Moon Lander: How We Developed the Apollo Lunar Module (Smithsonian History of Aviation and Spaceflight)

by Kelly, Thomas J.

  Gradually we realized that what had occurred was not only a personal tragedy to three astronauts and their families and friends but also a major setback to the Apollo program. The cause of the fire had to be isolated and removed, but beyond that, all other fire hazards must be identified and eliminated anywhere in the CM or LM. I was alarmed at the reports about laboratory tests done by NASA and the air force that showed extreme flammability of many materials in pure oxygen, even if they burned slowly in air. I asked Bob Carbee to assign our Materials engineers to gather the available information on this phenomenon.

  Even worse, as I talked with Carbee and Barnes in the half-empty expanse of Plant 35 (many engineers had been given the weekend off), we worried about how we could all have been so blind to an ancient hazard, which in retrospect was blatantly obvious. If we were so obtuse about fire, how many other serious hazards had also escaped our faulty vision? At the very least a total, searching review of LM hazards and protective features would be required, with additional new eyes added to those of us who had ceased to see the apparent.

  As at a wake, we shared stories about the deceased. I had only met Grissom briefly at the M-1 mockup review, but I had talked to White and Chaffee a few times when they were working on lunar egress during and after the M-5 review John Rigsby, Gene Harms, and Howard Sherman had worked very closely with White on the TM-1 with the Peter Pan rig, developing improved versions of the forward hatch, ladder, and descent-stage lunar experiment bay. We were all sobered and saddened by this grim turn of fate, made especially painful by the feeling that someone, somewhere in the vast Apollo program should have recognized the fire hazard and spoken out about it. And that someone could have been me. (In fact, Hilliard Paige, general manager of General Electric’s Apollo Support Division, had sent ASPO manager Joe Shea a letter in September 1966, pointedly warning of the danger of fire during ground tests in pure oxygen and urging that action be taken to reduce the amount of flammable material in the crew cabin.)

  It was little comfort to rationalize, as we briefly tried to do, that in a program as huge and complex as Apollo something was bound to go wrong. Or that three astronauts had already been killed in the line of duty, in crashes of their T-38 jet trainers.2 There was no way to avoid the realization that the Apollo program was in crisis and we were going to have to work very hard to dig our way out of it.

  Reaction and Redesign

  NASA and Congress each conducted investigations of the cause of the Apollo 1 fire and the recommended corrective actions.3 Prior to the fire, the U.S. manned spaceflight program had relied upon designing to eliminate potential ignition sources as the principal way to prevent fires. If a fire occurred in the crew cabin in space, it could be quickly extinguished by dumping cabin pressure, provided the crew were in their spacesuits. No special provisions were made for extinguishing cabin fires on the ground, nor was major effort made to minimize the amount of flammable material contained in the crew compartment.

  The investigations concluded that the Apollo 1 fire had most likely been started by an electrical spark, probably in or near the environmental control system module, that ignited wire insulation. It quickly spread to the highly flammable nylon, including the ubiquitous Raschel netting used to stow checklists, flight plans, and other materials used by the crew, and then raced throughout the cabin. Aluminum lines containing flammable water-glycol coolant melted in the heat and sprayed more fuel into the fire. The plastics burned and gave off toxic gases and dense smoke, which asphyxiated the astronauts once their spacesuits ruptured. (They were not incinerated, as early reports had claimed.) With the cumbersome arrangement of a boost protective cover hatch and two inward opening spacecraft hatches, the crew’s doom was sealed. The white room support crew had no awareness of, or training and equipment for, fighting fire in the cabin, should it erupt.

  Recommendations included: minimizing flammable materials in the cabin, protecting and providing fire breaks for any flammable material that remained, improving the quality of spacecraft wiring and plumbing, using stainless steel lines to carry water-glycol coolant, and studying two gas oxygen-nitrogen cabin atmospheres. These could apply to both CM and LM. Then uniquely for the command module: provide a single quick release outward opening hatch, consider two gas atmosphere and fire-extinguishing systems for ground test, and train and equip the white room team for fire fighting. In addition the investigating board demanded correction of the conditions that caused the many deficiencies they found in command module design and engineering, manufacture, and quality control.

  Long before the formal investigations were complete, Grumman embarked on a thorough inventory of all materials in the cabin, characterizing, by test if necessary, their flammability in the LM cabin environment of 5 psia pure oxygen. (LM ground tests and checkout were run with ambient air in the cabin.) NASA enlisted us in a major review, covering all aspects of safety hazards and spacecraft quality, with an emphasis on eliminating flammable materials, potential ignition sources, and quality defects. Spacecraft wiring and water-glycol coolant lines received special attention. NASA sent materials expert Robert L. “Bob” Johnston to Bethpage for several weeks to work with our Materials Group leadership organizing the materials characterization program and developing new design guidelines.

  They banished nylon from the LM cabin, along with some forms of fiberglass cloth. It was replaced by Beta cloth, newly developed by Corning Glass. Beta cloth was nonflammable and nontoxic, but it had poor wear resistance and was prone to flaking. Velcro was largely replaced by metal snap fasteners, grommets, and Beta cloth ties. Other plastics, particularly polycarbonates, which gave off toxic fumes when burned, were replaced with sheet metal where possible. Kevlar insulation was used on electrical wiring; it was fire retardant—charring in flame but smoldering or going out when flame was removed.

  New design guidelines for electrical wiring were adopted. First, wire bundles and connections were to be neatly combed and rigidly supported with clamps or Beta cloth ties at least every four inches. No “rats’ nests” (uncombed jumbles of wiring) were allowed at junction boxes, splices, and connectors. Second, fire-retardant potting (newly developed) was to be used on electrical connectors and switches and X-rayed after the potting cured. (When cured with a heat lamp, potting became firm but slightly flexible and adhered to the wires’ insulation and the connector, protecting the connector from moisture.) “Birdcaging” (wires pushed into an arc shape, rather than straight) was not allowed. Third, circuit breakers and some switches were to be covered on their back sides with hand-tied Beta cloth “booties,” providing fire protection to the plastic in the unit’s body or innards and preventing short circuits by floating metallic objects (such as screws, washers, etc.) in zero gravity.

  In the ECS system, aluminum tubing in the LM cabin was changed to stainless steel and rerouted to shield it from accidental damage by the crew. We also increased the flow rate of the LM cabin dump valve to speed fire extinguishing if needed in space. We participated in a joint group with NASA and North American, which reexamined the cabin atmosphere issue for CM and LM. For the command module a change proposed by Max Faget was adopted: For ground tests requiring spacesuited astronauts, the CM would be pressurized to 16.7 pounds per square inch absolute (psia)4 with 60 percent oxygen (O2)/40 percent nitrogen (N2), instead of pure O2 as before. After launch the cabin pressure would bleed down to 5 psia using pure oxygen for the spacesuit loop and for cabin leakage makeup.

  Since LM only operated in space and was unmanned at launch, it could be kept at the 5 psia pure oxygen originally chosen. At launch, when LM was unmanned inside the spacecraft/LM adapter with all systems turned off, it had been planned to pressurize the LM cabin with 16.7 psia pure oxygen. (For both CM and LM, the 2 psi differential above ambient was used to keep humidity and contaminants from getting into the cabin.) In the postfire scrutiny, Marshall decided that this was unacceptable because oxygen leaking or venting from LM could combine with hydrogen leaking from the SIVB stage j
ust below it, possibly causing a flammable or explosive mixture inside the SLA. To reduce this hazard, the LM cabin at launch was instead charged with 20 percent oxygen-80 percent nitrogen, which was bled down to 5 psia in space, with pure oxygen makeup. During a lunar mission the LM cabin was vented to permit opening the front hatch. Upon the first repressurization the cabin would contain 5 psia pure oxygen.

  By the time implementation of these changes was in full swing, I had left LM Engineering to lead LM Spacecraft Assembly and Test. The engineering redesign effort was led by John Coursen, who succeeded me as LM Engineering director, and his deputy, Erick Stern. Sal Salina was in charge of the flammability test program, with major assistance from the Structural Design and the Materials Sections. While under heavy pressure from upper management to minimize the schedule slippage caused by the flammability changes, Coursen and Stern implemented them completely and efficiently. They deserve great credit for leading LM Engineering’s recovery from a dark hour.

  About two weeks after the fire, and shortly after I transferred into S/CAT and moved into the temporary office trailer complex behind Plant 5, we were visited by a top Apollo management delegation from NASA led by George Mueller, Gen. Samuel Phillips, and Joseph Shea. After meeting with Lew Evans, Titterton, Gavin, and other executives, they spent the day holding meetings with large groups of Grumman LM people throughout Bethpage, assuring them that the Apollo program would continue despite the setback of Apollo 1, and that it was even more important for everyone to do his job correctly and efficiently. Schedule was important, but quality was even more so. “Do it right the first time” was the slogan of the day. Apollo’s salvation lay in the skill and dedication to quality of its people.

  In S/CAT we held the mass meeting on the floor of the LM Assembly area in Plant 5, a very large, high-ceilinged clean room, totally white in walls, ceiling, and floors. Everyone wore the required white smocks, caps, and cloth booties, including the speakers: Mueller, Shea, Evans, and Gavin. They stood together on a raised work platform where they could look out over the uplifted sea of white-clad faces. It was like a revival meeting, with Mueller and Evans the most inspiring, asking all of us to dedicate our efforts to the memory of the lost astronauts and assuring that their deaths were not in vain. I think we all felt reassured that the program and company leaders had the will and the vision to pull us out of the problems.

  After the big meeting in S/CAT, I led the NASA executives on a tour of the LM’s on the assembly floor and also to adjacent shop areas in Plant 5 where subassemblies were prepared for installation. On the assembly floor they scrutinized the LM’s wiring and plumbing. Although generally pleased with what they saw, as it apparently looked better than the workmanship in the command module, they insisted that we reexamine every detail of these installations. When we entered the subassembly areas in the shops Mueller, a non-smoker, suddenly produced a cigarette lighter, which he proceeded to use to test the flammability of many components that he saw being assembled. I blanched as he pounced upon wire bundles, switches, and circuit breakers and immersed them into his flame, staring quizzically at the result through his thick horn rimmed glasses. In the panel shop, where the control and display panels for the LM flight stations were assembled, I thought the foreman would have a heart attack when he saw Mueller whip out his lighter and hold the flame onto wiring and potting in the back of a newly assembled flight instrument panel. The only substance that burned in these forays was the potting, which continued to support a candle-like flame after the lighter was removed. Everything else just charred and smoldered when the ignition flame was taken away. (Fortunately Mueller did not come across any of the nylon netting, which would have given him quite a show.) I’m not sure what these ad hoc tests proved, since ambient air was a less severe environment than the 5 psia pure oxygen in which LM operated in space, but they seemed to satisfy Mueller’s curiosity and the damage that they caused was not major. The panels and assemblies would all require rework anyway when the material substitutions and other fire related changes were finalized.

  We adjourned to our spartan conference room in the trailers, an unimpressive room in faux wood paneling and beige asphalt tile floor, with a low ceiling inset with fluorescent lights. We gathered around the two plastic-topped metal tables at the front of the room; some sat in the front row of the hard plastic chairs with schoolroom writing arms that largely filled the room. The NASA men shared with us their first impressions of what the corrective actions would entail, emphasizing the need to remove flammables and potential ignition sources from the LM cabin, and to rededicate ourselves to quality in every detail. They impressed upon us the need for Grumman in particular to minimize the schedule impact of the changes because we were so far behind the rest of the program to begin with.

  During these discussions I first noticed indications that the tragedy had struck Joe Shea very hard. He was somber and muted, without his usual flashes of wit and puns, and lacking the self-assurance and confidence that were his hallmarks. When I had a few words with him privately, he said he would never forgive himself for being so blind to the danger. He told me how close he had come to being inside Spacecraft 012 during the test, and mused whether that might have been better.5 I urged him not to blame himself; we all shared the blame of overlooking the obvious.

  In the following weeks, Shea publicly and personally accepted the blame for the Apollo 1 accident and was perceived by the NASA leadership as increasingly showing signs of stress, despite his vigorous efforts to define and organize the recovery activities. Gilruth and other NASA leaders became concerned that Shea’s worsening frame of mind might affect his judgment on program matters and concluded it was not fair to Shea to keep him in such a demanding job. In early April, convinced by earnest entreaties and blandishments by Administrator Webb, Deputy Administrator Seamans, and Mueller, Shea agreed to relinquish his position as ASPO manager and become Mueller’s deputy at NASA Headquarters in Washington. Once there, he found he had little real work or responsibility, and in July 1967 he resigned from NASA to become engineering director of Polaroid Corporation, located near Boston.6 Joe Shea quietly left the grand stage of Apollo, leaving a legacy of monumental contributions to the definition, organization and implementation of the program. He provided objective analysis, sophisticated engineering judgment and practical management direction when the program most needed them, and assuredly ranks in that small pantheon of leaders without whom Apollo would not have succeeded.

  Shea was not the only Apollo manager who felt responsibility and remorse for not being more aware of potential fire danger. I felt it myself. My confidence and optimism were weakened by this evidence of tunnel-visioned failure to look beyond my immediate concerns and action items. Were we all so busy that we could no longer think? The fire gave objective evidence of our individual and collective shortcomings that no systems and procedures could hide. Did I, and did the Apollo team, have the wisdom, judgment and skill it would take to reach the Moon safely? After Apollo 1 the question was raised anew in our minds, and the answer was not reassuring.

  In my new job in S/CAT I was responsible for building and testing the LMs, and I spent much time on the floor in the LM Assembly clean room, or in the subassembly shops. There I saw the added work and manufacturing difficulties that the flammability “fixes” entailed. Since LM-1 and LM-2 were to be unmanned, they were exempt from the changes, but from LM-3 upward and for LTA-8, the manned thermal vacuum test article, all the fixes were rigorously applied within the cabin. (In the interest of standardization, some of the changes in materials, design, and manufacturing practices were also followed in the unpressurized areas outside of the LM cabin, including the descent stage.) The new fire-retardant potting took longer to cure than the material it replaced, and the Beta cloth, with its lower wear resistance and flaking, had to be handled very carefully by our technicians to avoid damage upon installation. Combing and dressing the wiring, hand tying it with Beta cloth tape, and swathing the circuit breakers and swi
tches in the Beta cloth booties were fussy, time-consuming operations. Every time the portable X-ray machine was brought into the LM to inspect connectors and junction boxes, all other workers had to evacuate the immediate area. A major reduction in the use of velcro inside the cabin caused an increase in more cumbersome grommets or ties. None of this helped our schedule situation.

  Nowhere in LM were the effects of the fixes more concentrated than in the cockpit control and display panels. Containing hundreds of instruments, switches, and circuit breakers, the backs of these panels were crowded with thousands of wires. The panels and adjacent cabin structure were modified to allow neat, orderly routing of wire bundles and to provide added space for potting, clamps, ties, and booties. The finished products were marvels of dense but purposeful packaging.

  The final test of the fixes was the flammability test article (FTA), designed and prepared by Sal Salina and his team. This full-sized steel boiler-plate shell of a lunar module cabin was outfitted inside with a full complement of flight-type materials, furnishings, and equipment that had been modified to the new posture standards. Many of the units consigned to this test were used design verification or qualification test articles, which had already served their intended purpose in the program. The FTA was filled with pure oxygen at one atmosphere pressure (14.7 psia), then pumped down to 5 psia. Relief valves would open if the outward pressure differential reached 5 psi (20 psia), due to fire-induced heating and pressure rise inside the cabin. Several spark-propane igniters were positioned at critical locations in the cabin, including behind the cockpit panels and under the ECS module.

  The modified LM passed this test readily. The test conductors were unable to get anything to burn; most locations just smoldered and charred, then went out when the igniters were shut off. After this required phase of the test was officially passed, an overstress test was conducted by placing a large pan of gasoline on the cabin floor. The gasoline fueled a raging fire, its blaze fully enveloping the cabin and popping open the relief valves, emitting columns of flame and smoke. When the FTA had cooled down sufficiently to be opened and inspected, it was found that the wire insulation, switch and circuit breaker housings, potting, and other plastic materials had charred and melted, and some thin aluminum panels had warped and melted. The spacesuits and hoses had local damage but were still functional. Although there was widespread fire damage, nothing much had burned except the gasoline. We and NASA were satisfied that the LM cabin was fire safe.