Failure Is Not an Option

by Gene Kranz

  The landing target is in the center of a ten-mile-long and three-mile-wide oval area (the “footprint”). To hit the landing point the LM descent engine must be started at a precise velocity 260 miles before the target. The pressure in the tunnel at separation changed the planned velocity at the ignition point.

  “Flight, [this is] Guidance. We’re out in the radial component of velocity. I’m halfway to my abort limit. I’ll watch it, and if it doesn’t grow, I think we’ll make it.” Bales’s concern is that the navigation system may be in error and that it will affect the trajectory during landing or if we abort late in the descent. I am also becoming concerned over the trajectory because Steve’s words confirm FIDO’s call that the altitude is a bit low.

  Like a bolt of lightning, the data is suddenly restored. The controllers make a quick assessment, and all systems are Go. Radar data continues to be “ratty” and is frequently lost. We have just enough to provide the needed data comparisons between the ground indications and those on the Eagle. Bales continues his assessment. The downrange error is not increasing, so he determines that the navigation is good. With data steady for the moment, we verify proper thrust levels. Aldrin calls from the Eagle: “I’m seeing some fluctuation in the AC voltages.” We quickly confirm that the electrical system is looking good on the ground, and Aldrin concludes that the hitch is in the meter on board.

  Everything is Go, and for the moment, the energy level of the room has settled down. We are running by the clock and are a quarter of the way to the surface. Bales again reports the downrange error is not increasing, and again states that he thinks we will make it through his mission rule gate. I have the fleeting impression that if it is close, he will bias his call on the Go side. After a visual position check against lunar landmarks, the crew indicates they also think they are a little long. I add up the pieces. Three data sources now say we are not going to hit the planned landing point. We are going to be long. I dig into my memory for the description of the landing site near the toe of the footprint. I know it is rough, full of craters and boulders. I hope Armstrong can find a landing site.

  I relax prematurely, and once again the data gets ratty. I tell the controllers to make their Go NoGo decision based on the last data they think is valid. I trust enough in their judgment and the spacecraft to keep descending without data for a while. I go rapidly around the horn, and all controllers are Go, especially Bales. His “Go!” resounds clearly through the room like a cymbal. He does not need a voice loop today. I chuckle as I continue polling the controllers.

  Duke advises the Eagle that they are Go to continue powered descent.Communications are noisy but usable, making it tough for me to pull the voices out of the background noise. It is the kind of workload that SimSup routinely put us through, and his training is paying off with my team today. Tindall must have been holding his breath, for he exhales noisily, and he knocks a book to the floor as he stirs in his chair.

  Data returns just as the LM radar locks on to the lunar surface. Bales reports, “Radar, Flight,” and his voice briefly quivers, betraying his true feelings. Steve has passed another of his Go NoGo milestones. Then, Aldrin reports, “Program alarm. It’s a 1202.”

  Controllers are still studying radar quality prior to incorporating the data into the computers and do not immediately pick up the alarm call. Seconds later, activity at the guidance console comes to an abrupt halt as the implications of the alarm sink in. Bales calls, “Stand by, Flight,” when his backroom support, Jack Garman, brings the alarm to his attention. Duke repeats, “It’s a 1202 alarm,” in a questioning voice. “It’s a 1202 alarm” echoes across the loops for several seconds.

  Aldrin requests a reading. It is like coming to a fork in the road where you’re uncertain which direction to take. Many of the controllers are oblivious to the alarm and are continuing the decision processes related to accepting the descent radar. Bales, Duke, and I start work to resolve the program alarm. I don’t think anyone outside the flight control team understands the real significance of the alarm, in the midst of the rapid-fire exchange of communications. Duke muses aloud on the flight director loop, “It’s the same one we had in training.” He audibly expresses our collective feeling, almost wonderment. These were the same exact alarms that brought us to the wrong conclusion, an abort command, in the final training run when SimSup won the last round. This time we won’t be stampeded.

  The significance of this is not lost on any of us. The alarm tells us that the computer is behind in its work. If the alarms continue, the guidance, navigation, and crew display updates will become unreliable. If the alarms are sustained, the computer could grind to a halt, possibly aborting the mission. Each alarm must be accounted for. They have the capacity to create doubt and distraction, two of a pilot’s deadliest enemies.

  Prompted by Gibson in the back room, Bales says, “We’re Go on that alarm. If it doesn’t recur, we are Go.” Then, in the blink of an eye, he swerves back to the nominal mission and says, “He’s [Aldrin] taking in the radar data.” We pass the throttle-down times, continue the routine assessments, and a backroom controller inadvertently comes on the loop, saying, “This is just like a simulation.” I smile and agree. There is nothing like working out a problem to relieve the tension on a team. Controllers always work best under pressure, and they are doing well during today’s final exam.

  The radar data smoothly corrects the altitude difference in the computer, and as we watch, we see another program alarm. Aldrin calls, “Same alarm, and it appears to come when we have a 1668 up.” (1668 is the LM computer display of time, landing site range, and altitude.)

  Bales quickly responds, “We are Go. Tell him [Aldrin] we will monitor his altitude data. I think that is why he is getting the alarm.” This information is quickly passed to the crew. Above all, we have to prevent a rapid string of these alarms, which will cause the computer to go into an idle mode and abort the landing. With pressure mounting on the team, I get on the loop, “Okay, all flight controllers, hang tight. We should be throttling down soon.”

  Today we are gobbling up the alarms as they occur. I mentally thank SimSup for the final training run on program alarms. Throttle-down comes uneventfully. LM systems and trajectory are good, and Duke advises the crew they are looking great. As the crew continue to pitch over to the vertical for the start of the landing phase, they select the steerable antenna to assure continued communications.

  We seem to gain strength as the problems mount. Again, I repeat, “Okay, everybody, hang tight . . . seven and one half minutes.” I run out of breath with that statement. Bales comes on the loop. “The landing radar has fixed everything, the LM velocity is beautiful.” Carlton, the LM CONTROL, has been watching the fuel gauging system, and he selects the fuel quantity measuring probe that will be used for giving the crew and control team voice call-outs on “seconds of fuel remaining.” The voice loop calls are now back to the expected traffic levels, and eight minutes after checking with Bales that the landing radar has updated the computers, I start to close out my final mission rules for landing. We have met all of the mission rule requirements. It is time to make the final landing Go NoGo decision.

  After the LM pitches toward the landing attitude the computer automatically completes the braking phase and switches to the final approach program. I know we are long, and the crew is now able to verify that the automatic system approach will take them into a large crater. My console telemetry display indicates the LM is about 7,000 feet above the surface, with a descent rate of 125 feet per second. Armstrong now selects a new landing point in the computer to overfly the crater, and Carlton reports that Armstrong has checked out the manual attitude control.

  I start around the loop for the landing Go NoGo. I have met all of my rule criteria, and I am sure that controllers have, too. We are about to hand over the control for the final phase to Armstrong and Aldrin. Soon, we will be spectators just like the rest of the world. The controllers respond crisply and again Bales gives a “G
o!” that rings through the room. I continue with my final polling. All controllers are “Go!”

  With deliberate emphasis, I say, “CapCom, we are Go for landing.” The voice exchanges become furious as Duke gives the Go to the crew, now busy trying to find a landing site. There is a brief pause, then Aldrin responds, “Roger, understand. Go for landing,” and then continues, “3,000 feet . . . program alarm . . . 1201.” Duke acknowledges, “1201,” and it echoes through the intercom loops with Bales advising, “Go . . . same type . . . we’re Go.” As it gets tougher, the team gets tighter. I am about to bust a gut with pride for my people.

  The intensity increases and all calls become even swifter. They are emotional, but crisp and shorn of excess verbiage. Controllers now report what they are seeing, and Duke starts to choose data from the controllers to send up to the crew. As the LM passes through 2,000 feet, Duke picks up another alarm, this time a 1202, and he advises the crew we copy. Throughout the descent so far we have not seen any discernible effect of the alarms on LM computer performance.

  Aldrin does not bother to respond. The control team has gone to a negative reporting mode as seconds become even more precious. Normal reporting stops and controllers report only NoGo conditions, with the exception of Carlton’s fuel-remaining calls. The room is silent, expectant, listening intently to the crew calls: “700 feet, down [descending] at twenty-one . . . 540 feet, down at fifteen.” During the descent, Buzz Aldrin, the LM pilot, selected landing data from the computer display and called out the critical data to Neil Armstrong, who was piloting the LM. The reports normally consisted of altitude, rate of descent, and forward velocity, although in many cases only the single most critical element was reported.

  Carlton calls out in hushed tones, “Attitude hold.” I acknowledge, “ATT hold,” then silence. The crew is searching for a landing site. Duke, in even more hushed tones, states, “I think we better be quiet from here on, Flight!” I respond, “Rog, the only call-outs from now on will be fuel.” My voice loops become silent, the atmosphere electric as we hang on to each of the crew’s words and wait for Carlton’s call. We are within 500 feet of the surface and continuing the descent. We watch displays that the crew cannot see and listen for sounds yet to be uttered. If anyone so much as clears his throat, twenty other voices shush him.

  Reflexively, I reach out and grip the handle on the TV monitor with my left hand and think, Damn close! I continue to keep up with my notations in the log. Again, I feel Tindall stir in his chair as he leans forward to look at the displays. It must be hell to be a spectator today. I have to break through the tension. I run a quick status check, “FIDO, are you happy!” “Go, Flight!” “Guidance, how about you? Are you happy?” “Go, Flight!”

  The tempo picks up, the crew call-outs of altitude and descent rate increase in frequency. You can almost feel the crew in Eagle reaching for the surface. I look at my displays. The descent rate is almost zero. They are hovering now, and I try some body English in my chair to help them find a place to land. I look at the clock and my log. It is more than eleven minutes since we started descent.

  In every training run, we would have put it down by now. It is going to be close, damn close, closer than we ever trained for. The voice loops are silent. Then someone unconsciously keys his mike, and for a few seconds you can hear him breathing, then he unkeys. It is quiet, no discussion at all, and in these last few seconds, I feel that every controller, our instructors, program management, and those in the viewing room are mentally on board the LM, feeling for the surface along with Eagle’s crew and aware fuel is almost gone.

  The crew reports, “250 feet, down at two and a half, nineteen forward.” Still near hovering, I think, but moving forward pretty rapidly. They are over a boulder field trying to find a landing spot. I write in my log, “Here we go,” and advise Carlton, “Okay, Bob, standing by for your call-outs shortly.” The crew continues, “200 feet,” then, “160 feet, five down, nine forward.”

  “Low level,” exclaims Carlton on the flight director loop. Propellant in the tanks is now below the point where we can measure it. It is like driving your car on empty. Controllers turn their mental clock on. We have 120 seconds or less to land or abort.

  Carlton’s backroom controller, Bob Nance, using a paper chart recorder, is mentally integrating throttle usage by the crew and giving Carlton his best guesstimate of the hover time remaining before the fuel runs out. During training, he got pretty good at it and could hit the empty point within plus or minus ten seconds, but I never dreamed we would still be flying this close to empty and depending on Nance’s eyeballs. I wait for Carlton’s next call.

  Armstrong is flying and Aldrin is reporting, “100, three and a half down, nine forward.” As the crew passes seventy-five feet, another call comes from Carlton, “Sixty seconds.” I marvel at his calm voice and wonder if he feels the turmoil I am starting to feel. I mentally integrate the time. At seventy-five feet of altitude with a descent rate of two and a half feet per second, we will have about thirty seconds of fuel remaining at touchdown, assuming Nance’s integration is good. It could be a lot closer!

  Duke repeats Carlton’s call on the uplink: “Sixty seconds.” There is no response from the crew. They are too busy. I get the feeling they are going to go for broke. I have had this feeling since they took over manual control. They are the right ones for the job. I cross myself and say, “Please, God.”

  Carlton’s voice again penetrates, “Stand by for thirty seconds, thirty seconds.” Duke echoes the time on the uplink. The whole mission is now down to the last thirty seconds, assuming we guessed right on fuel.

  It is quiet, damn quiet, the silence so great you could hear a feather hit the floor. All the air seems to have been suddenly sucked out of the control room as each controller gasps and then swallows a gulp of air, then holds it for Carlton’s next call.

  The crew report almost brings us to our feet: “Forty feet, picking up some dust, thirty feet, seeing a shadow.” They are going to make it! It is like watching Christopher Columbus wade ashore in the New World. Carlton calls, “Fifteen sec . . .” then stops.

  There is a lengthy pause in all crew communications, then, “Contact light . . . engine stop . . . ACA out of detent.” It takes me a second to realize the crew is going through the engine shutdown checklist, just as they did in training. It really sinks in when Carlton, in a droll, almost bored voice says, “Flight, we’ve had shutdown.” Duke responds, “We copy you down, Eagle.”

  Spectators in the viewing room and our instructors are drumming their feet on the floor, standing and cheering. We remain rooted in our chairs, but the sound seeps into the room. I experience a chill unlike any in my life. I am totally unprepared for the flood of emotion. This is the one thing that we never trained for—the instant of the actual landing. I am choked up, speechless, and I have to get going with the Stay NoStay. There is not one second to spare, and I just cannot speak.

  While the world waits, Neil Armstrong sends goose bumps around the globe with the words: “Houston, Tranquillity Base here. The Eagle has landed.”

  Frustrated at my lack of emotional control, I slam my forearm against the console. My pen flips into the air, startling Tindall and Charlesworth. In a voice that cracks, I say, “Everybody stand by for Stay NoStay. Stand by for T-1 [Time-1].”

  Charlie Duke, equally unsteady and in an emotion-filled voice, closes out this phase with a statement that expresses our feelings, “Roger, Tranquillity. We copy you on the ground. You got a bunch of guys about to turn blue. We’re breathing again. Thanks a lot.”

  In case of an emergency after the lunar landing, three LM liftoff times were selected that would permit a CSM rendezvous within the electrical power lifetime of the LM. The T1 time was two minutes after landing, T2 was eight minutes after landing, and T3 coincided with the CSM orbital pass two hours after landing.

  While the world is celebrating, each of the controllers overcomes his own emotional overload and proceeds to swiftly
assess spacecraft systems. They start the process to check for an acceptable surface attitude,then verify the primary computer configuration and LM systems status for a possible immediate liftoff. Within thirty seconds of landing, I start polling controllers to commit to a surface stay of at least eight minutes. If I receive a NoStay we must lift off in the next sixty seconds. All controllers crisply state they are “Stay for T1,” which Duke promptly relays to the crew.

  Without a break, the White Team rapidly recycles and, minutes later, gives the crew the “Stay for T2.” We then hunker down for the final Stay NoStay decision.

  Sixteen minutes after the T2 Stay, Carlton jolts me with the call, “Flight, the descent engine helium tank pressure is rising rapidly. The back room expects the burst disk to rupture. We want the crew to vent the system.”

  My team doesn’t have the opportunity to savor even a few seconds of the euphoria after the landing, as we watch the descent engine helium pressure rise, stabilize, then plummet. Carlton hovers over his telemetry display, anxiety coloring his drawl, then with a deep sigh he says, “Flight, we’re now okay. The pressure has dropped and the system is stable.” From that point on, the Stay decision is a piece of cake, Duke giving the crew the final, “Eagle, you have a Go for extended surface operations.”