Soyuz investigation findings backed by nominal Soyuz TMA-13 return

by Chris Bergin

Expedition 18 Commander Michael Fincke, Flight Engineer and Soyuz TMA-13 Commander Yury Lonchakov and space tourist Charles Simonyi have returned home safely, following their landing in Kazakhstan this morning. The safe return backs up the findings presented in an expansive NASA and Russian document that outlined the off-nominal ballistic re-entries of Soyuz TMA-10 and 11, and the subsiquent mitigation proceedures undertaken.

The landing took place near the town of Dzhezkazgan, which is west of Karaganda and southeast of the usual landing zone near Arkalyk. Fincke and Lonchakov have been aboard the orbiting laboratory since October 2008, following their ride to the ISS on the same Soyuz they landed with.

The Expedition 18 crew members undocked their Soyuz from the station at 10:55 pm CDT April 7. The deorbit burn to slow the Soyuz and begin its descent toward Earth began at 1:24 am this morning. The landing was moved to a more southerly landing site because of poor landing conditions at the original site.

Off-Nominal re-entries investigation:

The nominal re-entry and landing follows an issue-free return for Soyuz TMA-12. However, Soyuz TMA-11 and TMA-10 both suffered from what is called a ballistic re-entry – a degraded mode for landing, which initiates a steep trajectory, resulting in a much shorter than planned re-entry, exposing the crew to up to 10G.

a34The Soyuz Vehicle consists of three modules: the Orbital Module, the Descent Module (DM), and the Instrumentation/Propulsion Module (IPM). All three modules nominally separate simultaneously, shortly after the deorbit burn is completed – at around 140 km altitude.

The two “off nominal” re-entries in 2007 and 2008 were the cause of separation failures on the modules, thus initiating the ballistic return for their three person crews.

“In October 2007, Soyuz 14S (TMA 10) undocked from ISS and landed in Kazakhstan. The Instrument and Propulsion Module and the Descent Module failed to separate when commanded,” the large investigation document, available on L2, outlined. “Vehicle trims in a hatch-forward configuration when modules fail to separate. The modules eventually separated at approximately 80 km.

“Subsequently the “Ballistic Mode” was entered (steeper trajectory, higher G-loads) and the vehicle successfully landed at the ballistic landing site. A special commission was formed to investigate these events.

“In April 2008, Soyuz 15S (TMA 11) undocked from ISS and landed in Kazakhstan. The Instrument and Propulsion module and the Descent Module again failed to separate when commanded. Vehicle trims in a hatch-forward configuration when modules fail to separate. The modules eventually separated at approximately 60 – 66 km.

“The “Ballistic Mode” was entered and the vehicle successfully landed at the ballistic landing site. Two commissions were formed to investigate these events: External Commission headed by Koroteev from the Keldish Institute. RSC-E internal Commission headed by Lapota.”

On both occasions, the failure of one or more pyro bolts – which initiate separation – was deemed to be the root cause of the modules remaining together, prior to the eventual release of the DM due to aerodynamic drag and mainly heating loads.

However, this came only after a prolonged period of the vehicle diving through re-entry “hatch first”.

“The DM / IPM interfaces consists of 5 ‘locks’ and 5 pusher springs,” the document explained. “Each lock has 2 pyro bolts that are commanded simultaneously. 1 of 2 is required to successfully open the lock and allow separation. The pusher springs provide the force to separate the DM / IPM modules after the locks release.

“Koroteev Commission conducted an extensive investigation. 26 Branch Fault Tree that encompassed failures: Electrical firing circuits for separation. Failure of the pyro bolts. Mechanical failure of the lock.”

a25“Hatch forward” is undesirable for long periods of time during re-entry, due to the obvious risk of excessive heating causing a breach, which would result in the loss of the Soyuz crew.

“Worst Case Assumption for Mechanism Penetration Insulation,” explained one slide on the presentation. “Hatch failure assumed when temperature of hatch aluminum structure reaches point where internal pressure causes failure, around 750 degrees F.”

However, a Russian slide (see left) added to the investigation document appears to show the period of time Soyuz TMA-12 was in the “hatch forward” position was relatively short, with post landing photography backing up the slide, showing most of the vehicle’s TPS (Thermal Protection System) was in reasonably good shape, with only the antenna melted away.


Following the investigation, the Commission found that the most likely cause of the failure to open the latch located at “Plane I” of the interface, “was a failure of the 8 X 55 explosive bolt, caused by combined long-term exposure, under space flight conditions, to electrical discharges resulting from the difference in potential between the station hull and the surrounding plasma, which increased in magnitude after the electrical power capacity of the ISS was augmented.”

The findings relating to the long-term exposure to electromagnetic emissions on-orbit, and their potential to cause issues with the pyro bolts, came after an extensive investigation that included the removal and return of one pyro bolt from Soyuz TMA-12.

The removal came via EVA 20A, a special Russian spacewalk which was conducted by Sergei Volkov and Oleg Kononenko. Their task was to remove one of 10 pyrotechnic bolts from the docked Soyuz, and place it in the blast-proof canister, which was subsequently returned to Russian engineers on the ground.

“Soyuz commissions (one independent and one internal to Energia) were discussed at SORR (Stage Operations Readiness Review),’ noted a memo to senior managers, during the investigation. ‘According to the Russian report, the most likely cause of pyro bolt issue was long-term exposure to the space environment and electromagnetic emissions.”

Soyuz TMA-12 – minus one of its pyro bolts – returned to Earth on a nominal re-entry, landing on October 24, 2008. This vehicle also debuted a software patch, to aid the nominal chain of events during the separation of the modules, and cause the acceleration of a heating load forced separation in the event of a pyro bolt failure – by positioning the vehicle sideways on to the re-entry path.

“16S vehicle (TMA 12) had pyro lock at Plane 1 released via EVA by removing 1 of 2 pyrotechnic bolts. Bolt returned to ground to support root cause investigation,” noted the presentation. “Vehicle had new software patch installed. 16S re-entry nominal.

“Telemetry was obtained that verified software patch was functional (although did not affect re-entry since nominal separation occurred). Only received 30 sec of telemetry from separated IPM, but showed software was being executed up to that point. Note: Russians have flown a receiver with the capability of recovering telemetry from IPM for future re-entries.

The Commission used the findings to work on changes to the Soyuz TMA-13, which Expedition 18 crew members returned on without issue.

“Changes made to 17S (TMA 13) vehicle in response to Commission findings: Based on the Russian Commission findings, several changes were made to the 17S vehicle currently on-orbit,” added the document.

a51“Corrected the grounding issues at the Plane 1 pyro lock location. Physical separation of the pyro firing cables. Lockwiring the pyro connectors.

Replaced the pyro bolts with a more robust design that is less susceptible to the electromagnetic environment.

“Instituted a software change that will use IPM thrusters to force the vehicle to re-enter “sideways,” increasing heat loading on the truss, helping lead to truss failure and earlier separation.

“To be implemented on all future Soyuz re-entries. Software acts on IPM thrusters whether separation occurs or not.

“Performed a significant number of vehicle system checks to verify quality of TMA-13.”

US Assessment:

NASA – with an obvious stake in both the safe return of their ISS crewmembers, and future interest in the utilization of the Russian vehicle during the gap between shuttle retirement and Orion’s debut – held their own investigation into the Russian findings.

No specific conclusions were formed via the NASA overview, bar a specific understanding of both the anomalies and the consequences, and a level of concurance with the Russian findings.

“NASA formed a team to perform analysis Included members from Engineering, Operations, Crew, Safety, NESC, and the ISSP,” noted the NASA section of the presentation.

“Goal was to perform analysis based on the best information available to better understand Soyuz re-entry dynamics, and to better understand the Russian Commission report when it became available.

“Analysis based on: Basic vehicle data provided by RSC-E. Discussion between RS and US specialists. Soyuz 14S and 15S crew comments. Training for US crew members. Best Engineering judgment of our engineers based on similar materials and design practices.”

“Objectives: Assess truss failure and generate 15S notional trajectory. Compare with telemetry data provided by Russians. Implement software patch via analysis and assess effectiveness in accelerating truss failure. Compare with analysis data provided by Russians. Suppress DM-IPM separation and assess survivability of the hatch and chute covers.

“Compare with photographs from 15S re-entry. Note – analysis assumes that all 5 pyro locks fail to release. Since failure occurs due to heating, at a time when aero forces are relatively low, separation time should be similar no matter how many locks fail to release.”

a42NASA’s highly regarded thermal modelling capability, used mainly on shuttle analysis, is put to work on several slides relating to heating loads on the Soyuz – mainly used on working out when the separation of the modules would occur, in the event of a nominal separation failure.

Included in the findings are notes that the crew on Soyuz TMA-11 suffered from almost 8.5G during part of their re-entry, and that there is a serious risk – albeit under worst case scenarios – that the hatch could fail, or the parachute cover could incur damage – both hold the serious threat of LOV/C (Loss Of Vehicle/Crew).

“Analysis Summary: Notional trajectory (15S) had truss failure at 67.85 km altitude. Max g = 8.42 gees, consistent with crew experience. Comparable trends with Russian telemetry data. Software patch is effective in accelerating truss failure,” noted the presentation.

“Notional truss failure at 70.44 km (conservative), an acceleration of 2.6 km in altitude or 12.91 sec. Russians’ range of separation altitudes with software patch is within the bounds of our calculations. Russians’ range is 77 – 83 km. Our range is 68 – 89 km

“If separation did not occur and the spacecraft continued in the hatch-forward orientation. With worst case assumptions, the hatch would fail: Failure altitude = 55.95 km (11.9 km from notional truss failure). Failure time = 400 sec (59.49 sec from notional truss failure)

“With more realistic design assumptions, the hatch frame survives with a margin of around 100 degrees F from burst temperature. With conservative assumptions, the chute cover would fail: Failure altitude = 35.9 km (31.95 km from notional truss failure). Failure time = 487 sec (146.5 sec from notional truss failure).”

a61Also included in the presentation is one slide titled “Alternative Engineering Evaluations,” noting dissenting opinion on the Russian findings on the root cause of the pyro bolt issues, although it is conceded that the alternative explanation has a low probability.

“ISS environments team does not feel that plasma environment caused electrical potential issue, BUT, with improperly grounded system, failure of the type predicted is possible. Pyrotechnic experts have evaluated “dud-ing” condition of pyros. Dud-ing phenomenon is possible, but low probability

“NOTE: Results from Russian testing of returned pyro bolt have shown no anomalous behavior. NDE (Non Destructive Evaluation) inspections. Destructively fired at minimum “All Fire” current.”

Overall, NASA appear to be satisfied with the Russian Commission’s findings, and the actions taken to mitigate the threat of future issues during Soyuz re-entries.

“Conclusions From Analysis Team: Russian developed Fault Tree is very thorough, nothing to add from our side. IF the “most probable root cause,” as identified by the Russians is correct, all of the implemented changes are consistent with actions we would have taken.

“If another pyro failure occurs, the software patch is likely to help facilitate an earlier separation than without it, and should not make the situation worse.

“Our independent analysis agreed well with Russian provided data. Pyrotechnic and environments experts believe the stated most probable cause is possible, however unlikely in our experience.

“Detailed analysis of the hatch and parachute compartment indicate that truss section is likely to fail, leading to successful separation, prior to failure of either the hatch or parachute compartment. However, this analysis is based on multiple assumptions and an incomplete knowledge of the entire system and other potential failure modes.”

Backing up both the NASA and Russian findings has been the safe return of Soyuz TMA-13, which was the focus of the presentation – created at the end of February for evaluation by the STS-119 Flight Readiness Review (FRR) – due to the requirement for flight rationale with the immediate downstream plan relating to STS-119, and Soyuz TMA-13.

a72“17S Return Flight Rationale: Separation failures are still Unexplained Anomalies, however, 17S/TMA 13 vehicle highly scrutinized and tested due to anomaly,” added the presentation, which also summarized the actions taken with Soyuz TMA-13.

“17S vehicle has several modifications to address the identified most likely root cause: Replaced pyros (8X55 with 15X571) with a design less susceptible to EMI (similar to those used in the APAS).

“Improved bonding in Plane 1 pyro lock area with the used of Aluminized tape. Replaced explosive bolt power cables with new cables having enhanced shielding. Routed the cables attached to the explosive bolts along two independent paths. Introduced lockwiring of pyro bolt electrical connections.

“The software patch is available and planned for use, analysis indicates that it will help ensure separation. Independent re-entry analysis indicates truss will likely fail due to thermal heating prior to hatch or parachute compartment failure, leading to successful re-entry.”

As expected, the experts were proven right, early on Wednesday morning.

L2 members: Documentation – from which the above article has quoted snippets – is available in full in the related L2 sections, now over 4000 gbs in size.

Related Articles