| Launch Date | Program | Cause | Engineering Mistake | Technology Surprise |
|---|---|---|---|---|
| 04/90 | Hubble | Flawed manufacturing equipment misshaped the mirror. Quality assurance relied on the same equipment and could not perceive the mistake, even though independent checks indicated a defect. | x | |
| 07/92 | TSS-1 | Tether deployment mechanism was jammed by a bolt added at the launch site. | x | |
| 09/92 | Mars Observer | Corroded braze jammed a regulator, causing a breach of the propulsion line. The regulator was not qualified for a long mission. | x | x |
| 08/93 | NOAA 13 | The battery charger was shorted by a long screw. The unit had low dimensional tolerance and experienced thermal stress outside its qualification envelope. | x | |
| 10/93 | Landsat F | Pyrovalve exploded because of an unpredictable mechanism. | x | |
| 01/94 | Clementine | Computer froze, disabling the fault management software. Patches were prepared but not uploaded. | x | x |
| 05/94 | MSTI 2 | Cause unknown, attributed to impact by micrometeoroid or debris, or charging. | x | |
| 12/95 | Skipper | Solar array was miswired. Test did not ascertain current direction. | x | |
| 02/96 | TSS-1R | Contamination in the tether caused arcing. | x | |
| 08/97 | Lewis | Satellite lost orientation. The stability simulation was performed for the wrong orbit, the attitude control was improper, and the satellite was not monitored. | x | |
| 10/97 | STEP-4 | Satellite/launcher resonance caused vibration damage. The resonance was known but not addressed. | x | |
| 10/98 | STEX | Solar array failed—analysis was run on wrong configuration. | x | |
| 12/98 | MCO | Burned up because of unit mix-up in the navigation software. | x | |
| 01/99 | MPL | Requirement flowdown omission resulted in premature shutdown of descent engine. | x | |
| 03/99 | WIRE | Unexpected start-up transient fired pyros, causing the loss of all cryogen. The inhibit circuit design was flawed, and inappropriate test configuration masked the chip's misbehavior. | x | x |
| 08/01 | Simplesat | Transmitter suffered arcing in vacuum. | x | |
| 11/01 | Genesis | Parachute could not deploy because of deceleration sensor misorientation brought about by a layout change. | x | |
| 07/02 | Contour | Spacecraft broke up upon firing of an embedded solid motor. The plume analysis used to qualify the design by similarity relied on an AIAA paper that had a critical typo. | x | |
| 04/05 | DART | Spacecraft failed to rendezvous with its target satellite because of a combination of GPS software bug and flawed navigation design. | x | x |
| Launch Date | Program | Cause | Engineering Mistake | Technology Surprise |
|---|---|---|---|---|
| 03/90 | Titan III | Satellite could not be deployed because the pyro separation harness routed firing commands to ports different from those specified by software. | x | |
| 04/91 | Atlas I | Air was sucked through a defective checkvalve during ascent and froze in a turbopump, preventing a Centaur engine from starting. Air was able to get in because of design changes that were not accompanied by reanalysis. | x | x |
| 07/91 | Pegasus | The shaped-charge detonation system caused an incomplete cut, thwarting stage separation. | x | |
| 08/92 | Atlas I | Same as 04/91 Centaur failure. | x | x |
| 03/93 | Atlas I | A set screw in the throttle setting regulator came loose in flight because rework instructions neglected to require retorquing and verification. | x | |
| 08/93 | Titan IV | A propellant cut made during a repair opened in flight, instead of staying closed by internal pressure as expected, exposing the insulation to flame. | x | |
| 06/94 | Pegasus XL | Vehicle lost control because of unexpected aerodynamic load. The control loop design used improper variance analysis. | x | x |
| 06/95 | Pegasus XL | Second-stage nozzle could not gimbal because of an incorrectly installed foam skid. Operator concerns regarding foam skid orientation were ignored because there was no specific orientation requirement. | x | |
| 08/95 | Delta II | Wind shear caused a large deflection, damaging the explosive transfer line and preventing one of the strap-on motors from separating. | x | |
| 08/95 | Athena I | Thruster-vector-actuation hydraulic oil dumped overboard was ignited by the rocket's plume, damaging a control cable. The failure mode occurred on a similar European rocket earlier. Also, high-voltage power supply, qualified only for aviation applications, suffered arcing at high altitude. | x | x |
| 10/95 | Conestoga | Low-frequency noise of the vehicle was not filtered out, causing the vehicle to excessively actuate the vector thruster control, eventually exhausting hydraulic oil. | x | |
| 11/96 | Pegasus XL | Payload did not separate, probably because of shock damage to a battery or switch. | x | |
| 01/97 | Delta II | The motor case of a solid strap-on was damaged before launch and split in flight. | x | |
| 08/98 | Titan IV | Wire insulation damage on the power supply caused intermittent short of the computer. Upon power-on reset, the avionics system improperly commanded the vehicle, resulting in self-destruction. | x | |
| 08/98 | Delta III | A roll mode was not accounted for in the control system, resulting in loss of control. | x | |
| 04/99 | Titan IV | Upper stages could not separate because vague assembly instructions misled technicians into wrapping insulating tapes too tightly. Problems repeatedly occurred on previous flights. | x | |
| 04/99 | Athena II | Nose cone failed to separate—the operation of one set of pyros pulled open the connectors for the second set. The tolerance buildup problem was manifested in an earlier flight but was not addressed. | x | x |
| 04/99 | Titan IV | A roll filter manually entered in the transfer vehicle's avionics database had an exponent error (effectively misplaced a decimal point) which caused control loss. | x | |
| 05/99 | Delta III | A defective brazing in the combustion chamber was noticed during inspection but was allowed to pass because of ambiguous drawing instructions. The chamber breached in flight. | x | |
| 09/01 | Taurus | An attitude-control valve was jammed shut by debris. The problem had occurred several times previously but was deemed acceptable because the valves had always fortuitously stuck in nonfatal positions. | x | |
| 12/04 | Delta IV Heavy | The first stage shut down too early because cavitation spoofed the sensors into reacting to phantom fuel depletion. | x | |
| 03/06 | Falcon | A fuel leak, attributed to a corroded B-nut, started a fire. | x |
These charts show U.S. Government satellite (failures from 1990 to 2006. In contrast to common beliefs, mishaps are seldom due to poor workmanship, defective parts, or environmental factors. Notice that engineering mistakes—such as a typo (Contour), an overlooked requirement (MPL), and a unit mix-up (MCO)—caused the majority of failures. These embarrassing snafus are often so subtle that they are not caught during verification and review.