Part 1 (H)

Preparation for Flight, the Accident, and Investigation

March 16 through April 5, 1967

1967

March 16

• Issued 25 Board administrative procedures.
• Established the administrative and Secretarial Support Office, which had provided support in two shifts seven days a week, unless otherwise required, with some additional third-shift support.
• Established the Photographic Data Control Center to correlate and distribute photographs and maintain a film library.
• Processed letters, telegrams, and telephone messages received offering assistance, recommendations, and comments.
• Periodically issued approved schedules of work.
• Established the Audio Magnetic Tape Library to control 0.64centimeter voice-transmission tape recordings about spacecraft 012 during the Space Vehicle Plugs-Out Integrated Test.

March 18

The panel inspected the spacecraft structures while they were still at Launch Complex 34 and continued through removal of the CM heatshield. Structural damage reports were made coinciding with spacecraft disassembly phases. As major subsystems were removed from the spacecraft they were visually inspected. Buckles, fractures, cracks, melted areas, localized arcing or pitting in metal components, and obvious direct wire shorts were noted and documented.

Panel findings and determinations included:

Finding

Spacecraft data during the Plugs-Out Test gave indications from which a spacecraft pressure history could be estimated.

Determination

1. The CM cabin structure had ruptured at 6:31:19.4 (±0.1) p.m. EST January 27 at an estimated minimum cabin pressure of 20 newtons per sq cm (29 psia).
2. The CM cabin structure had sustained cabin pressure in excess of its designed ultimate pressure of 8.9 newtons-per-sq-cm (12.9-psi) differential (19 newtons per sq cm; 27.6 psia). Cabin pressure at rupture probably reached 20 to 26 newtons per sq cm (29 to 37.7 psia).
3. The estimated average gas temperature at rupture exceeded 644 kelvins (700 degrees F).

Finding

The CM cabin ruptured in the aft bulkhead adjacent to its juncture with the aft sidewall.

Determination

The failure occurred because of excessive meridional tensile stress in the inner face sheet at the junction of the weld land to the thinner face sheet. The fracture originated on the right-hand side of the command module.

Finding

The CM cabin structure was penetrated in the aft bulkhead beneath the environmental control unit and the aft sidewall.

Determination

1. The loss of structural integrity at these penetrations occurred after the primary rupture.
2. Failure of the water glycol and oxygen lines near the environmental control unit resulted in local burning and melting of the adjacent structure.

Finding

The aft heatshield stainless-steel face sheets were melted and eroded.

Determination

The temperature of the flame and gas exiting from the fracture origin exceeded 1640 K (2500 degrees F).

March 18-19

During the investigation the panel had discovered a number of items which might have had relevance to flame propagation:

• An engineering order, released at North American Aviation's Downey facility on January 20, provided direction to inspect the polyurethane foam in specified areas and coat the silicone rubber to meet flammability requirements. The direction was not recorded in the configuration verification record as of the start of the Space Vehicle Plugs-Out Integrated Test and was not accomplished on spacecraft 012. This item was considered as possibly significant in terms of fuel for the fire and a medium for flame propagation.
• Polyethylene bags covered the hose fitting for the drinking water dispenser and the battery-instrumentation cable and connectors and transducer, which were placed on the aft bulkhead near the batteries. The bags were made of nonflight materials.
• Two polyurethane pads, covered with Velostat, were stowed over couch struts. The pads were placed in the spacecraft to protect the struts, wiring, and aft bulkhead during the planned emergency egress at the end of the test. These items were of nonflight material and were not documented by quality inspection records.
• Three packages of switching checklists from the Operational Checkout Procedure and one package of system malfunction procedures, in a manila folder, were stowed on the crew couches and on a shelf. These items were on unqualified paper and, while required for the test, they were not documented by quality inspection records.
• Nylon protective sleeves were covering all three crewmen's oxygen umbilicals. These sleeves were nonflight items.
• Three ground-support-equipment window covers had been temporarily installed to protect the windows and were nonflight items in the spacecraft at the time of the accident. Another such cover for the side hatch window was removed by the crew and stowed inside the command module. These covers were of nylon fabric; flight covers were made of aluminized Mylar.
• Velcro pile had been installed to protect the Velcro hood on the command module floor. It would have been removed before the flight.
• "Remove before flight" streamers installed in the command module interior were additional nonflight items.
• Polyethylene zipper tubing, installed to protect hand controller cables, was a nonflight item and was additional material in the command module.

Finding

Eighty engineering orders effective for spacecraft 012 had not been carried out at the time of the accident. Of these, twenty were specified to be completed after the test; four did not affect configuration.

Determination

Test requirements had no defined relationships with the open status of 56 engineering orders. The reason not all work items and engineering orders were closed was late receipt of changes or further work scheduled to be completed before launch.

Finding

Items not documented by quality inspection records had been placed on board the spacecraft during preparation for the Space Vehicle Plugs- Out Integrated Test.

Determination

Procedures for controlling entry of items into the spacecraft were not strictly enforced.

March 18-19

The panel's report submitted six findings and determinations, which included:

Finding

KSC security personnel or uniformed security personnel had been assigned to all locations requiring safeguarding measures, including launch vehicle stages and spacecraft from the time of arrival at KSC until the time of the January 27 accident.

Determination

The number of KSC and uniformed security personnel members used was adequate.

Finding

The Apollo Preflight Operations Procedures - dated October 17, 1966, and January 24, 1967 - for access control of test and work areas, required that<

1. access controls to spacecraft work areas be exercised by the contractor;
2. the contractor maintain a log of all personnel permitted access during off-shift and nonwork periods; and
3. the contractor control and log command module ingress and egress.

Determination

The procedures established in the Apollo Preflight Operations Procedures were not followed for spacecraft 012 in that

1. the contractor failed to exercise adequate access controls on the fifth, sixth, and seventh spacecraft levels;
2. the contractor failed to maintain an off-shift log; and
3. the command module ingress-egress log was inadequately maintained.

March 18-20

Following an intensive study - which considered ignition sources, description, and course of the fire - the panel listed 10 findings and determinations in its final report, including:

Finding

Severe damage to wiring was found at the bottom of the power equipment bay along the aft bulkhead. Evidence of arcing was found and damage was less severe in the right-hand direction of this bay.

Determination

Electrical arcing in the extreme lower left-hand comer of this bay could have provided a primary ignition source.

Finding

Right-hand portions of the left-hand equipment bay were severely damaged. Wiring, tubing, and components in the carbon dioxide absorber compartment and oxygen/water panel compartment were burned and melted. Penetrations in the aft bulkhead and pressure vessel wall were observed. The carbon dioxide absorber compartment showed heavy fire damage; failure was due to pressure overload and melting caused by the fire in this area.

Determination

Electrical arcing in the right-hand portion of this bay could have provided a primary ignition source.

Finding

Evidence of electrical arcs from conductor to conductor and from conductor to structure were found.

Determination

No arc could be positively identified as the unique ignition source. Three were found that had all the elements needed to cause the disaster. Two of these showed evidence of poor engineering and installation.

March 19

The panel approached its task in two phases. First, it reviewed the emergency provisions at the time of the CM 012 accident, investigating

1. the procedures in published documents,
2. the emergency equipment inside and outside the spacecraft, and
3. the emergency training of the flight crew and checkout test team.

Findings and determinations included:

Finding

The applicable test documents and flight crew procedures for the AS- 204 Space Vehicle Plugs-Out Integrated Test did not include safety considerations, emergency procedures, or emergency equipment requirements relative to the possibility of an internal spacecraft fire during the operation.

Determination

The absence of any significant emergency preplanning indicated that the test configuration (pressurized 100-percent-oxygen cabin atmosphere) was not classified as potentially hazardous.

Finding

The propagation rate of the fire in the accident was extremely rapid. Removal of the three spacecraft hatches, from either the inside or the outside, for emergency exit required a minimum of 40 to 70 seconds, respectively, under ideal conditions.

Determination

Considering the rapid propagation of the fire and the time constraints imposed by the spacecraft hatch configuration, it is doubtful that any amount of emergency preparation would have precluded injury to the crew before egress.

Finding

Procedures for unaided egress from the spacecraft were documented and available. The AS-204 flight crew had participated in a total of eight egress exercises employing those procedures.

Determination

The 204 flight crew was familiar with and well trained in the documented emergency crew procedures for effecting unaided egress.

Finding

The spacecraft pad work team on duty at the time of the accident had not been given emergency training drills for combating fires in or around the spacecraft or for emergency crew egress. They were trained and equipped only for a normal hatch removal operation.

Determination

The spacecraft pad work team was not properly trained or equipped to effect an efficient rescue operation under the conditions resulting from the fire.

Finding

Frequent interruptions and failures had been experienced in the overall communications system during the operations preceding the accident. At the time the accident occurred, the status of the system was still under assessment.

Determination

The status of the overall communications was marginal for the support of a normal operation. It could not be assessed as adequate in the presence of an emergency condition.

Finding

Emergency equipment provided at the spacecraft work levels consisted of portable carbon dioxide fire extinguishers, rocket-propellant-fuel-handler's gas masks, and 4.4-centimeter-diameter fire hoses.

Determination

The existing emergency equipment was not adequate to cope with the conditions of the fire. Suitable breathing apparatus, additional portable carbon dioxide fire extinguishers, direct personnel evacuation routes, and smoke removal ventilation were significant items that would have improved the reaction capability of the personnel.

Finding

Under the existing method of test procedure processing at KSC, the safety offices reviewed only the procedures noted in the operational checkout procedure outline as involving hazards. Official approval by KSC and Air Force Eastern Test Range Safety was given after the procedure was published and released.

Determination

The scope of contractor and KSC Safety Office participation in test procedure development was loosely defined and poorly documented. Post-procedure-release approval by the KSC Safety Office did not ensure positive and timely coordination of all safety considerations.

March 19

• "Assemble, summarize, compare and interpret requirements and data describing the flammability of nonmetallic materials exposed to the crew bay environment of the spacecraft and in related applications.
• "Specify and authorize performance of tests and/or analyses to furnish additional information as to flammability characteristics of these materials alone, and in combination with fluids known or postulated to have been in the spacecraft 012 cabin.
• "Panel No. 8, in support of Panel No. 5 (Origin and Propagation of Fire) shall interpret and implement the requirements for analyses of debris removed from the spacecraft."

Finding

Complete documentation identifying potentially combustible nonmetallic materials in spacecraft 012 was not available in a single readily usable format. A total of 2,528 different potentially combustible nonmetallic materials that were probably used on spacecraft 012 was found by a review of available documentation.

Determination

The program for identifying and documenting nonmetallic materials used in the spacecraft, including their weights and surface areas, was not adequate.

Finding

Raschel Knit, Velcro, Trilock, and polyurethane foams burn about twice as fast (in the downward direction) in oxygen at a pressure of 11.4 newtons per sq cm (16.5 psia) as at 3.5 newtons per sq cm (5 psia).

Determination

The primary fuels for the fire burned more than twice as fast in the early stages of the spacecraft 012 fire in accident conditions (pressure of 11.4 newtons per sq cm) as in the space flight atmosphere for which they were evaluated (3.5 newtons per sq cm).

Finding

Surface and bulk damage of materials in spacecraft 012 varied from melting and blistering of aluminum alloys, combustion of Velcro, and burning of Teflon wire insulation to slight surface damage and melting of nylon fabrics.

Determination

The fire filled the spacecraft interior. The most intense heat was in the lower left front area around the environmental control unit. Surface temperatures in excess of 800 kelvins (1,000 degrees F) were reached in areas such as the front and left side of the spacecraft. Surface temperatures were less than 500 K (400 degrees F) in isolated pockets above the right-hand couch.

Finding

The rate of flame propagation, the rate of pressure increase, the maximum pressures achieved, and the extent of conflagration in 3.5 newtons-per-sq-cm (5-psia) oxygen boilerplate tests was much less severe than observed in the 11.4-newton (16.5-psia) oxygen boilerplate tests. Burning or charring was limited to approximately 29 percent of the nonmetallic materials by oxygen depletion.

Determination

The conflagration that occurred in spacecraft 012 at a pressure of 11.4 newtons per sq cm would be far less severe and slower in a spacecraft operating with an oxygen environment at 3.5 newtons, if additional large quantities of oxygen are not fed into the fire.

Finding

North American Aviation materials selection specification requires that a material pass only a 500 K (400 degrees F) spark-ignition test in oxygen at 10.1 newtons per sq cm (14.7 psia).

Determination

NAA criteria for materials flammability control were inadequate.

Finding

No flammability criteria or control existed covering nonflight items installed in CM 012 for test.

Determination

Lack of control of nonflight material could have contributed to the fire.

Finding

The NASA materials selection criteria required that a material pass a 500 K (400 degrees F) spark-ignition test and a 1.27-an-per-sec combustion rate (measured downward in oxygen at 3.5 newtons per sq cm). Raschel Knit and Velcro (hook) pass this test.

Determination

The NASA criteria for materials flammability were not sufficiently stringent.

Finding

The system for control of nonmetallic materials use at MSC during the design and development of government furnished equipment used in CM 012 depended on identification of noncompliance with criteria by the development engineers.

Determination

The NASA materials control system was permissive to the extent that installation or use of flammable materials were not adequately reviewed by a second party.

Finding

Nonmetallic materials selection criteria used by North American and NASA were not consistent. The NASA criteria, although more stringent, were not contractually imposed on the spacecraft contractor.

Determination

Materials were evaluated and selected for use in CM 012 using different criteria. Application of the NASA criteria to the command module would have reduced the amount of the more flammable materials (Velcro and Uralane foam).

Finding

Alternate materials that are nonflammable or significantly less flammable than those used on spacecraft 012 were available for many applications.

Determination

The amount of combustible material used in command modules can be limited.

Finding

Current information and displays of the potentially flammable materials configuration of spacecraft 012 were not available before the fire.

Determination

Maintenance of data and displays at central locations and test sites for management visibility and control of flammable materials is feasible and useful.

March 20

NASA News Release 67-67, March 20, 1967.

March 20

1. Reports, files, and working materials;
2. Medical reports;
3. Spacecraft 012 command module, its systems, components, and related drawings.

In other actions Robert W. Van Dolah, Chairman of the Origin and Propagation of Fire Panel, reported on a test being conducted in CM 014 to attempt to establish the amount of static electricity that might be generated by a suited crewman; and members of the Board met with MSC Director Robert R. Gilruth and members of his staff, as well as management and engineering personnel of North American Aviation, for a presentation concerning solder joints in the CM.

"Board Proceedings," pp. 3-30, 3-31.

March 21

Procedures followed included the following actions:

• Immediately after the January 27 accident, NASA KSC Security placed Launch Complex 34 under additional security. Special guards were assigned to the service structure and to the adjustable level at the entrance of the CM. Controls were established for personnel access to the service structure and the CM.
• After the accident, before disturbing any items in the spacecraft, a series of photographs was taken. A step-by-step photography method was established as a standard operating procedure for the Disassembly Activities Panel.
• The first step toward an orderly disassembly was to ensure safe working conditions at the spacecraft. A meeting with KSC and Air Force Eastern Test Range Safety personnel established procedures and safety rules.
• After the couches were removed, a special false floor was suspended from the couch strut fittings to provide access to the entire inside of the spacecraft without disturbing any evidence. The false floor was fabricated from aluminum angles supporting 2-centimeter-thick, 46-centimeter plexiglass squares.
• The Review Board appointed a Panel Coordination Committee to carry out new procedures to ensure closely controlled and coordinated equipment removal.

1. Bond room - a bonded area to receive components as they were removed from CM 012. This area was provided with a receiving table; 10 storage cabinets for small components; and areas for large components and items associated with the investigation but not from the command module itself.
2. Astronaut equipment room and work room - an area in which the spacesuits and other government furnished crew equipment were investigated.
3. Bonded display area - an area in which components could be displayed under controlled conditions to permit investigators to examine CM 012 components visually.
4. Command module 012 work area - The command module was placed in a supporting ring within an existing workstand in the PIB and remained in this area until the aft heatshield was removed. The CM was then transferred to a standard support ring in the north end of the building. Technicians continued the disassembly activities while the CM was in these areas.
5. Spacecraft 014 CM - Spacecraft 014 CM (identical in configuration to spacecraft 012) was shipped to KSC on February 1 to assist the Apollo 204 Review Board in the investigation. This CM was placed in the PIB and was used for practicing difficult removals of CM 012 components.
6. Mockup No. 2 - Mockup No. 2, a full-scale plywood command module, was brought to KSC and placed in the PIB February 8. The mockup had been configured with Velcro, debris traps, couch positioning, etc., to duplicate CM 012 configuration at the time of the fire.
7. Half-scale mockup - A half-scale mockup of the CM interior was placed in the bonded display area February 8 to display half-scale interior surface photographs taken after the fire in CM 012.

March 25

The panel reviewed all tests pertinent to the investigation. The qualification tests were reviewed at MSC, covering more than 1,000 documents. Vehicle tests were reviewed at North American Aviation's Downey, Calif., facility, covering more than 500 documents. Summaries of these efforts were reviewed by the panel at KSC to determine any test program deficiencies.

The final report of the panel included six findings and determinations. Among them were:

Finding

Not all crew compartment equipment had been tested as explosion proof.

Determination

Testing of possible ignition sources had been insufficient.

Finding

Some CM equipment exhibited arcing or shorting either during certification or during spacecraft 012 testing. There was no positive way to determine from the records reviewed whether spacecraft anomalies (possibly caused by an arc or a short) were reviewed by system engineers and the test conductor before a test.

Determination

Review of possible ignition sources before manned testing was inadequate.

Finding

Not all equipment installed in CM 012 at the time of the accident was intended for flight (some components were installed for test purposes only).

Determination

The suitability of this equipment in the CM for this test was not established.

March 25 - April 24

1. all Apollo missions would be numbered sequentially in the order flown, with the next mission to be designated Apollo 4, the following one Apollo 5, etc., and
2. the Apollo Applications missions would be designated sequentially as AAP-1, AAP-2, etc. The number designations would not differentiate between manned and unmanned or uprated Saturn I and Saturn V missions.

   In a letter to George E. Mueller, OMSF, on March 30, MSC Deputy Director George M. Low offered two suggestions, in keeping with the intent of the NASA instruction yet keeping the designation Apollo 1 for spacecraft 012. NASA Hq. had approved that designation before the January 27 fire claimed the lives of Astronauts Virgil I. Grissom, Edward H. White II, and Roger B. Chaffee; and their widows requested that the designation be retained. The suggestions were:

3. Consider the AS-201, 202, and 203 missions part of the Saturn I (as opposed to uprated Saturn I) series; reserve the designation Apollo 1 for spacecraft 012; and number the following flights Apollo 2, etc., or
4. Designate the next flight Apollo 4, as indicated by Headquarters, but apply the scheme somewhat differently for missions already flown. Specifically, put the Apollo 1 designation on spacecraft 012 and then, for historic purposes, designate 201 as mission 1-a, 202 as mission 2 and 203 as mission 3.

On April 24, OMSF further instructed the Centers that AS-204 would be officially recorded as Apollo 1, "first manned Apollo Saturn flight - failed on ground test." AS-201, AS-202, and AS-203 would not be renumbered in the "Apollo" series, and the next mission would be Apollo 4.

TWX, Mueller, NASA OMSF, to KSC, MSFC, MSC, "Apollo and AAP Mission Designation," March 25 and April 24, 1967; ltr., Low to Mueller, March 30, 1967; memo, Julian Scheer, NASA Assistant Administrator for Public Affairs, to distr., April 3, 1967.

March 27

1. no fire detection system was available for incorporation into the Apollo spacecraft;
2. a reliable system would be desirable, but the system must not give false alarms when used in a closed spacecraft environment and yet must give adequate warning of fire;
3. two kinds of systems appeared to be in varying states of development - systems using infrared or ultraviolet sensors and systems sensing ionized particles or condensation nucleii in the atmosphere;
4. a work statement should be prepared, with the help of personnel at Wright Field, for the purpose of receiving specific proposals on available systems; and
5. the ultimate goal should be to develop a system ready for flight use within six months.

March 28

The final report of the Screening Committee was distributed to the Board by George T. Sasseen, KSC, for review. Sasseen stated that the following items would be retained as Category A (items damaged or identified as suspect or associated with anomalies).

• Lower equipment bay junction box cover plate
• Command pilot's torso harness
• Velcro and Raschel netting
• Static inverter 2
• Main display control panel 8
• Instrumentation data distribution panel J800/J850
• Octopus cable.

William D. Mangan, Langley Research Center, joined the legal staff supporting the Board.

"Board Proceedings," pp. 3-32, 3-33.

March 29

ALSEP III Experiments:

Passive Seismic, Heat Flow (w/Lunar Drill), Cold Cathode Gauge, and Charged Particle Lunar Environment.

ALSEP IV Experiments:

Passive Seismic, Active Seismic, Suprathermal Ion Detector/Cold Cathode Gauge, and Charged Particle Lunar Environment.

Ltr., Apollo Program Director, NASA Hq., to R. O. Piland, MSC, March 29, 1967.

March 29-30

Memo, Chief, Mission Operations Div., MSC, to Manager, ASPO, "Trip Report - Apollo Site Selection Board and Surveyor/Orbiter Utilization Committee Meetings," April 20, 1967.

March 29 - April 4

Memo, Creighton, Goldenberg, and Witherington to Kleinknecht, "Condition of Spacecraft 101 Wire Bundles," April 4, 1967.

March 30

Panel 3 had served as a separate panel from January 31 through February 23, when it was merged with the Integration Analysis Panel (No. 18). Panel 3 reported one finding and one determination:

Finding

The data recorded from the spacecraft and ground instrumentation system during the Spacecraft Plugs-Out Test were found to be valid except for three brief dropouts after 6:31:17 EST, January 27 (13 seconds after the pilot reported "fire in the cockpit"). All onboard data transmission ended about 6:31:22 EST.

Determination

The onboard instrumentation system functioned normally before and during the initial phase of the fire. There were no indicated malfunctions in any of the instrumentation sensors during this period.

March 30

Among the panel's findings and determinations were:

Finding

209 pages of the 275-page Operational Checkout Procedure (OCP) were revised and released on the day before the test. However, less than 25 percent of the line items were changed. Approximately one percent of the change was due to errors in technical content in the original issue of the procedure. In addition, 106 deviations were written during the test.

Determination

Neither the revision nor the deviations were known to have contributed specifically to the incident. The late timing of the change release, however, prevented test personnel from becoming adequately familiar with the test procedure before use.

Finding

During the altitude chamber tests, the cabin was pressurized at pressures greater than sea level with an oxygen environment two and a half times as long as the cabin was pressurized with oxygen before the accident during Plugs-Out Test.

Determination

The spacecraft had successfully operated with the same cabin conditions in the chamber for a greater period of time than on the pad up to the time of the accident.

Finding

Troubleshooting the communication problem was not controlled by any one person, and was at times independently run from the spacecraft, Launch Complex 34 Blockhouse, and the Manned Spacecraft Operations Building. Communications switching, some of which was not called out in OCP, was performed without the control of the Test Conductor.

Determination

The uncontrolled troubleshooting and switching contributed to the difficulty experienced in attempting to assess the communication problem.

Finding

KSC was not able to ensure that the spacecraft launch operations plans and procedures adequately satisfied, in a timely way, the intent of MSC. Changes in spacecraft testing by KSC could not be kept in phase with the latest requirements of MSC. Prelaunch checkout requirements were not formally transmitted to KSC from MSC.

Determination

Prelaunch-test-requirements control for the Apollo spacecraft program was constrained by slow response to changes, lack of detailed KSC-MSC inter-Center agreements, and lack of official NASA-approved test specifications applicable to prelaunch checkout.

Finding

The decision to perform the Plugs-Out Test with the flight crew, closed hatch, and pure oxygen cabin environment made on October 31, 1966, was a significant change in test philosophy.

Determination

There was no evidence that this change in test philosophy was made so late as to preclude timely incorporation into the test procedure.

March 30

In its final report to the Review Board the Historical Data Panel submitted eight findings and determinations. Among them were:

Finding

The Ingress-Egress Log disclosed several instances where tools and equipment were carried into the spacecraft, but the log did not indicate these items had been removed.

Determination

Maintenance of the Ingress-Egress Log was inadequate.

Finding

Inspection personnel did not perform a prescheduled inspection with a checklist before hatch closing.

Determination

Inspection personnel could not verify specific functions during that period.

Finding

At the time of the spacecraft 012 shipment to KSC, the contractor submitted an incomplete list of open items. A revision of that list significantly and substantially enlarged the list of open items.

Determination

The true status of the spacecraft was not identified by the contractor.

March 30

The contemplated spacecraft configuration for the next scheduled manned flight (spacecraft 101, Block II) was significantly different from that of spacecraft 012 (Block I), in which the January 27 fire had occurred. Therefore, both configurations were to be reviewed - the Block I configuration as an aid in determining possible sources for the fire, the Block II to evaluate the system design characteristics and potential design change requirements to prevent recurrence of fire.

The panel's final report to the Review Board contained findings on ignition and flammability, cabin atmosphere, review of egress process, and review of the flight and ground voice communications. Among them were:

Finding

Flammable, nonmetallic materials were used throughout the spacecraft. In the Block I and Block II spacecraft design, combustible materials were contiguous to potential ignition sources.

Determination

In the Block I and Block II spacecraft design, combustible materials were exposed in sufficient quantities to constitute a fire hazard.

Finding

The spacesuit contained power wiring to electronic circuits. The astronauts could be electrically insulated.

Determination

Both the power wiring and potential for static discharge constituted possible ignition sources in the presence of combustible materials. The wiring in the suit could fail from working or bending.

Finding

Residues of RS89 (inhibited ethylene glycol/water solution) after drying were both corrosive and combustible. RS89 was corrosive to wire bundles because of its inhibitor.

Determination

Because of the corrosive and combustible properties of the residues, RS89 coolant could, in itself, provide all of the elements of a fire hazard if it leaked onto electrical equipment.

Finding

Water/glycol was combustible, although not easily ignited.

Determination

Leakage of water/glycol in the cabin would increase risk of fire.

Finding

Deficiencies in design, manufacture, and quality control were found in the postfire inspection of the wire installation.

Determination

There was an undesirable risk exposure, which should have been prevented by both the contractor and the government.

Finding

The spacecraft atmosphere control system design was based on providing a pure oxygen environment.

Determination

The technology was so complex that, to provide diluent gases, duplication of the atmosphere control components as well as addition of a mechanism for oxygen partial-pressure control would be required. These additions would introduce additional crew-safety failure modes into the flight systems.

Finding

Sixty seconds were required for unaided crew egress from the CM. The hatch could not be opened with positive cabin pressure above approximately 0.17 newtons per sq cm (0.25 psi). The vent capacity was insufficient to accommodate the pressure buildup in the Apollo 204 spacecraft.

Determination

Even under optimum conditions emergency crew egress from Apollo 204 spacecraft could not have been accomplished in sufficient time.

Finding

During the January 27 Apollo 204 test, difficulty was experienced in communicating from ground to spacecraft and among ground stations.

Determination

The ground system design was not compatible with operational requirements.

March 31

Findings

Several arcing indications were observed in the CM left front sector and a voltage transient was noted in all three phases of AC Bus 2. This transient was most closely simulated by a power interruption or short circuit on DC Bus B. Physical evidence and witness statements indicated the progress of the fire to be from the left side of the spacecraft. Simulations and tests indicated that combustion initiation by electrostatic discharge or chemical action was not probable. No physical evidence of prefire overheating of mechanical components or heating devices was found.

Determinations

No single ignition source could be conclusively identified. The most probable initiator was considered to be the electrical arcing or shorting in the left front sector of the spacecraft. The location best fitting the total available information was that where environmental control system instrumentation power wiring ran into the area between the environmental control unit and the oxygen panel.

Finding

All spacecraft records were reviewed by the various panels and the results were screened by Panel 18.

Determination

No evidence was found to correlate previously known discrepancies, malfunctions, qualification failures or open work items with the source of ignition.

Finding

At the time of the observed fire, data including telemetry and voice communications indicated no malfunctioning spacecraft systems (other than the live microphone).

Determination

Existing spacecraft instrumentation was insufficient by itself to provide data to identify the source of ignition.

March 31

The panel report indicated that at the time of the accident two NASA physicians were in the blockhouse monitoring data from the senior pilot. Upon hearing the first voice transmission indicating fire, the senior NASA physician turned from the biomedical console to look at the bank of television monitors. When his attention returned to the console the bioinstrumentation data had stopped. The biomedical engineer in the Acceptance Checkout Equipment (ACE) Control Room called the senior medical officer for instructions. He was told to make the necessary alarms and informed that the senior medical officer was leaving his console. The two NASA physicians left the blockhouse for the base of the umbilical tower and arrived there shortly before ambulances and a Pan American physician arrived at 6:43 p.m. The three physicians went to the spacecraft; time of their arrival at the White Room was estimated to be 6:45 p.m. EST.

By this time some 12 to 15 minutes had elapsed since the fire began. After a quick evaluation it was evident that the crew had not survived the heat, smoke, and burns and it was decided that nothing could be gained by attempting immediate egress and resuscitation.

Panel 11's 24 findings included:

Finding

Biomedical data at the time of the accident were received from only the senior pilot. The data consisted of one lead of electrocardiogram, one lead of phonocardiogram, and impedance pneumogram (respiration). The data was received by telemetry and from the onboard medical data acquisition system.

Determination

This configuration was normal for the test.

Finding

At 6:31:04 p.m. there was a marked change in the senior pilot's respiratory and heart rates on the biomedical tape. There was also evidence of muscle activity in the electrocardiogram and evidence of motion in the phonocardiogram. The heart rate continued to climb until loss of signal.

Determination

This physiological response is compatible with the realization of an emergency situation.

Finding

Voice contact with the crew was maintained until 6:31:22.7

Determination

At least one crew member was conscious until that time.

Finding

Hatches were opened at approximately 6:36 p.m. and no signs of life were detected. Three physicians looked at the suited bodies at approximately 6:45 p.m. and decided that resuscitation efforts would be to no avail.

Determination

Time of death could not be determined from this finding.

Finding

"The cause of death of the Apollo 204 Crew was asphyxia due to inhalation of toxic gases due to fire. Contributory cause of death was thermal burns."

Determination

It could be concluded that death occurred rapidly and that unconsciousness preceded death by some increment of time. The fact that an equilibrium had not been established throughout the circulatory system indicated that blood circulation stopped rather abruptly before an equilibrium could be reached.

Finding

Panel 5 had estimated that significant levels (more than two percent) of carbon monoxide were in the spacecraft atmosphere by 6:31:30 p.m. EST. By this time at least one spacesuit had failed, introducing cabin gases to all suit loops.

Determination

The crew was exposed to a lethal atmosphere when the first suit was breached.

Finding

The distribution of carbon monoxide in body organs indicated that circulation stopped rather abruptly when high levels of carboxyhemoglobin reached the heart.

Determination

Loss of consciousness was caused by cerebral hypoxia due to cardiac arrest from myocardial hypoxia. Factors of temperature, pressure, and environmental concentrations of carbon monoxide, carbon dioxide, oxygen, and pulmonary irritants were changing at extremely rapid rates. It was impossible from available information to integrate these variables with the dynamic physiological and metabolic conditions they produced, to arrive at a precise statement of the time when consciousness was lost and when death supervened. Loss of consciousness was estimated as at between 15 and 30 seconds after the first suit failed. Chances of resuscitation decreased rapidly thereafter and were irrevocably lost within 4 minutes.

Finding

The purge with 100-percent oxygen at above sea-level pressure contributed to the propagation of fire in the Apollo 204 spacecraft.

Determination

The oxygen level was the planned cabin environment for testing and launch, since prelaunch denitrogenation was necessary to forestall the possibility of the astronauts' suffering the bends. A comprehensive review of operational and physiological tradeoffs of various methods of denitrogenation was in progress.

March 31

Required leak check operations were also requested at a maximum pressure of 142 newtons per sq cm (206 psia), with a design limit of 186 newtons per sq cm (270 psia). The test fluids would be compatible with the titanium alloy at the test pressures. The test would be conducted in the Altitude Test Stand, where adequate protection existed for isolating and containing a failure. MSC Director Robert R. Gilruth approved the request the same day.

Memo, Shea to Gilruth, "Request for authorization to conduct a pressure test," March 31, 1967.

April 1

Ltr., Kleinknecht to Phillips, "Delay in Direction to Effect Service Module Tank Change," April 1, 1967.

April 5

TWX, Phillips to MSC, MSFC, and KSC, "First Manned Mission," April 5, 1967.

April 5

The Apollo 204 Review Board studied Apollo spacecraft 014 (above) in its investigation of the January 27, 1967, fire in the similar CM 012 (below, photographed after the fire). The interior view shows the forward section of the left-hand equipment bay, below the environmental control unit in each spacecraft. The DC power cable crosses over aluminum tubing and under a lithium hydroxide access door (removed in the photo of the damaged CM 012). The board determined this was the area of the most probable initiator of the fire.

During the review the Board had adhered to the principle that reliability of the CM and the entire system involved in its operation was a requirement common to both safety and mission success. Once the CM had left the earth's environment the occupants were totally dependent on it for their safety. It followed that protection from fire as a hazard required much more than quick egress. Egress was useful only during test periods on earth when the CM was being readied for its mission and not during the mission itself. The risk of fire had to be faced, but that risk was only one factor pertaining to CM reliability that must receive adequate consideration. Design features and operating procedures intended to reduce the fire risk must not introduce other serious risks to mission success and safety.

The House Committee on Science and Astronautics' Subcommittee on NASA Oversight held hearings on the Review Board report April 10-12, 17, and 21 and May 10. Senate Committee on Aeronautical and Space Sciences hearings were held April 11, 13,and 17 and May 4 and 9 (see May 9-10, 1967, and Appendix 8).

Findings, determinations, and recommendations of the Apollo 204 Review Board were:

Finding

1. A momentary power failure occurred at 6:30:55 p.m. EST (23:30:55 GMT).
2. Evidence of several arcs was found in the postfire investigation.
3. No single ignition source of the fire was conclusively identified.

Determination

The most probable initiator was an electrical arc in the sector between the -Y and +Z spacecraft axes. The exact location best fitting the total available information was near the floor in the lower forward section of the left-hand equipment bay where environmental control system instrumentation power wiring led into the area between the environmental control unit and the oxygen panel. No evidence was discovered that suggested sabotage.

Finding

1. The CM contained many classes of combustible material in areas contiguous to possible ignition sources.
2. The test was conducted with a 100-percent oxygen atmosphere at 11.5 newtons per sq cm (16.7 psia).

Determination

The test conditions were extremely hazardous.

Recommendation

The amount and location of combustible materials in the CM must be severely restricted and controlled.

Finding

1. The rapid spread of fire increased pressure and temperature, rupturing the CM and creating a toxic atmosphere. "Death of the crew was from asphyxia due to inhalation of toxic gases due to fire. A contributory cause of death was thermal burns."
2. Non-uniform distribution of carboxyhemoglobin was found by autopsy.

Determination

Autopsy data led to the medical opinion that unconsciousness occurred rapidly and that death followed soon thereafter.

Finding

Because of internal pressure, the CM inner hatch could not be opened before rupture of the CM.

Determination

The crew was never capable of effecting emergency egress because of the pressurization before the rupture and their loss of consciousness soon after rupture.

Recommendation

The time required for egress of the crew should be reduced and the operations necessary for egress be simplified.

Finding

The organizations responsible for planning, conducting, and safety of this test failed to identify it as being hazardous. Contingency preparations to permit escape or rescue of the crew from an internal CM fire were not made.

1. No procedures for this kind of emergency had been established either for the crew or for the spacecraft pad work team.
2. The emergency equipment in the White Room and on the spacecraft work levels was not designed for the smoke condition resulting from a fire of this nature.
3. Emergency fire, rescue, and medical teams were not in attendance.
4. Both the spacecraft work levels and the umbilical tower access arm contained features such as steps, sliding doors, and sharp turns in the egress paths which hindered emergency operations.

Determination

Adequate safety precautions were neither established nor observed for this test.

Recommendations

1. Management should continually monitor the safety of all test operations and ensure the adequacy of emergency procedures.
2. All emergency equipment (breathing apparatus, protective clothing, deluge systems, access arm, etc.) should be reviewed for adequacy.
3. Personnel training and practice for emergency procedures should be given regularly and reviewed before a hazardous operation.
4. Service structures and umbilical towers should be modified to facilitate emergency operations.

Finding

Frequent interruptions and failures had been experienced in the overall communication system during the operations preceding the accident.

Determination

The overall communication system was unsatisfactory.

Recommendation

1. The ground communication system should be improved to ensure reliable communications among all test elements as. soon as possible and before the next manned flight.
2. A detailed design review should be conducted on the entire spacecraft communication system.

Finding

1. Revisions in the Operational Checkout Procedure for the test were issued at 5:30 p.m. EST January 26, 1967 (209 pages), and 10:00 a.m. EST January 27, 1967 (4 pages).
2. Differences existed between the ground test procedures and the inflight checklists.

Determination

Neither the revision nor the differences contributed to the accident. The late issuance of the revision, however, prevented test personnel from becoming adequately familiar with the test procedure before use.

Recommendations

1. Test procedures and pilot's checklists that represent the actual CM configuration should be published in final form and reviewed early enough to permit adequate preparation and participation of all test organizations.
2. Timely distribution of test procedures and major changes should be made a constraint to the beginning of any test.

Finding

The fire in CM 012 was subsequently simulated closely by a test fire in a full-scale mockup.

Determination

Full-scale mockup fire tests could be used to give a realistic appraisal of fire risks in flight-configured spacecraft.

Recommendation

Full-scale mockups in flight configuration should be tested to determine the risk of fire.

Finding

The CM environmental control system design provided a pure oxygen atmosphere.

Determination

This atmosphere presented severe fire hazards if the mount and location of combustibles in the CM were not restricted and controlled.

Recommendations

1. The fire safety of the reconfigured CM should be established by full-scale mockup tests.
2. Studies of the use of a diluent gas should be continued, with particular reference to assessing the problems of gas detection and control and the risk of additional operations that would be required in the use of a two-gas atmosphere.

Finding

Deficiencies existed in CM design, workmanship and quality control, such as:

1. Components of the environmental control system installed in CM 012 had a history of many removals and of technical difficulties, including regulator failures, line failures, and environmental control unit failures. The design and installation features of the environmental control unit made removal or repair difficult.
2. Coolant leakage at solder joints had been a chronic problem.
3. The coolant was both corrosive and combustible.
4. Deficiencies in design, manufacture, installation, rework, and quality control existed in the electrical wiring.
5. No vibration test was made of a complete flight-configured spacecraft.
6. Spacecraft design and operating procedures required the disconnecting of electrical connections while powered.
7. No design features for fire protection were incorporated.

Determination

These deficiencies created an unnecessarily hazardous condition and their continuation would imperil any future Apollo Operations.

Recommendations

1. All elements, components, and assemblies of the environmental control system should be reviewed in depth to ensure its functional and structural integrity and to minimize its contribution to fire risk.
2. The design of soldered joints in the plumbing should be modified to increase integrity or the joints should be replaced with a more structurally reliable configuration.
3. Deleterious effects of coolant leakage and spillage should be eliminated.
4. Specifications should be reviewed; three-dimensional jigs should be used in manufacture of wire bundles; and rigid inspection at all stages of wiring design, manufacture, and installation should be enforced.
5. Flight-configured spacecraft should be vibrationtested.
6. The necessity for electrical connections or disconnections with power on within the crew compartment should be eliminated.
7. The most effective means of controlling and extinguishing a spacecraft fire should be investigated. Auxiliary breathing oxygen and crew protection from smoke and toxic fumes should be provided.

Finding

An examination of operating practices showed the following examples of problem areas:

1. The number of open items at the time of shipment of the CM 012 was not known. There were 113 significant engineering orders not accomplished at the time CM 012 was delivered to NASA; 623 engineering orders were released subsequent to delivery. Of these, 22 were recent releases that were not recorded in configuration records at the time of the accident.
2. Established requirements were not followed with regard to the pretest constraints list. The list was not completed and signed by designated contractor and NASA personnel before the test, even though oral agreement to proceed was reached.
3. Formulation of and changes in prelaunch test requirements for the Apollo spacecraft program were responsive to changing conditions.
4. Noncertified equipment items were installed in the CM at time of test.
5. Discrepancies existed between NAA and NASA MSC specifications regarding inclusion and positioning of flammable materials.
6. The test specification was released August 1966 and was not updated to include accumulated changes from release date to the January 27 test date.

Determination

Problems of program management and relations between Centers and with the contractor had led to some insufficient responses to changing program requirements.

Recommendation

Every effort must be made to ensure the maximum clarification and understanding of the responsibilities of all organizations in the program, the objective being a fully coordinated and efficient program.