Apollo 1

Apollo 1, initially designated AS-204, was intended to be the first crewed mission of the Apollo program, the American undertaking to land the first man on the Moon. It was planned to launch on February 21, 1967, as the first low Earth orbital test of the Apollo command and service module. The mission never flew; a cabin fire during a launch rehearsal test at Cape Kennedy Air Force Station Launch Complex 34 on January 27 killed all three crew members—Command Pilot Gus Grissom, Senior Pilot Ed White, and Pilot Roger B. Chaffee—and destroyed the command module (CM). The name Apollo 1, chosen by the crew, was made official by NASA in their honor after the fire.

Immediately after the fire, NASA convened an Accident Review Board to determine the cause of the fire, and both chambers of the United States Congress conducted their own committee inquiries to oversee NASA's investigation. The ignition source of the fire was determined to be electrical, and the fire spread rapidly due to combustible nylon material and the high-pressure pure oxygen cabin atmosphere. Rescue was prevented by the plug door hatch, which could not be opened against the internal pressure of the cabin. Because the rocket was unfueled, the test had not been considered hazardous, and emergency preparedness for it was poor.

During the Congressional investigation, Senator Walter Mondale publicly revealed a NASA internal document citing problems with prime Apollo contractor North American Aviation, which became known as the Phillips Report. This disclosure embarrassed NASA Administrator James E. Webb, who was unaware of the document's existence, and attracted controversy to the Apollo program. Despite congressional displeasure at NASA's lack of openness, both congressional committees ruled that the issues raised in the report had no bearing on the accident.

Crewed Apollo flights were suspended for twenty months while the command module's hazards were addressed. However, the development and uncrewed testing of the lunar module (LM) and Saturn V rocket continued. The Saturn IB launch vehicle for Apollo1, SA-204, was used for the first LM test flight, Apollo 5. The first successful crewed Apollo mission was flown by Apollo1's backup crew on Apollo 7 in October 1968.

Crew

First backup crew (April–December 1966)

Second backup crew (December 1966 – January 1967)

Apollo crewed test flight plans

AS-204 was to be the first crewed test flight of the Apollo command and service module (CSM) to Earth orbit, launched on a Saturn IB rocket. AS-204 was to test launch operations, ground tracking and control facilities and the performance of the Apollo-Saturn launch assembly and would have lasted up to two weeks, depending on how the spacecraft performed.

The CSM for this flight, number 012 built by North American Aviation (NAA), was a Block I version designed before the lunar orbit rendezvous landing strategy was chosen; therefore it lacked capability of docking with the lunar module. This was incorporated into the Block II CSM design, along with lessons learned in Block I. Block II would be test-flown with the LM when the latter was ready.

Director of Flight Crew Operations Deke Slayton selected the first Apollo crew in January 1966, with Grissom as Command Pilot, White as Senior Pilot, and rookie Donn F. Eisele as Pilot. But Eisele dislocated his shoulder twice aboard the KC135 weightlessness training aircraft, and had to undergo surgery on January 27. Slayton replaced him with Chaffee, and NASA announced the crew selection on March 21, 1966. James McDivitt, David Scott and Russell Schweickart were named as the backup crew.

On September 29, Walter Schirra, Eisele, and Walter Cunningham were named as the prime crew for a second Block I CSM flight, AS-205. NASA planned to follow this with an uncrewed test flight of the LM (AS-206), then the third crewed mission would be a dual flight designated AS-278 (or AS-207/208), in which AS-207 would launch the first crewed Block II CSM, which would then rendezvous and dock with the LM launched uncrewed on AS-208.

In March, NASA was studying the possibility of flying the first Apollo mission as a joint space rendezvous with the final Project Gemini mission, Gemini 12 in November 1966. But by May, delays in making Apollo ready for flight just by itself, and the extra time needed to incorporate compatibility with the Gemini, made that impractical. This became moot when slippage in readiness of the AS-204 spacecraft caused the last-quarter 1966 target date to be missed, and the mission was rescheduled for February 21, 1967.

Mission background

In October 1966, NASA announced the flight would carry a small television camera to broadcast live from the command module. The camera would also be used to allow flight controllers to monitor the spacecraft's instrument panel in flight. Television cameras were carried aboard all crewed Apollo missions.

Insignia

Grissom's crew received approval in June 1966 to design a mission patch with the name ''Apollo1'' (though the approval was subsequently withdrawn pending a final decision on the mission designation, which was not resolved until after the fire). The design's center depicts a command and service module flying over the southeastern United States with Florida (the launch point) prominent. The Moon is seen in the distance, symbolic of the eventual program goal. A yellow border carries the mission and astronaut names with another border set with stars and stripes, trimmed in gold. The insignia was designed by the crew, with the artwork done by North American Aviation employee Allen Stevens.

Spacecraft and crew preparation

The Apollo command and service module was much bigger and far more complex than any previous manned spacecraft. In October 1963, Joseph F. Shea was named Apollo Spacecraft Program Office (ASPO) manager, responsible for managing the design and construction of both the CSM and the LM.
In a spacecraft review meeting held with Shea on August 19, 1966 (a week before delivery), the crew expressed concern about the amount of flammable material (mainly nylon netting and Velcro) in the cabin, which both astronauts and technicians found convenient for holding tools and equipment in place. Although Shea gave the spacecraft a passing grade, after the meeting they gave him a crew portrait they had posed with heads bowed and hands clasped in prayer, with the inscription:

Shea gave his staff orders to tell North American to remove the flammables from the cabin, but did not supervise the issue personally.

North American shipped spacecraft CM-012 to Kennedy Space Center on August 26, 1966, under a conditional Certificate of Flight Worthiness: 113 significant incomplete planned engineering changes had to be completed at KSC. But that was not all; an additional 623 engineering change orders were made and completed after delivery. Grissom became so frustrated with the inability of the training simulator engineers to keep up with the spacecraft changes, that he took a lemon from a tree by his house and hung it on the simulator.

The command and service modules were mated in the KSC altitude chamber in September, and combined system testing was performed. Altitude testing was performed first uncrewed, then with both the prime and backup crews, from October 10 through December 30. During this testing, the environmental control unit in the command module was found to have a design flaw, and was sent back to the manufacturer for design changes and rework. The returned ECU then leaked water/glycol coolant, and had to be returned a second time. Also during this time, a propellant tank in another service module had ruptured during testing at NAA, prompting the removal from the KSC test chamber of the service module so it could be tested for signs of the tank problem. These tests were negative.

In December the second Block I flight AS-205 was canceled as unnecessary; Schirra, Eisele and Cunningham were reassigned as the backup crew for Apollo1. McDivitt's crew was now promoted to prime crew of the Block II/LM mission, re-designated AS-258 because the AS-205 launch vehicle would be used in place of AS-207. A third crewed mission was planned to launch the CSM and LM together on a SaturnV (AS-503) to an elliptical medium Earth orbit (MEO), to be crewed by Frank Borman, Michael Collins and William Anders. McDivitt, Scott and Schweickart had started their training for AS-258 in CM-101 at the NAA plant in Downey, California, when the Apollo1 accident occurred.

Once all outstanding CSM-012 hardware problems had been fixed, the reassembled spacecraft completed a successful altitude chamber test with Schirra's backup crew on December 30. According to the final report of the accident investigation board, "At the post-test debriefing the backup flight crew expressed their satisfaction with the condition and performance of the spacecraft." This would appear to contradict the account given in the 1994 book '' Lost Moon: The Perilous Voyage of Apollo13'' by Jeffrey Kluger and astronaut James Lovell, that "When the trio climbed out of the ship,... Schirra made it clear that he was not pleased with what he had seen," and that he later warned Grissom and Shea that "there's nothing wrong with this ship that I can point to, but it just makes me uncomfortable. Something about it just doesn't ring right," and that Grissom should get out at the first sign of trouble.

After the successful altitude tests, the spacecraft was removed from the altitude chamber on January 3, 1967, and mated to its Saturn IB launch vehicle on pad 34 on January 6.

Grissom said in a February 1963 interview that NASA could not eliminate risk despite precautions:

"I suppose that someday we are going to have a failure. In every other business there are failures, and they are bound to happen sooner or later", he added. Grissom was asked about the fear of potential catastrophe in a December 1966 interview:

Accident

Plugs-out test

The launch simulation on January 27, 1967, on pad 34, was a "plugs-out" test to determine whether the spacecraft would operate nominally on (simulated) internal power while detached from all cables and umbilicals. Passing this test was essential to making the February 21 launch date. The test was considered non-hazardous because neither the launch vehicle nor the spacecraft was loaded with fuel or cryogenics and all pyrotechnic systems (explosive bolts) were disabled.

At 1:00 pm EST (1800 GMT) on January 27, first Grissom, then Chaffee, and White entered the command module fully pressure-suited, and were strapped into their seats and hooked up to the spacecraft's oxygen and communication systems. Grissom immediately noticed a strange odor in the air circulating through his suit which he compared to "sour buttermilk", and the simulated countdown was put on hold at 1:20 pm, while air samples were taken. No cause of the odor could be found, and the countdown was resumed at 2:42 pm. The accident investigation found this odor not to be related to the fire.

Three minutes after the count was resumed the hatch installation was started. The hatch consisted of three parts: a removable inner hatch which stayed inside the cabin; a hinged outer hatch which was part of the spacecraft's heat shield; and an outer hatch cover which was part of the boost protective cover enveloping the entire command module to protect it from aerodynamic heating during launch and from launch escape rocket exhaust in the event of a launch abort. The boost hatch cover was partially, but not fully, latched in place because the flexible boost protective cover was slightly distorted by some cabling run under it to provide the simulated internal power (the spacecraft's fuel cell reactants were not loaded for this test). After the hatches were sealed, the air in the cabin was replaced with pure oxygen at , higher than atmospheric pressure.

Movement by the astronauts was detected by the spacecraft's inertial measurement unit and the astronauts' biomedical sensors, and also indicated by increases in oxygen spacesuit flow, and sounds from Grissom's stuck-open microphone. The stuck microphone was part of a problem with the communications loop connecting the crew, the Operations and Checkout Building, and the Complex 34 blockhouse control room. The poor communications led Grissom to remark: "How are we going to get to the Moon if we can't talk between two or three buildings?"

The simulated countdown was put on hold again at 5:40 pm while attempts were made to troubleshoot the communications problem. All countdown functions up to the simulated internal power transfer had been successfully completed by 6:20 pm, and at 6:30 the count remained on hold at T minus 10 minutes.

Fire

The crew members were using the time to run through their checklist again, when a momentary increase in AC Bus2 voltage occurred. Nine seconds later (at 6:31:04.7), one of the astronauts (some listeners and laboratory analysis indicate Grissom) exclaimed "Hey!", "Fire!", or "Flame!"; this was followed by two seconds of scuffling sounds through Grissom's open microphone. This was immediately followed at 6:31:06.2 (23:31:06.2 GMT) by someone (believed by most listeners, and supported by laboratory analysis, to be Chaffee) saying, " 've, or We'vegot a fire in the cockpit." After 6.8 seconds of silence, a second, badly garbled transmission was heard by various listeners as:
* "They're fighting a bad fire—Let's get out... Open 'er up",
* "We've got a bad fire—Let's get out... We're burning up", or
* "I'm reporting a bad fire... I'm getting out..."
The transmission lasted 5.0 seconds and ended with a cry of pain.

Some blockhouse witnesses said that they saw White on the television monitors, reaching for the inner hatch release handle as flames in the cabin spread from left to right.

The heat of the fire fed by pure oxygen caused the pressure to rise to , which ruptured the command module's inner wall at 6:31:19 (23:31:19 GMT, initial phase of the fire). Flames and gases then rushed outside the command module through open access panels to two levels of the pad service structure. The intense heat, dense smoke, and ineffective gas masks designed for toxic fumes rather than smoke, hampered the ground crew's attempts to rescue the men. There were fears the command module had exploded, or soon would, and that the fire might ignite the solid fuel rocket in the launch escape tower above the command module, which would have likely killed nearby ground personnel, and possibly have destroyed the pad.

As the pressure was released by the cabin rupture, the rush of gases within the module caused flames to spread across the cabin, beginning the second phase. The third phase began when most of the oxygen was consumed and was replaced with atmospheric air, essentially quenching the fire, but causing high concentrations of carbon monoxide and heavy smoke to fill the cabin, and large amounts of soot to be deposited on surfaces as they cooled.

It took five minutes for the pad workers to open all three hatch layers, and they could not drop the inner hatch to the cabin floor as intended, so they pushed it out of the way to one side. Although the cabin lights remained on, they were unable to see the astronauts through the dense smoke. As the smoke cleared they found the bodies, but were not able to remove them. The fire had partly melted Grissom's and White's nylon space suits and the hoses connecting them to the life support system. Grissom had removed his restraints and was lying on the floor of the spacecraft. White's restraints were burned through, and he was found lying sideways just below the hatch. It was determined that he had tried to open the hatch per the emergency procedure, but was not able to do so against the internal pressure. Chaffee was found strapped into his right-hand seat, as procedure called for him to maintain communication until White opened the hatch. Because of the large strands of melted nylon fusing the astronauts to the cabin interior, removing the bodies took nearly 90 minutes.

Deke Slayton was possibly the first NASA official to examine the spacecraft interior. His testimony contradicted the official report concerning the position of Grissom's body. Slayton said of Grissom and White's bodies, "it is very difficult for me to determine the exact relationships of these two bodies. They were sort of jumbled together, and I couldn't really tell which head even belonged to which body at that point. I guess the only thing that was real obvious is that both bodies were at the lower edge of the hatch. They were not in the seats. They were almost completely clear of the seat areas."

Investigation

As a result of the in-flight failure of the Gemini 8 mission on March 17, 1966, NASA Deputy Administrator Robert Seamans wrote and implemented ''Management Instruction 8621.1'' on April 14, 1966, defining ''Mission Failure Investigation Policy And Procedures''. This modified NASA's existing accident procedures, based on military aircraft accident investigation, by giving the Deputy Administrator the option of performing independent investigations of major failures, beyond those for which the various Program Office officials were normally responsible. It declared, "It is NASA policy to investigate and document the causes of all major mission failures which occur in the conduct of its space and aeronautical activities and to take appropriate corrective actions as a result of the findings and recommendations."

Immediately after thefire NASA Administrator James E. Webb asked President Lyndon B. Johnson to allow NASA to handle the investigation according to its established procedure, promising to be truthful in assessing blame, and to keep the appropriate leaders of Congress informed. Seamans then directed establishment of the ''Apollo 204 Review Board'' chaired by Langley Research Center director Floyd L. Thompson, which included astronaut Frank Borman, spacecraft designer Maxime Faget, and six others. On February 1, Cornell University professor Frank A. Long left the board, and was replaced by Robert W. Van Dolah of the U.S. Bureau of Mines. The next day North American's chief engineer for Apollo, George Jeffs, also left.

Seamans ordered all Apollo1 hardware and software impounded, to be released only under control of the board. After thorough stereo photographic documentation of the CM-012 interior, the board ordered its disassembly using procedures tested by disassembling the identical CM-014 and conducted a thorough investigation of every part. The board also reviewed the astronauts' autopsy results and interviewed witnesses. Seamans sent Webb weekly status reports of the investigation's progress, and the board issued its final report on April 5, 1967.

Cause of death

According to the Board, Grissom suffered severe third-degree burns on over one-third of his body and his spacesuit was mostly destroyed. White suffered third-degree burns on almost half of his body and a quarter of his spacesuit had melted away. Chaffee suffered third-degree burns over almost a quarter of his body and a small portion of his spacesuit was damaged. The autopsy report determined that the primary cause of death for all three astronauts was cardiac arrest caused by high concentrations of carbon monoxide. Burns suffered by the crew were not believed to be major factors, and it was concluded that most of them had occurred postmortem. Asphyxiation occurred after the fire melted the astronauts' suits and oxygen tubes, exposing them to the lethal atmosphere of the cabin.

Major causes of accident

The review board identified several major factors which combined to cause the fire and the astronauts' deaths:
* An ''ignition source'' most probably related to "vulnerable wiring carrying spacecraft power" and "vulnerable plumbing carrying a combustible and corrosive coolant"
* A ''pure oxygen atmosphere'' at higher than atmospheric pressure
* A ''cabin sealed with a hatch cover'' which could not be quickly removed at high pressure
* An extensive distribution of ''combustible materials'' in the cabin
* ''Inadequate emergency preparedness'' (rescue or medical assistance, and crew escape)

Ignition source

The review board determined that the electrical power momentarily failed at 23:30:55 GMT, and found evidence of several electric arcs in the interior equipment. They were unable to conclusively identify a single ignition source. They determined that the fire most likely started near the floor in the lower left section of the cabin, close to the Environmental Control Unit. It spread from the left wall of the cabin to the right, with the floor being affected only briefly.

The board noted that a silver-plated copper wire, running through an environmental control unit near the center couch, had become stripped of its Teflon insulation and abraded by repeated opening and closing of a small access door.

This weak point in the wiring also ran near a junction in an ethylene glycol/water cooling line that had been prone to leaks. Electrolysis of ethylene glycol solution with the silver anode of the wire was discovered at the Manned Spacecraft Center on May 29, 1967 to be a hazard capable of causing a violent exothermic reaction, igniting the ethylene glycol mixture in the Command Module's pure oxygen atmosphere. Experiments at the Illinois Institute of Technology confirmed the hazard existed for silver-plated wires, but not for copper-only or nickel-plated copper. In July, ASPO directed both North American and Grumman to ensure no silver or silver-coated electrical contacts existed in the vicinity of possible glycol spills in the Apollo spacecraft.

Pure oxygen atmosphere

The plugs-out test had been run to simulate the launch procedure, with the cabin pressurized with pure oxygen at the nominal launch level of , above standard sea level atmospheric pressure. This is more than five times the partial pressure of oxygen in the atmosphere, and provides an environment in which materials not normally considered flammable will be highly flammable and burst into flame.

The high-pressure oxygen atmosphere was similar to that which had been used successfully in the Mercury and Gemini programs. The pressure before launch was deliberately greater than ambient in order to drive out the nitrogen-containing air and replace it with pure oxygen, and also to seal the plug door hatch cover. During the launch, the pressure would have been gradually reduced to the in-flight level of , providing sufficient oxygen for the astronauts to breathe while reducing the fire risk. The Apollo1 crew had successfully tested this procedure with their spacecraft in the Operations and Checkout Building altitude (vacuum) chamber on October 18 and 19, 1966, and the backup crew of Schirra, Eisele and Cunningham had repeated it on December 30. The investigation board noted that, during these tests, the command module had been fully pressurized with pure oxygen four times, for a total of six hours and fifteen minutes, two and a half hours longer than it had been during the plugs-out test.

Flammable materials in the cabin

The review board cited "many types and classes of combustible material" close to ignition sources. The NASA crew systems department had installed of Velcro throughout the spacecraft, almost like carpeting. This Velcro was found to be flammable in a high-pressure 100% oxygen environment. Astronaut Buzz Aldrin states in his book ''Men From Earth'' that the flammable material had been removed per the crew's August 19 complaints and Joseph Shea's order, but was replaced before the August 26 delivery to Cape Kennedy.

Hatch design

The inner hatch cover used a plug door design, sealed by higher pressure inside the cabin than outside. The normal pressure level used for launch ( above ambient) created sufficient force to prevent removing the cover until the excess pressure was vented. Emergency procedure called for Grissom to open the cabin vent valve first, allowing White to remove the cover, but Grissom was prevented from doing this because the valve was located to the left, behind the initial wall of flames. Also, while the system could easily vent the normal pressure, its flow capacity was utterly incapable of handling the rapid increase to caused by the intense heat of the fire.

North American had originally suggested the hatch open outward and use explosive bolts to blow the hatch in case of emergency, as had been done in Project Mercury. NASA did not agree, arguing the hatch could accidentally open, as it had on Grissom's ''Liberty Bell 7'' flight, so the Manned Spacecraft Center designers rejected the explosive design in favor of a mechanically operated one for the Gemini and Apollo programs. Before the fire, the Apollo astronauts had recommended changing the design to an outward-opening hatch, and this was already slated for inclusion in the Block II command module design. According to Donald K. Slayton's testimony before the House investigation of the accident, this was based on ease of exit for spacewalks and at the end of flight, rather than for emergency exit.

Emergency preparedness

The board noted that the test planners had failed to identify the test as hazardous; emergency equipment (such as gas masks) were inadequate to handle this type of fire; that fire, rescue, and medical teams were not in attendance; and that the spacecraft work and access areas contained many hindrances to emergency response such as steps, sliding doors, and sharp turns.

Choice of pure oxygen atmosphere

When designing the Mercury spacecraft, NASA had considered using a nitrogen/oxygen mixture to reduce the fire risk near launch, but rejected it based on a number of considerations. First, a pure oxygen atmosphere is comfortably breathable by humans at , greatly reducing the pressure load on the spacecraft in the vacuum of space. Second, nitrogen used with the in-flight pressure reduction carried the risk of decompression sickness (known as "the bends"). But the decision to eliminate the use of any gas but oxygen was crystalized when a serious accident occurred on April 21, 1960, in which McDonnell Aircraft test pilot G. B. North passed out and was seriously injured when testing a Mercury cabin / spacesuit atmosphere system in a vacuum chamber. The problem was found to be nitrogen-rich (oxygen-poor) air leaking from the cabin into his spacesuit feed. North American Aviation had suggested using an oxygen/nitrogen mixture for Apollo, but NASA overruled this. The pure oxygen design was judged to be safer, less complicated, and lighter in weight. In his monograph ''Project Apollo: The Tough Decisions'', Deputy Administrator Seamans wrote that NASA's worst mistake in engineering judgment was not running a fire test on the command module before the plugs-out test. In the first episode of the 2009 BBC
...