50 years on, reminders of Apollo 1 beckon a safer future
Fifty years ago Friday, the first – but sadly not the last – fatal spaceflight accident struck NASA when a fire claimed the lives of Virgil “Gus” Grissom, Roger Chaffee, and Ed White during a training exercise at Launch Complex 34. The accident, a major setback for the struggling Apollo program, ushered in the first understanding of the “bad day” effects of schedule pressure for spaceflight and brought with it words and reminders that still echo today.
It was 25 May 1961. Twenty days earlier, the United States had just successfully sent its first astronaut into space on only a sub-orbital flight.
The first orbital U.S. manned flight was still nine months away.
But on this day, President John F. Kennedy stood before a joint session of Congress and committed the nation and NASA to “landing a man on the moon and returning him safely to Earth” before the end of the decade.
The schedule was set.
Project Mercury successfully proved to NASA that men could survive in space on multi-orbit missions.
Project Gemini – among other things – proved that more than one person could fly in a single spaceship, that multi-day flights were viable, that rendezvous and docking operations were possible, and that EVAs were feasible.
The final Project Gemini flight successfully splashed down on 15 November 1966. Now, all eyes were on Apollo and the first crewed mission.
Apollo 204 – as Apollo 1 was officially designated at the time – was to be the first manned flight of the Apollo program, testing the Apollo Command and Service Module (CSM) during a Low Earth Orbit flight.
The primary objectives of the planned up-to two week mission were to test the launch capabilities of the Saturn IB rocket, measure and verify the overall launch performance of the integrated Apollo/Saturn launch stack, monitor ground station tracking performance, and verify control facilities operations.
Originally, Apollo 204 was slated to launch in 1966, and NASA had considered – for a time – making the final Gemini flight a joint space rendezvous mission with Apollo 204.
However, the amount of worked needed to make the Gemini capsule and its systems compatible with the Apollo CSM Block I design – as well as the added work that would have been required to make the Block I Apollo CSM capable of performing docking operations – made this idea impractical.
The Block I Apollo CSM was designed before the Apollo program made the decision to pursue a lunar orbit rendezvous landing strategy and therefore lacked the ability to perform docking operations.
Regardless, developmental delays with Apollo 204’s CSM subsequently pushed the target launch date beyond that of the Gemini Program.
Crew selection and naming of the mission:
Prior to those delays, the prime crew for Apollo 204 was selected internally in January 1966, with Deke Slayton, Director of Flight Crew Operations, choosing Virgil I. “Gus” Grissom as Command Pilot, Edward H. White II as Senior Pilot, and Donn F. Eisele as Pilot.
Eisele then dislocated his shoulder twice in the weightless training aircraft, and Slayton replaced him with Roger B. Chaffee.
The prime crew was announced to the public on 21 March 1966, along with the original backup crew: James McDivitt, David Scott, and Russell Schweickart.
Of the prime crew, Grissom was the most experienced, with two spaceflights to his name. White had one spaceflight under his belt, and Chaffee was a rookie.
After their selection, Grissom, White, and Chaffee began referring to the mission as Apollo 1, though NASA did not recognize that name officially at first.
In June 1966, NASA officially gave the crew permission to use the name Apollo 1 on their mission patch – though internal documentation continued, even after the accident, to refer to the flight as Apollo 204.
The first public reference to “Apollo 1” subsequently appeared in a newspaper on 4 August 1966; and when the CM (Command Module) – CM-012 – for the mission arrived at the Kennedy Space Center, FL, on 26 August 1966, its packaging bore the label – printed by the manufacturer, not NASA – “Apollo One”.
“Something about it just doesn’t ring right”:
One week prior to CM-012’s arrival at KSC, the crew and Apollo Spacecraft Program Office manager, Joseph F. Shea, participated in a meeting at which the crew expressed their concerns about the amount of flammable material in the CM.
Shea ultimately passed CM-012, over the crew’s specific concerns, through inspection. In response, the crew sent him a photo of themselves in prayer over the CM, inscribed with the words: “It isn’t that we don’t trust you, Joe, but this time we’ve decided to go over your head.”
Shea subsequently ordered the manufacturer to remove all flammables from the CM, and CM-012 was moved to Kennedy with a “conditional Certificate of Flight Worthiness” – with 113 “significant, incomplete, planned engineering changes” needing to be addressed at KSC.
Subsequent to delivery, a further 623 engineering changes were ordered to CM-012 – significantly compromising simulator engineers’ ability to provide an accurate representation of the craft to the crew during training.
Nonetheless, the CM and SM were mated together in September, and the CSM underwent a series of altitude chamber tests, first unmanned, and then with both the prime and first (then second) backup crews between September and December 1966.
But technical issues with the CSM persisted.
An Environmental Control Unit in the CM had to be sent back to its manufacturer twice for design changes and operational leaks.
Moreover, the mated CSM had to be de-mated for inspection of the SM’s propellant tank after a tank on another SM ruptured during testing at its manufacturer.
In the latter part of 1966, Apollo 204’s backup crew was changed to Walter M. Schirra, Donn F. Eisele, and R. Walter Cunningham.
Upon completion of the final altitude chamber test with the new backup crew, conflicting accounts exist of Schirra’s satisfaction with the CSM.
The official report of the Apollo 204 accident notes that Schirra was happy with the craft, while an account of the Apollo 13 incident presents a different tale, with Schirra warning Grissom that the craft made him uncomfortable and that “something about it just doesn’t ring right.”
This second account also purports that Schirra told Grissom to evacuate the craft at the first sign of trouble.
Nonetheless, Grissom, in an interview that same month, stated that “There’s always a possibility that you can have a catastrophic failure, of course; this can happen on any flight; it can happen on the last one as well as the first one. So you just plan as best you can to take care of all these eventualities, and you get a well-trained crew and you go fly.”
27 January 1967:
With altitude chamber testing complete, the CSM was mated to the top of its Saturn IB launch vehicle at LC-34 on 6 January 1967.
The first major on-pad test occurred on 27 January 1967.
The test was a “plugs out” launch simulation to confirm that the CSM could function properly on simulated internal power when completely disconnected from cables and umbilicals.
At this point, launch was set for 21 February, and the 27 January test was deemed “essential” to making that launch date.
Crucially, the test was considered “non-hazardous” as no propellant would be loaded into the CSM or Saturn IB’s tanks and all pyrotechnics would be disabled.
As the test commenced, Grissom boarded the CSM first, at 13:00 EST, followed by Chaffee and then White.
As this was a simulated countdown and launch, the crew wore their flight pressure suits and were connected to the spacecraft’s oxygen and communication systems.
Once connected, Grissom reported a “sour buttermilk” odor in the air in his suit.
The test was halted at 13:20 EST to examine the cause of the odor. None was ever identified.
The simulation resumed at 14:42 EST.
At 14:45 EST, hatch installation commenced.
The Block I CSM hatch had three parts: a removable inner hatch inside the cabin, a hinged outer hatch that was part of the CM’s heat shield, and an outer hatch cover that was part of the boost protective cover around the entire CM to protect against aerodynamic heating during launch and launch escape tower rocket exhaust.
Crucially, the inner hatch, which opened inward, could only be opened when atmospheric pressure inside and outside the CM were equalized.
For the plugs out test, both the inner and outer hatches were completely installed, but the outer boost protective cover was not fully installed because of cables needed to simulate internal power for the CM.
Once hatch installation was complete, the CM was pressurized with pure oxygen to 16.7 psi (115 kPa), 2 psi (14 kPa) higher than the outside atmospheric pressure.
After pressurization, a communications issue developed with Grissom’s microphone – which could not be turned off. Additional communications issues led to poor connectivity between the crew, the Operations and Checkout Building, and the Complex 34 blockhouse control room.
The countdown held again at 17:40 EST while attempts to troubleshoot the comm issue occurred.
By 18:20 EST, all steps up to the switch to simulated internal power had been completed by the crew and ground teams.
At 18:30 EST, the countdown remained in a hold at the T-10min mark.
At 18:30:55 EST, a momentary increase in AC Bus 2 voltage occurred.
The first indications of a fire occurred 9.7 seconds later at 18:31:04.7 EST via Grissom’s stuck open mic.
The open mic provided audio of the crew as the fire quickly spread, and a TV camera inside the CM broadcast closed-circuit video of the fire and of Ed White’s attempts to open the inner hatch – which was not possible because the CM was pressurized.
The fire, fed by the pure oxygen environment, caused a rapid increase in pressure inside the cabin from 16.7 psi (115 kPa) to 29 psi (200 kPa) by 18:31:19 – 14.3 seconds after the first indication of the fire.
The sudden pressure increase fractured the CM’s inner wall, causing flames and gas to escape from the CM and into two levels of Pad 34’s service structure.
The CM’s inner wall rupture caused the fire to rapidly spread across the cabin – before the fire quelched itself when atmospheric air rushed into the CM through the ruptured hull, causing high concentrations of carbon monoxide.
The dense smoke, heat, and ineffective gas masks – which were designed for toxic spills, not smoke – prohibited the pad crew’s ability to start rescue operations, as did a fear that the CM had exploded or soon would, and that the heat could ignite the solid fuel in the escape tower.
Understanding and recovery:
In the immediate aftermath of the fire, NASA Deputy Director, Robert Seamans, directed the establishment of the “Apollo 204 Review Board” to officially investigate the accident and ordered that all Apollo 204 hardware and software be impounded and turned over to the Board.
The Board was chaired by Langley Research Center Director, Floyd Thompson, and the official investigation took just over two months – with a final report issued on 5 April 1967.
In all, the Board noted five contributing, major causes for the accident: “An ignition source most probably related to ‘vulnerable wiring carrying spacecraft power’ and ‘vulnerable plumbing carrying a combustible and corrosive coolant’; a pure oxygen atmosphere at higher than atmospheric pressure; a cabin sealed with a hatch that could not be quickly removed at high pressure; an extensive distribution of combustible materials in the cabin; and inadequate emergency preparedness.”
Specific to the ignition source of the fire, the Board was not able to find a single source for the fire, but did specifically note the momentary electrical power failure at 18:30:55 EST – corresponding to the increase in AC Bus 2 voltage.
Inspection of CM-012 also found evidence of “several electrical arcs” in the CM’s equipment.
The Board concluded, from evidence in the CM, that the fire likely started near the lower, left section of the CM near the Environmental Control Unit (ECU) that had been returned to its manufacturer twice.
The ECU was found to have a silver-plated copper wire that was stripped of its Teflon insulation and was highly abraded – likely due to the opening and closing of a small access hatch.
The stripped wire was located near an ethylene glycol/water cooling line that had leaked earlier.
While not known at the time of the Board’s official report, it was later discovered – on 29 May 1967 – that electrolysis of ethylene glycol with a silver anode can cause a violent exothermic reaction that can ignite ethylene glycol in a pure oxygen atmosphere.
Following this discovery, all silver and silver-coated electrical contacts were removed from all future Apollo spacecraft.
The Board also noted numerous types and amounts of “combustible material” in the cabin – including 3.2 square meters (34 square feet) of velcro – which the crew had specifically raised concerns about.
The velcro had been removed from the cabin per the crew’s concern and Shea’s order on 19 August 1966, but was put back in by the manufacturer just days later before CM-012 shipped to KSC.
Moreover, the design of the hatch system was also called into question.
The CM’s manufacturer had originally suggested an outward opening inner hatch with explosive bolts that could be triggered in an emergency – as had been used on Project Mercury capsules.
NASA rejected this design for the Block I Apollo CM because of the inadvertent detonation of the hatch on – coincidentally – Grissom’s Mercury flight.
However, the outward opening inner hatch was already planned for and incorporated into the Apollo CM Block II design at the time of the Apollo 204 fire.
Furthermore, emergency procedures for Apollo 204 called for Grissom to open a manual vent valve to lower the CM’s pressure to ambient conditions, after which White could physically open the inner hatch.
The Board found that this was not possible in the Apollo 204 fire as the fire almost immediately blocked the vent valve from Grissom’s reach and, even if Grissom had been able to reach it, the valve and systems were completely incapable of handling the sudden increase in pressure to 29 psi (200 kPa) caused by the fire.
As with the hatch, the Apollo CM manufacturer had originally suggested using an oxygen/nitrogen atmosphere in the cabin instead of pure oxygen.
NASA rejected this because of a 21 April 1960 accident during testing for Project Mercury when a test pilot was severely injured following a nitrogen air leak that created a nitrogen-rich, oxygen-poor atmosphere.
Unknown to NASA in the time leading up to the Apollo 204 fire, the Soviet space program had suffered two serious pure-oxygen accidents/incidents in 1961/1965 – the first of which wasn’t revealed by the Soviet Union until 28 January 1986, coincidentally the same day as the Shuttle Challenger disaster.
Moreover, at the time of the Apollo 204 fire, NASA had no knowledge of how a pure oxygen environment could influence a fire and had not conducted a fire test on the Apollo CM, giving them no information on how the spacecraft would be affected by a fire.
Furthermore, the Board also found that NASA’s classification of the plugs out test as “non-hazardous” resulted in poor rescue training, emergency procedures understanding, and a lack of appropriate medical personnel on site.
As a result of the Board’s findings, no astronauts ever flew on the Apollo Block I CM.
The Apollo Block II CM – already incorporating an outward opening hatch – subsequently included an oxygen/nitrogen launch atmosphere (replaced with pure oxygen once in space), self-extinguishing materials, and plumbing and wiring covered with protective insulation.
Moreover, crew flight suits were redesigned from nylon to Beta cloth, a non-flammable, highly melt-resistant fabric.
Additionally, per a request from Grissom’s, White’s, and Chaffee’s widows, NASA officially recognized Apollo 204 as Apollo 1 on 24 April 1967 and retroactively marked the mission as Apollo 1, “first manned Apollo Saturn flight – failed on ground test.”
Out of respect, NASA agreed not to reuse the Apollo 1 moniker and instituted a new numbering scheme for Apollo.
With Apollo 1 reserved for Grissom, White, and Chaffee’s mission, NASA took the previous three Apollo flights – 201, 202, and 203 – and eliminated 203 (as it didn’t carry an Apollo spacecraft), leaving 201 and 202 as “Apollo flights” – for a total of three Apollo missions.
Thus, the next flight of the program, the first flight of the Saturn V, became Apollo 4 – with Apollo 2 and Apollo 3 going unused.
Moreover, with all of these changes came new practices and manufacturing standards for Apollo and NASA.
But the culture change began far earlier.
On 30 January, just three days after the fire, Gene Kranz held a meeting with his staff in Mission Control. Addressing his team, he said, “From this day forward, Flight Control will be known by two words: Tough and Competent.
“Tough means we are forever accountable for what we do or what we fail to do. We will never again compromise our responsibilities.
“Competent means we will never take anything for granted.
“Mission Control will be perfect. When you leave this meeting today, you will go to your office and the first thing you will do there is to write “Tough” and “Competent” on your blackboards. It will never be erased.
“Each day when you enter the room, these words will remind you of the price paid by Grissom, White, and Chaffee. These words are the price of admission to the ranks of Mission Control.”
With this message, Kranz guided his team through numerous test flights, shakedowns of the lunar equipment, and successfully – and as safely as possible – landed the first two men on the moon on 20 July 1969, fulfilling President Kennedy’s goal.
Resonance with today:
Launches are exciting. For many, they are the main event in spaceflight – the most visible aspect to missions that are otherwise unnoticed.
But a desire to launch – as Apollo 1 showed – should never be driven by schedule pressure from a company/agency or from the general public.
Nor should such a desire suppress a need to speak toward things that don’t seem, look, or feel right.
As SpaceX now prepares to return east coast launch capabilities via historic LC-39A at the Kennedy Space Center, it’s easy to clamor for a launch – to be excited for it – and become verbal as the launch slips due to pad readiness.
But a desire to launch should never override a calm, measured return to launch capability – whether that launch is a crewed or uncrewed mission.
For as much as NASA learned the lesson of what can happen when schedule pressures override safety with Apollo 1, they learned that lesson again 19 years and one day later when schedule and mounting delays overcame judgement and the advice of engineers – for which the Challenger seven paid.
So too was this lesson painfully re-learned again 17 years and four days after Challenger, when an unspoken but building schedule desire to launch Node-2 Harmony to the ISS led – perhaps subconsciously – to a “dispensation” of the External Tank foam debris problem, to which the crew of Columbia was lost.