In the summer of 2007, an accident occurred aboard the International Space Station that destroyed nothing, killed no one, and barely made it into the textbooks. Yet it exposed a fundamental flaw in how engineers think about reliability.
June 2007 — the ISS is going through one of its busiest assembly phases. The shuttle Atlantis (mission STS-117) is docked with the station, having delivered the S3/S4 truss with a new pair of solar arrays. The crew of Expedition 15 — commander Fyodor Yurchikhin and flight engineer Oleg Kotov — is working aboard alongside the shuttle astronauts. The station is growing, its power architecture is becoming more complex, and the new panels are beginning to feed electricity into the common grid. This is a routine working moment: every new structural element slightly changes the station’s electrical balance, and ground control centers track the power parameters closely. Everything is nominal — until June 13, when the Russian segment falls silent.
Not entirely. Not in the sense that the lights go out and the air supply stops. But its brain falls silent: six onboard control computers — three central (TsVM) and three terminal (TVM) — shut down at once. These machines, developed by the German company DASA (later absorbed into Astrium) for ESA and RKK Energia, were responsible for the Russian segment’s attitude control, navigation, and oversight of a number of onboard systems. Three primary units and three backups — the classic triple-redundancy arrangement, meant to guarantee that at least one channel would always remain operational. All six went down at once.
Triple redundancy is the engineering religion of spaceflight. The idea is simple: if one computer fails, the second takes over its functions; if the second fails, there is a third. The probability of three independent systems failing simultaneously is vanishingly small. But that is the thing: the word “independent” is crucial here, and on June 13 it came into question.
When telemetry from all six machines vanished from the screens at MCC-Moscow, the first response was a reboot. Standard procedure: switch them off, wait, switch them back on. It did not help. The computers would power up and immediately shut down again, as though someone were throwing a breaker. The Russian segment lost automatic attitude control — which meant the station had to be kept in the proper orientation by other means. The American segment, with its gyroscopes (CMG — Control Moment Gyroscopes) and its own computers, could partially compensate for the loss, and that is precisely what happened: the docked Atlantis and the American control system took over the task of maintaining attitude. The crew faced no immediate evacuation, the life-support system continued to operate, oxygen kept flowing. But the situation was alarming for another reason: no one understood why it had happened.
What gets me about this story is that precise moment — not the failure itself, but the pause of incomprehension. Six computers designed to operate independently had failed in sync. It was as though three defibrillators and three backups in a hospital had all stopped at the same moment — despite standing in different rooms and being plugged, as everyone believed, into different outlets.
The first theories emerged quickly — and were, in essence, attempts to explain the impossible. Russian flight directors pointed to NASA: the new solar arrays delivered by Atlantis had begun generating electricity, and so-called “dirty” 28 V power — with interference, spikes, abnormal characteristics — might have entered the Russian side of the station. Another theory sounded even more exotic: plasma effects. Solar panels operating in the ionosphere really do interact with the surrounding plasma, and in theory this can produce stray currents. Both hypotheses were technically possible, but neither explained the essential point — why all six machines had failed, backups included.
Put crudely, “dirty” voltage is noise in the electrical system. Computers are certainly sensitive to power quality, but they are designed with filters and protective circuits precisely for this kind of event. The plasma hypothesis looked even more strained: the interaction between panels and the ionosphere is a real effect, but it could not selectively disable six specific devices without affecting the rest of the electronics. Still, both theories were actively debated in the first days, and tense talks went back and forth between MCC-Moscow and MCC-Houston. Each side defended its own architecture: Russian specialists suspected an effect from American hardware; the Americans looked for the problem in the Russian segment.
While the engineers on Earth argued, the crew in orbit had to act. Atlantis could not remain docked forever — its mission time was limited, and undocking was scheduled for June 19. Once it undocked, the Russian segment would again have to take over attitude control, and without working computers that was impossible. The clock was ticking in the most literal sense.
The solution the ground specialists arrived at was elegant in its crudeness. If the computers shut down when normal power is supplied, then power had to be supplied abnormally, bypassing the suspect section of the circuit. Yurchikhin and Kotov received detailed instructions from the ground: install jumpers — jumper cables — bypassing the power-control unit and the protective circuit on the computers. In effect, the crew surgically cut out of the electrical schematic the element that engineers believed was falsely triggering the shutdown command.
The work was painstaking. Each computer had to be rewired individually, checked, and confirmed to start up and hold the load. The cosmonauts worked in cramped compartments, amid bundles of cables, following voice instructions from Moscow. It was not like a heroic film montage — more like an electrician spending long hours in a basement, except the basement is flying at nearly eight kilometers per second. Gradually, one by one, the computers returned to service. By the time Atlantis undocked on June 19, the Russian segment had restored automatic attitude control. The shuttle departed. The station continued its flight.
But the question “why?” remained open. The jumpers were a workaround, a patch. They proved that the problem lay in the power circuit, but did not explain what exactly in that circuit had failed. The computers themselves were sound — that became clear when they worked under the alternative configuration. So the issue was not in the machines, but in something between them and the source of electricity. Something that had affected all six channels at once.
The answer emerged just a few weeks after the accident. Yurchikhin, Kotov, and NASA astronaut Clayton Anderson, who was working with them, dismantled the power-control units and cable harnesses and inspected every corner — probes and instruments found nothing, but eyes and fingers did: the pins in the connector of the power-control unit — the very one they had bypassed with jumpers — were wet and corroded. The culprit turned out to be something disarmingly mundane — drops of condensation from a faulty air dehumidifier.
In orbit, moisture behaves differently than it does on Earth. Without gravity, droplets do not run downward; they remain where they formed, or drift slowly along with air currents. By the engineers’ design, condensation was not supposed to threaten the cables: heat from operating current and air circulation were meant to keep them above the dew point. But the dehumidifier was malfunctioning: its frequent on-off cycles released bursts of water vapor, while a stream of cold air from another of its outlets periodically dropped the cable temperature below the dew point. Condensation settled on the contacts again and again — the contacts oxidized, resistance changed, and at a certain point a short circuit occurred.
But here is what turns this story from an ordinary malfunction into an engineering lesson. All six computers — three primary and three backup — were connected to a single “power off” command line. That line existed as a protective mechanism: if an emergency was detected, it was meant to cut power to the system and prevent damage to the equipment. The designers’ logic was understandable — there had to be a master switch for a fire or some other emergency. The problem was that corrosion eventually brought the cable to a short circuit — and it shorted that very line. The shutdown command, which no one had issued, was born right in the wire leading to all three channels. The master switch tripped — and shut down everything, including the backup channels that were supposed to be independent.
There is, I think, a bitter irony in that: the mechanism created for protection became the cause of failure. The fuse that was supposed to save the system from catastrophe caused the catastrophe itself — however manageable it was.
This type of failure has a precise engineering name — common-mode failure, a failure from a shared cause. The concept has been known for a long time: if several redundant systems share any common element — a power source, a communications channel, a physical space — then the failure of that element wipes out the entire redundancy architecture at once. Reliability textbooks discuss it in their opening chapters. And yet the engineers who designed the Russian segment’s control system made exactly this mistake.
It was not negligence or stupidity. The shared power-off line had its rationale: in an emergency, there must be a way to cut power to everything quickly. But “everything” included the backups, turning the triple redundancy into scenery. On paper — three independent channels. In reality — one wire that could kill all three. The difference between the diagram and reality ran through a tiny section of circuitry that looked like an insignificant detail on the functional schematic.
The aviation and nuclear industries know common-mode failure all too well. The Chernobyl disaster, the loss of the Space Shuttle Challenger, the Boeing 737 MAX crashes — in each case, one can find elements of common-cause failure, where redundant systems turned out not to be as independent as assumed. The ISS incident of June 2007 caused no deaths and did not even require an evacuation, but it demonstrated the same principle with textbook clarity. Six boxes of electronics, three of which existed specifically in case the other three failed — and all six were disabled by a drop of water on a common wire.
A separate thread in this story is the interaction between the ground control centers. The ISS is a project of fifteen countries, but operationally the station is controlled from two main points: MCC-Moscow (Korolyov) and MCC-Houston (Johnson). The Russian and American segments have different control systems, different computer architectures, different protocols. Under normal conditions, each center controls “its” half of the station, coordinating with the other through established channels.
June 13 put that arrangement to the test. When the Russian computers went down, the American segment remained fully operational. The CMG gyroscopes and the Atlantis attitude-control system took over the task of keeping the station properly oriented. Houston maintained the critical functions while Moscow searched for the cause of the failure and developed a recovery procedure. This was exactly the situation for which the ISS had been designed as a two-segment station: if one half loses control, the other can keep the station going.
But the friction showed itself there as well. The theory of “dirty” voltage from the new American solar arrays, advanced by the Russian side, amounted to an accusation: your equipment broke our computers. Houston, naturally, disagreed. Both sides conducted parallel analyses and exchanged data, but each worked within its own engineering culture and its own assumptions. When the true cause emerged several weeks later — condensation and corrosion — it became clear that the problem lay entirely within the Russian segment and had nothing whatsoever to do with the American arrays. The false “dirty voltage” trail consumed precious time and added tension between the control centers.
This incident is rarely mentioned in popular accounts of the ISS. It left no photogenic traces — no holes in the hull, no air leaks, no dramatic spacewalks for emergency repairs. Two cosmonauts rewiring cables in a cramped module by voice instruction does not cut well into a trailer. Media memory retained other episodes: the ammonia leak in 2013, the depressurization of Soyuz MS-09 in 2018, the cracks in the Zvezda module. The computer story dissolved into the news cycle, leaving behind only dry lines in technical reports.
And yet it deserves attention precisely because nothing terrible happened. It is that rare case when a system failed severely enough to expose a design flaw, but not severely enough to lead to irreversible consequences. The ideal textbook case. A drop of condensation from a broken dehumidifier, corroded contacts, a short circuit on the shared power-off line, the simultaneous failure of all six computers, an argument between two control centers, false theories, a manual bypass of the circuit, gradual recovery, the discovery of oxidized pins only weeks later. Every element of that chain is a lesson in the fact that reliability is a property not of individual components, but of the connections between them.
After the incident, the design flaw was addressed radically: during Endeavour’s August visit, the old computer network was dismantled down to the last unit — behind the removed units, the crew found condensation mixed with mold — and reassembled using fresh machines and cables delivered by ESA. One of the new cables turned out to be forty centimeters too short; the old one was checked for continuity, no corrosion was found, and it was put back in place. And to keep condensation from creeping toward the connectors again, they built a thermal barrier between the dehumidifier and the electronics — out of a spare reference manual and gray tape. All of it quiet, invisible work that never makes headlines, but that is, in essence, what real engineering work in orbit consists of. The station has been flying for more than twenty-five years, and every year its reliability is determined not by promotional figures about triple redundancy, but by how honestly the engineers on Earth have answered one question: what do those three “independent” channels have in common?