage of experience gained on the ISS, NASA will pursue design 

concepts targeted at implementing dissimilar redundancy as a more robust approach. For example, 

there are redundant carbon dioxide removal systems on the ISS, but they are completely different 

systems in design and technology and totally independent of each other. Regardless of the ultimate 

design approach, NASA stated that the main goal remains the same—ensuring adherence to either loss 

of crew or loss of mission safety requirements.

In general, the Panel feels the DSG framework has excellent potential for appropriate risk mitigation related to a journey to Mars and looks forward to the ongoing detailed concept development.

VI. Aviati

A. Introduction

FIGURE 16. NASA Airborne Science Program’s 

P-3 Orion research aircraft departs

for another science mission.

During 2017, the Panel’s schedule afforded 

fewer opportunities to assess Aeronautics and 

Air Operations than were available during 2016. 

However, we did have the opportunity to receive 

an update on the status of the NASA Aircraft 

Management Information System (NAMIS) as well 

as a robust discussion on NASA aircraft capabilities improvements related to compliance with the 

NextGen Air Traffic Control initiative. Additionally, 
24 Annual Report for 2017

Aerospace Safety Advisory Panel

the Panel was represented at the IAOP and Aircraft Advisory Committee meetings in December 2017, 

which covered topics as diverse as Unmanned Aircraft Systems (UAS) regulatory development and 

operations to Public Aircraft Operations and Contract Air Services.

B. NASA Aircraft Management Information System

During 2017, the Panel addressed the ongoing NAMIS issue. In the previous two annual reports, 

NAMIS emerged as a topic area of serious concern, primarily due to program misalignment and persistent budgetary shortfalls that threatened its viability as a reliable aircrew readiness and aircraft configuration management tool. We are pleased to find that funding for NAMIS was realigned under the 

Office of Chief Information Officer (OCIO) as a “funded Information System Application” during 

FY 2017. This administrative realignment is an important step, because it should help alleviate some 

of the budget instability that had limited maintainability and required updates of NAMIS software 

in previous years. It should be noted that even though the NAMIS operating budget has been somewhat stabilized under the OCIO funding, some budgetary instability remains in the form request versus grant shortfalls. For example, for FY 2017, the approved grant was $4.2 million, but at some point 

during the FY, that was reduced to $3.9 million. With a relatively small operating budget, even small 

reductions such as this can result in reduced capacity to make critical, safety-of-flight software changes.

FIGURE 17. Different NAMIS software modules and their functions,

as well as interfaces with external systems.

Another commendable improvement in NAMIS program management is the maturation of the 

Configuration Control Board (CCB) process and its efforts to evaluate risk as it prioritizes software 

change requests. The CCB’s efforts have resulted in a marked decrease in overall number of open 
Annual Report for 2017 25

Aerospace Safety Advisory Panel

NAMIS software change requests and, more importantly, the process identifies and elevates the priority of critical safety-of-flight-related changes.

From an aircrew readiness perspective, NAMIS remains the sole means to monitor individual aircrew qualifications and flight currency. On the surface, having a software system with this capability 

and level of fidelity sounds like a fairly simple task, but it is, in fact, quite difficult to track properly. 

What makes this such a challenge is the fact that each NASA Center that has operating aircraft has 

a unique stable of airframes with various type/model/series represented, combined with NASA pilots 

who are generally qualified in multiple combinations of these aircraft. For example, a pilot assigned to 

JSC who is qualified in a single aircraft is required to fly a minimum number of hours and conduct a 

minimum number of landings/approaches per month/year in that aircraft. Compare that simple tracking formula to one that must track a pilot who is qualified in the T-38, WB-57, and the Gulfstream 

simultaneously. To maintain currency in all three of these aircraft, the pilot must fly each airframe with 

enough frequency to be proficient, but not as frequently as if they were qualified in each one separately. In other words, the tracking formula, and the program code in NAMIS, is different and may 

require a software change request to work correctly. The Panel will continue to monitor the status of 

NAMIS throughout 2018, paying close attention to funding consistency, change request backlog, as 

well as Agency discussions/decisions regarding future inclusion of UAS under the NAMIS umbrella.

C. Aircraft Operations and Fleet Updates

In December 2017, Panel representatives attended the IAOP held at NASA Headquarters. This 

engagement opportunity provided us with detailed insight into almost every facet of NASA 

aircraft operations.

NASA operates a diverse portfolio of aircraft to support a wide variety of missions, ranging from 

astronaut training to worldwide Earth science missions. Many are unique, one-of-a-kind aircraft that 

are highly modified to meet mission requirements. As these airframes age, a long-term plan is required 

to ensure NASA maintains the capability to conduct these critical Earth science missions. For example, NASA’s DC-8 was built in 1969, 

and has been flying with NASA since 

1985. Replacing this airframe requires 

a long-lead-time plan that will likely 

include a significant period of rework 

and modification prior to initial operational capability. The Panel commends 

the efforts of the Aeronautics Research 

Mission Directorate (ARMD) and 

their forward-looking vision to ensure 

seamless Earth science flight research 

capability.

FIGURE 18. Armstrong Flight Research Center’s

highly-modified DC-8 Airborne Science Laboratory
26 Annual Report for 2017

Aerospace Safety Advisory Panel

Additionally, NASA’s aircraft fleet must maintain the most current communications and navigation technology to operate unimpeded in the National Airspace System as well as in airspace systems 

around the globe. The ARMD has done an exceptional job managing these avionics system upgrades 

across the NASA aircraft portfolio to meet requirements to operate safely in special airspace such as 

Reduced Vertical Separation Minimums airspace, North Atlantic Organized Track System routes, and 

to meet forthcoming year 2020 Automatic Dependent Surveillance-Broadcast “out” to meet FAA 

NextGen Air Traffic Control requirements. These avionics capability upgrades all come at a cost, and 

priority should be given to continue funding these critical safety-of-flight upgrades.

D. New Aviation Horizon

FIGURE 19. NASA Commercial Supersonic Technology Demonstrator

Last year, the ASAP report discussed the proposed NASA 

Program entitled “New 

Horizons in Aeronautics.” 

The Program was envisioned 

to highlight NASA’s increased 

emphasis in aeronautics, air 

traffic management, aircraft 

environmental impact, and 

advanced aircraft technology, 

often referred to as “X-Planes.” 

The Panel praised this effort by 

the Agency to work towards sustaining U.S. leadership in flight 

science and aircraft design. At 

that time, due to the timing of 

budget actions, we were uncertain if this important initiative would obtain the necessary startup funding. We are pleased to report that funding was provided, and the work was initiated in 2017. More 

importantly, sustaining funding has been requested in the 2018 and out-year budgets.

The ASAP’s only caution expressed at that time was that any endeavor involving aircraft and 

advanced technology involves risk both to those on the ground and to the crew who pilot the test aircraft. Many of the technologies which will be investigated—for example, hypersonic and commercial 

supersonic flight, aircraft icing, and advanced propulsion—involve considerable risks, many of which 

are still unknown.

Therefore, we continue to emphasize our caution and urge NASA to move into the unknown 

while applying its full effort to risk identification and mitigation. Exploring the unknown can never be 

without risk, but taking unnecessary risk should not be tolerated. This important Program will be one 

which we will monitor closely, especially as NASA moves into X-Plane flight operations.
Annual Report for 2017 27

Aerospace Safety Advisory Panel

VII. Enterprise Protecti

Throughout 2017, the ASAP monitored NASA’s progress on its Enterprise Protection (EP) Program 

and related risk management activities. NASA has also received recent pressure from both the 

Administration—through a May 2017 Presidential Executive Order—and the NASA Office of 

Inspector General (OIG)—through numerous audits—to broadly account for the current NASA risk 

posture across the security enterprise. To NASA’s credit, Agency leadership has shown demonstrated 

awareness of the risks, and a few small steps have been taken toward an improved risk posture for the 

physical, corporate, and mission layers of the enterprise. However, much of NASA’s efforts this year 

have been focused on identifying areas of risk, while the implementation of risk reduction generally 

remains a topic for future work. From the ASAP’s perspective, the implementation of broader risk 

reduction measures, and how such measures are implemented through governance, will be a watch 

item in 2018.

Although the NASA EP Program began 2017 with an aggressive stance, it quickly stalled due to 

several factors. First, the Principal Advisor for Enterprise Protection announced his retirement after 

the first quarter of 2017, and his replacement was in place only after the start of the 4th quarter, 

leading to a leadership gap that may have been unavoidable but was nonetheless somewhat disruptive. Second, the Presidential Executive Order, Strengthening the Cybersecurity of Federal Networks and 

Critical Infrastructure (May 11, 2017), necessitated the stand-up of a NASA “Tiger Team” to provide 

a very broad, comprehensive response to the White House on a very demanding timeline. This NASA 

Tiger Team was constituted with all available talent, including the use of scant resources that were otherwise dedicated to the EP Program. Third, NASA has received a number of reports from the NASA 

OIG that audit many elements of Enterprise Protection (e.g., cybersecurity, governance for mission 

and institutional IT systems), and NASA has been challenged to address the findings, some of which 

have repeated over several years.

It was apparent to the ASAP that NASA’s concepts of Enterprise Protection are maturing. For 

example, the external pressure of the Presidential Executive Order ultimately created a much-needed 

focus on the risk management of the entire NASA enterprise, and NASA has now generated a comprehensive framework for future implementation of risk reduction. In addition, NASA is now working on an interim directive related to Enterprise Protection for the Agency and is developing a concept 

for a type of centralized security center designed to coordinate with other agencies on threat-based, 

cybersecurity issues.

As much as NASA has advanced its thinking on enterprise risk reduction for physical, corporate, 

and mission layers, it still requires governance, language, rule sets, budget alignments, clarity of authorities, and much more to actually achieve a sea change in risk-reducing behaviors across the enterprise. 

The ASAP senses that there are “great ideas” from NASA management on how to coordinate between 

disparate Centers and mission programs—some of which we noted in our 2016 report—but there is 

little evidence of comprehensive improvement plans that are designed to reduce risk. For example, 

the NASA OIG Report IG-18-002, NASA’S Efforts To Improve The Agency’s Information Technology 
28 Annual Report for 2017

Aerospace Safety Advisory Panel

Governance (Oct 19, 2017), documented NASA’s governance entities and their respective responsibilities for budget, authorities, policy, security, and the like, but made no mention at all of the Agency’s 

new EP Position nor the related EP Board. We were impressed with the enterprise risk reduction 

framework that NASA provided to the Executive Branch in August 2017, but it may be time to pause, 

redefine, and realign disparate enterprise protection governance activities—EP Office, OCIO, Center 

Directors, Mission/Center Project Managers/Chief Information Officers, Facility Operations, related 

Boards/Councils, etc.—to make the framework a reality that produces results. Any EP Program will 

be effective only if the entire Agency embraces it fully.

In the 2016 report, the ASAP mentioned concerns that the EP Principle Advisor and the EP 

Program was not a NASA program in the traditional sense, and that the EP Program needed to receive 

support and resources to wield influence within the Agency in the face of complacent security culture 

and ineffective integration. Although we have not seen sufficient evidence of a broadly supported EP 

Program, the Principal Advisor and the EP Program did make progress in addressing our very specific 

concern—implementing a policy that ensures that appropriate security clearances levels are attained 

and maintained for those personnel who have a role in managing enterprise risk, including the appropriate program managers. In 2016, we formulated a recommendation on this topic.

The ASAP recommends that NASA make it a matter of policy that priority is given to obtaining the 

appropriate level of security clearance for all personnel essential to implementing the Enterprise 

Protection Program, including the appropriate program managers.

The ASAP received a progress report late in 2017 about NASA’s improved security clearance metrics. The report indicated that the management of security clearances has the appropriate attention at 

the most senior leadership level, and that some top-down discipline has been instilled in NASA’s processes for defining, implementing, and monitoring the necessary match between security requirements 

and personnel positions.

In summary, while the Panel was initially impressed with the overall vision of the EP Program, 

NASA’s efforts do not seem to be integrated across the enterprise. Our observations are generally consistent with both the recent NASA OIG Federal Information Security Management Act (FISMA) 

Evaluation (Nov 6, 2017) and recent NASA OIG Audits, which repeatedly state that NASA has done 

a fairly good job of self-assessment but lacks cohesive, integrated, executable improvement plans. In 

2018, we will watch with interest to see how NASA intends to use its new, comprehensive framework 

to reduce risk across the enterprise.
Annual Report for 2017 29

Aerospace Safety Advisory Panel

VIII. Summa

Ten topic areas, highlighted in this report, are summarized in the following table. They have been broken out to focus attention on individual issues that the Panel feels are worthy of note. 

Topics 2017 Assessment

Impact of Continuing 

Resolution Funding

The Panel continues to be concerned with the continued use of partial year CRs, which add complexity and 

uncertainty to program management and execution, and detract from the requisite focus on safety and 

mission assurance.

Micrometeoroids and 

Orbital Debris

The potential for damage from MMOD is a major and increasing risk factor for every human space flight 

program. Serious improvements are needed in space situational awareness, space traffic management, and 

efforts to prevent the generation of new debris while reducing hazards posed by existing debris.

Human Space Flight 

Mishap Investigation 

Planning

The Panel has recommended that the language in the NASA Authorization Act of 2005 requiring a 

Presidential Commission investigation in all cases involving loss of flight crew as well as cases involving 

loss of vehicle, be reviewed and modified. The goal should be to have an independent review by qualified 

individuals, including NASA participation, in a thorough but expeditious manner.

Enterprise Protection

While the Panel was initially impressed with the overall vision of the EP Program, NASA’s efforts do not 

seem to be integrated across the enterprise. NASA has done a fairly good job of self-assessment but lacks 

cohesive, integrated, executable improvement plans.

Commercial Crew

Technical and 

Schedule Challenges

The current planning dates for the first crewed missions would allow NASA to maintain uninterrupted 

access to ISS. However, based on the quantity, significance, and associated uncertainty of work remaining 

for both providers, future schedule slips could easily consume all remaining margin. There are several 

major qualification and flight test events that historically are schedule drivers or could reveal the need for 

additional work. Space X is also still working the redesign and qualification of the COPV helium tanks for the 

Falcon 9.

Deep Space 

Exploration

NASA has defined the DSG as a flexible architecture capable of partnering with both industry and 

international partners to carry out exploration technology and operational risk mitigation in cislunar space. 

Given the recent direction to return to the lunar surface, the Panel is concerned that without additional 

resources to accomplish this new task, NASA’s ability to conduct a robust risk mitigation program will be in 

jeopardy. Adequate resources should be provided to ensure proper program content, testing, and milestones 

related to risk reduction for future Mars missions.

Exploration Systems 

Development—

Program Schedule 

Impact on Safety

In 2015, the Panel expressed concern that NASA was making changes to the Orion Test and Verification 

plan primarily to maintain schedule and did not assess the cumulative risk associated with those changes. 

However, currently we continue to see NASA’s commitment to “not cut technical content to hold schedule.” 

Yet, the upcoming program development activity is highly complex and involves the testing of huge pieces 

of hardware that continues to put pressure on the certification program, so this remains a watch item.

Exploration System 

Development—Launch 

Gap

The needed modification of the MLP to accommodate the SLS when fitted with the EUS would cause an 

approximate 33-month gap between EM-1 and EM-2, giving rise to a potential safety problem from the 

deterioration in both the number and skill of the ground launch work force. This could be mitigated by the 

construction of a second MLP if initiated in the near term.

International Space 

Station Contingency 

Deorbit Planning

While ISS deorbit planning continues to make progress and a designated Project Manager has been 

established to coordinate required actions, several critical elements of preparing to safely deorbit the 

Station in the event of an emergency are still required. Much of this work is beyond NASA’s control and 

must be accomplished by our Russian partner in order to have an emergency deorbit capability in place if 

needed.

Funding Adequacy 

for NASA Aircraft 

Management 

Information System

Adequate funding for NAMIS causing a large backlog in functional change requests was highlighted as a 

serious issue in last year’s report. This year, NAMIS funding responsibility was assumed by NASA OCIO and 

the backlog, while still significant, has been reduced. Despite funding being aligned under the OCIO, some 

budgetary risk remains, as evidenced by the FY 2017 funding shortfall of approximately $300,000 (93 

percent of original request). The NAMIS CCB is managing risk effectively at this time, but deeper budgetary 

cuts could jeopardize long-term NAMIS functionality.
30 Annual Report for 2017

Aerospace Safety Advisory Panel

Appendix A

Fire/Overheating 

(1971-2008)

ISS, 10/10/2008

ISS, 9/18/2006, 

ISS, 3/2005, Cre

Mir* 

Overheating BM

health-threaten

Crew: 2

Mir* 

Chemical oxyg

(SFOG) failure 

Crew: 5

Mir, 10/1994, C

STS-40, 6/1991, 

STS-35, 12/1990

STS-28, 8/1989, 

STS-6, 4/1983, C

Salyut 7, 9/1982

Salyut 6, 1979, 

Salyut 1, 6/197

*toxic byprodu

STS-112 10/7/2002

T-0 umbilical issues resulted in none of 

the system A pyrotechnic charges firing.

Crew: 6 

STS-61C 1/6/1986

System configuration errors resulted 

in inadvertent drain back of 14,000 

lbs of LOX prelaunch, which would 

have resulted in a Trans-Atlantic Abort 

Landing. 

Crew: 7

On-pad Abort Events (1984-1993)

STS-41D 6/26/1984

Following a pad abort, LH2

 leaked from SSME3, resulting in a fire at the base of 

the orbiter.

Crew: 6 

Other On-pad Abort Events:

STS-51F, STS-55, STS-51, STS-68.

STS-1 4/12/1981

SRB ignition pressure wave caused TPS 

and structural damage.

Crew: 2

Apollo 1 (AS-204) 1/27/1967

Crew cabin fire (electrical short + high 

pressure O2

 atmosphere).

Crew: 3 Loss of Crew

Gemini 6 12/12/1965

Main engine shutdown. Booster left 

unsecured on pad. Crew elected not to 

eject. Launched 3 days later.

Crew: 2

Loss of Crew

Crew Injury/Illness 

and/or Loss of 

Vehicle or Mission

Related or Recurring 

event

Legend

Significant Incidents and Close Calls in Human Spaceflight

A Product of the JSC S&MA Flight Safety Office

STS-110 4/8/2002

STS-109 3/1/2002

STS-108 12/5/2001

Incorrect adjustments to the 

controller software resulted in SSME 

underperformance. 

Crew: 7

STS-91 6/2/1998

Main engine pressure chamber sensor 

failed. If it occurred later, logic error 

may have triggered at RTLS.

Crew: 6

Soyuz TM-9 2/11/1990

DM insulation torn loose on ascent;

contingency EVA repair.

Crew: 2

SRB Seal Events (1981-1996)

 

Other SRB gas sealing anomalies: STS-2, 

6, 41B, 41C, 41D, 51C, 51D, 51B, 51G, 51F, 

51I, 51J, 61A, 61B, 61C, 42, 71, 70, 78

STS-51F 7/29/1985

Temperature sensor problems resulted in 

SSME1 shutdown at T+5:45.

Crew: 7 Abort To Orbit

Soyuz 18-1(18a) 4/5/1975

Electrical fault caused premature 

firing of half of the 2nd stage separation 

bolts, resulting in the inability to fire the 

remaining ones. Staging failure 

resulted in abort sequence being used 

at T=295 seconds. 

Crew: 2 Loss of Vehicle/Mission

Apollo 13 4/11/1970

2nd stage center engine shutdown due 

to pogo oscillations.

Crew: 3 

Apollo 12 11/14/1969

Lightning strike on ascent.

Crew: 3

Gemini 10 7/18/1966

1st stage oxidizer tank exploded at staging. 

No discernable effects. Nominal ascent.

Crew: 2

EVA Incidents Summary (1965-2014)

See the Significant Incidents in EVA Operations 

Graphic for more details.

(spaceflight.nasa.gov/outreach/readersroom.html)

Medical Evacuation

Mir EO-2, 1987, Cr

One replaced e

medical condit

Salyut 7, 1985, Cre

One returned w

due to medica

Salyut 5, 8/25/197

Early return of c

effects from sus

gases in space 

Apollo 10 5/22/1969

Switch misconfiguration resulted 

in lunar module control problems.

Crew: 2

ISS Increment 38 12/11/2013

ITCS configuration errors resulted 

in near freezing and potential 

rupture of water-to-ammonia heat 

exchanger. 

Crew: 6 

Soyuz TMA-18 (22S) 9/23/2010

First attempt to separate from ISS 

failed; ISS crew succeeded in 

bypassing faulty sensor.

Crew: Soyuz 3, ISS 3

ISS, Increment 17 4/30/2008

Freon 218 leaked from SM AC.

Crew: 3

ISS Increment 15 6/10-6/18/2007

Power switch failures caused loss 

of ISS propulsive attitude control 

capability.

Crew: 10

ISS, Increment 13 8/2006

Triol coolant leak in SM.

Crew: 3

ISS, Increment 10 2/2005

Potential acid preservative aerosol 

escape from Russian urinal.

Crew: 2

ISS, Increment 5&6 mid-2002-2/03

Formaldehyde periodically 

exceeded long-term limits.

Crew: 3-10

ISS, Increment 2-4 4/2001-3/2002

Freon 218 leaked from SM AC.

Crew: 3

ISS, Increment 4 2/2002

MetOx regeneration caused 

noxious air.

Crew: 3

ISS 8/2001

Extrememly high methanol levels in 

FGB air sample.

Crew: 3

STS-104 7/2001

EMU battery leaked hazardous KOH. 

Discovered during EMU checkout.

Crew: 5

X-15 3-65-97 11/15/1967

Electrical short and crew 

error led to loss of control 

at 230,000 feet. First U.S. 

spaceflight fatality.

Crew: 1 Loss of Crew

Entry

Ascent

SpaceShipOne, 16P 9/29/2004

Uncommanded vehicle roll. 

Control regained prior to 

apogee.

Crew: 1

SpaceShipOne, 14P 5/13/2004

Flight computer unreponsive. 

Recovered by rebooting.

Crew: 1

Suborbital Flights

Altitude Chamber O2 Fire - Soviet 3/23/1961

Alcohol wipe hit hot plate and started fire in 

oxygen-rich test chamber.

Crew: 1 Loss of Crew Descent

Cruise

Launch/Ground Research Facility Atmospheric Flights 

Ascent

Earth Orbit

Apollo 11 7/21/1969

Engine arm circuit breaker knob broke 

off. Circuit breaker successfully reset 

allowing ascent.

Crew: 2

Lunar Orbit

Ascent

The Significant Incidents and Close Calls in Human Spaceflight graphic is primarily focused on human spaceflight incidents occurring with a 

crew aboard a space vehicle. It includes suborbital, orbital, and lunar missions. Selected non-spaceflight and uncrewed events are included 

if they have strong relevance to human spaceflight. For instance, the loss of the uncrewed Progress 44P is included because it has launch 

vehicle commonalities with the crewed Soyuz missions. The altitude chamber oxygen fire in Russia preceded the U.S. Navy oxygen chamber 

fire and the Apollo 1 fire, which occurred under similar circumstances. The SR-71 accident is the highest and fastest vehicle breakup on record 

that was survivable, and it represents the d

the loss of a suborbital space vehicle durin

This document is a work in progress. It is co

S&MA Flight Safety Office.

Outbound

Apollo 14 1/31/1971

Multiple failed docking attempts. 

Contingency procedures 

developed to mitigate risk of 

recurring docking anomaly. 

Docking successful. 

Crew: 3

Apollo 13 4/13/1970

Explosion due to electrical 

short. Loss of O2 and EPS.

Crew: 3 Loss of Mission

Ascent

ISS Increment 2 4/24/2001

Failure of all U.S. command and 

control computers on ISS.

Crew: 10

STS-99 2/2000

High bacterial count in postflight 

sample after GIRA installed to 

removed iodine.

Crew: 6

ISS, Flight 2A.1 5/1999

Crew sickened in FGB; likely a 

result of high localized CO2

 levels 

due to poor ventilation.

Crew: 7

STS-95 10/29/1998

Preflight sterilization process 

chemically altered the Low 

Iodine Residual System resulting 

in contaminated drinking water. 

Crew: 7

STS-87 11/21/1997

Spartan satellite deployed 

without proper activation. 

Recapture with RMS unsuccessful. 

Later captured by EVA crew.

Crew: 6

Mir 7/17/1997

Accidental unplugging of 

computer power cable led to 

loss of attitude control and loss of 

power. 

Crew: 3

STS-83 4/6/1997

Failure of fuel cell number 2 

resulted in MDF being declared. 

The 15-day mission was 

shortened to 3 days. 

Crew: 7 Minimum Duration Flight 

 Loss of Mission

STS-51 9/12/1993

Both port-side primary and 

secondary SUPER*ZIP explosive 

cords fired, resulting in 

containment tube failure and 

damage in the payload bay.

Crew: 5

STS-44 11/24/1991

Failure of IMU 2 caused MDF to be 

declared. 10-day mission shortened to 

7 days.

Crew: 6 Minimum Duration Flight

STS-32 1/9/1990

Erroneous state vector up-linked to flight 

control system, causing immediate and 

unpredictable attitude control problems.

Crew: 3 Loss of Attitude Control

STS-9 12/8/1983

Two GPCs failed during reconfiguration 

for entry. One GPC could not be 

recovered.

Crew: 3

STS-2 11/12/1981

• Failure of fuel cell resulted in a MDF 

being declared. 

• The fuel cell failure also resulted 

in hydrogen in the drinking water 

leading to crew dehydration.

Crew: 2 Mission Terminated

Soyuz 33 4/12/1979

Main engine anomaly caused final 

rendezvous abort. 

Crew: 2 Loss of Mission

Soyuz 21 8/24/1976

Separation from Salyut failed; ground 

command succeeded in opening 

latches.

Crew: 2

Soyuz 1 4/23/1967

Failures in attitude control and 

electrical power systems resulted in 

a loss of mission. The launch of the 

intended docking target, Soyuz 2, was 

scrubbed. 

Crew: 1 Loss of Mission

Gemini 8 3/16-3/17/1966

Stuck thruster caused loss of control 

and led to 1st U.S. emergency de-orbit. 

Crew: 2 Emergency De-orbit

Mercury MA-9 5/16/1963

Electrical faults caused loss of some 

systems and need to perform manual 

entry. Also experienced high PPCO2 levels in suit during entry operations.

Crew: 1 Manual Entry

Navy Chamber 11/17/1962

Fire started in a 100% oxygen environment 

at 5 psi. Four officers injured.

Crew: 4 Crew Injury (4)

Soyuz T-10-1 (T-10a) 9/26/1983

Pad booster fire/explosion. Capsule 

Escape System used. 

Crew: 2 Loss of Vehicle/Mission

SR-71 

Ascent Debris 

STS-124 5/31/2008

Pad 39-A flame trench suffered 

significant damage causing 

about 3,500 refractory bricks to 

be blown away from the flame 

trench wall.

Crew: 7

STS-95 10/29/1998

Drag chute door separated 

during launch and impacted 

main engine bell.

Crew: 7

Other significant ascent debris 

events have occurred on:

STS-116 and STS-125

Late Release Orbiter Tyvek 

Covers

STS-114, 115, 118, 119, 124, 126

Docking Anomalies

STS-133 

Experienced significant misalignment between orbiter a

post-capture free drift due to gravity-gradient-induced 

Crew: 6

STS-130 

Experienced significant misalignment between orbiter a

post-capture free drift due to gravity-gradient-induced 

Crew: 6

Skylab 2 

Multiple failed automatic docking attempts resulted in ma

Skylab. 

Crew: 3

Mir Collision Events (1994-1997)

 

Mir 8/30/1994

Progress M-24 collided with Mir 

during second docking attempt. 

Mir Crew: 2 Collision

Mir 1/14/1994

Soyuz TM-17 collided twice with 

Mir during undocking.

Crew: Soyuz 2, Mir 3 Collision

Mir 6/25/1997

Progress M-34 collided with Mir. 

Spektr pressure shell ruptured. 

Spektr module isolated. Cables 

through hatchway impeded 

hatch closing.

Mir Crew: 3 Collision

SR-71 1/25/1966

Loss of control at high speed 

and altitude.

Crew: 2 Loss of Crew (1)

Soyuz T-8 

Loss of rendezvous antenna prevented docking. 

Crew: Soyuz 3 

Soyuz 10 

Automatic docking system failed. Manual docking with Saly

Crew: 3 

Descent

Earth Return

Ascent

Descent

Progress M-12M (44P) 8/24/2011

Anomaly in fuel pressurization system led 

to shutdown of 3rd stage engine. Vehicle failed to reach orbit. 

Crew: 0 Loss of Vehicle/Mission

STS-117 6/8/2007

Thermal blanket damage. EVA performed 

to repair damage. 

Crew: 7 

STS-114 5/26/2005

• Bird strike on External Tank.

• Loss of foam from External Tank PAL ramp.

• TPS gap filers protruding. Removed during 

third mission EVA.

• Missing O-ring resulted in ejection of one of two NSIs, compromising the ET forward 

separation bolt function and damaging 

secondary structure and a thermal 

blanket. 

Crew: 7 

STS-93 7/23/1999

• At T+5 a short on AC1 Phase A resulted in loss of SSME1 Controller A and 

SSME3 Controller B.

• SSME3 H2

 leak: early LOX depletion and shutdown.

Crew: 5 

13 EVAs resulted in crew injury:

Gemini 10, Apollo 17, Salyut 7 PE-1,

Salyut 7 VE-3, STS-61-B EVAs 1&2,

STS-37, Mir PE-9, STS-63, STS-97/4A,

STS-100/6A EVAs 1&2, STS-134/ULF6

X-15 3-65-97 11/15/1967

Electrical short and crew

error led to loss of control 

at 230,000 feet. First U.S. 

spaceflight fatality.

Crew: 1 Loss of Crew

STS-51L (Challenger) 1/28/1986

SRB seal failure.

Crew: 7 Loss of Crew
Annual Report for 2017 31

Aerospace Safety Advisory Panel

g Events

8, Crew: 3

 Crew: 3*

ew: 2

2/26/1998

MP beds produce 

ing level of CO.

2/24/1997

gen generator 

resulted in fire.

rew: 6

 Crew: 7*

0, Crew: 7*

 Crew: 5*

Crew: 4*

2, Crew: 3

 Crew: 3

1, Crew: 3

ucts released

Soyuz TM-5 9/6/1988

Two de-orbit attempts failed. Crew confined to DM due 

to OM being jettisoned prior to 1st de-orbit attempt. Crew 

prevented erroneous firing of SM separation pyrotechnics.

Crew: 2 

Soyuz T-11 10/2/1984

Partial failure of atmospheric entry control system.

Crew: 3

Soyuz 33 4/12/1979

Backup engine burned 25 seconds too long on

de-orbit. Ballistic entry.

Crew: 2

Skylab 4 2/8/1974

Incorrect circuit breakers opened, resulting in the loss of 

the automatic control. 

Crew: 3 

Soyuz 11 6/30/1971

Pyrotechnic system failure resulted in crew module 

rapid depress.

Crew: 3 Loss of Crew

Gemini 5 8/29/1965

Erroneous entry data uplinked; crew manually corrected 

entry flight profile.

Crew: 2

Gemini 4 6/7/1965

Erroneous entry data uplinked; crew manually corrected 

entry flight profile.

Crew: 2

Voskhod 2 3/19/1965

Automatic descent system malfunctioned. Issues with 

manual entry resulted in off-target, rough terrain landing. 

Delayed crew recovery. 

Crew: 2

Mercury MA-7 5/24/1962

Pitch horizon scanner failed, resulting in manual entry 

and off-target landing. Delayed crew recovery. 

Crew: 1

Mercury MA-6 2/20/1962

False landing-bag indicator light led to entry with 

retropack in place as a precaution.

Crew: 1

ns (1976-1987)

rew: 2

early due to

tion.

ew: 3

with visiting crew 

l condition.

76, Crew: 2

crew due to health 

spected toxic 

 station.

 Crew Illness

Landing and Postlanding

Soyuz TM-25 8/17/1997

Landing rockets fired at heat shield 

separation rather than at landing.

Crew: 3

Apollo ASTP 7/24/1975

N2

O4 in crew cabin. Crew hospitalized for 2 weeks. 

Crew: 3 Crew Injury 

Mercury MA-7 5/24/1962

RCS depletion at 80,000 ft.

Crew: 1

Entry

Descent

demonstrated limit of crew survival with current technology. The SpaceShipTwo accident represents 

ng flight testing.

ontinually under review and frequently updated. Please direct comments and questions to the JSC 

Service/Descent Module Separation Failures

(1961-2008) 

Soyuz TMA-10 (14S) 10/21/2007 Crew: 3

Soyuz 5 1/18/1969 Crew: 2

Voskhod 2 3/19/1965 Crew: 1

Vostok 5 6/19/1963 Crew: 1

Vostok 2 8/7/1961 Crew: 1

Vostok 1 4/12/1961 Crew: 1

Soyuz Landing Events (1967-1993)

Soyuz TM-15 2/1/1993

Rolled down hillside.

Crew: 2

Soyuz TM-14 8/10/1992

Hard landing impact. Hatch 

jammed, requiring cosmonauts to 

use tools to pry open.

Crew: 3

Soyuz TM-12 10/10/1991

Hard impact. News team reported 

capsule as “very dented.”

Crew: 3

Soyuz TM-7 4/27/1989

Double-impact “hard landing.” 

Crew: 2 Crew Injury (1) 

Soyuz T-7 12/10/1982

Landed on hillside and rolled 

downhill. One cosmonaut thrown 

from seat.

Crew: 2

Soyuz 36 7/31/1980

Landing rockets failed to fire 

resulting in ~30 g impact.

Crew: 2

Soyuz 23 10/16/1976

Landed on frozen lake during 

blizzard. Delayed recovery.

Crew: 2

Soyuz 18-1 (18a) 4/5/1975

After ascent abort, capsule 

landed on snowy slope above cliff. 

Parachute snagged and prevented 

fall.

Crew: 2

Soyuz 5 1/18/1969

Landing rockets failed to fire, 

resulting in a hard landing. 

Crew: 1 Crew Injury 

Soyuz 1 4/24/1967

Main and reserve parachutes 

failed. 

Crew: 1 Loss of Crew 

Summer 2015

STS-134 6/1/2011

Brief fire observed between the left 

main landing gear tires during runway 

rollout.

Crew: 7

STS-108 12/17/2001

Violation of minimum landing weather 

requirements.

Crew: 7

STS-90 5/3/1998

Hard, fast landing due to human 

factors and rogue wind gust. Hardest 

shuttle landing.

Crew: 7

STS-37 4/11/1991

Several factors contributed to a

low-energy landing 623 feet prior to 

the threshold of the runway at the 

backup landing location.

Crew: 5 Low Energy Landing

STS-51D 4/19/1985

Right brake failed (locked up) causing 

blowout of inboard tire and significant 

damage to outboard tire.

Crew: 7

STS-9 12/8/1983

A. Two APUs caught fire during rollout.

B. GPC failed on touchdown.

C.Incorrect flight control 

rechannelization on rollout.

Crew: 6

STS-3 3/30/1982

Pilot induced oscillation during 

derotation. Stronger than predicted 

winds contributed.

Crew: 2

Soyuz 15 8/28/1974

Descended through an electrical storm 

during night landing.

Crew: 2

Apollo 15 8/7/1971

Landed with only 2 of 3 parachutes.

Crew: 3

Apollo 12 11/24/1969

Harder than normal splashdown 

knocked loose a camera. The 

camera knocked lunar module pilot 

unconscious. 

Crew: 3

Mercury MR-4 7/21/1961

Inadvertent hatch pyrotechnic firing. 

Capsule sunk. Astronaut nearly drowned.

Crew: 1 Loss of Capsule

TPS Entry Events (1981-2003)

STS-51D 4/19/1985

TPS burn-through on left outboard elevon.

Crew: 7

STS-1 4/14/1981

Right-hand main landing gear door warped 

due to entry heating.

Crew: 2

Other significant STS TPS anomalies:

STS-6, 41B, 51G, 27*, 28, 40, 42, 45

*Most severe tile damage to date.

STS-107 (Columbia) 2/1/2003

TPS damage from ascent debris strike 

resulted in loss of crew and vehicle on 

entry. Similar bipod ramp foam loss 

occurred on STS-7, STS-32, STS-50, STS-52, 

STS-62, and STS-112

Crew: 7 Loss of Crew

Soyuz TMA-11 (15S) 4/19/2008 

Ballistic, high g entry and landing over 400 

km short of intended target.

Crew: 3 Crew Injury (1)

X-15 Soyuz 1 Apollo 1 Soyuz 11 Challenger Columbia

2/26/2011

and ISS during 

 motion.

2/10/2010

and ISS during 

 motion.

5/26/1973

anual docking to 

4/22/1983

Loss of Mission

4/23/1971

yut not achieved. 

Loss of Mission

SpaceShipTwo, PF04 10/31/2014

Vehicle breakup during powered flight.

Crew: 2 Loss of Crew (1)

SpaceShipOne, Flight 11P 12/17/2003

Left main landing gear collapsed.

Crew: 1

M21-D21 7/30/1966

D21 drone collided with M21 during launch, causing M21 

breakup. Crew survived breakup but one was lost after 

water landing. 

Crew: 2 Loss of Crew (1)

Abbreviations and Acronyms

AC Air Conditioner

APU Auxiliary Power Unit

BMP Microimpurities Removal System (Russian)

CDRA Carbon Dioxide Removal System

CMG Control Management Gyroscope

CO Carbon Monoxide

CO2 Carbon Dioxide

DM Descent Module

EMU Extravehicular Mobility Unit

EPS Electrical Power System

EV Extravehicular

FGB Functional Cargo Block (Russian)

FSO Flight Safety Office

GIRA Galley Iodine Removal Assembly

GPC General Purpose Computer

GPS Global Positioning System

H2 Hydrogen

IMU Inertial Measurement Unit

ISS International Space Station

ITCS Internal Thermal Control System

KOH Potassium Hydroxide

LH2 Liquid Hydrogen

LOC Loss of Crew

LOV Loss of Vehicle

LOX Liquid Oxygen

MDF Minimum Duration Flight

MetOx Metal Oxide

MMOD Micro-Meteoroid Orbital Debris

N2

O4 Nitrogen Tetroxide

NSI NASA Standard Initiator

O2 Oxygen

OM Oribital Module

OSMA Office of Safety & Mission Assurance

PAL Protuberance Air Load

PASS Primary Avionics Software System

PPCO2 Partial Pressure of Carbon Dioxide

RCS Reaction Control System/Subsystem

RMS Remote Manipulator System

RTLS Return to Launch Site

SFOG Solid Fuel Oxygen Generator

S&MA Safety & Mission Assurance

SM Service Module

SRB Solid Rocket Booster

SSME Space Shuttle Main Engine

SSP Space Shuttle Program

STS Space Transportation System

TPS Thermal Protection System

U.S. United States

Visit the NASA Human Spaceflight Readers Room

(http://spaceflight.nasa.gov/outreach/readersroom.html)

for the latest version of the Significant Incidents and

Close Calls in Human Spaceflight chart.

Contacts

Nigel Packham, Ph.D., NASA

Manager, JSC S&MA Flight Safety Office

Nigel.Packham-1@nasa.gov

William Stockton, SAIC

FSO Support Team Lead

William.W.Stockton@nasa.gov

Dennis Pate, SAIC

Assessments Specialist, FSO Support Team

Dennis.W.Pate@nasa.gov

Soyuz 18-1 (18a) 4/5/1975

After ascent abort, capsule 

landed on snowy slope above cliff. 

Parachute snagged and prevented 

fall.

Crew: 2

Soyuz 18-1 (18a) 4/5/1975

After ascent abort, capsule landed 

on snowy slope above cliff. Parachute 

snagged and prevented fall.

Crew: 2 Crew Injury

Fire/Overheating Events

(1971-2008)

ISS, 10/10/2008, Crew: 3

ISS, 9/18/2006, Crew: 3*

ISS, 3/2005, Crew: 2

Mir* 2/26/1998

Overheating BMP beds produce 

health-threatening level of CO.

Crew: 2

Mir* 2/24/1997

Chemical oxygen generator 

(SFOG) failure resulted in fire.

Crew: 5

Mir, 10/1994, Crew: 6

STS-40, 6/1991, Crew: 7*

STS-35, 12/1990, Crew: 7*

STS-28, 8/1989, Crew: 5*

STS-6, 4/1983, Crew: 4*

Salyut 7, 9/1982, Crew: 3

Salyut 6, 1979, Crew: 3

Salyut 1, 6/1971, Crew: 3

*toxic byproducts released

Soyuz TM-5 9/6/1988

Two de-orbit attempts failed. Crew confined to DM due 

to OM being jettisoned prior to 1st de-orbit attempt. Crew 

prevented erroneous firing of SM separation pyrotechnics.

Crew: 2 

Soyuz T-11 10/2/1984

Partial failure of atmospheric entry control system.

Crew: 3

Soyuz 33 4/12/1979

Backup engine burned 25 seconds too long on

de-orbit. Ballistic entry.

Crew: 2

Skylab 4 2/8/1974

Incorrect circuit breakers opened, resulting in the loss of 

the automatic control. 

Crew: 3 

Soyuz 11 6/30/1971

Pyrotechnic system failure resulted in crew module 

rapid depress.

Crew: 3 Loss of Crew

Gemini 5 8/29/1965

Erroneous entry data uplinked; crew manually corrected 

entry flight profile.

Crew: 2

Gemini 4 6/7/1965

Erroneous entry data uplinked; crew manually corrected 

entry flight profile.

Crew: 2

Voskhod 2 3/19/1965

Automatic descent system malfunctioned. Issues with 

manual entry resulted in off-target, rough terrain landing. 

Delayed crew recovery. 

Crew: 2

Mercury MA-7 5/24/1962

Pitch horizon scanner failed, resulting in manual entry 

and off-target landing. Delayed crew recovery. 

Crew: 1

Mercury MA-6 2/20/1962

False landing-bag indicator light led to entry with 

retropack in place as a precaution.

Crew: 1

paceflight

Medical Evacuations (1976-1987)

Mir EO-2, 1987, Crew: 2

One replaced early due to

medical condition.

Salyut 7, 1985, Crew: 3

One returned with visiting crew 

due to medical condition.

Salyut 5, 8/25/1976, Crew: 2

Early return of crew due to health 

effects from suspected toxic 

gases in space station.

 Crew Illness

Descent

Cruise

Atmospheric Flights Landing and Postlanding

Soyuz TM-25 8/17/1997

Landing rockets fired at heat shield 

separation rather than at landing.

Crew: 3

Apollo ASTP 7/24/1975

N2

O4 in crew cabin. Crew hospitalized for 2 weeks. 

Crew: 3 Crew Injury 

Mercury MA-7 5/24/1962

RCS depletion at 80,000 ft.

Crew: 1

Entry

Descent

Ascent

rth Orbit

7/21/1969

rcuit breaker knob broke 

eaker successfully reset 

ent.

ng with a 

 included 

as launch 

chamber 

on record 

that was survivable, and it represents the demonstrated limit of crew survival with current technology. The SpaceShipTwo accident represents 

the loss of a suborbital space vehicle during flight testing.

This document is a work in progress. It is continually under review and frequently updated. Please direct comments and questions to the JSC 

S&MA Flight Safety Office.

Service/Descent Module Separation Failures

(1961-2008) 

Soyuz TMA-10 (14S) 10/21/2007 Crew: 3

Soyuz 5 1/18/1969 Crew: 2

Voskhod 2 3/19/1965 Crew: 1

Vostok 5 6/19/1963 Crew: 1

Vostok 2 8/7/1961 Crew: 1

Vostok 1 4/12/1961 Crew: 1

Soyuz Landing Events (1967-1993)

Soyuz TM-15 2/1/1993

Rolled down hillside.

Crew: 2

Soyuz TM-14 8/10/1992

Hard landing impact. Hatch 

jammed, requiring cosmonauts to 

use tools to pry open.

Crew: 3

Soyuz TM-12 10/10/1991

Hard impact. News team reported 

capsule as “very dented.”

Crew: 3

Soyuz TM-7 4/27/1989

Double-impact “hard landing.” 

Crew: 2 Crew Injury (1) 

Soyuz T-7 12/10/1982

Landed on hillside and rolled 

downhill. One cosmonaut thrown 

from seat.

Crew: 2

Soyuz 36 7/31/1980

Landing rockets failed to fire 

resulting in ~30 g impact.

Crew: 2

Soyuz 23 10/16/1976

Landed on frozen lake during 

blizzard. Delayed recovery.

Crew: 2

Soyuz 18-1 (18a) 4/5/1975

After ascent abort, capsule 

landed on snowy slope above cliff. 

Parachute snagged and prevented 

fall.

Crew: 2

Soyuz 5 1/18/1969

Landing rockets failed to fire, 

resulting in a hard landing. 

Crew: 1 Crew Injury 

Soyuz 1 4/24/1967

Main and reserve parachutes 

failed. 

Crew: 1 Loss of Crew 

Summer 2015

STS-134 6/1/2011

Brief fire observed between the left 

main landing gear tires during runway 

rollout.

Crew: 7

STS-108 12/17/2001

Violation of minimum landing weather 

requirements.

Crew: 7

STS-90 5/3/1998

Hard, fast landing due to human 

factors and rogue wind gust. Hardest 

shuttle landing.

Crew: 7

STS-37 4/11/1991

Several factors contributed to a

low-energy landing 623 feet prior to 

the threshold of the runway at the 

backup landing location.

Crew: 5 Low Energy Landing

STS-51D 4/19/1985

Right brake failed (locked up) causing 

blowout of inboard tire and significant 

damage to outboard tire.

Crew: 7

STS-9 12/8/1983

A. Two APUs caught fire during rollout.

B. GPC failed on touchdown.

C.Incorrect flight control 

rechannelization on rollout.

Crew: 6

STS-3 3/30/1982

Pilot induced oscillation during 

derotation. Stronger than predicted 

winds contributed.

Crew: 2

Soyuz 15 8/28/1974

Descended through an electrical storm 

during night landing.

Crew: 2

Apollo 15 8/7/1971

Landed with only 2 of 3 parachutes.

Crew: 3

Apollo 12 11/24/1969

Harder than normal splashdown 

knocked loose a camera. The 

camera knocked lunar module pilot 

unconscious. 

Crew: 3

Mercury MR-4 7/21/1961

Inadvertent hatch pyrotechnic firing. 

Capsule sunk. Astronaut nearly drowned.

Crew: 1 Loss of Capsule

TPS Entry Events (1981-2003)

STS-51D 4/19/1985

TPS burn-through on left outboard elevon.

Crew: 7

STS-1 4/14/1981

Right-hand main landing gear door warped 

due to entry heating.

Crew: 2

Other significant STS TPS anomalies:

STS-6, 41B, 51G, 27*, 28, 40, 42, 45

*Most severe tile damage to date.

STS-107 (Columbia) 2/1/2003

TPS damage from ascent debris strike 

resulted in loss of crew and vehicle on 

entry. Similar bipod ramp foam loss 

occurred on STS-7, STS-32, STS-50, STS-52, 

STS-62, and STS-112

Crew: 7 Loss of Crew

Soyuz TMA-11 (15S) 4/19/2008 

Ballistic, high g entry and landing over 400 

km short of intended target.

Crew: 3 Crew Injury (1)

11/24/1991

ed MDF to be 

sion shortened to 

m Duration Flight

1/9/1990

 up-linked to flight 

g immediate and 

e control problems.

f Attitude Control

12/8/1983

ng reconfiguration 

ould not be 

11/12/1981

sulted in a MDF 

lso resulted 

rinking water 

hydration.

Mission Terminated

4/12/1979

y caused final 

Loss of Mission

8/24/1976

ut failed; ground 

ed in opening 

4/23/1967

ntrol and 

ems resulted in 

aunch of the 

get, Soyuz 2, was 

Loss of Mission

3/16-3/17/1966

 loss of control 

ergency de-orbit. 

ergency De-orbit

5/16/1963

d loss of some 

perform manual 

d high PPCO2 

ry operations.

Manual Entry

/17/1962

nment 

Injury (4)

SR-71 X-15 Soyuz 1 Apollo 1 Soyuz 11 Challenger Columbia

Docking Anomalies

STS-133 2/26/2011

Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.

Crew: 6

STS-130 2/10/2010

Experienced significant misalignment between orbiter and ISS during post-capture free drift due to gravity-gradient-induced motion.

Crew: 6

Skylab 2 5/26/1973

Multiple failed automatic docking attempts resulted in manual docking to 

Skylab. 

Crew: 3

Mir Collision Events (1994-1997)

 

Mir 8/30/1994

Progress M-24 collided with Mir 

during second docking attempt.

Mir Crew: 2 Collision

Mir 1/14/1994

Soyuz TM-17 collided twice with 

Mir during undocking.

Crew: Soyuz 2, Mir 3 Collision

Mir 6/25/1997

Progress M-34 collided with Mir. 

Spektr pressure shell ruptured. 

Spektr module isolated. Cables 

through hatchway impeded 

hatch closing.

Mir Crew: 3 Collision

SR-71 1/25/1966

Loss of control at high speed 

and altitude.

Crew: 2 Loss of Crew (1)

Soyuz T-8 4/22/1983

Loss of rendezvous antenna prevented docking. 

Crew: Soyuz 3 Loss of Mission

Soyuz 10 4/23/1971

Automatic docking system failed. Manual docking with Salyut not achieved. 

Crew: 3 Loss of Mission

SpaceShipTwo, PF04 10/31/2014

Vehicle breakup during powered flight.

Crew: 2 Loss of Crew (1)

SpaceShipOne, Flight 11P 12/17/2003

Left main landing gear collapsed.

Crew: 1

M21-D21 7/30/1966

D21 drone collided with M21 during launch, causing M21 

breakup. Crew survived breakup but one was lost after 

water landing. 

Crew: 2 Loss of Crew (1)

Abbreviations and Acronyms

AC Air Conditioner

APU Auxiliary Power Unit

BMP Microimpurities Removal System (Russian)

CDRA Carbon Dioxide Removal System

CMG Control Management Gyroscope

CO Carbon Monoxide

CO2 Carbon Dioxide

DM Descent Module

EMU Extravehicular Mobility Unit

EPS Electrical Power System

EV Extravehicular

FGB Functional Cargo Block (Russian)

FSO Flight Safety Office

GIRA Galley Iodine Removal Assembly

GPC General Purpose Computer

GPS Global Positioning System

H2 Hydrogen

IMU Inertial Measurement Unit

ISS International Space Station

ITCS Internal Thermal Control System

KOH Potassium Hydroxide

LH2 Liquid Hydrogen

LOC Loss of Crew

LOV Loss of Vehicle

LOX Liquid Oxygen

MDF Minimum Duration Flight

MetOx Metal Oxide

MMOD Micro-Meteoroid Orbital Debris

N2

O4 Nitrogen Tetroxide

NSI NASA Standard Initiator

O2 Oxygen

OM Oribital Module

OSMA Office of Safety & Mission Assurance

PAL Protuberance Air Load

PASS Primary Avionics Software System

PPCO2 Partial Pressure of Carbon Dioxide

RCS Reaction Control System/Subsystem

RMS Remote Manipulator System

RTLS Return to Launch Site

SFOG Solid Fuel Oxygen Generator

S&MA Safety & Mission Assurance

SM Service Module

SRB Solid Rocket Booster

SSME Space Shuttle Main Engine

SSP Space Shuttle Program

STS Space Transportation System

TPS Thermal Protection System

U.S. United States

Visit the NASA Human Spaceflight Readers Room

(http://spaceflight.nasa.gov/outreach/readersroom.html)

for the latest version of the Significant Incidents and

Close Calls in Human Spaceflight chart.

Contacts

Nigel Packham, Ph.D., NASA

Manager, JSC S&MA Flight Safety Office

Nigel.Packham-1@nasa.gov

William Stockton, SAIC

FSO Support Team Lead

William.W.Stockton@nasa.gov

Dennis Pate, SAIC

Assessments Specialist, FSO Support Team

Dennis.W.Pate@nasa.gov

Descent

Earth Return

Ascent

t

Soyuz 18-1 (18a) 4/5/1975

After ascent abort, capsule 

landed on snowy slope above cliff. 

Parachute snagged and prevented 

fall.

Crew: 2

Soyuz 18-1 (18a) 4/5/1975

After ascent abort, capsule landed 

on snowy slope above cliff. Parachute 

snagged and prevented fall.

Crew: 2 Crew Injury

The Significant Incidents and 

Close Calls in Human Spaceflight graphic is primarily 

focused on human spaceflight incidents occurring with 

a crew aboard a space vehicle. It includes suborbital, 

orbital, and lunar missions. 

Selected non-spaceflight 

and uncrewed events are 

included if they have strong 

relevance to human spaceflight. For instance, the loss of 

the uncrewed Progress 44P 

is included because it has 

launch vehicle commonalities with the crewed Soyuz missions. The altitude chamber 

oxygen fire in Russia preceded 

the U.S. Navy oxygen chamber fire and the Apollo 1 fire, 

which occurred under similar 

circumstances. The SR-71 accident is the highest and fastest vehicle breakup on record 

that was survivable, and it 

represents the demonstrated 

limit of crew survival with current technology. The SpaceShipTwo accident represents 

the loss of a suborbital space 

vehicle during flight testing.

This document is a work in 

progress. It is continually 

under review and frequently 

updated. Please direct comments and questions to the 

JSC S&MA Flight Safety Office.
32 Annual Report for 2017

Aerospace Safety Advisory Panel
Annual Report for 2017 33

Aerospace Safety Advisory Panel

Appendix B

Summary and Status of Aerospace Safety Advisory Panel 

(ASAP) Open Recommendations

2017 Recommendations4

4 Note on colors: Red highlights what the ASAP considers to be a long-standing concern or an issue that has not yet been adequately 

addressed by NASA, or that there is no identified resolution. Yellow highlights an important ASAP concern or issue that we are not 

confident is being addressed adequately by NASA, or where a resolution has been identified but does not yet have a defined implementation plan. Green indicates a positive aspect or concern that is being adequately addressed by NASA but continues to be followed by the Panel.

2017-01-01

Practice of System Engineering and Integration (SE&I) Principles by Commercial Crew 

Providers for Transportation Services to the International Space Station (ISS): Panel recommends 

that NASA require the Commercial Crew providers to produce verifiable evidence of the practice of 

rigorous, disciplined, and sustained SE&I Principles in support of the NASA Certification and operation of commercial crew transportation services to the ISS.

 OPEN NASA responded on 5/22/17, concurring with the recommendation. NASA stated that the 

Commercial Crew Program (CCP) providers are responsible for ensuring cost-effective system 

design, realization, operation, and technical management of the systems they are developing to 

meet a fixed-price contract. Through contract requirement, deliverables, and increased insight, 

CCP asserts the ability to verify and/or validate that SE&I principles are followed to assure the 

proper management of risks, requirements, interfaces, configuration, and technical data throughout the system life cycle. ASAP continues to monitor CCP progress in gathering evidence of SE&I 

practices throughout the development and certification process.
34 Annual Report for 2017

Aerospace Safety Advisory Panel

2017-02-01

Schedule and Cycle of Safety Audits: NASA should establish, prioritize, resource, and implement a 

rigorous schedule of audits, executed by Office of Safety and Mission Assurance (OSMA) and conducted at the Center level, to ensure that documented safety requirements, processes, and procedures 

are consistently applied across the Agency.

 OPEN NASA responded on 8/29/17, concurring with the recommendation and provided a presentation at the 4th Quarterly Meeting of 2017. OSMA has prepared a survey of targeted SMA engineering disciplines, including System Safety, and will administer it from November 2017 through 

January 2018. After review and analysis of the system safety survey, OSMA will use the results to 

inform like activities in other SMA engineering disciplines. ASAP wants to be assured that OSMA 

has a mechanism to verify that the NASA safety policies, processes, and procedures are being 

followed to ensure employee safety, system safety, and program safety. The Panel will continue to 

monitor progress and the results of the system safety survey.

Open Recommendations from Prior Years

2016-04-01

Asset Protection—Security Clearance Policy: NASA should make it a matter of policy that 

priority is given to obtaining the appropriate level of security clearance for all personnel essential to 

implementing the Enterprise Protection Program, including the appropriate program managers.

 OPEN NASA responded on 1/17/17, concurring with the recommendation. NASA is establishing 

clearance requirements within the governance management system of the Enterprise Protection 

Program (EPP) and is reviewing all positions descriptions and compliances accordingly. The Panel 

was last briefed on the EPP in November 2017. Work is on-going. ASAP will continue to follow the 

progress of this action in 2018.

2015-05-02

Human Space Flight Mishap Response Procedure: The Authorization language should be reviewed 

with today’s systems in mind. Also, more details appear appropriate for the NASA implementation 

document. These details would include the level of vehicle damage requiring investigation, the temporal issues of when mission phases begin and end, and NASA’s oversight role in mishap investigations 
Annual Report for 2017 35

Aerospace Safety Advisory Panel

conducted by its providers, as well as when the need for outside oversight is required. The mishap response procedures should be thought through, documented, and in place well before any 

actual flights.

 OPEN NASA originally responded on 4/31/2016. The response stated NASA was reaching out to 

the Federal Aviation Administration (FAA) and the National Transportation Safety Board (NTSB) to 

jointly develop viable options to revise the Authorization language with today’s systems in mind. 

The NASA Human Exploration and Operations Mission Directorate (HEOMD) reported at the 3rd 

Quarterly of 2016 that the effort was on-going and provided tentative language. NASA predicted 

they would have proposed language by end of the 2016.

NASA provided a follow-up response on 3/20/17 in which they provided the results of NASA’s 

assessment of strategy option in the event of a major malfunction or mishap in the Commercial 

Crew Program (CPP). The ASAP provided a written response on September 8, 2017, followed by 

subsequent discussions and is awaiting NASA’s formal response to the Panel’s input. The Agency 

is currently reviewing the ASAP response.

2014-01-01

Radiation Risk Decision on Deep Space Mission: The ASAP recommends that (1) NASA continue 

to seek mitigations for the radiation risk and (2) establish an appropriate decision milestone point by 

which to determine acceptability for this risk to inform the decision about a deep space mission. This 

risk choice should be made before NASA decides to go forward with the investment in a future longterm mission.

 OPEN NASA originally responded on 4/24/14. The Office of the Chief Health and Medical Officer 

(OCHMO) briefed the NASA implementation plan to the recommendations in the Institute of 

Medicine (IOM) Study to the ASAP on 10/28/14 at the 4th Quarterly ASAP meeting. The ASAP 

was complimentary of the plan and said in their response dated 11/17/14 that NASA should 

adopt the process as briefed. OCHMO had the action to get on the Agency PMC agenda to brief 

the implementation plan. Once complete and the associated decision memo has been signed, 

OCHMO was to develop the appropriate OCHMO Procedural Requirements. OCHMO briefed the 

Panel again at the 2nd Quarterly of 2016 on the plan for implementing recommendations from the 

IOM report “Health Standards for Long Duration and Exploration Spaceflight Ethics, Principles, 

Responsibilities and Decision Framework.” The Panel had favorable response to report and is 

awaiting NASA policy and guidelines for implementation of these plans.

The ASAP received an update at the 3rd Quarterly Meeting of 2017. Progress has been made in 

policy and guidelines. Work is on-going and will continue into 2018.
36 Annual Report for 2017

Aerospace Safety Advisory Panel

2014-AR-05

Processes for Managing Risk with Clear Accountability: NASA should consistently provide formal 

versus ad hoc processes for managing risk with clear accountability.

 OPEN NASA originally responded on 7/22/14 and updated response on 1/22/15. The Office of 

Safety and Mission Assurance (OSMA) presented at the 2nd Quarterly of 2016 and later met with 

ASAP Chair for input into updated policies. OSMA released an interim directive in September of 

2016 to temporarily institute a formal process for risk acceptance procedure. A permanent policy establishing individual risk acceptance authorities, NPR 8000.4B, was released on 12/6/17, as 

this report was being finalized. Over the next reporting period, the ASAP will carefully monitor the 

training, promotion, implementation, and enforcement of this important policy change.

2012-01-02

International Space Station (ISS) Deorbit Capability: (1) To assess the urgency of this issue, NASA 

should develop an estimate of the risk to ground personnel in the event of uncontrolled ISS reentry. 

(2) NASA should then develop a timeline for development of a controlled reentry capability that can 

safety deorbit the ISS in the event of foreseeable anomalies.

 OPEN NASA originally responded on 5/9/12. ASAP decided the recommendation would stay open 

until ISS has a timeline for implementing a deorbit plan and the deorbit plan is in place. HEOMD 

began working this action when assigned in 2012. There are many aspects to implementing the 

deorbit plan, including working with international partners. It is estimated that it will take 1–2 years 

to implement the plan after the schedule is determined. At the 2016 1st Quarterly, the current 

ISS Program Manager briefed the Panel on the status of the deorbit plan. In January 2016, the 

Russians had received direction to restart End-of-Life (EOL) production development. In March 

2016, a Technical Interchange Meeting was held to move the EOL activities forward. The ISS briefing at the 3rd and 4th Quarterlies of 2016, showed further progress; however, the plan is still not 

complete. The ASAP received status updates during the four Quarterly Meetings of 2017. ISS has 

provided a timeline chart and made some forward progress with Russia. ISS will continue to brief 

the ASAP on a quarterly basis on the status of this recommendation in 2018.
Annual Report for 2017 37

Aerospace Safety Advisory Panel

Appendix C 

Closure Rationale for Recommendation Closed in 2017 

2014-01-02

Knowledge Capture and Lessons Learned: The ASAP strongly recommends a continuous and formal 

effort in knowledge capture and lessons learned that will make them highly visible and easily accessible. 

Modern tools exist to facilitate this and NASA should avail itself of them. NASA’s Knowledge 

Management system should include risk-informed prioritization of lessons and a process to determine 

which lessons have generic (vs. local or project unique) potential. Further, it should be supplemented 

by formal incorporation into appropriate policies and technical standards of those lessons that are most 

important to safety and mission success. Rigor in this area is particularly critical as the experience in 

specific skills dissipates over time and as engineering talent is stretched across programs.

CLOSURE RATIONALE: The Panel received a briefing from NASA Chief Knowledge Officer at the second quarterly meeting of 2017, detailing the tools for sharing information. With the updates made 

to the Knowledge Management system, the ASAP closed this recommendation.

Aerospace Sa fet y Adv isory Pa 

Dr. Patricia A. Sanders, Chair 

Dr. James P. Bagian

Mr. John C. Frost 

Lieutenant General Susan J. Helms, USAF (Ret.)

Captain Brent W. Jett, Jr., USN (Ret.) 

Dr. Sandra H. Magnus 

Dr. Donald P. McErlean

Dr. George C. Nield 

Captain Christopher M. Saindon, USN (Ret.)

NP-2017-11-2493-HQ