Robert Seamans had already arranged for a small dinner party at his house with Doc Draper and a few other close associates, so Webb had told him to go ahead with his own plans. When Seamans reached home, his wife, Eugenia, was talking on the phone. “He’s coming in the door now,” she said, handing him the receiver.
George Low was on the line. “They’re all three dead,” he said.
“What three?” Seamans asked.
“The three astronauts.”
Devastated, Seamans returned to his office at NASA Headquarters and started making phone calls.
This photo shows the interior of the Command Module 14 that was to fly after Command Module 12 (Apollo 1). The Left Hand Equipment Bay (LHEB) contained the Environmental Control System (ECS). The wiring shown would be same as that in Apollo 1. The red arrow points to the wire harness that was the most probable ignition source of the Apollo 1 fire. The wire goes over the plumbing into the ECS, with power from Main Bus A & B. It has a white Teflon protective overwrap as it goes over the plumbing, but the last closeout Apollo 1 photo of this same area shows the Teflon wrap had slipped down, no longer protecting the wiring. Credit: Gary Johnson.
That evening, Webb went to talk directly to President Johnson, asking if NASA could handle the accident investigation on its own and choose the members of the investigation board. Seamans was tasked with assembling the board. The next day, Seamans appointed an eight-member internal NASA investigation team, chaired by the director of the Langley Research Center, Floyd Thompson; other members included Frank Borman and Max Faget. Their job was to find out all the details of the fire: What went wrong? How did it happen and why? In the years and months of preparation, what did they miss? They needed to find out everything so this never happened again.
The same area as the previous photo, but shows the Block II spacecraft changes made for protection of the interior of the spacecraft, including hard removable floor for ground personnel when working inside; an arrow on the left shows the hard metal covers that are installed over the wire harness. After the Apollo 1 fire, a program directive established what was called Management Walk-through Inspection required on every Apollo spacecraft prior to being shipped to the launch site. Gary Johnson was responsible for all of the wiring inspections. Credit: Gary Johnson.
WHEN GARY JOHNSON REVIEWED HIS DATA, he saw a short on the CM’s two electrical distribution systems, the Main DC Bus A and B, right before the crew reported the fire. As soon as the details started to emerge of what took place at the Cape, Gary Johnson suddenly remembered a fire that took place nine months prior.
In early May 1966, Johnson received an assignment to investigate an accident out at AiResearch in Torrance, California. AiResearch supplied the environmental control systems in the Apollo spacecraft, and during a test in their vacuum chamber facilities, which simulated the interior oxygen environment of the Apollo CM, a fire broke out. All the equipment was severely damaged, but no one was injured. Johnson’s independent investigation quickly determined the likely cause of the fire as an electrical heat tape a technician added to the system to simulate a steam duct heater.
“The heat tape was wrapped around a metal duct that had thermal insulation around it,” Johnson said, “and the technician told me he had gone down to Sears and bought a heat tape—the kind you wrap around your outdoor pipes in winter to keep them from freezing. The last thing the guy remembers is turning up the voltage on it, and boom, the fire broke out.”
Johnson wrote up his report, expressing concern about the fact that the technician had added the heat tape without proper engineering verification. But then, what worried Johnson the most was being told to alter his report.
“I was told not to put in my report that the technician had installed a commercial heat tape,” Johnson said, “and not only that, I was told not to talk about this accident. You never saw this in the papers, as the press out there in California was suppressed about it. No one wanted this to get out.”
Johnson never saw the official final report on this investigation; it was considered classified and wasn’t distributed even to those who participated in the inquiry. As a young engineer at the Manned Spacecraft Center (MSC), Johnson didn’t feel it was his place to raise any issues about it—but now, after the CM fire, he was quickly coming to understand that information about mishaps needed to be shared and discussed so that NASA could learn from mistakes and possibly prevent future accidents. He knew now the fire at AiResearch should have been a wake-up call.
The next week, Johnson was assigned a new investigative task: to go down to the Cape and crawl through the charred CM to identify what wire short caused the fire. Along with a photographer, Johnson meticulously examined and documented all the wiring in the CM to try to identify the ignition source.
He found a significant part of the left-hand lower equipment bay was completely gone: plumbing, wiring and metal—aluminum and stainless steel—that melted in the 1,000°F (538°C) inferno. This was where the fire started and was the hottest.
While nothing in that area remained as specific evidence, there was another option. It was standard procedure for the ground technicians to take “closeout photos” of the interior of the CM before a crew entered, with close-up shots of the switches and wiring. Once he got his hands on the photo of the now destroyed lower left-hand bay, Johnson found a Teflon-insulated set of twisted wires that were powered by the Main Bus A and B. The wire harness had been routed over metal plumbing and under a coolant control access panel, just below the left crew couch, Grissom’s seat. It was near the glycol-water cooling line of the environmental system, which had been prone to leaks. An extra Teflon overwrap for protection had been added to the set of wires, but the Teflon wrap had slipped down and was not protecting the wire from external damage. The wire harness had no extra protection from the panel door being opened or closed by the ground test personnel and it looked as though the wires were touching the bottom of the panel door. The wire harness was exposed to the cabin, open to the crew at the time of the test. With all the evidence, Johnson determined the most probable initiator of the fire was an electrical arc occurring from this set of wires.
Johnson’s report was part of an exhaustive three-month investigation. At the height of the review, five thousand experts and people from NASA and North American worked to study every aspect of what happened, offer their testimony and suggest fixes. Engineers and managers relooked at every design and procedure. While technicians took apart the destroyed ship looking for evidence, engineers at MSC duplicated conditions of Spacecraft 012 inside another capsule and ran test after test, always reaching the same fiery conclusion.
Seated at the witness table before the Senate Committee on Aeronautical and Space Services, chaired by Senator Clinton P. Anderson, on the Apollo 1 (Apollo 204) accident are (left to right): Dr. Robert C. Seamans, NASA Deputy Administrator; James E. Webb, NASA Administrator; Dr. George E. Mueller, Associate Administrator for Manned Space Flight, and Maj. Gen. Samuel C. Phillips, Apollo Program Director. Astronauts Virgil “Gus” Grissom, Edward White and Roger Chaffee died tragically inside the Apollo 1 Command Module during a preflight test. The astronauts were unable to exit the spacecraft when a fire, most likely caused by faulty wiring and exacerbated by an oxygen leak, broke out in the Command Module. Credit: NASA.
The evidence stared back at everyone: Exposed wiring and NASA’s standard use of pure oxygen in a highly pressurized capsule now seemed incomprehensible. Flammable materials were everywhere inside the spacecraft—Velcro fasteners, nylon nets, nylon spacesuits, paper checklists. And the hatch—the tragic irony of NASA insisting on an inward-opening, hard-to-open spacecraft door after Grissom’s Mercury hatch blew unexpectedly after splashdown. In the best of conditions, the Apollo hatch took at least ninety seconds to open. The first Apollo crew didn’t have that much time.
Along with the technical investigation came congressional hearings. Senators grilled NASA and North American officials, accusing them of compromis
ing safety in order to meet an unrealistic schedule in their race to the Moon. Some congressmen said NASA had knowingly put the astronauts at risk, and the failure to document and deal with known problems was an “unquestionably serious dereliction.”
And seemingly, no one at either organization could explain why engineers, rocket scientists and technical experts had been blind to the fact that Spacecraft 012 sat as a vulnerable flash point on the launchpad.
“We did not think,” said Frank Borman as he testified at the hearing, “and this is a failing on my part and on everyone associated with us; we did not recognize the fact that we had the three essentials, an ignition source, extensive fuel and, of course, we knew we had oxygen.”
He later summarized the fire as: “We screwed up and lost three lives.”
NASA didn’t want to release any conclusions of the board’s findings until the investigation was complete, but the press and the public clamored for details, wanting to know who was responsible. Newspapers published accusations of NASA coverups and conspiracies; NASA and North American officials accused the press of innuendo and making things up.
But there was plenty of blame to go around. When the board released their three-thousand-page report, it listed deficiencies in design, engineering, manufacturing and quality control; complacency and overconfidence because of past success and materials and procedures that fueled the fire. The report concluded that “in its devotion to the many difficult problems associated with space travel, the Apollo team failed to give adequate attention to certain mundane but equally vital questions of crew safety.”
Just one flaw in the hardware or procedures could have meant failure, but in combination they became deadly.
WHILE THE INVESTIGATION OF THE FIRE was ongoing, there was another lesser-known investigation that had been dogging NASA engineers and scientists for several months. It, too, could threaten to derail the entire Apollo program if it wasn’t resolved. Across the country, propellant tanks manufactured for the Apollo spacecraft started blowing up.
The tanks, technically referred to as pressure vessels, held gases or liquids under high pressure for the propulsion and life-support systems on the CSM and Lunar Module (LM). In total, every Apollo spacecraft contained seventy-one pressure vessels: fifty-five of these tanks were made from a titanium alloy.
“If you look at a schematic for the Apollo spacecraft, you can see it almost is a large collection of pressure vessels surrounding a few systems and the crew compartments,” said Glenn Ecord, a metallurgist and materials engineer at MSC. “The blowup of a pressure vessel is a serious thing. Lots of energy is released, and it could be catastrophic if this happened during spaceflight.”
Bell Aircraft in New York manufactured the small titanium pressure vessels for the CSM and LM Reaction Control Systems (RCS). Grumman was conducting a thirty-day hold test on two of their tanks at Bell, where the propellant was placed in a tank and held for a period of time at operating pressure to qualify the tanks against any defects. Eight days into the test, one of the vessels exploded. A couple of days later, the second one blew. Grumman instituted another hold test using ten tanks. After just thirty-four hours, one tank blew. Three more exploded within the next nine hours.
Everyone knew this was a very serious problem, but there was also a mystery. North American had the same tanks made by Bell and were conducting their own hold test with the same propellant. However, their tanks weren’t exploding.
“Nobody could immediately figure this out,” Ecord said, “but it was pretty clear it was stress-corrosion cracking, which is where small cracks start to form and then spread in stressed metals that are in a corrosive environment. But we didn’t know the cause since this had never happened with similar tanks and the nitrogen tetroxide (N2O4) propellant used for Mercury and Gemini.”
The seriousness of having unusable propellent tanks for Apollo prompted a large, extensive investigation involving metallurgists from several different NASA centers, North American, Grumman, Bell and Boeing. But while this investigation was progressing, a different type of tank exploded, this time at North American.
A leak had developed in one of the Service Module’s (SM’s) main propulsion tanks during a test called a cold-flow test. This kind of test used a type of methanol as a substitute for the highly toxic and volatile Aerozine-50 fuel that would be used in space. This made the test less hazardous while on the ground. To investigate the cause of the leak, a second tank along with one of the SMs was put under a cold-flow test inside a special pressurized test pit at the Downey facility. Rich Manley was monitoring the test. Twenty-two days into a thirty day test, suddenly all the telemetry disappeared from his console in the blockhouse control room near the pit.
After the pressure of the pit had stabilized, Manley and the other technicians entered the 40-foot (12-m) deep facility to find pieces of titanium from the tank scattered about, as well as a completely destroyed SM. “I found a piece of metal about 3 by 4 inches (8 by 10 cm) had guillotined the main power cable,” Manley said, “so that explained the loss of telemetry. The ground support equipment was still there, but the tank and Service Module were shrapnel.”
Engineers and metallurgists from North American immediately began an investigation, and parallel tests were set up in Houston to verify the results. Some wondered if the explosions of the SM main engine tanks and LM RCS tanks were related since they both appeared to be stress-corrosion failures. But after months of more tests and scientific detective work, engineers found two separate causes.
Schematic of Apollo service module propulsion and other tanks. Credit: NASA.
“For the Lunar Module tanks,” Ecord said, “it was discovered the N2O4 propellant used by Grumman was slightly different than what North American was using. It was the same propellant, and both met the same specifications, but they were manufactured by different companies, each using different manufacturing techniques.”
The propellant in the Bell tests was purer, which meant it had a slightly lower concentration of nitrous oxide. But that extremely small deficiency made the fuel aggressively corrosive to titanium.
“It was like the corrosive version of the propellant just progressively pushed the grains of the titanium apart until an explosion occurred,” Ecord said. “But just the right amount of nitrous oxide stopped the corrosive nature. So the requirements of how the propellant was manufactured had to be modified to ensure it was compatible with the tanks.”
Pressure vessels used for the Apollo thrusters. Credit: NASA.
For the SM tank failure, engineers determined the methanol used for the cold-flow tests was highly corrosive to the type of titanium alloy used to weld the two halves of the tank together. This meant that all the existing tanks that had undergone a cold-flow test had to be removed from the Apollo program inventory in case they had been damaged during testing. It was later determined that all of the cold flow–tested tanks had been damaged as suspected. While the fixes in both instances were relatively easy to enact, they represented lost time and additional cost. Plus, the months of investigation and testing provided headaches and sleepless nights for everyone involved.
Historically, these types of explosions had never been encountered. So why were these tank failures happening in Apollo while Mercury and Gemini never experienced such catastrophes?
It turns out there was an underlying cause after all. Early in the Apollo program, managers at NASA and North American quickly realized weight was going to be a persistent problem: The heavier something is, the more propellant it takes to launch on a larger rocket. Since Apollo entailed bigger spacecraft to carry more people and equipment, weight was a constant battle fought between designers and rocket engineers. But at some point, a rather radical decision was made: lower the safety factor of the tanks. This meant more propellant could be put in a smaller tank, saving weight. NASA went from the industry standard of a 2.0 safety factor to their own factor of 1.5.
The safety factor describes the ratio of the point at w
hich a tank will fail (i.e., explode) versus the accepted operating pressure. At a standard 2-to-1 factor, if a tank is specified to burst at 10,000 pounds per square inch of pressure, it can be operated at 5,000 pounds per square inch or lower. Changing the safety factor to 1.5 meant the same tank could be used at 7,500 pounds per square inch. In practice, this meant every Apollo launch with a CSM and an LM could save approximately 500 pounds. But what it meant in principle is that NASA took risks by lowering the safety factor—risks that resulted in unexpected technical problems.
“The original 2.0 safety factor came from worlds of experience,” said Ecord, “from the military and the early space missions. But now for Apollo, these tanks have much higher stresses during use. With higher stresses, things can happen that have never happened before. A liquid that may have been compatible before, now isn’t. A small nick or flaw in the tank or a change in the type of weld can lead to a failure.”
The tank failure problem was something that NASA now had to account for, and it ended up having repercussions throughout the entire Apollo program. Making sure the tanks and propellant were compatible became such a headache that Rocco Petrone, the director of launch operations at the Kennedy Space Center, once said that if he ever found out who made the decision to lower the safety factor, he would strangle them.
Similar to the initial decisions that led to the Apollo 1 fire on January 27, lowering the safety factor was another early decision that had consequences. But in this case, NASA ended up being lucky.
“If the first tank had failed during an Apollo flight, we might have not ever gotten any good data to try to figure out what blew up,” said Henry Pohl, who had been entrenched in the investigation at MSC.
Eight Years to the Moon Page 22