|
|
| Click on picture for color enlargement. |
N JUNE 25, 1997, THE Russian supply spacecraft Progress 234 collided with the Mir space station, rupturing its pressure hull, throwing it into an uncontrolled attitude drift, and nearly forcing evacuation of the station. Like many high profile accidents, this collision was the consequence of a chain of events which led to the final piloting errors that were its immediate cause.
The discussion below does not resolve the relative contribution of the several actions and decisions in this chain. Neither does it suggest corrective measures, many of which are straight forward and already implemented by NASA and the Russian Space Agency. Rather, its purpose is to identify the human factors associated with the incident. The Mir-Progress collision is particularly instructive in this respect because human factors played a pervasive role. Workplace stress, fatigue, and sleep deprivation were identified by NASA as contributory factors (NASA, 1997-1999; Culbertson, 1997), but others also present, though in this case only contributory, could become important in future situations.
T h e M i r P r o g r a m s a n d C r e w
In 1995 NASA began sending astronauts to the Russian Mir space station as part of an in ternational program to learn to live and work in space. This program was Phase 1 of the International Space Station. NASA expected to benefit from unique Russian experience in very long duration space flight; to use Mir to test and verify new technology; to conduct scientific research requiring microgravity environments; and to help keep the Russian space program afloat through an infusion of over $400M, support personnel, and the use of the Space Shuttle for supply. In particular, NASA hoped co-operation with the Russians would reduce the risks of long duration space flight including eventual interplanetary missions. Initial research would be directed towards biological and materials science research that require long term exposure to a space station microgravity environment (Oberg, 1998;, Culbertson, 1997).
Three crew members were on board Mir at the time of the collision (see photo). Vasili Tsibliyev, a former military jet pilot was the commander. He received his pilot training at the Gritsevets Military School of Aviation and the Gagarin Air Force Academy between 1975 and 1987. He followed a general space training course at the Gagarin Cosmonaut Training Center (CTC) between 1987 and 1989. He had previous experience on Mir in January of 1994 during a joint Russian-French mission. On this flight he piloted a Soyuz spacecraft into a very low speed collision with Mir. This contact occurred during a fly-around for photographic purposes. (Burrough, 1998a, p. 69). He was, however, considered to be among the best operators of the Toru teleoperation system used to dock Progress vehicles by remote control (NASA, 9/97). However, because there were no simulation training facilities onboard Mir, his last training on the Toru simulator at Star City was 4 months prior to the collision, just before his launch.
 Crew members on Mir from left to right: Vasili Tsibliyev, Aleskandr Lazutkin, and C. Michael Foale. |
The civilian flight engineer for Mir on this mission was Aleksandr "Sasha" Lazutkin, an employee of Energia, the organization that owns Mir and oversees its daily operation. Lazutkin had not been in space before and like many astronauts and cosmonauts suffered significant nausea during the initial phase of the mission. Between 1981 and 1984, he worked in the Moscow Aviation Institute on mathematical models for thermal processes in thermal control systems. He began working for Energia in 1984 where he developed and optimized cosmonaut extravehicular activities or space walks, worked on Russian space shuttle crew activities and helped train cosmonauts to control individual space mobility aids. He began his cosmonaut training in 1992 at the Gagarin CTC. His principal function on Mir was to refurbish and maintain systems required for station operations.
The American astronaut on Mir during the collision was C. Michael Foale. Dr. Foale, an American citizen born into a British-American family in England, received a Ph.D. in astro- physics from Cambridge University after studying there at Queens College. He began working for NASA as a McDonnell-Douglas contractor. After June 1983, he worked on payload operations with responsibility for several Space Shuttle missions. He began astro- naut candidate training in June 1987 and was selected as an astronaut in 1988. He flew as a mission specialist on Space Shuttle flights STS-45, 56, 63 and has conducted a 4.5 hour space walk (STS-63) during which he manually maneuvered the ~1270 kg (2800 lb) Spartan satellite. He was qualified for long-term space flight on Mir at the Gagarin CTC and there refined his good command of the Russian language, becoming the most "Russianized" American astronaut to spend time on Mir (Burrough, 1998a). On May 18, 1997 he replaced Jerry Leninger on Mir as the U.S. astronaut to continue onboard scientific research.
T h e V e h i c l e s
Mir. The 100 metric ton, 14-year-old Mir (Figure 2) is the oldest space vehicle to remain in low earth orbit (300-400 km altitude at 51.6° inclination). Its oldest module, the Base Block, was orbited in 1986. Its newest module is the Piroda module, added for scientific experi- mentation in 1996. Mir is pressurized at 760 mm Hg (normal sea level pressure) with a total pressurized volume of approximately 380 m3. It's about the size of 6 school buses. Technical details about its structure, function, and mission are easily available on Internet websites (Mir, 1998). Most significantly, during its 14 years of continuous orbiting many critical elements of the station had been operating for more than twice their planned life. Consequently, Russian crews have been continually busy repairing broken systems to keep the station functional1. The frequent failures, often ad hoc repair, and only intermittent con- tact with ground controllers due to degradation of the Russian ground communication systems have resulted in a increasingly complex, sometimes difficult to document spacecraft that has become harder to maintain. The continual repair work, interrupted by major systems failures such as a intense 14 minute fire due to a malfunctioning oxygen-generating canister, has from time to time put extreme pressure on the crew (Oberg, 1998). The re- sulting fatigue has underlain human errors sometimes contributing to major systems failures such as the shutdown of the main attitude control computer due to accidental crew discon- nection three days after the collision. Mir is now unoccupied and will soon be intentionally deorbited.
Progress 234. The 7 metric ton, expendable Progress ship was the primary carrier of supplies to Mir. Approximately the size of a crewed Soyuz spacecraft, it can deliver slightly more than 2 metric tons of consumables and dry cargo to either end of the station's x-axis (Figure 1) where special docking fixtures are attached. After delivering cargo at intervals of approxi- mately 1-3 months, the Progress has been loaded with garbage, undocked and sent spiraling down towards earth where it is incinerated. Progress vehicles are normally automatically guided to rendezvous and docking by a Kurs radar-based system, notably now imported from the Ukraine. Kurs is normally also used with Soyuz vehicles. Both Progress and Soyuz vehicles are likely to remain part of the Russian space program and will likely dock with the International Space Station currently under construction.
 | The continual repair work, interrupted by major systems failures, has at times put extreme pressure on the crew. |
Since the early 1990's, the Russians have developed a manual backup for Kurs: the Toru remote control system. It includes rotational and translational hand controllers in Mir that are similar to those used in the Soyuz spacecraft which ferried cosmonauts to and from Mir. Signals from these controllers are sent to Progress thrusters via a radio link. A Klest TV system on Progress transmits video data back to Mir so the operator may control Progress from the vantage point of the vehicle. Though the Toru manual backup system may be used if Kurs fails, nominal flight rules dictate that docking be aborted if the Kurs failure occurs when the range to the station is greater than 1 km. The Toru system is thus by NASA flight definitions intended solely for proximity operations. Significantly, Kurs's availability and cost have become issues since it is not produced within Russia and one system is consumed for every Progress mission.
 Figure 1. Supply vehicles and modules of the Mir space station. Parenthesized dates show year of installation. |
B e f o r e T h e C r a s h
During the four months preceding the collision, the Russian crew of Mir had experienced frequent spacecraft systems failures. These included an intense fire in an oxygen generator, multiple ethylene glycol coolant leaks and resultant atmospheric contamination, five days of tropical cabin temperatures in some parts of the station, attitude control problems leading to power outages, and other breakdowns requiring the almost continuous attention of the crew. The commander Tsibliyev, for example, had only two days of rest during this entire four month period, reported poor quality sleep in the two weeks before the crash, and was concerned about the health effects of the ethylene glycol leaks. These stresses from long hours became apparent during his communications with Russian ground control (TsUP). They were aggravated by the Russian practice since 1993 of providing monetary incentives for the Russian crew to complete all their activities planned for their mission. Fatigue threatened errors and omissions. Errors and omissions threatened loss of bonuses. (Burrough, 1998a, pp. 63-64, p. 357, NASA, 1997-1999).
The most relevant incident preceding the collision, however, was a near-miss during an attempted Toru-assisted docking of Progress 233 on March 4, 1997. Toru had been previ- ously used to dock Progress to Mir with manual takeover occurring when vehicles were within 200 m of Mir, a distance well within the 1 km limit from Russian flight rules. However, the ground controllers wished to try to extend Toru's operational range and trans- ferred to manual control of Progress 233 at a range of 8 km. This distance is the maximum range of the TV system which provides the video image from Progress. During this test, a failure of the primary command link was overcome by switching to the backup system, but the operator Tsibliyev was unable to view the video image from Progress on his monitor and aborted the docking approach. Using his own and other crew members' sightings of Progress out the windows as guides, he made emergency maneuvers to avoid a collision. The miss distance between Mir and Progress was variously guessed by the crew to be between 30 and 200 meters (NASA, 1997-1999; van Laak, 1999). The problem with the video signal was later attributed to possible misconfiguration or to interference from the active Kurs radar system (NASA, 1997-1999).
T h e C r a s h
Despite the near collision during the Progress 233 test, Russian flight controllers elected to repeat the test with Progress 234. Potential interference from the Kurs radar was to be avoided by shutting the system down, depriving the cosmonauts of range data! The objective of the test was to determine again the safety and reliability of the Toru remote control docking system at long ranges. Before the test, the commander was told Progress fuel should be conserved for subsequent use in a fly-around inspection of Mir, biasing him to minimize his fuel usage. Transfer to manual control occurred at a range of 6 km.
The planned approach was complicated by three significant navigational variants from previous dockings. The first two variants were designed to improve safety margins, but the third does not appear to be intentional. 1) After the Progress was allowed to drift away from the station, the initial burn to return it to the vicinity of Mir targeted a point about 1000 m behind the station. This targeting contrasts to the previously, commonly used aim point essentially at the station itself. 2) The Progress was given a 400 meter displacement out of Mir's orbital plane complicating the orbital dynamics of the trajectory. 3) At the point of manual takeover, the rate of closure was estimated to be 6.5 m/sec instead of the planned 5.0 m/sec (NASA, 1997-1999).
The commander was expected to pitch the Progress to visually acquire an image of Mir in the Toru video system, using the attitude hand controller to center it in the Toru video screen. Translation inputs were then to be used to null Progress's drift rates, stabilizing the Mir image in the Toru T.V. display. Braking burns were scheduled based on the angular size of the image in terms of a grid pattern on the T.V. monitor. The planned approach rates were faster than those consistent with a U.S. 0.1% reference approach which dictates closure rates generally of 0.1% of the range, e.g. at 1 km the closure rate should be 1 m/sec. Studies have shown, however, that this is a very conservative reference and trained operators should be able to handle rates like those used (Brody, 1990).
| Fatigue threatened errors and omissions; errors and omissions threatened loss of bonuses. |
Because the Kurs radar was turned off and the Progress was not visible out of the Mir's windows for laser range measurements at appropriate times, the commander's sole source of range rate information was the changing angular size and position of Mir on the T.V. moni- tor, a source difficult to use (Brody, 1988). At the very best he could be expected to detect 5% changes in speed (McKee, 1981; Stone & Thompson, 1992). But because of the de- graded viewing conditions on the T.V. monitor, he would be much less sensitive. Accordingly, his control of the Progress was very much open-loop. He did not realize that the closure rate, which was initially too high, had grown beyond his ability to brake. When he finally did realize that the rate was too high at a range of about 250 meters, about a minute before collision, he began continuous braking and lateral down translation but failed to clear the station.
Impact was about 3 m/sec (~7 mph) on the solar arrays and hull of the Spektr module (Figure 2). Estimates of the rate of air loss from the puncture showed that the crew had about 28 minutes before they needed to abandon the station because cabin pressure would reach the critical 550 mm Hg. This pressure corresponds to an altitude of about 3000 m (10,000 ft), the atmospheric pressure at which significant changes in physiological and psychological functions become a concern. Fortunately, since Lazutkin has seen the impact on Spektr through a window, the crew knew which module had to be sealed off. After dis- connecting and cutting cables draped across the Spektr hatch, the crew closed it approximately 11 minutes after the collision, stabilizing the cabin pressure near 690 mm Hg, the atmospheric pressure at about 760 m (2500 ft), saving the station but also marking the beginning of months of work to return Mir to normal functional order.
 Figure 2. Arrows show the approximate collision path of Progress 234. It approached Mir from above, passing along the Base module from A and striking the Spectr Module's solar panels at B and Spectr itself at C. |
C a u s e s O f T h e C r a s h
There were three immediate causes of the crash: 1) The higher than planned initial closing rate, 2) Late realization that the closing rate was too high and 3) Incorrect final avoidance maneuvering. This last cause is based on post crash simulations that have explored the possible outcomes of alternative avoidance maneuvering which show that a collision could have been avoided in many cases, include the case of no maneuvering at all (NASA, 1997- 1999). Because the final pattern of maneuvering thrusts do not indicate that the commander attempted to break off the docking attempt (NASA, 1997-1999; Erkenswick, 1999), the actual contact might be described as controlled flight into collision somewhat analogous to "close in" landing short accidents in aviation (Wiener, 1977).
Post collision analysis has also identified human factors contributions to the incident in that the crew had been under stress due to repeated systems failures and lack of sleep. But human factors may be seen as potentially an even more pervasive contributor to the incident. As shown in Figure 4, the elements of human factors range from underlying low level psy- chophysical phenomena to very high level political issues. Factors potentially contributing to the crash can be found at virtually every level illustrated in this figure.
Psychophysical. Potential psychophysical elements of the crash include the fact that the low contrast and poor resolution of the Toru T.V. display could make detection and discrimination of the Mir station image on the screen difficult and inaccurate. This detection was made harder because Progress approached Mir from above directing its camera downward against a background of moving clouds that made Mir even harder to see. Thus, the commander's ability to observe the looming or lateral drift rate of the station could be impeded and his ability to estimate its angular size in terms of grid checks could be impaired.
Sensorimotor. The sensory/motor elements relate principally to dynamics and frame of reference for tele- operation of the Progress. The cosmonauts are trained on Toru simulators to compensate for the cross coupling between the different axes of control due to mismatches between cen- ters of mass and centers of thrust (e.g. Brody, Jacoby & Ellis, 1992). They also study the counter intuitive aspects of orbital dynamics (e.g. Grunwald & Ellis, 1993). Though the specific loading of trash onto Progress 234 moved its center of mass somewhat away from the middle of the nominal range, NASA post mission analyses have indicated that the place- ment of the center of mass was well within acceptable limits and not an issue in this particular mishap. The duration of manual control of Progress, about 16 minutes or about 1/6 of an orbital period, also could produce some cross-coupling of control axes due to the orbital mechanics; however, this complication was also minor.
| Because of the four-month lapse since his last formal training, Tsibliyev may not have received sufficient of timely practice for the specific docking conditions he faced. |
A more important sensorimotor control issue was the difficulty the commander would have determining the relative velocity of Progress solely from visual information presented on the T.V. monitor. Subjective estimates of its velocity would be complicated by several factors. First the relative movement of the background clouds and ground details seen on the monitor could induce apparent motion or illusions of self-motion. Second, the camera's small field of view requires frequent attitude changes so that the docking target on Mir can be kept in view during the approach. These attitude changes can interfere with appreciation of the true lateral drift because their visual effects on the T.V. display are very similar to those caused by drift. Additionally, since firing the attitude control thrusters on Progress can add to its forward velocity, the pitching necessary to keep Mir in view during the approach could aggravate a situation in which closing rate is unknowingly already excessive.
Cognitive. The shutdown of the Kurs radar decreased the commander's ability to maintain spatial awareness during the docking because of the absence of position, range and range rate in- formation. These coordinates were difficult or impossible to get from visual sightings or hand-held laser range finder readings. The targeting of a point behind Mir rather than the more common targeting to intercept Mir could also have added control difficulties because of the lack of recent training in this procedure. In fact, because of the lapse of four months since his last formal training, Tsibliyev may not have received sufficient, timely practice for the specific docking conditions he faced. Simulations conducted with the Russian Toru docking simulators after the crash showed that some cosmonauts attempting a similar ma- neuver either missed the docking target entirely or collided with the station. The only one to successfully brake for docking did so ".... because to some extent, he ignored the instructions." (Andrey Malikov, PBS, 1998). Malikov's remarks must, however, be qualified because many post-collision test simulations incorporated major displacements of Progress's center of mass, making the simulated vehicles hard to control in ways probably not important in the actual incident (van Laak, 1999).
| Maintaining the balance between automatic and manual systems will require study of the human perceptual, motor, cognitive, and social behavior to optimize interaction with the complete system. |
Social. The social factors that could have contributed to the crash include the subordinate relation- ship between the cosmonauts and Russian Mission Control (TsUP) which is believed to have led to the crew's acceptance of long hours, fatigue and sleep deprivation before the docking test (Oberg, 1998). The arrangement by which cosmonauts' pay was tied to their completion of planned activities coupled with the poor economic situation in Russia, subtly pressured them to complete difficult tasks even when anomalies may have been present. Tsibliyev had added pressure of this type because of his earlier failure to successfully dock Progress 233. These long hours and the stress of the near miss and collision in Tsibliyev's case possibly contributed to heart rate irregularities he experienced after the crash.
Political. There was ultimately even a political dimension to the crash. The underlying reason the Toru docking system was developed and needed testing was that the supply of Kurs automatic docking equipment from the Ukraine was no longer certain or affordable after the breakup of the Soviet Union. Production of an entirely Russian alternative was needed to avoid a 400% increase in the cost of Kurs system (Burrough, 1998b).
 Figure 3. The human factor elements of the collision. |
Automation and Human Factors in Space Flight
As of the writing of this report, the Mir space station is unoccupied and will probably remain so until its final incendiary orbit. But crewed space flight is likely to continue to uti- lize increased automation at all levels and fully automatic systems such as Kurs will remain. The hardware which will underlie this automation will never itself be responsible for safety or success. Responsibility will ultimately rest with astronauts, cosmonauts, and mission controllers who monitor and sometimes overrule it with manual systems such as Toru. Their ability to appropriately and successfully introduce such overrides will depend upon comprehensive understanding of the automation based on continual skill maintenance and in situ training.
As has been the case with the introduction of automation into many areas, the balancing of automatic and manual systems will require study of the human perceptual, motor, cognitive and social behavior to optimize interaction with the complete system (e.g. Sheridan, 1992). Safe, efficient manned space flight during more and more ambitious missions can only be assured if the human factors of this balance are well understood for each specific im- plementation.
R e f e r e n c e s