Previously Undetected Software Bug Potential Cause for Soyuz/Fregat Failure

The failure of a Soyuz 2-1B/Fregat-M rocket launching the Meteor-M 2-1 weather satellite and 18 international secondary payloads was traced back to a software bug on the rocket’s Fregat upper stage brought on by the unique parameters for Soyuz launches out of the Far Eastern Vostochny Cosmodrome.

Loaded with the 2,750-Kilogram Meteor satellite, four MicroSatellites weighing between 6.5 and 86 Kilograms and fourteen CubeSats, Soyuz lifted off from the 1S Launch Complex at the Vostochny Cosmodrome on November 28 at the precise instant of 5:41:45.965 UTC. Powering away from the snowy grounds of eastern Russia, Soyuz was programmed to roll 174 degrees before pitching over and flying almost straight north, aiming for a Sun Synchronous Orbit – the optimal orbital destination for a low-orbiting weather satellite.

Soyuz thundered uphill with a thrust of 424 metric ton-force provided by its core stage and four liquid-fueled boosters which separated 118 seconds into the flight. The fairing separated three minutes and 43 seconds into the mission when Soyuz had departed the dense atmosphere and aerodynamic forces were no longer a danger to the satellite. Hot-staging between the 27.8-meter long core stage and the modified Block I third stage occurred after four minutes and 47 seconds of flight time and the four-chamber RD-0124 engine then fired until T+9 minutes and 22 seconds to boost the stack to a sub-orbital trajectory.

The Fregat-M upper stage separated one second after Soyuz finished its role in powered flight. At that point, celebration erupted at the Vostochny Cosmodrome where a number of high-ranking officials had gathered and witnessed the successful operation of the Soyuz 2-1B carrier rocket. However, around 180 Kilometers above the Arctic, the Fregat upper stage was starting a deathly dance – beginning a re-orientation to what its flight computer perceived to be the correct attitude for the beginning of its first main engine burn that was to push the stack into an elliptical transfer orbit.

700 seconds into the mission, Fregat exited the range of Russian ground stations, having begun its first main engine burn to enter a preliminary orbit ahead of a circularization maneuver into an 820-Kilometer Sun Synchronous Orbit. When re-appearing in ground station range, engineers hoped to receive signals from the separated Meteor-M 2-1 satellite and the Fregat upper stage as it started the second part of its mission, but no transmissions ever arrived from either of them – indicating something had gone spectacularly wrong on Fregat’s first lap around the planet.

Pilots on the North Atlantic route between Europe and North America reported seeing a slow-moving fireball in the night skies near Iceland and vivid discussion emerged on the frequency as a number of aircraft had witnessed the falling Fregat upper stage as it re-entered the atmosphere along with all 19 payloads it was supposed to deliver to orbit.

https://twitter.com/thatjetsetgirl/status/935569848507170817

 

In the hours after the event – as is typical for such scenarios – Russian press outlets began reporting theories and speculation based on sources close to the space industry, claiming that a human error led to Fregat’s untimely demise. Within a day of the mishap, Roscosmos appointed the members of the accident investigation board with the goal of closing out the inquiry by December 15th.

More details on the rather bizarre failure mechanism that transpired on November 28 emerged over the course of the week from different press outlets, RussianSpaceWeb.com and knowledgeable posters on the Novosti-Kosmonavtiki forums, indicating a previously undetected software bug led to the mission’s outcome.

The trusted Soyuz launch vehicle, flying for the first time in a slightly modified 2-1B version with upgraded flight computer and optimization for the Vostochny ground infrastructure, was fully exonerated and the investigation focused on the Fregat upper stage and a peculiarity within its guidance system that operates completely autonomous from Soyuz. Because of that separation between the two, Soyuz and Fregat do not use the same reference axis and have an offset of 10 degrees between their axes of reference; however, these ten degrees would prove crucial in this particular mission.

The geographical location and orientation of the Vostochny launch pad make it unique among the other Soyuz pads in Baikonur, Plesetsk and French Guiana in that Soyuz has to perform a fairly large roll maneuver after launch to attain the proper launch azimuth when flying north into a Sun Synchronous Orbit. This roll requirement arises from the Soyuz flight program that requires the Block B booster (located in the Soyuz reference system’s stabilization plane) to point down – in case of the November 28 mission, Soyuz had to roll 174 degrees counterclockwise to achieve the proper orientation for the pitch-over.

 

Soyuz rotated its gyro platform to 174 degrees and completed gyro settling before moving back to its zero position so that the reference plane would align with the launch azimuth after executing the roll maneuver. Fregat did the same, but of course with a 10° offset to Soyuz. This put the two systems into a situation that can not occur at other launch sites: Soyuz worked with a roll angle of under 180° while Fregat was above 180°. At other launch sites, both angles are below 180 degrees.

In fact, both Soyuz and Fregat, are programmed to move back to the zero position on the shortest route possible – for Soyuz this creates either a clockwise or counterclockwise roll after liftoff whichever is closer to the launch azimuth. In case of Vostochny, Soyuz went from 174 degrees back to zero, but since Fregat had crossed 180°, the shortest path for its gyro platform to the zero position was continuing another 176 degrees in the same direction, effectively ending at the starting position through clockwise rotation . However, as has been reported, Fregat’s flight computer registered the platform at 360 degrees.

Soyuz did its job as planned and separated the Fregat upper stage upon which its flight computer kicked into active mode and began its flight program on the false notion it had been 360 degrees off its roll target. As a result, Fregat fired its thrusters to turn around into its desired zero-position which overwhelmed a subset of its gyroscopes that reached a hard stop after 60 degrees, causing Fregat to lose its inertial reference frame.

Fregat fired up its S5.92 main engine as planned 623 seconds into the mission but due to the loss of attitude knowledge, the thrust component from the engine was not pointed to the required direction. Attitude errors likely accumulated as the burn went on, resulting in a net loss of speed which placed Fregat onto a shorter sub-orbital arc than the Block I stage of Soyuz which was expected to fall south of the Northern Tropic.

It will be up to the Russian State Commission to determine exactly where the software bug within Fregat’s flight program originated and, more importantly, why flight simulations did not uncover the problem.

The issue did not occur on any of Fregat’s 64 previous missions because the separation between the Soyuz stabilization plane and the desired launch azimuth had never reached the critical value of 170 degrees on any of these missions.

For the Soyuz U/FG launch vehicle generation, no roll was possible after liftoff due to their old-fashioned analog guidance systems which required the launch table to be physically rotated to point the stabilization plane to the desired launch azimuth. The Baikonur and Plesetsk pads used by Soyuz-2/Fregat missions roughly point the Soyuz stabilization plane to the East, creating fairly small roll requirements after liftoff for all prograde and polar orbits; the ELS launch pad at French Guiana faces the stabilization plane to an azimuth of 135°, still not even close to the critical value, even for polar missions.