APOLLO 1

The Fire

27 January 1967

 

 

Background

 

The first manned Apollo mission was scheduled for launch on 21 February 1967 at Cape Kennedy Launch Complex 34. However, the death of the prime crew in a command module fire during a practice session on 27 January 1967 put America’s lunar landing program on hold.

 

The crew consisted of Lt. Colonel Virgil Ivan “Gus” Grissom (USAF), command pilot; Lt. Colonel Edward Higgins White, II (USAF), senior pilot; and Lt. Commander Roger Bruce Chaffee (USN), pilot.

 

Selected in the astronaut group of 1959, Grissom had been pilot of MR-4, America’s second and last suborbital flight, and command pilot of the first two-person flight, Gemini 3. Born on 3 April 1926 in Mitchell, Indiana, Grissom was 40 years old on the day of the Apollo 1 fire. Grissom received a B.S. in mechanical engineering from Purdue University in 1950. His backup for the mission was Captain Walter Marty “Wally” Schirra [shi-RAH] (USN).

 

White had been pilot for the Gemini 4 mission, during which he became the first American to walk in space. He was born 14 November 1930 in San Antonio, Texas, and was 36 years old on the day of the Apollo 1 fire. He received a B.S. from the U.S. Military Academy at West Point in 1952, an M.S. in aeronautical engineering from the University of Michigan in 1959, and was selected as an astronaut in 1962. His backup was Major Donn Fulton Eisele [EYES-lee] (USAF).

 

Chaffee was training for his first spaceflight. He was born 15 February 1935 in Grand Rapids, Michigan, and was 31 years old on the day of the Apollo 1 fire. He received a B.S. in aeronautical engineering from Purdue University in 1957, and was selected as an astronaut in 1963. His backup was Ronnie Walter “Walt” Cunningham.

 

 

The Accident

 

The accident occurred during the Plugs Out Integrated Test. The purpose of this test was to demonstrate all space vehicle systems and operational procedures in as near a flight configuration as practical and to verify systems capability in a simulated launch.

 

The test was initiated at 12:55 GMT on 27 January 1967. After initial system tests were completed, the flight crew entered the command module at 18:00 GMT. The command pilot noted an odor in the spacecraft environmental control system suit oxygen loop and the count was held at 18:20 GMT while a sample of the oxygen in this system was taken. The count was resumed at 19:42 GMT with hatch installation and subsequent cabin purge with oxygen beginning at 19:45 GMT. The odor was later determined not to be related to the fire.

 

Communication difficulties were encountered and the count was held at approximately 22:40 GMT to troubleshoot the problem. The problem consisted of a continuously live microphone that could not be turned off by the crew. Various final countdown functions were still performed during the hold as communications permitted.

 

By 23:20 GMT, all final countdown functions up to the transfer to simulated fuel cell power were completed and the count was held at T-10 minutes pending resolution of the communications problems.

 

From the start of the T-10 minute hold at 23:20 GMT until about 23:30 GMT, there were no events that appeared to be related to the fire. The major activity during this period was routine troubleshooting of the communications problem; all other systems were operating normally. There were no voice transmissions from the spacecraft from 23:30:14 GMT until the transmission reporting the fire, which began at 23:31:04.7 GMT.

 

During the period beginning about 30 seconds before the report, there were indications of crew movement. These indications were provided by the data from the biomedical sensors, the command pilot’s live microphone, the guidance and navigation system, and the environmental control system. There was no evidence as to what this movement was or that it was related to the fire.

 

The biomedical data indicated that just prior to the fire report the senior pilot was performing essentially no activity until about 23:30:21 GMT, when a slight increase in pulse and respiratory rate was noted. At 23:30:30 GMT, the electrocardiogram indicated some muscular activity for several seconds. Similar indications were noted at 23:30:39 GMT. The data showed increased activity but were not indicative of an alarm type of response. By 23:30:45 GMT, all of the biomedical parameters had reverted to the baseline “rest” level.

 

Beginning at about 23:30 GMT, the command pilot’s live microphone transmitted brushing and tapping noises indicative of movement. The noises were similar to those transmitted earlier in the test by the live microphone when the command pilot was known to have been moving. These sounds ended at 23:30:58.6 GMT.

 

Any significant crew movement resulted in minor motion of the command module and was detected by the guidance and navigation system. The type of movement, however, could not be determined. Data from this system indicated a slight movement at 23:30:24 GMT, with more intense activity beginning at 23:30:39 GMT and ending at 23:30:44 GMT. More movement began at 23:31:00 GMT and continued until loss of data transmission during the fire.

 

Increases of oxygen flow rate to the crew suits also indicated movement. All suits had some small leakage, and this leakage rate varied with the position of each crew member in the spacecraft. Earlier in the Plugs Out Integrated Test, the crew reported that a particular movement, the nature of which was unspecified, provided increased flow rate.

 

This was also confirmed from the flow rate data records. The flow rate showed a gradual rise at 23:30:24 GMT which reached the limit of the sensor at 23:30:59 GMT.

 

At 23:30:54.8 GMT, a significant voltage transient was recorded. The records showed a surge in the AC Bus 2 voltage. Several other parameters being measured also showed anomalous behavior at this time.

 

Beginning at 23:31:04.7 GMT, the crew gave the first verbal indication of an emergency when they reported a fire in the command module.

 

Emergency procedures called for the senior pilot, occupying the center couch, to unlatch and remove the hatch while retaining his harness buckled. A number of witnesses who observed the television picture of the command module hatch window discerned motion that suggested that the senior pilot was reaching for the inner hatch handle. The senior pilot’s harness buckle was found unopened after the fire, indicating that he initiated the standard hatch-opening procedure. Data from the Guidance and Navigation System indicated considerable activity within the command module after the fire was discovered. This activity was consistent with movement of the crew prompted by proximity of the fire or with the undertaking of standard emergency egress procedures.

 

Personnel located on adjustable level 8 adjacent to the command module responded to the report of the fire. The pad leader ordered the implementation of crew egress procedures and technicians rushed toward the White Room which surrounded the hatch and into which the crew would step upon egress. Then, at 23:31:19 GMT, the command module ruptured.

 

All transmission of voice and data from the spacecraft terminated by 23:31:22.4 GMT, three seconds after rupture. Witnesses monitoring the television showing the hatch window reported that flames spread from the left to the right side of the command module and shortly thereafter covered the entire visible area.

 

Flames and gases flowed rapidly out of the ruptured area, spreading flames into the space between the command module pressure vessel and heat shield through access hatches and into levels A-8 and A-7 of the service structure. These flames ignited combustibles, endangered pad personnel, and impeded rescue efforts. The burst of fire, together with the sounds of rupture, caused several pad personnel to believe that the command module had exploded or was about to explode.

 

The immediate reaction of all personnel on level A-8 was to evacuate the level. This reaction was promptly followed by a return to effect rescue. Upon running onto the swing arm from the umbilical tower, several personnel obtained fire extinguishers and returned along the swing arm to the White Room to begin rescue efforts. Others obtained fire extinguishers from various areas of the service structure and rendered assistance in fighting the fires.

 

Three hatches were installed on the command module. The outermost hatch, called the boost protective cover (BPC) hatch, was part of the cover which shielded the command module during launch and was jettisoned prior to orbital operation. The middle hatch was termed the ablative hatch and became the outer hatch when the BPC was jettisoned after launch. The inner hatch closed the pressure vessel wall of the command module and was the first hatch to be opened by the crew in an unaided crew egress.

 

On the day of the fire, the outer or BPC hatch was in place but not fully latched because of distortion in the BPC caused by wire bundles temporarily installed for the test. The middle hatch and inner hatch were in place and latched after crew ingress. Although the BPC hatch was not fully latched, it was necessary to insert a specially-designed tool into the hatch in order to provide a hand-hold for lifting it from the command module. By this time the White Room was filling with dense, dark smoke from the command module interior and from secondary fires throughout level A-8. While some personnel were able to locate and don operable gas masks, others were not. Some proceeded without masks while others attempted without success to render masks operable. Even operable masks were unable to cope with the dense smoke present because they were designed for use in toxic rather than dense smoke atmospheres.

 

Visibility in the White Room was virtually nonexistent. It was necessary to work essentially by touch since visual observation was limited to a few inches at best. A hatch removal tool was in the White Room. Once the small fire near the BPC hatch had been extinguished and the tool located, the pad leader and an assistant removed the BPC hatch. Although the hatch was not latched, removal was difficult.

 

The personnel who removed the BPC hatch could not remain in the White Room because of the smoke. They left the White Room and passed the tool required to open each hatch to other individuals. A total of five individuals took part in opening the three hatches. Each were forced to make several trips to and from the White Room in order to reach breathable air.

 

The middle hatch was removed with less effort than was required for the BPC hatch.

 

The inner hatch was unlatched and an attempt was made to raise it from its support and to lower it to the command module floor. The hatch could not be lowered the full distance to the floor and was instead pushed to one side. When the inner hatch was opened, intense heat and a considerable amount of smoke issued from the interior of the command module.

 

When the pad leader ascertained that all hatches were open, he left the White Room, proceeded a few feet along the swing arm, donned his headset and reported this fact. From a voice tape it has been determined that this report came approximately 5 minutes 27 seconds after the first report of the fire. The pad leader estimates that his report was made no more than 30 seconds after the inner hatch was opened. Therefore, it was concluded that all hatches were opened and the two outer hatches removed approximately five minutes after the report of fire or at about 23:36 GMT.

 

Medical opinion, based upon autopsy reports, concluded that chances of resuscitation decreased rapidly once consciousness was lost (about 15 to 30 seconds after the first suit failed) and that resuscitation was impossible by 23:36 GMT. Cerebral hypoxia, due to cardiac arrest resulting from myocardial hypoxia, caused a loss of consciousness. Factors of temperature, pressure, and environmental concentrations of carbon monoxide, carbon dioxide, oxygen, and pulmonary irritants were changing rapidly. The combined effect of these environmental factors dramatically increased the lethal effect of any factor by itself. Because it was impossible to integrate the variables with the dynamic physiological and metabolic conditions they produced, a precise time when consciousness was lost and death supervened could not be conclusively determined.

 

Visibility within the command module was extremely poor. Although the lights remained on, they could be perceived only dimly. No fire was observed. Initially, the crew was not seen. The personnel who had been involved in removing the hatches attempted to locate the crew without success.

 

Throughout this period, other pad personnel were fighting secondary fires on level A-8. There was considerable fear that the launch escape tower, mounted above the command module, would be ignited by the fires below and destroy much of the launch complex.

 

Shortly after the report of the fire, a call was made to the fire department. From log records, it appeared that the fire apparatus and personnel were dispatched at about 23:32 GMT. The doctor monitoring the test from the blockhouse near the pad had already proceeded to the base of the umbilical tower.

 

The exact time at which firefighters reached Level A-8 is not known. Personnel who opened the hatches unanimously stated that all hatches were open before any firefighters were seen on the level or in the White Room. The first firefighters who reached Level A-8 stated that all hatches were open, but that the inner hatch was inside the command module when they arrived. This placed arrival of the firefighters after 23:36 GMT. It was estimated on the basis of tests that seven to eight minutes were required to travel from the fire station to the launch complex and to ride the elevator from the ground to Level A-8. Thus, the estimated time the firefighters arrived at level A-8 was shortly before 23:40 GMT.

 

When the firefighters arrived, the positions of the crew couches and crew could be perceived through the smoke but only with difficulty. An unsuccessful attempt was made to remove the senior pilot from the command module.

 

Initial observations and subsequent inspection revealed the following facts. The command pilot’s couch (the left couch) was in the “170 degree” position, in which it was essentially horizontal throughout its length. The foot restraints and harness were released and the inlet and outlet oxygen hoses were connected to the suit. The electrical adapter cable was disconnected from the communications cable. The command pilot was lying supine on the aft bulkhead or floor of the command module, with his helmet visor closed and locked and with his head beneath the pilot’s head rest and his feet on his own couch. A fragment of his suit material was found outside the command module pressure vessel five feet from the point of rupture. This indicated that his suit had failed prior to the time of rupture (23:31:19.4 GMT), allowing convection currents to carry the suit fragment through the rupture.

 

The senior pilot’s couch (the center couch) was in the “96 degree” position in which the back portion was horizontal and the lower portion was raised. The buckle releasing the shoulder straps and lap belts was not opened. The straps and belts were burned through. The suit oxygen outlet hose was connected but the inlet hose was disconnected. The helmet visor was closed and locked and all electrical connections were intact. The senior pilot was lying transversely across the command module just below the level of the hatchway.

 

The pilot’s couch (the couch on the right) was in the “264 degree” position in which the back portion was horizontal and the lower portion dropped toward the floor. All restraints were disconnected, all hoses and electrical connections were intact and the helmet visor was closed and locked. The pilot was supine on his couch.

 

From the foregoing, it was determined that the command pilot probably left his couch to avoid the initial fire, the senior pilot remained in his couch as planned for emergency egress, attempting to open the hatch until his restraints burned through. The pilot remained in his couch to maintain communications until the hatch could be opened by the senior pilot as planned. With a slightly higher pressure inside the command module than outside, opening the inner hatch was impossible because of the resulting force on the hatch. Thus the inability of the pressure relief system to cope with the pressure increase due to the fire made opening the inner hatch impossible until after cabin rupture. Following rupture, the intense and widespread fire, together with rapidly increasing carbon monoxide concentrations, further prevented egress.

 

Whether the inner hatch handle was moved by the crew cannot be determined because the opening of the inner hatch from the White Room also moves the handle within the command module to the unlatched position.

 

Immediately after the firefighters arrived, the pad leader on duty was relieved to allow treatment for smoke inhalation. He had first reported over the headset that he could not describe the situation in the command module. In this manner he attempted to convey the fact that the crew was dead to the test conductor without informing the many people monitoring the communication channels. Upon reaching the ground the pad leader told the doctors that the crew was dead. The three doctors proceeded to the White Room and arrived there shortly after the arrival of the firefighters. The doctors estimate their arrival to have been at 23:45 GMT. The three doctors entered the White Room and determined that the crew had not survived the heat, smoke, and thermal burns. The doctors were not equipped with breathing apparatus, and the command module still contained fumes and smoke. It was determined that nothing could be gained by immediate removal of the crew. The firefighters were then directed to stop removal efforts.

 

When the command module had been adequately ventilated, the doctors returned to the White Room with equipment for crew removal. It became apparent that extensive fusion of suit material to melted nylon from the spacecraft would make removal very difficult. For this reason it was decided to discontinue removal efforts in the interest of accident investigation and to photograph the command module with the crew in place before evidence was disarranged.

 

Photographs were taken and the removal efforts resumed at approximately 00:30 GMT, 28 January. Removal of the crew took approximately 90 minutes and was completed about seven and one-half hours after the accident.

 

 

Chronology of the Fire

 

It was most likely that the fire began in the lower forward portion of the left equipment bay, to the left of the command pilot, and considerably below the level of his couch.

 

Once initiated, the fire burned in three stages. The first stage, with its associated rapid temperature rise and increase in cabin pressure, terminated 15 seconds after the verbal report of fire. At this time, 23:31:19 GMT, the command module cabin ruptured. During this first stage, flames moved rapidly from the point of ignition, traveling along debris traps installed in the command module to prevent items from dropping into equipment areas during tests or flight. At the same time, Velcro strips positioned near the ignition point also burned.

 

The fire was not intense until about 23:31:12 GMT. The slow rate of buildup of the fire during the early portion of the first stage was consistent with the opinion that ignition occurred in a zone containing little combustible material. The slow rise of pressure could also have resulted from absorption of most of the heat by the aluminum structure of the command module.

 

The original flames rose vertically and then spread out across the cabin ceiling. The debris traps provided not only combustible material and a path for the spread of the flames, but also firebrands of burning molten nylon. The scattering of these firebrands contributed to the spread of the flames.

 

By 23:31:12 GMT, the fire had broken from its point of origin. A wall of flames extended along the left wall of the module, preventing the command pilot, occupying the left couch, from reaching the valve that would vent the command module to the outside atmosphere.

 

Although operation of this was the first step in established emergency egress procedures, such action would have been to no avail because the venting capacity was insufficient to prevent the rapid buildup of pressure due to the fire. It was estimated that opening the valve would have delayed command module rupture by less than one second.

 

The command module was designed to withstand an internal pressure of approximately 13 pounds per square inch above external pressure without rupturing. Data recorded during the fire showed that this design criterion was exceeded late in the first stage of the fire and that rupture occurred at about 23:31:19 GMT. The point of rupture was where the floor or aft bulkhead of the command module joined the wall, essentially opposite the point of origin of the fire. About three seconds before rupture, at 23:31:16.8 GMT, the final crew communication began. This communication ended shortly after rupture at 23:31:21.8 GMT, followed by loss of telemetry at 23:31:22.4 GMT.

 

Rupture of the command module marked the beginning of the brief second stage of the fire. This stage was characterized by the period of greatest conflagration due to the forced convection that resulted from the outrush of gases through the rupture in the pressure vessel. The swirling flow scattered firebrands throughout the crew compartment, spreading fire. This stage of the fire ended at approximately 23:31:25 GMT. Evidence that the fire spread from the left side of the command module toward the rupture area was found on subsequent examination of the module and crew suits. Evidence of the intensity of the fire includes burst and burned aluminum tubes in the oxygen and coolant systems at floor level.

 

This third stage was characterized by rapid production of high concentrations of carbon monoxide. Following the loss of pressure in the command module and with fire now throughout the crew compartment, the remaining atmosphere quickly became deficient in oxygen so that it could not support continued combustion. Unlike the earlier stages where the flame was relatively smokeless, heavy smoke now formed and large amounts of soot were deposited on most spacecraft interior surfaces as they cooled. The third stage of the fire could not have lasted more than a few seconds because of the rapid depletion of oxygen. It was estimated that the command module atmosphere was lethal by 23:31:30 GMT, five seconds after the start of the third stage.

 

Although most of the fire inside the command module was quickly extinguished because of a lack of oxygen, a localized, intense fire lingered in the area of the environmental control unit. This unit was located in the left equipment bay, near the point where the fire was believed to have started. Failed oxygen and water/glycol lines in this area continued to supply oxygen and fuel to support the localized fire that melted the aft bulkhead and burned adjacent portions of the inner surface of the command module heat shield.

 

 

The Investigation

 

Immediately after the accident, additional security personnel were positioned at Launch Complex 34 and the complex was impounded. Prior to disturbing any evidence, numerous external and internal photographs were taken of the spacecraft. After crew removal, two experts entered the command module to verify switch positions. Small groups of NASA and North American Aviation management, Apollo 204 Review Board members, representatives, and consultants inspected the exterior of Spacecraft 012.

 

A series of close-up stereo photographs of the command module was taken to document the as-found condition of the spacecraft systems. After the couches were removed, a special false floor with removable 18-inch transparent squares was installed to provide access to the entire inside of the command module without disturbing evidence. A detailed inspection of the spacecraft interior was then performed, followed by the preparation and approval by the Board of a command module disassembly plan.

 

Command module 014 was shipped to NASA Kennedy Space Center (KSC) on 1 February 1967 to assist the Board in the investigation. This command module was placed in the Pyrotechnics Installation Building and was used to develop disassembly techniques for selected components prior to their removal from command module 012. By 7 February 1967, the disassembly plan was fully operational. After the removal of each component, photographs were taken of the exposed area. This step-by-step photography was used throughout the disassembly of the spacecraft. Approximately 5,000 photographs were taken.

 

All interfaces such as electrical connectors, tubing joints, physical mounting of components, etc. were closely inspected and photographed immediately prior to, during, and after disassembly. Each item removed from the command module was appropriately tagged, sealed in clean plastic containers, and transported under the required security to bonded storage.

 

On 17 February 1967, the Board decided that removal and wiring tests had progressed to a point which allowed moving the command module without disturbing evidence. The command module was moved to the Pyrotechnics Installation Building at KSC, where better working conditions were available.

 

With improved working conditions, it was found that a work schedule of two eight-hour shifts per day for six days a week was sufficient to keep pace with the analysis and disassembly planning. The only exception to this was a three-day period of three eight-hour shifts per day used to remove the aft heat shield, move the command module to a more convenient workstation and remove the crew compartment heat shield. The disassembly of the command module was completed on 27 March 1967.

 

 

Cause of the Apollo 1 Fire

 

Although the Board was not able to determine conclusively the specific initiator of the Apollo 204 fire, it identified the conditions that led to the disaster. These conditions were:

 

1. A sealed cabin, pressurized with an oxygen atmosphere.

 

2. An extensive distribution of combustible materials in the cabin.

 

3. Vulnerable wiring carrying spacecraft power.

 

4. Vulnerable plumbing carrying a combustible and corrosive coolant.

 

5. Inadequate provisions for the crew to escape.

 

6. Inadequate provisions for rescue or medical assistance.

 

Having identified these conditions, the Board addressed the question of how these conditions came to exist. Careful consideration of this question led the Board to the conclusion that in its devotion to the many difficult problems of space travel, the Apollo team failed to give adequate attention to certain mundane but equally vital questions of crew safety. The Board’s investigation revealed many deficiencies in design and engineering, manufacture, and quality control.

 

As a result of the investigation, major modifications in design, materials, and procedures were implemented. The two-piece hatch was replaced by a single quick-operating, outward opening crew hatch made of aluminum and fiberglass. The new hatch could be opened from inside in seven seconds and by a pad safety crew in 10 seconds. Ease of opening was enhanced by a gas-powered counterbalance mechanism. The second major modification was the change in the launch pad spacecraft cabin atmosphere for pre-launch testing from 100 percent oxygen to a mixture of 60 percent oxygen and 40 percent nitrogen to reduce support of any combustion. The crew suit loops still carried 100 percent oxygen. After launch, the 60/40 mix was gradually replaced with pure oxygen until cabin atmosphere reached 100 percent oxygen at 5 pounds per square inch. This “enriched air” mix was selected after extensive flammability tests in various percentages of oxygen at varying pressures.

 

Other changes included: substituting stainless steel for aluminum in high-pressure oxygen tubing, armor plated water-glycol liquid line solder joints, protective covers over wiring bundles, stowage boxes built of aluminum, replacement of materials to minimize flammability, installation of fireproof storage containers for flammable materials, mechanical fasteners substituted for gripper cloth patches, flameproof coating on wire connections, replacement of plastic switches with metal ones, installation of an emergency oxygen system to isolate the crew from toxic fumes, and the inclusion of a portable fire extinguisher and fire-isolating panels in the cabin.

 

Safety changes were also made at Launch Complex 34. These included structural changes to the White Room for the new quick-opening spacecraft hatch, improved firefighting equipment, emergency egress routes, emergency access to the spacecraft, purging of all electrical equipment in the White Room with nitrogen, installation of a hand-held water hose and a large exhaust fan in the White Room to draw smoke and fumes out, fire-resistant paint, relocation of certain structural members to provide easier access to the spacecraft and faster egress, addition of a water spray system to cool the launch escape system (the solid propellants could be ignited by extreme heat), and the installation of additional water spray systems along the egress route from the spacecraft to ground level.