vol4.pdf [Ivanovskiy Boris Andreyevich]

NPO Energiya cosmonaut Vladimir Aksenov 

inscribed this picture of himself while he was 

in space during his Soyuz-22 flight in 1976.

 50. TsUKOS—Tsentralnoye upravleniye kosmicheskikh stredstv (Central Directorate of Space 

Assets)—was the official name of the Soviet “space forces.”

507

Rockets and People: The Moon Race

took place showed that the computer was performing dynamic monitoring 

of the approach parameters and predicting their changes. The computer 

prognosis differed from the actual motion. Consequently, the computer 

decided that the process was abnormal, issued an “emergency” command, 

and shut down the automatic control system. The computer was not the 

culprit. It was a human error, this time committed by representatives of a 

new profession—programmers. The control algorithms required a greater 

rendezvous velocity than was actually the case.

It was mandatory that any changes in the drawings of a rocket, of a space-

craft, or in electrical circuits be documented in “change notices.” Depending 

on the causes and consequences, these notices had to be signed by the authors, 

managers, lead designers, and—in acute situations—the chief designer, too.

Changes in the software, on the other hand, could lead to much more 

significant consequences than changes in the electrical circuitry or design. For 

the design and circuitry, there were sets of drawings and technical documenta-

tion, which were accounted for in accordance with all the stringency of state 

standards. The originals were stored in archives, and each change was strictly 

recorded in accordance with the rules of technical documentation management. 

Something intangible, unaccounted, incomprehensible—software—broke 

into this strict order, which had been in place practically since the times of 

the artillery of Peter I.

This prompted some heated conversations between Yeliseyev’s and 

Legostayev’s services.

“We must train the TsUP operators and cosmonauts using documents 

that are accounted for—drawings, diagrams, descriptions—which exist for all 

the vehicle’s systems,” Yeliseyev said. “But when it comes to motion control, 

they tell us that now we need to study algorithms and programs rather than 

instruments. We are prepared to do this, but show them [to us]. It turns out 

that in the best-case scenario they are in the developers’ notebooks, and each 

one of these idea men is storing all the changes in his own memory. That’s fine 

if the person isn’t off on a business trip or on vacation, and without him no 

one can remember the ‘patch’.” These were more or less the completely valid 

grievances that Yeliseyev mentioned to me.

It took two years before some order was brought into this system. During 

the first years of on-board digital computers, the authors of algorithms and 

programs were themselves the record-keepers and executors of changes intro-

duced into the computer memory. There were a lot of arguments, turmoil, and 

all sorts of incidents associated with this. Software was supposed to be updated, 

supplemented, and improved based on observations after each flight. Soyuz 

T-3 and Soyuz T-4 had been launched to Salyut-6, and Soyuz T-5 launched to 

Salyut-7. The computer on Soyuz T-6 once again decided to give notice that it 

508

People in the Control Loop

was high time to bring strict order to the data that the whiz-kid programmers 

were using to try to “train” it. Cosmonauts Vladimir Dzhanibekov, Aleksandr 

Ivanchenkov, and Frenchman Jean-Loup Chrétien flew on the Soyuz T-6 

launched on 24 June 1982. Dozens of correspondents and foreign guests, 

including the French ambassador and his diplomatic entourage, filled the visi-

tors’ gallery at TsUP. There was no need to say anything about our brass. After 

all, the first Frenchman in the history of cosmonautics was being launched 

into space on a Soviet spacecraft.

I was at TsUP following the course of the approach process on the moni-

tors with those directly participating in this crucial historic event. Groups of 

approach and docking specialists had moved their workstations out of the main 

control room into a separate room on the second floor so that they wouldn’t 

disturb others and others wouldn’t disturb them. The crew switched on the 

automatic approach mode during the 17th orbit after executing the two-burn 

maneuver prescribed by the ballistics experts for the vehicle to make a safe 

entry into Igla’s coverage zone.

At 2009 hours, the first information appeared on the monitors: “Target 

availability signal received; range 11.4 kilometers; approach velocity 18 meters 

per second.” Ten minutes later the on-board digital computer requested crew 

permission to execute a braking burn. The crew gave permission from its con-

sole. After that the computer acted according to the algorithm loaded into its 

memory, in concert with the information received from Igla. Upon receiving 

its commands, the Chayka control system turned the spacecraft’s pitch by 90° 

and fired the engine to reduce the line-of-sight angular rate to zero. Now it 

executed a reverse turn to put the spacecraft into the initial state and then to 

swing around to fire a second correcting burn.

At 2026 hours, at a range of 1.4 kilometers, they began the second turn in 

the yaw angle. Meanwhile, the lock-on mode strayed. The Igla antennas were 

unable to maintain lock-on at wide angles. But the on-board digital computer 

kept this in mind. Upon receiving the computer’s command, the engine fired at 

a range of 960 meters. The approach velocity slowed to 3.3 meters per second. 

The computer did not “forget” to issue the command for a turnaround. In so 

doing, communication was restored via Igla.

“So that’s how we rendezvous now!” someone standing behind us mar-

veled, with bad timing. “Remember, in Yevpatoriya we only found out from 

the films that the SKD had fired 20 times for approach. And now all it takes 

is two burns.”

“Quiet!” blurted out someone at an adjacent monitor, where Igla special-

ists were sitting.

While turning around, the spacecraft turned its “nose,” i.e., its docking 

assembly, toward the station. During the turn, at 2028 hours, the telemetry 

509

Rockets and People: The Moon Race

struck the nerves of everyone sitting in hushed silence at the monitors: “The 

first block of DUSes is shut down! Backup activated…. Backup block of DUSes 

is shut down! Chayka digital circuit shut down. Igla shut down!”

“Look what comes from nostalgia for Yevpatoriya,” I sighed, stunned by 

what had happened.

Twenty-five degrees were left until the turn was completed. The space-

craft’s angular motion continued due to inertia. Flight management at TsUP 

was in shock for several seconds. But it was as if the crew had just expected 

this. Without any hesitation, Dzhanibekov switched on the backup analog 

manual control loop. Just 25 seconds passed after the “accident,” which was 

displayed simultaneously on board the spacecraft and on the monitors in the 

TsUP control rooms. Dzhanibekov saw the DOS on the screen of his optical 

sight and calmly halted the spinning of the spacecraft. According to the radio 

coverage conditions, right at that time KIK lost communication with the 

vehicle for 10 minutes.

At the most tense moment a special messenger ran in: “They’re asking for 

Yeliseyev to report to the State Commission!”

Yeliseyev gave Legostayev, Branets, and me a questioning look.

“Igla was operating normally according to all parameters all the way up 

until it shut down,” Suslennikov managed to say.

I made the following recommendation: “In 3 minutes the vehicle will 

appear in the coverage zone. We’ll go downstairs to the communications room 

and make a joint decision there. It’s not right to summon a commander from 

the field of battle in a critical situation. Pass that on to the chairman of the 

State Commission.”

51

At 2036 hours, the spacecraft entered the coverage zone. It was just 100 

meters away from the station. The crew very calmly reported that everything 

was fine and requested permission to perform manual docking. Permission 

was immediately granted. Docking proceeded without a hitch. During the 

following orbit the crew entered the DOS. There was thunderous applause 

from the guests in the balcony. Flashbulbs popped as the latest triumph of 

Soviet cosmonautics and the traditional friendship with the people of France 

was recorded for history. Our top brass didn’t have time to realize what had 

actually happened. The French guests smiled happily.

While the large throng of brass and distinguished guests congratulated one 

another and those who had absolutely nothing to do with it, the true experts 

and culprits huddled around the consoles, not sharing the general jubilation, 

 51.  The chairman of the State Commission was Kerim Kerimov.

510

People in the Control Loop

trying to grasp what had happened. Vadim Kravets, who was in charge of the 

analysis group in Yevpatoriya, congratulated me for the brilliant docking and 

pointed to Mikhail Chertok, who had retreated into himself.

“I thought that I had done a good job learning the signs that are quick 

tip-offs to off-nominal situations in the behavior of Chayka. If Mikhail Chertok 

is silently scratching his beard it means that he understood everything. There 

were no failures. This is the latest mathematical discrepancy in the program.”

Evidently, Branets also knew that pensive scratching of the beard is a sign 

of enlightenment. Mikhail began to explain to him in a deliberate manner and 

drew something on his notepad.

“Despite the happy ending, the State Commission demands my explana-

tions,” said Yeliseyev, who had joined us. “What shall I report?”

“Report that there were no failures in the system,” advised Branets. “There 

was a glitch in terms of tolerances for runtime check. The crew was well trained; 

it executed manual approach perfectly. We’re looking into the details on our 

test stand, and we’ll report in the morning.”

There was no need for prolonged investigations of the “French off-nominal 

situation.”

After conducting an investigation according to the service hierarchy, 

Branets reported, “The program algorithm for the runtime check had values for 

angular rates for each of the three axes loaded into it. Rendezvous required two 

correction burns. In so doing, the vehicle is turned at angles that are optimal 

for propellant consumption. After issuing the command to fire the attitude-

control engines for a turn, the computer monitors the vehicle’s angular rotation 

rate relative to its center of mass. The angular rate depends on the operating 

time of the attitude-control engines and the moments of inertia relative to the 

corresponding axis. The computer knows the engine’s operating time, and the 

ratio of the angular rate to the inertial moment is loaded into the algorithm.”

In this case, the angular rates during the turns exceeded the tolerance. The 

computer interpreted this as a failure of the angular rate sensors and switched 

from the first set to the second. But the second set also showed rates that did 

not correspond to the design values. Then, according to the runtime check 

algorithm, the digital (i.e., computerized) control loop was shut down. This 

happened at a range of 800 meters.

Soyuz-T vehicles have a backup analog manual control loop. At the ini-

tiative of Dzhanibekov and our manual control specialists, the crew had pre-

liminary training for approach using this loop at a range up to 1,500 meters. 

Therefore, as soon as the computerized loop “failed,” Dzhanibekov switched on 

the backup, took over control—and docking took place at the calculated time.

As far as root causes were concerned, the computer was not to blame. The 

culprit was a telephone connection between the planners and our dynamics 

511

Rockets and People: The Moon Race

specialists. The actual moments of inertia of this specific spacecraft differ from 

those that our dynamics specialists used to calculate the angular rate values. 

Instead of having official, accounted-for documents, they received the infor-

mation over the telephone.

After our circle of control specialists had pored over how much the values 

of the actual center-of-mass characteristics had deviated from the design 

values loaded into the runtime check program and received assurances that 

now everything would be corrected, I then had to brief the general designer 

on the causes of the incident. To my astonishment, instead of reacting to the 

incident with the anticipated and completely understandable outrage, Glushko 

dealt with it very calmly but was meticulously interested in the mathematical 

operations that the on-board digital computer received in order to predict the 

angular rates that depended on the duration of the attitude-control engines’ 

burn. A calm conversation resulted in the following instructions: announce 

orders that stringently stipulate the requirement to issue, before each launch, an 

archived calculation, in which the center-of-mass coordinates and moments of 

inertia will correspond to the actual vehicles and crews, rather than to designs 

from three years before.

“It was quite difficult for us to establish a weight discipline,” Glushko said, 

“and we even strictly monitor the cosmonauts’ weight. But I didn’t think that 

you had tasked the computer to monitor the moments of inertia. All the plan-

ners must understand what parameters are involved in the field of computer 

monitoring and bear responsibility for their authenticity.”

The Soyuz-T crew proved that it was possible to perform docking using 

manual control from a range of around 1,000 meters. However, subsequently, 

the initial conditions did not always favor such a happy ending. Soyuz T-8, car-

rying cosmonauts Vladimir Titov, Gennadiy Strekalov, and Aleksandr Serebrov, 

lifted off on 20 April 1983. After insertion, the traditional all-systems test was 

performed, including the Igla rendezvous radio system. During this process, it 

was determined that Igla’s main gyrostabilized pencil-beam antenna was unable 

to assume the necessary position. All of the experts agreed that the antenna 

control mechanism had jammed. To avoid aborting the docking, TsUP formed 

a team that worked through the night and came up with an automatic rendez-

vous control procedure based on prediction without using Igla until the range 

was no more than 1 kilometer and then switching over to manual mode. After 

the completion of the automatic rendezvous using the scenario the team had 

developed, the range was 3 kilometers. Exercising discipline, the crew waited 

30 minutes for instructions from TsUP. Finally, TsUP made its decision and 

granted permission for manual approach.

Fifteen minutes later, the spacecraft approached to a range of around 200 

meters from the station. Precisely at that moment, the vehicle and station entered 

512

People in the Control Loop

Earth’s shadow. In the darkness the crew managed to avoid collision, “diving” 

under the station. After emerging from the shadow, the Soyuz T-8 once again was 

3 kilometers from the station. Calculations showed that the remaining propellant 

reserves were insufficient for new attempts at approach. After being briefed, the 

State Commission made two decisions: to have Soyuz T-8 return to Earth and to 

form the latest accident investigation commission to determine the causes for the 

failure of the Igla. Once again I found myself in the thankless role of chairman.

Our commission succeeded in reproducing the mechanical jamming of 

Igla’s gyrostabilized antenna, having resorted to a “foreign object” scenario. 

We supposed that a wayward nut or something of that ilk floating freely in 

weightlessness under the housing of the drive mechanisms had gotten into the 

works. In this connection we recalled Mnatsakanyan’s sensational declaration 

at the collegium of ministers: “Flying with Igla is tantamount to death!” But 

we didn’t have Kurs yet, and we had to fly. Until we had Kurs, our commission 

recommended to the ballistics and approach dynamics specialists that, “just 

in case,” they develop an approach procedure in the event of a complete radio 

system failure, so that it wouldn’t be necessary to improvise at the last minute. 

The recommendation was accepted for implementation.

The team of Legostayev, Branets, Degtyarenko, Borisenko, Bragazin, and 

Semyachkin, unique in terms of its concentration of intellectuals, acquired an 

inventor’s certificate for a rendezvous method to be used in the event of the 

failure of the radio system that measures relative motion parameters. Special 

algorithms were introduced into the software of the on-board digital computer. 

In combination with the crew’s actions, this made it possible to substantially 

increase the probability of rendezvous with the station in the event of the 

failure of the on-board radar.

“It bodes ill that you came up with this,” someone at the next meeting of 

our accident investigation commission said to the inventors. “Now in addition 

to failures of Igla or Kurs, we’ll have to figure out why your procedure failed.”

A year and a half later the new technology came in handy to save 

the Salyut-7 orbital station. The story of the “clinical death” and resuscitation 

of Salyut-7 serves as a classic example, it would seem, of a small human error in 

the control loop and, subsequently, the truly heroic actions of people involved in 

another large control loop to eliminate the catastrophic consequences of this error.

On 2 October 1984, a crew made up of Leonid Kizim, Vladimir Solovyev, 

and Oleg Atkov departed the station.

52

 Temporarily, the Salyut-7 station 

 52.  This was the Soyuz T-10 crew.

513

Rockets and People: The Moon Race

remained in unpiloted mode and peacefully drifted in near-Earth space. The 

calm mode, which generated no interest in the press, the lack of a crew that 

might “do” something and require constant attention on the ground—all of 

this dulled the sense of vigilance of the personnel involved in the large control 

loop at TsUP. This sort of tranquility in space is deceptive.

On 11 February 1985, at the end of the watch of the latest shift at TsUP, 

telemetry reported that current protection in the on-board complex control 

system had been tripped, shutting down the first, primary radio transmitter 

of the long-range radio communication system. It was an unpleasant incident, 

but far from an emergency. Unit S-190, stuffed with long-range radio com-

munication system (DRS) equipment, housed two identical transmitters. It 

also contained receivers and decoders receiving commands from Earth.

Once the radio system automatics had perceived the failure of the primary 

transmitter, it switched on the second—the backup. The shift that was on duty 

at TsUP was not surprised after discovering the automatic switch to the backup 

transmitter. It was well known that the set of radio instruments had exhausted 

its service life and had the moral right to one failure that would not lead to the 

failure of the whole system. A cargo transport vehicle had previously delivered 

the spare set that was on board. The crew of the upcoming expedition was 

supposed to replace the spent S-190 set with the new one.

53

The shift recorded the unremarkable incident (compared with the scales 

of other space incidents) in the flight log with the recommendation to call in 

a specialist on the on-board complex control system (SUBK) from TsKBEM 

and the DRS specialist from the Scientific-Research Institute of Space 

Instrumentation Building (NIIKP) in Moscow so that they could analyze the 

situation together and prepare a report.

54

 But meanwhile they decided to work 

using the second transmitter.

Flight control was conducted from TsUP in four shifts. Each one was on 

duty for 24 hours. I wasn’t able to determine what information the members 

of that shift, who were hurrying off to get some rest after a sleepless night, 

passed on to their relief shift members. And that’s really just a detail. All we 

know is that the director of the new shift did not summon or did not wait until 

the arrival of the specialists, i.e., the SUBK developers responsible for current 

 53. The original slated next crew for Salyut-7, the fourth primary expedition, included 

V. A. Vasyutin, V. P. Savinykh, and A. A. Volkov. Their backups were A. S. Viktorenko, 

A. P. Aleksandrov, and Ye. V. Saley.

 54. SUBK—Sistema upravleniya bortovogo kompleksa; NIIKP—Nauchno-issledovatelskiy 

institut kosmicheskogo priborostroyeniya. The latter was formerly known as NII-885.

514

People in the Control Loop

protection and the radio complex developers capable of making a diagnosis 

and giving a report about the shutdown of the primary transmitter.

Subsequent examination determined that in keeping with tradition and 

the existing procedure, it was the duty of the shift flight director to wait for the 

specialists (developers of the DRS and SUBK) to show up. After analyzing the 

telemetry information, having debated with one another, they were supposed 

to make recommendations as to how to work thereafter, having signed off on 

the corresponding conclusion in the logbook.

Evidently, the shift director decided “we didn’t just fall off the turnip truck.” 

Without waiting for those responsible for the systems, he gave the command 

to switch on the first DRS transmitter. And really, why not give the first set 

one more try? Perhaps an accidental actuation of the automatic protection had 

occurred. And if there really is a malfunction there, that’s what the current 

protection is for—it will trip again. You can reason like that at home if you’ve 

blown a fuse. Even a housewife who has seen smoke coming from the televi-

sion or vacuum cleaner will not count on the reliability of the fuses and risk 

switching it on again. At TsUP they didn’t see whether smoke had appeared 

on board the DOS. But the actuation of the current protection in itself meant 

that the strength of the current exceeded the norm by three to five times.

The findings regarding this incident, approved by Oleg Shishkin (deputy 

minister [at MOM] at that time) and signed by me, Ryazanskiy, Vorshev, and 

two military representatives, said:

. . . 3. Analysis of the circuit, design, and operational documenta-

tion, and also the broad experience accumulated during the joint 

operation of the DRS and SUBK systems on spacecraft 11F615-A8, 

11F615-A12, 11F615-A15, and 17K, showed that the principle 

“any one failure in any of the systems must not lead to the failure 

of a system” has been fulfilled.

55

  4. Failure of the first transmitter of the DRS system, identified 

on 02 November 1985 during orbit 16,252, was contained by 

the current protection of the SUBK system and did not result in a 

failure in the operation of any of the systems. Up until 1320 hours, 

51 seconds, all on-board systems were operating normally according 

to data from the analysis of telemetry information.

 55.  These indices denote the following spacecraft: 11F615A8 (Soyuz ferry vehicle, 7K-T), 

11F615A12 (Soyuz vehicle for the Apollo-Soyuz Test Project, 7K-TM), 11F615A15 (original 

Progress cargo vehicle, 7K-TG), and 17K (DOS-class stations).

515

Rockets and People: The Moon Race

  5. Commands from the ground to reactivate the first transmitter, 

which came after the actuation of its current protection during orbit 

16,252, resulted in the development of a failure process. During 

orbit 16,254, attempts to switch on the clearly malfunctioning 

transmitter using a command from the ground resulted in a snow-

balling short-circuiting process, as a result of which the integrity of 

the power circuitry of both transmitters was irreversibly damaged 

and the operation of the decoders was shut down.

The failure of the decoders, which were installed in the same framework as 

the transmitters, deprived the station of the ability to receive any commands 

from Earth. The station went out of control. We were unable to reproduce 

the “snowballing process” under laboratory conditions with a short-circuiting 

current of 120 amperes passing through the transmitter because of the ambigu-

ity and randomness of the phenomena. The findings contained the following 

modest statement: “The failures were confined to the S-190 framework of the 

DRS system and in the power circuits of the transmitters of instrument BKP 

of the SUBK system.” The short-circuiting current in excess of 100 amperes 

rapidly discharged the buffer batteries. The voltage of the on-board network 

fell to the minimum level, at which point the automatic circuit breakers were 

tripped, shutting down the electric power consumers one after another.

After commands were issued from the ground to reactivate the malfunc-

tioning transmitter, the strength of the current in the power circuit exceeded 

100 amperes. Most likely the contacts of the radio transmitter power switch 

“burned out,” the insulation melted, and possibly there was short-circuiting 

somewhere else “along the way” in the cable network.

There was a weak glimmer of hope that despite the loss of orientation, the 

station, while turning, would still receive enough energy from the Sun to sup-

port the thermal mode to the minimum extent necessary. However, this same 

“snowballing process” also resulted in the malfunctioning of the sequencer, 

which at least once per day issued a command to connect the solar arrays to 

the buffer battery charging circuit. The command to charge the batteries did 

not get through from the ground or from the on-board sequencer. The system 

orienting the solar arrays on the Sun ceased to operate. The single power supply 

system—the on-board electric power station—completely broke down. All 

the electrical systems, including the thermal mode control assemblies, ceased 

to function.

The station began to freeze. According to the calculations of the thermal 

mode specialists, the temperature inside the station would fall to –20°C [–4°F] 

in a week. The station became a big, useless, artificial satellite, which only the 

missile defense system’s space monitoring facilities could track. Salyut-7 fell 

516

People in the Control Loop

into a state of anabiosis. No ingenious sets of commands sent on board from 

TsUP were capable of bringing it out of this state.

The station could only be saved by a human being, who after entering 

the station would disconnect the failed S-190 casing; replace it with a spare, 

which fortunately was on board the station; replace the cables damaged by 

the current surge with others brought from Earth; connect a warm storage 

battery that was also brought along; begin warming up the system; and 

restore orientation, thermal control, and everything else, including the life-

support system.

This repair team would have a lot of work to do. And it was unusual work. 

But how would a human being get there if the station was silent and the Igla 

rendezvous radio system, among others, also remained without power? This 

was the full-scale manifestation of Pilyugin’s law: “Emergency situations are 

the strongest impetus for new ideas and the improvement of systems.” This was 

one more of my versions of this law. Against the background of the Americans’ 

success, the loss of the Salyut-7 orbital station could become one more power-

ful blow against the Soviet Union’s prestige in space.

56

 Moreover, there were 

many costly instruments and materials for science programs on the station. 

“Save the station no matter what” was the overriding mission that the teams 

of control specialists set for themselves.

Throughout February [1985] we assessed the degree of possible damage 

incurred in the station’s electrical network and developed measures to reani-

mate the systems, which inevitably go out of order when exposed to prolonged 

freezing. Everything that was needed for the repairs and restoration was 

immediately put to work. The most important thing was still the question, 

who would fly to the station to revive it and how would they get there? After 

brief discussions they settled on the plan that Vladimir Dzhanibekov and 

Viktor Savinykh should be in the primary crew. Dzhanibekov already had 

experience in manual approach from great distances and was quite familiar 

with the station.

57

 Engineer Savinykh from NPO Energiya was officially 

considered a specialist in optical sensors and manual orientation systems 

 56.  Chertok is probably referring to the many successes of the early Space Shuttle program 

from 1981 to 1985.

 57.  Vladimir Aleksandrovich Dzhanibekov (1942–) had, by 1985, flown four orbital space 

missions, more than any other Soviet cosmonaut. These included Soyuz-27 (1978), Soyuz-39 

(1981), Soyuz T-6 (1982), and Soyuz T-12 (1984). All of these missions had involved docking 

with Salyut space stations.

517

Rockets and People: The Moon Race

From the author’s archives.