APOLLO/SATURN V SPACE VEHICLE ----------------------------- The primary flight hardware of the Apollo Program consists of the Saturn V launch vehicle and Apollo spacecraft. Collectively, they are designated the Apollo/Saturn V space vehicle (SV). Selected major systems and subsystems of the space vehicle may be summarized as follows. SATURN V LAUNCH VEHICLE ----------------------- The Saturn V launch vehicle (LV) is designed to boost up to 300,000 pounds into a 105 nautical mile earth orbit and to provide for lunar payloads of over 100,000 pounds. The Saturn V LV consists of three propulsive stages (S-IC, S-II, S-IVB), two interstages, and an instrument unit (IU). S-IC Stage The S-IC stage is a large cylindrical booster, 138 feet long and 33 feet in diameter, powered by five liquid propellant F-1 rocket engines. These engines develop a nominal sea level thrust total of approximately 7,650,000 pounds. The stage dry weight is approximately 288,000 pounds and the total loaded stage weight is approximately 5,031,500 pounds. The S-IC stage interfaces structurally and electrically with the S-II stage. It also interfaces structurally, electrically, and pneumatically with ground support equipment (GSE) through two umbilical service arms, three tail service masts, and certain electronic systems by antennas. The S-IC stage is instrumented for operational measurements or signals which are transmitted by its independent telemetry system. S-II Stage The S-II stage is a large cylindrical booster, 81.5 feet long and 33 feet in diameter, powered by five liquid propellant J-2 rocket engines which develop a nominal vacuum thrust of 230,000 pounds each for a total of 1,150,000 pounds. Dry weight of the S-II stage is approximately 78,050 pounds. The stage approximate loaded gross weight is 1,075,000 pounds. The S- IC/S-II inter-stage weighs 10,460 pounds. The S-II stage is instrumented for operational and research and development measurements which are transmitted by its independent telemetry system. The S-II stage has structural and electrical interfaces with the S-IC and S-IVB stages, and electric, pneumatic, and fluid interfaces with GSE through its umbilicals and antennas. S-IVB Stage The S-IVB stage is a large cylindrical booster 59 feet long and 21.6 feet in diameter, powered by one J-2 engine. The S- IVB stage is capable of multiple engine starts. Engine thrust is 203,000 pounds. This stage is also unique in that it has an attitude control capability independent of its main engine. Dry weight of the stage is 25,050 pounds. The launch weight of the stage is 261,700 pounds. The inter-stage weight of 8,100 pounds is not included in the stated weights. The stage is instrumented for functional measurements or signals which are transmitted by its independent telemetry system. The high performance J-2 engine as installed in the S-IVB stage has a multiple start capability. The S-IVB J-2 engine is scheduled to produce a thrust of 203,000 pounds during its first burn to earth orbit and a thrust of 178,000 pounds (mixture mass ratio of 4.5:1) during the first 100 seconds of translunar injection. The remaining translunar injection acceleration is provided at a thrust level of 203,000 pounds (mixture mass ratio of 5.0:1). The engine valves are controlled by a pneumatic system powered by gaseous helium which is stored in a sphere inside a start bottle. An electrical control system that uses solid stage logic elements is used to sequence the start and shutdown operations of the engine. Instrument Unit The Saturn V launch vehicle is guided from its launch pad into earth orbit primarily by navigation, guidance, and control equipment located in the instrument unit (IU). The instrument unit is a cylindrical structure 21.6 feet in diameter and 3 feet high installed on top of the S-IVB stage. The unit weighs 4,310 pounds and contains measurements and telemetry, command communications, tracking, and emergency detection system components along with supporting electrical power and the environmental control system. APOLLO SPACECRAFT ----------------- The Apollo spacecraft (S/C) is designed to support three men in space for periods up to 2 weeks, docking in space, landing on and returning from the lunar surface, and safely entering the earth's atmosphere. The Apollo S/C consists of the spacecraft-to-LM adapter (SLA), the service module (SM), the command module (CM), the launch escape system (LES), and the lunar module (LM). The CM and SM as a unit are referred to as the command and service module (CSM). Spacecraft-to-LM Adapter The SLA is a conical structure which provides a structural load path between the LV and SM and also supports the LM. Aerodynamically, the SLA smoothly encloses the irregularly shaped LM and transitions the space vehicle diameter from that of the upper stage of the LV to that of the SM. The SLA also encloses the nozzle of the SM engine and the high gain antenna. Spring thrusters are used to separate the LM from the SLA. After the CSM has docked with the LM, mild charges are fired to release the four adapters-which secure the LM in the SLA. Simultaneously, four spring thrusters mounted on the lower (fixed) SLA panels push against the LM landing gear truss assembly to separate the spacecraft from the launch vehicle. Service Module -------------- The service module (SM) provides the main spacecraft propulsion and maneuvering capability during a mission. The SM provides most of the spacecraft consumables (oxygen, water, propellant, and hydrogen) and supplements environmental, electrical power, and propulsion requirements of the CM. The SM remains attached to the CM until it is jettisoned just before CM atmospheric entry. Structure. The basic structural components are forward and aft (upper and lower) bulkheads, six radial beams, four sector honeycomb panels, four reaction control system honeycomb panels, aft heat shield, and a fairing. The forward and aft bulkheads cover the top and bottom of the SM. Radial beam trusses extending above the forward bulkhead support and secure the CM. The radial beams are made of a solid aluminum alloy which has been machined and chem-milled to thicknesses varying between 2 inches and ,018 inch; three of these beams have compression pads and the other three have shear-compression pads and tension ties. Explosive charges in the center section of these tension ties are used to separate the CM from the SM. An aft heat shield surrounds the service propulsion engine to protect the SM from the engine's heat during thrusting. The gap between the CM and the forward bulkhead of the SM is closed off with a fairing which is composed of eight electrical power system radiators alternated with eight aluminum honeycomb panels. The sector and reaction control system panels are 1 inch thick and are made of aluminum honeycomb core between two aluminum face sheets. The sector panels are bolted to the radial beams. Radiators used to dissipate heat from the environmental control subsystem are bonded to the sector panels on opposite sides of the SM. These radiators are each about 30 square feet in area. The SM interior is divided into six sectors, or bays, and a center section. Sector one is currently void. It is available for installation of scientific or additional equipment should the need arise. Sector two has part of a space radiator and a reaction control system (RCS) engine quad (module) on its exterior panel and contains the service propulsion system (SPS) oxidizer sump tank. This tank is the larger of the two tanks that hold the oxidizer for the SPS engine. Sector three has the rest of the space radiator and another RCS engine quad on its exterior panel and contains the oxidizer storage tank. This tank is the second of two SPS oxidizer tanks and feeds the oxidizer sump tank in sector two. Sector four contains most of the electrical power generating equipment. It contains three fuel cells, two cryogenic oxygen and two cryogenic hydrogen tanks, and a power control relay box. The cryogenic tanks supply oxygen to the environmental control sub-system and oxygen and hydrogen to the fuel cells. Sector five has part of an environmental control radiator and an RCS engine quad on the exterior panel and contains the SPS engine fuel sump tank. This tank feeds the engine and is also connected by feed lines to the storage tank in sector six. Sector six has the rest of the environmental control radiator and an RCS engine quad on its exterior and contains the SPS engine fuel storage tank which feeds the fuel sump tank in sector five. The center section contains two helium tanks and the SPS engine. The tanks are used to provide helium pressurant for the SPS propellant tanks. Propulsion. Main spacecraft propulsion is provided by the 20,500 pound thrust SPS. The SPS engine is a restartable, non- throttleable engine which uses nitrogen tetroxide (N2O4) as an oxidizer and a 50-50 mixture of hydrazine and unsymmetrical- dimethylhydrazine (UDMX) as fuel. (These propellants are hypergolic, i.e., they burn spontaneously when combined, without need for an igniter.) This engine is used for major velocity changes during the mission, such as mid-course corrections, lunar orbit insertion, trans-earth injection, and CSM aborts. The SPS engine responds to automatic firing commands from the guidance and navigation system or to commands from manual controls. The engine assembly is gimbal-mounted to allow engine thrust-vector alignment with the spacecraft center of mass to preclude tumbling. Thrust-vector alignment control is maintained by the crew. The SM RCS provides for maneuvering about and along three axes. Additional SM systems. In addition to the systems already described, the SM has communication antennas, umbilical connections, and several exterior mounted lights. The four antennas on the outside of the SM are the steerable S-band high- gain antenna, mounted on the aft bulkhead; two VHF omnidirectional antennas, mounted on opposite sides of the module near the top; and the rendezvous radar transponder antenna, mounted in the SM fairing. Seven lights are mounted in the aluminum panels of the fairing. Four lights (one red, one green, and two amber) are used to aid the astronauts in docking: one is a floodlight which can be turned on to give astronauts visibility during extravehicular activities, one is a flashing beacon used to aid in rendezvous, and one is a spotlight used in rendezvous from 500 feet to docking with the LM. SM/CM separation. Separation of the SM from the CM occurs shortly before entry. The sequence of events during separation is controlled automatically by two redundant service module jettison controllers (SMUC) located on the forward bulkhead of the SM. Command Module -------------- The command module (CM) serves as the command, control, and communications center for most of the mission. Supplemented by the SM, it provides all life support elements for three crewmen in the mission environments and for their safe return to the earth's surface. It is capable of attitude control about three axes and some lateral lift translation at high velocities in earth atmosphere. It also permits LM attachment, CM/LM ingress and egress, and serves as a buoyant vessel in open ocean. Structure. The CM consists of two basic structures joined together: the inner structure (pressure shell) and the outer structure (heat shield). The inner structure, the pressurized crew compartment, is made of an aluminum sandwich construction consisting of a welded aluminum inner skin, a bonded aluminum honeycomb core, and an outer face sheet. The outer structure is basically a heat shield and is made of stainless steel-brazed- honeycomb brazed between steel alloy face sheets. Parts of the area between the inner and outer sheets are filled with a layer of fibrous insulation as additional heat protection. Display and controls. The main display console (MDC) has been arranged to provide for the expected duties of crew members. These duties fall into the categories of Commander, CM Pilot, and LM Pilot, occupying the left, center, and right couches, respectively. The CM Pilot also acts as the principal navigator. All controls have been designed so they can be operated by astronauts wearing gloves. The controls are predominantly of four basic types: toggle switches, rotary switches with click-stops, thumb-wheels, and push buttons. Critical switches are guarded so that they cannot be thrown inadvertently. In addition, some critical controls have locks that must be released before they can be operated. Flight controls are located on the left center and left side of the MDC, opposite the Commander. These include controls for such subsystems as stabilization and control, propulsion, crew safety, earth landing, and emergency detection. One of two guidance and navigation computer panels also is located here, as are velocity, attitude, and altitude indicators. The CM Pilot faces the center of the console, and thus can reach many of the flight controls, as well as the system controls on the right side of the console. Displays and controls directly opposite him include reaction control, propellant management, caution and warning, environmental control, and cryogenic storage systems. The rotation and translation controllers used for attitude, thrust vector, and translation maneuvers are located on the arms of two crew couches. In addition, a rotation controller can be mounted at the navigation position in the lower equipment bay. Critical conditions of most spacecraft systems are monitored by a caution and warning system. A malfunction or out-of-tolerance condition results in illumination of a status light that identifies the abnormality. It also activates the master alarm circuit, which illuminates two master alarm lights on the MDC and one in the lower equipment bay and sends an alarm tone to the astronauts' headsets. The master alarm lights and tone continue until a crewman resets the master alarm circuit. This can be done before the crewmen deal with the problem indicated. The caution and warning system also contains equipment to sense its own malfunctions. Lunar Module ------------ The lunar module (LM) is designed to transport two men safely from the CSM, in lunar orbit, to the lunar surface, and return them to the orbiting CSM. The LM provides operational capabilities such as communications, telemetry, environmental support, transportation of scientific equipment to the lunar surface, and returning surface samples with the crew to the CSM. The lunar module consists of two stages: the ascent stage and the descent stage. The stages are attached at four fittings by explosive bolts. Separable umbilicals and hardline connections provide subsystem continuity to operate both stages as a single unit until separate ascent stage operation is desired. The LM is designed to operate for 48 hours after separation from the CSM, with a maximum lunar stay time of 44 hours. Table 3-I is a weight summary of the Apollo/Saturn 5 space vehicle for the Apollo 13 mission. Main Propulsion Main propulsion is provided by the descent pro- pulsion system (DPS) and the ascent propulsion system (APS). Each system is wholly independent of the other. The DPS provides the thrust to control descent to the lunar surface. The APS can provide the thrust for ascent from the lunar surface. In case of mission abort, the APS and/or DPS can place the LM into a rendezvous trajectory with the CSM from any point in the descent trajectory. The choice of engine to be used depends on the cause for abort, on how long the descent engine has been operating, and on the quantity of propellant remaining in the descent stage. Both propulsion systems use identical hypergolic propellants. The fuel is a 50-50 mixture of hydrazine and unsymmetrical- dimethylhydrazine and the oxidizer is nitrogen tetroxide. Gaseous helium pressurizes the propellant feed systems. Helium storage in the DPS is at cryogenic temperatures in the super-critical state and in the APS it is gaseous at ambient temperatures. Ullage for propellant settling is required prior to descent engine start and is provided by the +X axis reaction engines. The descent engine is gimbaled, throttleable, and restartable. The engine can be throttled from 1,050 pounds of thrust to 6,300 pounds. Throttle positions above this value automatically produce full thrust to reduce combustion chamber erosion. Nominal full thrust is 9,870 pounds. Gimbal trim of the engine compensates for a changing center of gravity of the vehicle and is automatically accomplished by either the primary guidance and navigation system (PGNS) or the abort guidance system (AGS). Automatic throttle and on/off control is available in the PGNS mode of operation. The AGS commands on/off operation but has no automatic throttle control capability. Manual control capability of engine firing functions has been provided. Manual thrust control override may, at any time, command more thrust than the level commanded by the LM guidance computer (LGC). The ascent engine is a fixed, non-throttleable engine. The engine develops 3,500 pounds of thrust, sufficient to abort the lunar descent or to launch the ascent stage from the lunar surface and place it in the desired lunar orbit. Control modes are similar to those described for the descent engine. The APS propellant is contained in two spherical titanium tanks, one for oxidizer and the other for fuel. Each tank has a volume of 36 cubic feet. Total fuel weight is 2,008 pounds, of which 71 pounds are unusable. Oxidizer weight is 3,170 pounds, of which 92 pounds are unusable. The APS has a limit of 35 starts, must have a propellant bulk temperature between 50ø F. and 90ø F. prior to start, must not exceed 460 seconds of burn time, and has a system life of 24 hours after pressurization. Electrical power system. The electrical power system (EPS) contains six batteries which supply the electrical power requirements of the LM during un-docked mission phases. Four batteries are located in the descent stage and two in the ascent stage. Batteries for the explosive devices system are not included in this system description. Postlaunch LM power is supplied by the descent stage batteries until the LM and CSM are docked. While docked, the CSM supplies electrical power to the LM up to 296 watts (peak). During the lunar descent phase, the two ascent stage batteries are paralleled with the descent stage batteries for additional power assurance. The descent stage batteries are utilized for LM lunar surface operations and checkout. The ascent stage batteries are brought on the line just before ascent phase staging. All batteries and busses may be individually monitored for load, voltage, and failure. Several isolation and combination modes are provided. Two inverters, each capable of supplying full load, convert the DC to AC for 115 volt, 400 hertz supply. Electrical power is distributed by the following busses: LM Pilot's DC bus, Commander's DC bus, and AC busses A and B. The four descent stage silver-zinc batteries are identical and have a 400 ampere-hour capacity at 28 volts. Because the batteries do not have a constant voltage at various states of charge/load levels, "high" and "low" voltage taps are provided for selection. The "low voltage" tap is selected to initiate use of a fully charged battery. Cross-tie circuits in the busses facilitate an even discharge of the batteries regardless of distribution combinations. The two silver-zinc ascent stage batteries are identical to each other and have a 296 ampere-hour capacity at 28 volts. The ascent stage batteries are normally connected in parallel for even discharge. Because of design load characteristics, the ascent stage batteries do not have and do not require high and low voltage taps. Nominal voltage for ascent stage and descent stage batteries is 30.0 volts. Reverse current relays for battery failure are one of many components designed into the FPS to enhance EPS reliability. Cooling of the batteries is provided by the environmental control system cold rail heat sinks. Available ascent electrical energy is 17.8 kilowatt hours at a maximum drain of 50 amps per battery, and descent energy is 46.9 kilowatt hours at a maximum drain of 25 amps per battery. MISSION MONITORING, SUPPORT, AND CONTROL ---------------------------------------- Mission execution involves the following functions: pre-launch checkout and launch operations; tracking the space vehicle to determine its present and future positions; securing information on the status of the flight crew and space vehicle systems (via telemetry); evaluation of telemetry information; commanding the space vehicle by transmitting real-time and updata commands to the onboard computer; and voice communication between flight and ground crews. These functions require the use of a facility to assemble and launch the space vehicle (see Launch Complex), a central flight control facility, a network of remote stations located strategically around the world, a method of rapidly transmitting and receiving information between the space vehicle and the central flight control facility, and a real-time data display system in which the data are made available and presented in usable form at essentially the same time that the data event occurred. The flight crew and the following organizations and facilities participate in mission control operations: a. Mission Control Center (MCC), Manned Spacecraft Center (MSC), Houston, Texas. The MCC contains the communication, computer display, and command systems to enable the flight controllers to effectively monitor and control the space vehicle. b. Kennedy Space Center (KSC), Cape Kennedy, Florida. The space vehicle is launched from KSC and controlled from the Launch Control Center (LCC). Prelaunch, launch, and powered flight data are collected at the Central Instrumentation Facility (CIF) at KSC from the launch pads, CIF receivers, Merritt Island Launch Area (MILA), and the down-range Air Force Eastern Test Range (AFETR) stations. These data are transmitted to MCC via the Apollo Launch Data System (ALDS). Also located at KSC (AFETR) is the Impact Predictor (IP), for range safety purposes. c. Goddard Space Flight Center (GSFC), Greenbelt, Maryland. GSFC manages and operates the Manned Space Flight Network (MSFN) and the NASA communications (NASCOM) network. During flight, the MSFN is under the operational control of the MCC. d. George C. Marshall Space Flight Center (MSFC), Huntsville, Alabama. MSFC, by means of the Launch Information Exchange Facility (LIEF) and the Huntsville Operations Support Center (HOSC) provides launch vehicle systems real-time support to KSC and MCC for preflight, launch, and flight operations. Vehicle Flight Control Capability Flight operations are controlled from the MCC. The MCC has two flight control rooms, but only one control room is used per mission. Each control room, called a Mission Operations Control Room (MOCR), is capable of controlling individual Staff Support Rooms (SSR's) located adjacent to the MOCR. The SSR's are manned by flight control specialists who provide detailed support to the MOCR. The consoles within the MOCR and SSR's permit the necessary interface between the flight controllers and the spacecraft. The displays and controls on these consoles and other group displays provide the capability to monitor and evaluate data concerning the mission and, based on these evaluations, to recommend or take appropriate action on matters concerning the flight crew and spacecraft. Problems concerning crew safety and mission success are identified to flight control personnel in the following ways: a. Flight crew observations b. Flight controller real-time observations c. Review of telemetry data received from tape recorder playback d. Trend analysis of actual and predicted values e. Review of collected data by systems specialists f. Correlation and comparison with previous mission data g. Analysis of recorded data from launch complex testing APOLLO 13 MISSION DESCRIPTION ----------------------------- PRIMARY MISSION OBJECTIVES The primary mission objectives were as follows: Perform selenological inspection, survey, and sampling of materials in a preselected region of the Fra Mauro Formation. Deploy and activate an Apollo Lunar Surface Experiments Package (ALSEP). Develop man's capability to work in the lunar environment. Obtain photographs of candidate exploration sites. Launch and Earth Parking Orbit Apollo 13 was successfully launched on schedule from Launch Complex 39A, Kennedy Space Center, Florida, at 2:13 p.m. EST, April 11, 1970. The launch vehicle stages inserted the S-IVB/ instrument unit (IU)/ spacecraft combination into an earth parking orbit with an apogee of 100.2 nautical miles (n. mi.) and a perigee of 98.0 n. mi. (100 n. mi. circular planned). During second stage boost, the center engine of the S-IC stage cut off about 132 seconds early, causing the remaining four engines to burn approximately 34 seconds longer than predicted. Space vehicle velocity after S-II boost was 223 feet per second (fps) lower than planned. As a result, the S-IVB orbital insertion burn was approximately 9 seconds longer than predicted with cutoff velocity within about 1.2 fps of planned. Total launch vehicle burn time was about 44 seconds longer than predicted. A greater than 3-sigma probability of meeting trans-lunar injection (TLI) cutoff conditions existed with remaining S-IVB propellants. After orbital insertion, all launch vehicle and spacecraft systems were verified and preparation was made for trans-lunar injection (TLI). Onboard television was initiated at 01:35 ground elapsed time (g.e.t.) for about 5.5 minutes. The second S-IVB burn was initiated on schedule for TLI. All major systems operated satisfactorily and all end conditions were nominal for a free-return circumlunar trajectory. Trans-lunar Coast The CSM separated from the LM/IU/S-IVB at about 03:07 g.e.t. On- board television was then initiated for about 72 minutes and clearly showed CSM "hard docking" -- ejection of the CSM/LM from the S-IVB at about 04:01 g.e.t., and the S-IVB auxiliary propulsion system (APS) evasive maneuver as well as spacecraft interior and exterior scenes. The SM RCS propellant usage for the separation, transposition, docking, and ejection was nominal. All launch vehicle safing activities were performed as scheduled. The S-IVB APS evasive maneuver (by an 8-second APS ullage burn) was initiated at 04:18 g.e.t. and was successfully completed. The liquid oxygen dump was initiated at 04:39 g.e.t. and was also successfully accomplished. The first S-IVB ALPS burn for lunar target point impact was initiated at 06:00 g.e.t. The burn duration was 217 seconds, producing a differential velocity of approximately 28 fps. Tracking information available at 08:00 g.e.t. indicated that the S-IVB/IU would impact the lunar surface at 6ø 53' S., 30ø 53' W. versus the targeted 3ø S., 30ø W. Therefore, the second S-IVB APS (trim) burn was not required. The gaseous nitrogen pressure dropped in the IU ST-124-M3 inertial platform at 18:25 g.e.t. and the S-IVB/IU no longer had attitude control but began tumbling slowly. At approximately 19:17 g.e.t., a step input in tracking data indicated a velocity increase of approximately 4 to 5 fps. No conclusions have been reached on the reason for this increase. The velocity change altered the lunar impact point closer to the target. The S-IVB/IU impacted the lunar surface at 77:56:40 g.e.t. (08:09:40 p m. e.s.t. April 14) at 2.4ø S., 27.9ø W., and the seismometer deployed during the Apollo l2 mission successfully detected the impact. The targeted impact point was 125 n. mi. from the seismometer. The actual impact point was 74 n. mi. from the seismometer, well within the desired 189 n. mi. (350 km) radius. The accuracy of the TLI maneuver was such that spacecraft mid-course correction No. 1 (MCC-1), scheduled for 11:41 g.e.t., was not required. MCC-2 was performed as planned at 30:41 g.e.t. and resulted in placing the spacecraft on the desired, non-free- return circum-lunar trajectory with a predicted closest approach to the moon of 62 n. mi. All SPS burn parameters were normal. The accuracy of MCC-2 was such that MCC-3, scheduled for 55:26 g.e.t., was not performed. Good quality television coverage of the preparations and performance of MCC-2 was received for 49 minutes beginning at 30:13 g.e.t. At approximately 55:55 g.e.t. (10:08 p.m. EST), the crew reported an undervoltage alarm on the CSM main bus B. Pressure was rapidly lost in SM oxygen tank no. 2 and the current in fuel cells 1 and 3 dropped to zero due to loss of their oxygen supply. At this point, the decision was made to abort the mission. The increased load on fuel cell 2 and decaying pressure in the remaining oxygen tank led to the decision to activate the LM, power down the CSM, and use the LM systems for life support. At 61:30 g.e.t., a 38 fps mid-course maneuver (MCC-4) was performed by the LM DPS to place the spacecraft in a free-return trajectory on which the CM would nominally land in the Indian Ocean south of Mauritius at approximately 152:00 g.e.t. Trans-earth Coast At pericynthion plus 2 hours ("PC+2", 79:28 g.e.t.), a LM DPS maneuver was performed to shorten the return trip time and move the earth landing point. The 263.4 second burn produced a delta V (differential velocity) of 860.5 fps and resulted in an initial predicted earth landing point in the mid-Pacific Ocean at 142:53 g.e.t. Both LM guidance systems were powered up and the primary system was used for this maneuver. Following the maneuver, passive thermal control (firing the RCS engine quad clusters to put the CSM/LM into a slow roll, to allow incident solar energy to fall on the entire surface of both CSM/LM, to reduce the load on the ECS) was established, and the LM was powered down to conserve consumables; only the LM environmental control system (ECS) and communications and telemetry systems were kept powered up. The LM DPS was used to perform MCC-5 at 105:19 g.e.t. The 14 second burn (at 10% throttle) produced a delta V of about 7.8 fps and successfully raised the entry flight path angle to -6.52ø. The CSM was partially powered up for a check of the thermal conditions of the CM, with first reported receipt of S-band signal at 101:53 g.e.t. Thermal conditions on all CSM systems observed appeared to be in order for entry. Due to the unusual spacecraft configuration, new procedures leading to entry were developed and verified in ground-based simulations. The resulting timeline called for a final mid-course correction (MCC-7) at entry interface (EI) -5 hours, jettison of the SM at EI -4.5 hours, then jettison of the LM at EI -1 hour prior to a normal atmospheric entry by the CM. MCC-7 was successfully accomplished at 137:40 g.e.t. The 22.4- second LM RCS maneuver resulted in a predicted entry flight path angle of -6.49ø. The SM was jettisoned at 138:02 g.e.t. The crew viewed and photographed the SM and reported that an entire panel was missing near the S-band high-gain antenna and a great deal of debris was hanging out. The CM was powered up and then the LM was jettisoned at 141:30 g.e.t. The EI at 40,000 feet was reached at 142:41 g.e.t. Entry and Recovery Weather in the prime recovery area was as follows: broken stratus clouds at 2,000 feet; visibility 10 miles; 6 knot ENE winds; and wave height 1 to 2 feet. Drogue and main parachutes deployed normally. Visual contact with the spacecraft was reported at 142:50 g.e.t. Landing occurred at 142:54:41 g.e.t. (01:07:41 p.m. EST, April 17). The landing point was in the mid-Pacific Ocean, approximately 21ø40' S., 165ø22' W. The CM landed in the Stable 1 position about 3.5 n. mi. from the prime recovery ship, the helicopter carrier USS IWO JIMA. The crew, picked up by a recovery helicopter, was safe aboard the ship at 1:53 p.m. EST, less than an hour after landing. REVIEW AND ANALYSIS OF APOLLO 13 ACCIDENT ----------------------------------------- PART 1. INTRODUCTION It became clear in the course of the Board's review that the accident during the Apollo 13 mission was initiated in the service module cryogenic oxygen tank no. 2. Therefore, the following analysis centers on that tank and its history. In addition, the recovery steps taken in the period beginning with the accident and continuing to reentry are discussed. Two oxygen tanks essentially identical to oxygen tank no. 2 on Apollo 13, and two hydrogen tanks of similar design, operated satisfactorily on several unmanned Apollo flights and on the Apollo 7, 8, 9, 10, 11, and 12 manned missions. With this in mind, the Board placed particular emphasis on each difference in the history of oxygen tank no. 2 from the history of the earlier tanks, in addition to reviewing the design, assembly, and test history. OXYGEN TANK NO. 2 HISTORY DESIGN ------ On February 26, 1966, the North American Aviation Corporation, now Rockwell International, prime contractor for the Apollo command and service modules (CSM), awarded a subcontract to the Beech Aircraft Corporation (Beech) to design, develop, fabricate, assemble, test, and deliver the Block II Apollo cryogenic gas storage subsystem. This was a follow-on to an earlier subcontract under which the somewhat different Block I subsystem was procured. Each oxygen tank has an outer shell and an inner shell, arranged to provide a vacuum space to reduce heat leak, and a dome enclosing paths into the tank for transmission of fluids and electrical power and signals. The space between the shells and the space in the dome are filled with insulating materials. Mounted in the tank are two tubular assemblies. One, called the heater tube, contains two thermostatically protected heater coils and two small fans driven by 1,800 rpm motors to stir the tank contents. The other, called the quantity probe, consists of an upper section which supports a cylindrical capacitance gauge used to measure electrically the quantity of fluid in the tank. The inner cylinder of this probe serves both as a fill and drain tube and as one plate of the capacitance gauge. In addition, a temperature sensor is mounted on the outside of the quantity probe near the head. Wiring for the gauge, the temperature sensor, the fan motors, and the heaters passes through the head of the quantity probe to a conduit in the dome. From there, the wiring runs to a connector which ties it electrically to the appropriate external circuits in the CSM. The fill line from the exterior of the SM enters the oxygen tank and connects to the inner cylinder of the capacitance gauge through a coupling of two Teflon adapters or sleeves and a short length of Inconel tubing. The dimensions and tolerances selected are such that if "worst case" variations in an actual system were to occur, the coupling might not reach from the fill line to the gauge cylinder. Thus, the variations might be such that a very loose fit would result. The supply line from the tank leads from the head of the quantity probe to the dome and then, after passing around the tank between the inner and outer shells, exits through the dome to supply oxygen to the fuel cells in the service module (SM) and the environmental control system (ECS) in the command module (CM). The supply line also connects to a relief valve. Under normal conditions, pressure in the tank is measured by a pressure gauge in the supply line and a pressure switch near this gauge is provided to turn on the heaters in the oxygen tank if the pressure drops below a pre-selected value. This periodic addition of heat to the tank maintains the pressure at a sufficient level to satisfy the demand for oxygen as tank quantity decreases during a flight mission. The oxygen tank is designed for a capacity of 320 pounds of super-critical oxygen at pressures ranging between 865 to 935 pounds per square inch absolute (psia). The tank is initially filled with liquid oxygen at -297ø F. and operates over the range from -340ø F. to +80ø F. (The term "super-critical" means that the oxygen is maintained at a temperature and pressure which assures that it is in a homogeneous, single-phase "fluid" state.) The burst pressure of the oxygen tank is about 2,200 psi at -150ø F., over twice the normal operating pressure at that temperature. The relief valve is designed to relieve pressure in the oxygen tank overboard at a pressure of approximately 1,000 psi. The oxygen tank dome is open to the vacuum between the inner and outer tank shell and contains a rupture disc designed to blow out at about 75 psi. THE OXYGEN TANK & ITS SHELF --------------------------- Two oxygen tanks are mounted on a shelf in bay 4 of the SM. The bottom of the oxygen shelf houses some of the oxygen system instrumentation and wiring, largely covered by insulation. MANUFACTURE ----------- The manufacture of oxygen tank no. 2 began in 1966. Under subcon- tracts with Beech, the inner shell of the tank was manufactured by the Airite Products Division of Electrada Corporation; the quantity probe was made by Simmonds Precision Products, Inc., and the fans and fan motors were produced by Globe Industries, Inc. The Beech serial number assigned to the oxygen tank no. 2 flown in the Apollo 13 was 10024XTA0008. It was the eighth Block II oxygen tank built. Twenty-eight Block I oxygen tanks had previously been built by Beech. The design of the oxygen tank is such that once the upper and lower halves of the inner and outer shells are assembled and welded, the heater assembly must be inserted in the tank, moved to one side, and bolted in place. Then the quantity probe is inserted into the tank and the heater assembly wires (to the heaters, the thermostats, and the fan motors) must be pulled through the head of the quantity probe and the 32 inch coiled conduit in the dome. Thus, the design requires during assembly a substantial amount of wire movement inside the tank, where movement cannot be readily observed, and where possible damage to wire insulation by scraping or flexing cannot be easily detected before the tank is capped off and welded closed. Several minor manufacturing flaws were discovered in oxygen tank no. 2 in the course of testing. A porosity in a weld on the lower half of the outer shell necessitated grinding and rewelding. Re-welding was also required when it was determined that incorrect welding wire had been inadvertently used for a small weld on a vacuum pump mounted on the outside of the tank dome. The upper fan motor originally installed was noisy and drew excessive current. The tank was disassembled and the heater assembly, fans, and heaters were replaced with a new assembly and new fans. The tank was then assembled and sealed for the second time, and the space between the inner and outer shells was pumped down over a 28-day period to create the necessary vacuum. TANK TESTS AT BEECH ------------------- Acceptance testing of oxygen tank no. 2 at Beech included extensive dielectric, insulation, and functional tests of heaters, fans, and vacuum pumps. The tank was then leak-tested at 500 psi and proof tested at 1,335 psi with helium. After the helium proof test, the tank was filled with liquid oxygen and pressurized to a proof pressure of 1,335 psi by use of the tank heaters powered by 65 V AC. Extensive heat-leak tests were run at 900 psi for 25 to 30 hours over a range of ambient conditions and out-flow rates. At the conclusion of the heat- leak tests, about 100 pounds of oxygen remained in the tank. About three-fourths of this was released by venting the tank at a controlled rate through the supply line to about 20 psi. The tank was then emptied by applying warm gas at about 30 psi to the vent line to force the liquid oxygen (LOX) in the tank out the fill line. No difficulties were recorded in this de-tanking operation. The acceptance test indicated that the rate of heat leak into the tank was higher than permitted by the specifications. After some re-working, the rate improved, but was still somewhat higher than specified. The tank was accepted with a formal waiver of this condition. Several other minor discrepancies were also accepted. these included oversized holes in the support for the electrical plug in the tank dome, and an oversized rivet hole in the heater assembly just above the lower fan. None of these items were serious, and the tank was accepted, filled with helium at 5 psi, and shipped to Rockwell on May 3, 1967. ASSEMBLY AND TEST AT ROCKWELL ----------------------------- The assembly of oxygen shelf serial number 0632AAG3277, with Beech oxygen tank serial number 10024XTA0009 as oxygen tank no. 1 and serial number 10024XTA0008 as oxygen tank no. 2, was completed on March 11, 1968. The shelf was to be installed in SM 106 for flight in the Apollo 10 mission. Beginning on April 27, the assembled oxygen shelf underwent standard proof-pressure, leak, and functional checks. One valve on the shelf leaked and was repaired, but no anomalies were noted with regard to oxygen tank no. 2, and therefore no re-work of oxygen tank no. 2 was required. None of the oxygen tank testing at Rockwell required use of LOX in the tanks. On June 4, 1968, the shelf was installed in SM 106. Between August 3 and August 8, 1968, testing of the shelf in the SM was conducted. No anomalies were noted. Due to electromagnetic interference problems with the vacuum-ion pumps on cryogenic tank domes in earlier Apollo spacecraft, a modification was introduced and a decision was made to replace the complete oxygen shelf in SM 106. An oxygen shelf with approved modifications was prepared for installation in SM 106. On October 21, 1968, the oxygen shelf was removed from SM 106 for the required modification and installation in a later spacecraft. After various lines and wires were disconnected and bolts which hold the shelf in the SM were removed, a fixture suspended from a crane was placed under the shelf and used to lift the shelf and extract it from the bay. One shelf bolt was mistakenly left in place during the initial attempt to remove the shelf; and as a consequence, after the front of the shelf was raised about two inches, the fixture broke, allowing the shelf to drop back into place. Photographs of the underside of the fuel cell shelf in SM 106 indicate that the close-out cap on the dome of oxygen tank no. 2 may have struck the underside of that shelf during this incident. At the time, however, it was believed that the oxygen shelf had simply dropped back into place and an analysis was performed to calculate the forces resulting from a drop of two inches. It now seems likely that the shelf was first accelerated upward and then dropped. The remaining bolt was then removed, the incident recorded, and the oxygen shelf was removed without further difficulty. Following removal, the oxygen shelf was re-tested to check shelf integrity, including proof-pressure tests, leak tests, and functional tests of pressure transducers and switches, thermal switches, and vacuum-ion pumps. Cryogenic testing was conducted. Visual inspection revealed no problems. These tests would have disclosed external leakage or serious internal malfunctions of most types, but would not disclose fill line leakage within oxygen tank no. 2. Further calculations and tests conducted during this investigation, however, have indicated that the forces experienced by the shelf were probably close to those originally calculated, assuming only a two inch drop. The probability of tank damage from this incident, therefore, is now considered to be rather low, although it is possible that a loosely fitting fill tube could have been displaced by the event. The shelf passed these tests and was installed in SM 109 on November 22, 1968. The shelf tests accomplished earlier in SM 106 were repeated in SM 109 in late December and early January, with no significant problems, and SM 109 was shipped to Kennedy Space Center (KSC) in June of 1969 for further testing, assembly on the launch vehicle, and launch. TESTING AT KSC -------------- At the Kennedy Space Center, the CM and the SM were mated, checked, assembled on the Saturn V launch vehicle, and the total vehicle was moved to the launch pad. The countdown demonstration test (CDDT) began on March 16, 1970. Up to this point, nothing unusual about oxygen tank no. 2 had been noted during the extensive testing at KSC. The oxygen tanks were evacuated to a pressure of 5mm Hg, followed by an oxygen pressure of about 80 psi. After the cooling of the fuel cells, cryogenic oxygen loading and tank pressurization to 331 psi were completed without abnormalities. At the time during CDDT when the oxygen tanks are normally partially emptied to about 50 percent of capacity, oxygen tank no. 1 behaved normally, but oxygen tank no. 2 only went down to 92 per cent of its capacity. The normal procedure during CDDT to reduce the quantity in the tank is to apply gaseous oxygen at 80 psi through the vent line and to open the fill line. When this procedure failed, it was decided to proceed with the CDDT until completion and then look at the oxygen de-tanking problem in detail. An Interim Discrepancy Report was written and transferred to a Ground Support Equipment (GSE) Discrepancy Report, since a GSE filter was suspected. On Friday, March 27, 1970, de-tanking operations were resumed, after discussions of the problem had been held, with KSC, MSC, Rockwell, and Beech personnel participating, either personally, or by telephone. As a first step, oxygen tank no. 2, which had self-pressurized to 178 psi and was about 83 percent full, was vented through its fill line. The quantity decreased to 65 per cent. Further discussions between KSC, MSC, Rockwell, and Beech personnel considered that the problem might be due to a leak in the path between the fill line and the quantity probe due to loose fit in the sleeves and tube. Such a leak would allow the gaseous oxygen (GOX) being supplied to the vent line to leak directly to the fill line without forcing any significant amount of LOX out of the tank. At this point, a discrepancy report against the spacecraft system was written. A "normal" de-tanking procedure was then conducted on both oxygen tanks, pressurizing through the vent line and opening the fill lines. Tank no. 1 emptied in a few minutes. Tank no. 2 did not. Additional attempts were made with higher pressures without effect, and a decision was made to try to "boil off" the remaining oxygen in tank no. 2 by use of the tank heaters. The heaters were energized with the 65V DC GSE power supply, and, about 1« hours later, the fans were turned on to add more heat and mixing. After 6 hours of heater operation, the quantity had only decreased to 35 per cent, and it was decided to attempt a pressure cycling technique. With the heaters and fans still energized, the tank was pressurized to about 300 psi, held for a few minutes, and then vented through the fill line. The first cycle produced a 7 per cent quantity decrease, and the process was continued, with the tank emptied after five pressure/vent cycles. The fans and heaters were turned off after about 8 hours of heater operation. Suspecting the loosely fitting fill line connection to the quantity probe inner cylinder, KSC personnel consulted with cognizant personnel at MSC and Rockwell and decided to test whether the oxygen tank no. 2 could be filled without problems. It was decided that if the tank could be filled, the leak in the fill line would not be a problem in flight, since it was felt that even a loose tube resulting in an electrical short between the capacitance plates of the quantity gauge would result in an energy level too low to cause any other damage. Replacement of the oxygen shelf in the CM would have been difficult and would have taken at least 45 hours. In addition, shelf replacement would have had the potential of damaging or degrading other elements of the SM in the course of replacement activity. Therefore, the decision was made to test the ability to fill oxygen tank no. 2 on March 30, 1970 -- twelve days prior to the scheduled Saturday, April 11 launch -- so as to be in a position to decide on shelf replacement well before the launch date. Accordingly, flow tests with GOX were run on oxygen tank no. 2 and on oxygen tank no. 1 for comparison. No problems were encountered, and the flow rates in the two tanks were similar. In addition, Beech was asked to test the electrical energy level reached in the event of a short circuit between plates of the quantity probe capacitance gauge. This test showed that very low energy levels would result. On the filling test, oxygen tanks no. 1 and no. 2 were filled with LOX to about 20 per cent of capacity on March 30 with no difficulty. Tank no. 1 emptied in the normal manner, but emptying oxygen tank no. 2 again required pressure cycling with the heaters turned on. As the launch date approached, the oxygen tank no. 2 de-tanking problem was considered by the Apollo organization. At this point, the "shelf drop" incident on October 21, 1968, at Rockwell was not considered and it was felt that the apparently normal de-tanking which had occurred in 1967 at Beech was not pertinent because it was believed that a different procedure was used by Beech. In fact, however, the last portion of the procedure was quite similar, although a slightly lower GOX pressure was utilized. Throughout these considerations, which involved technical and management personnel of KSC, MSC, Rockwell, Beech, and NASA headquarters, emphasis was directed toward the possibility and consequences of a loose fill tube, while very little attention was paid to the extended operation of heaters and fans, except to note that they apparently operated during and after the de-tanking sequences. Many of the principals in the discussions were not aware of the extended heater operations. Those that did know the details of the procedure did not consider the possibility of damage due to excessive heat within the tanks and therefore did not advise management officials of any possible consequences of the unusually long heater operations. As noted earlier in this chapter, each heater is protected with a thermostatic switch, mounted on the heater tube, which is intended to open the heater circuit when it senses a temperature of 80ø F. In tests conducted at MSC since the accident, however, it was found that the switches failed to open when the heaters were powered from a 65V DC supply similar to the power used at KSC during the de-tanking sequence. Subsequent investigations have shown that the thermostatic switches used, while rated as satisfactory for the 28V DC spacecraft power supply, could not open properly at 65V DC. Qualification and test procedures for the heater assemblies and switches do not at any time test the capability of the switches to open while under full current conditions. A review of the voltage recordings made during the de-tanking at KSC indicates that, in fact, the switches did not open when the temperature indication from within the tank rose past 80ø F. Further tests have shown that the temperatures on the heater tube may have reached as much as 1,000ø F during the de-tanking. This temperature will cause serious damage to adjacent Teflon insulation, and such damage almost certainly occurred. None of the above, however, was known at the time and, after extensive consideration was given to all possibilities of damage from a loose fill tube, it was decided to leave the oxygen shelf and oxygen tank no. 2 in the SM and to proceed with preparations for the launch of Apollo 13. THE APOLLO 13 FLIGHT -------------------- The Apollo 13 mission was designed to perform the third manned lunar landing. The selected site was in the hilly uplands of the Fra Mauro formation. A package of five scientific experiments was planned for installation on the lunar surface near the lunar module (LM) landing point: (1) a lunar passive seismometer to measure and relay meteoroid impact and moon quakes, and to serve as the second point in a seismic net begun with the Apollo 12 seismometer; (2) a heat flow device for measuring the heat flux from the lunar interior to the surface and surface material conductivity to a depth of 3 meters; (3) a charged particle lunar environment experiment for measuring solar wind proton and electron effects on the lunar environment; (4) a cold cathode gauge for measuring density and temperature variations in the lunar atmosphere; and (5) a dust detector experiment. Additionally, the Apollo 13 landing crew was to gather the third set of selenological samples of the lunar surface for return to earth for extensive scientific analysis. Candidate future landing sites were scheduled to be photographed from lunar orbit with a high-resolution topographic camera carried aboard the command module. During the week prior to launch, back-up Lunar Module Pilot Charles M. Duke, Jr., contracted rubella. Blood tests were performed to determine prime crew immunity, since Duke had been in close contact with the prime crew. These tests determined that prime crew Commander James A. Lovell and prime crew Lunar Module Pilot Fred Haise were immune to rubella, but that prime crew Command Module Pilot Thomas K. ("Ken") Mattingly III did not have immunity. Consequently, following two days of intensive simulator training at KSC, back-up Command Module Pilot John L. ("Jack") Swigert, Jr., was substituted in the prime crew to replace Mattingly. Swigert had trained for several months with the back-up crew, and this additional work in the simulators was aimed toward integrating him into the prime crew so that the new combination of crewmen could function as a team during the mission. Launch was on time at 2:13 p.m. EST, on April 11, 1970, from the KSC Launch Complex 39A. The spacecraft was inserted into a 100 nautical mile circular earth orbit. The only significant launch phase anomaly was premature shutdown of the center engine of the S-IC second stage. As a result, the remaining four S-IC engines burned 34 seconds longer than planned and the S-IVB third stage burned a few seconds longer than planned. At orbital insertion, the velocity was within 1.2 feet per second of the planned velocity. Moreover, an adequate propellant margin was maintained in the S-IVB for the trans-lunar injection burn. Orbital insertion was at 00:12:39 ground elapsed time (g.e.t.). The initial one and a half earth orbits before trans-lunar injection (TLI) were spent in spacecraft systems checkout and included television transmissions as Apollo 13 passed over the Merritt Island Launch Area, Florida, tracking station. The S-IVB restarted at 02:35:46 g.e.t. for the trans-lunar injection burn, with shutdown coming some 5 minutes, 51 seconds later. Accuracy of the Saturn V instrument unit guidance for the TLI burn was such that a planned mid-course correction maneuver at 11:41:23 g.e.t. was not necessary. After TLI, Apollo 13 was calculated to be on a free-return trajectory with a predicted closest approach to the lunar surface of 210 nautical miles. The CSM was separated from the S-IVB about 3 hours after launch, and after a brief period of stationkeeping, the crew maneuvered the CSM to dock with the LM vehicle in the LM adapter atop the S- IVB stage. The S-IVB stage was separated from the docked CSM and LM shortly after 4 hours into the mission. In manned lunar missions prior to Apollo 13, the spend S-IVB third stages were accelerated into solar orbit by a "slingshot" maneuver in which residual liquid oxygen was dumped through the J-2 engine to provide propulsive energy. On Apollo 13, the plan was to impact the S-IVB stage on the lunar surface in proximity to the seismometer placed in the Ocean of Storms by the crew of Apollo 12. Two hours after TLI, the S-IVB attitude thrusters were ground- commanded on to adjust the stage's trajectory toward the designated impact at latitude 3 degrees S. by longitude 30 degrees W. Actual impact was at latitude 2.4 degrees S. by longitude 27.9 degrees W. -- 74 nautical miles from the Apollo 12 seismometer and well within the desired range. Impact was at 77:56:40 g.e.t. Seismic signals relayed by the Apollo 12 seismometer as the 30,700 pound stage hit the Moon lasted almost 4 hours and provided lunar scientists with additional data on the structure of the Moon. As in previous lunar missions, the Apollo 13 spacecraft was set up in the passive thermal control (PTC) mode which calls for a continuous roll rate of three longitudinal axis revolutions each hour. During crew rest periods and at other times in trans-lunar and trans-earth coast when a stable attitude is not required, the spacecraft is placed in PTC to stabilize the thermal response by spacecraft structures and systems. At 30:40:49 g.e.t., a mid-course correction maneuver was made using the service module propulsion system. The crew preparations for the burn and the burn itself were monitored by the Mission Control Center (MCC) at MSC by telemetered data and by television from the spacecraft. This mid-course correction maneuver was a 23.2 feet per second hybrid transfer burn which took Apollo 13 off a free return trajectory; a similar trajectory had been flown on Apollo 12. The objective of leaving a free-return trajectory is to control the arrival time at the Moon to insure the proper lighting conditions at the landing site. Apollo 8, 10, and 11 flew free- return trajectories until lunar orbital insertion. The Apollo 13 hybrid transfer maneuver lowered the predicted closest approach, or pericynthion, altitude at the Moon from 210 to 64 nautical miles. From launch through the first 46 hours of the mission, the performance of oxygen tank no. 2 was normal, so far as telemetered data and crew observations indicate. At 46:40:02, the crew turned on the fans in oxygen tank no. 2 as a routine operation. Within 3 seconds, the oxygen tank no. 2 quantity indication changed from a normal reading of about 82 percent full to an obviously incorrect reading "off-scale high," or over 100 per cent. Analysis of the electrical wiring of the quantity gauge shows that this erroneous reading could be caused by either a short circuit or an open circuit in the gauge wiring or a short circuit between the gauge plates. Subsequent events indicated that a short circuit was the more likely failure mode. At 47:54:50 and at 51:07:44, the oxygen tank no. 2 fans were turned on again, with no apparent adverse effects. The quantity gauge continued to read off-scale high. Following a rest period, the Apollo 13 crew began preparations for activating and powering-up the LM for checkout. At 53:27 g.e.t., the Commander (CMR) and Lunar Module Pilot (LMP) were cleared to enter the LM to commence in-flight inspection of the LM. Ground tests before launch had indicated the possibility of a high heat-leak rate in the LM descent stage super-critical helium tank. Crew verification of actual pressures found the helium pressure to be within normal limits. (Super-critical helium is stored in the LM for pressurizing propellant tanks.) The LM was powered-down and preparations were underway to close the LM hatch and run through the pre-sleep checklist when the accident in oxygen tank no. 2 occurred. At 55:52:30 g.e.t., a master alarm on the CM caution and warning system alerted the crew to a low pressure indication in the cryogenic hydrogen tank no. 1. This tank had reached the low end of its normal operating pressure range several times previously during the flight. At 55:52:58, flight controllers in the MCC requested the crew to turn on the cryogenic system fans and heaters. The Command Module Pilot (CMP) acknowledged the fan cycle request at 55:53:06 g.e.t., and data indicate that current was applied to the oxygen tank no. 2 fan motors at 55:53:20. About 93 seconds later, at 55:54:53.555, telemetry from the spacecraft was lost almost totally for 1.8 seconds. During the period of data loss, the caution and warning system alerted the crew to a low voltage condition on DC main bus B. At about the same time, the crew heard a loud "bang" and realized that a problem existed in the spacecraft. The events between fan turn-on at 55:53:20 and the time when the problem was evident to the crew and Mission Control are covered in some detail in Part 4 of this chapter, "Summary Analysis of the Accident." It is now clear that oxygen tank no. 2 or its associated tubing lost pressure integrity because of combustion within the tank, and the effects of oxygen escaping from the tank caused the removal of the panel covering bay 4, and a relatively slow leak in oxygen tank no. 1 or its lines or valves. Photos of the SM taken by the crew later in the mission show the panel missing, the fuel cells on the shelf above the oxygen shelf tilted, and the high-gain antenna damaged. The resultant loss of oxygen made the fuel cells inoperative, leaving the CM with batteries normally used only during re-entry as the sole power source, and with only that oxygen contained in a surge tank and re-pressurization packages (used to re-pressurize the CM after cabin venting). The LM, therefore, became the only source of sufficient electrical power and oxygen to permit safe return of the crew to Earth. DETAILED CHRONOLOGY FROM BEFORE ACCIDENT TO 5 MINUTES AFTER ----------------------------------------------------------- Events During 52 Seconds Prior to First Observed Abnormality 55:52:31 Master caution and warning triggered by low hydrogen pressure in tank no. 1. Alarm is turned off after 4 seconds. 55:52:58 Ground requests tank stir. 55:53:06 Crew acknowledges tank stir. 55:53:18 Oxygen tank no. 1 fans on. 55:53:19 Oxygen tank no. 1 pressure decreases 8 psi. 55:53:20 Oxygen tank no. 2 fans turned on. 55:53:20 Stabilization control system electrical disturbance indicates a power transient. 55:53:21 Oxygen tank no. 2 pressure decreases 4 psi. Abnormal Events During 90 Seconds Preceding the Accident 55:53:22.718 Stabilization control system electrical disturbance indicates a power transient. 55:53:22.757 1.2 volt decrease in AC bus 2 voltage. 55:53:22.772 11.1 amp rise in fuel cell 3 current for one sample. 55:53:36 Oxygen tank no. 2 pressure begins rise lasting for 24 seconds. 55:53:38.057 11 volt decrease in AC bus 2 voltage for one sample. 55:53:38.085 Stabilization control system electrical disturbance indicates a power transient. 55:53:41.172 22.9 amp rise in fuel cell 3 current for one sample. 55:53:41.192 Stabilization control system electrical disturbance indicates a power transient. 55:54:00 Oxygen tank no. 2 pressure rise ends at a pressure of 953.8 psia. 55:54:15 Oxygen tank no. 2 pressure begins to rise. 55:54:30 Oxygen tank no. 2 quantity drops from full scale for 2 seconds and then reads 75.3 percent. 55:54:31 Oxygen tank no. 2 temperature begins to rise rapidly. 55:54:43 Flow rate of oxygen to all three fuel cells begins to decrease. 55:54:45 Oxygen tank no. 2 pressure reaches maximum value of 1,008.3 psia. 55:54:48 Oxygen tank no. 2 temperature rises 40ø F. for one sample (invalid reading). 55:54:51 Oxygen tank no. 2 quantity jumps to off-scale high and then begins to drop until the time of telemetry loss, indicating failed sensor. 55:54:52 Oxygen tank no. 2 temperature reads -151.3ø F. 55:54:52.703 Oxygen tank no. 2 temperature suddenly goes off-scale low, indicating failed sensor. 55:54:52.763 Last telemetered pressure from oxygen tank no. 2 before telemetry loss is 995.7 psia. 55:54:53.182 Sudden accelerometer activity on X, Y, and Z axes. 55:54:53.220 Stabilization control system body rate changes begin. 55:54:53.323 Oxygen tank no. 1 pressure drops 4.2 psi. 55:54:53.5 2.8 amp rise in total fuel cell current. 55:54:53.542 X, Y, and Z accelerations in CM indicate 1.17g, 0.65g and 0.65g, respectively. 1.8 Second Data Loss 55:54:53.555 Loss of telemetry begins. 55:54:53.555+ Master caution and warning triggered by DC main bus B undervoltage. Alarm is turned off in 6 seconds. All indications are that the cryogenic oxygen tank no. 2 lost pressure in this time period and the panel separated. 55:54:54.741 Nitrogen pressure in fuel cell 1 is off-scale low indicating failed sensor. 55:54:55.35 Recovery of telemetry data. Events During 5 Minutes Following the Accident .............................................. 55:54:56 Service propulsion system engine valve body temperature begins a rise of 1.65ø F. in 7 seconds. 55:54:56 DC main bus A decreases 0.9 volt to 28.5 volts and DC main bus B decreases 0.9 volt to 29.0 volts. 55:54:56 Total fuel cell current is 15 amps higher than the final value before telemetry loss. High current continues for 19 seconds. 55:54:56 Oxygen tank no. 2 temperature reads off-scale high after telemetry recovery, probably indicating failed sensors. 55:54:56 Oxygen tank no. 2 pressure reads off-scale low following telemetry recovery, indicating a broken supply line, a tank pressure below 19 psi, or a failed sensor. 55:54:56 Oxygen tank no. 1 pressure reads 781.9 psia and begins to drop steadily. 55:54:57 Oxygen tank no. 2 quantity reads off-scale high following telemetry recovery, indicating failed sensor. 55:54:59 The reaction control system helium tank temperature begins a 1.66ø F. increase in 36 seconds. 55:55:01 Oxygen flow rates to fuel cells 1 and 3 approaches zero after decreasing for 7 seconds. 55:55:02 The surface temperature of the service module oxidizer tank in bay 3 begins a 3.8ø F. increase in a 15 second period. 55:55:02 The service propulsion system helium tank temperature begins a 3.8ø F. increase in a 32 second period. 55:55:09 DC main bus A voltage recovers to 29.0 volts, DC main bus B recovers to 28.8 volts. 55:55:20 Crew reports, "I believe we've had a problem here." 55:55:35 Crew reports, "We've had a main bus B undervolt." 55:55:49 Oxygen tank no. 2 temperature begins steady drop lasting 59 seconds, probably indicating failed sensor. 55:56:10 Crew reports, "Okay right now, Houston. The voltage is looking good, and we had a pretty large bang associated with the caution and warning there. And as I recall, main B was the one that had had an amp spike on it once before." 55:56:38 Oxygen tank no. 2 quantity becomes erratic for 69 seconds before assuming an off-scale low state, indicating failed sensor. 55:57:04 Crew reports, "That jolt must have rocked the sensor on see now oxygen quantity 2. It was oscillating down around 20 to 60 per cent. Now it's full-scale high again." 55:57:39 Master caution and warning triggered by DC main bus B undervoltage. Alarm is turned off in 6 seconds. 55:57:40 DC main bus B drops below 26.25 volts and continues to fall rapidly. 55:57:44 AC main bus 2 fails within 2 seconds. 55:57:45 Fuel cell 3 fails. 55:57:59 Fuel cell 1 current begins to decrease. 55:58:02 Master caution and warning caused by AC main bus 2 being reset. Alarm is turned off after 2 seconds. 55:58:06 Master caution and warning triggered by DC main bus A undervoltage. Alarm is turned off in 13 seconds. 55:58:07 DC main bus A drops below 26.25 volts and in the next few seconds, levels off at 25.5 volts. 55:58:07 Crew reports, "AC 2 is showing zip." 55:58:25 Crew reports, "Yes, we got a main bus A undervolt now, too, showing. It's reading about 25«. Main B is reading zip right now." 56:00:06 Master caution and warning triggered by high hydrogen flow rate to fuel cell 2. Alarm is turned off in 2 seconds. SUMMARY ANALYSIS OF THE ACCIDENT -------------------------------- Combustion in oxygen tank no. 2 led to failure of that tank, damage to oxygen tank no. 1, or its lines or valves adjacent to tank no. 2, removal of the bay 4 panel, and, through the resultant loss of all three fuel cells, to the decision to abort the Apollo 13 mission. In the attempt to determine the cause of ignition in oxygen tank no. 2, the course of propagation of the combustion, the mode of tank failure, and the way in which subsequent damage occurred, the Board has carefully sifted through all available evidence and examined the results of special tests and analyses conducted by the Apollo organization by or for the Board after the accident. Although tests and analyses are continuing, sufficient information is now available to provide a reasonably clear picture of the nature of the accident and the events which led up to it. It is now apparent that the extended heater operation at KSC damaged the insulation on wiring in the tank and thus made the wiring susceptible to the electrical short circuit which probably initiated combustion within the tank. While the exact point of initiation of combustion may never be known with cer- tainty, the nature of the occurrence is sufficiently understood to per mit taking corrective steps to prevent its recurrence. The Board has identified the most probable failure mode. The following discussion treats the accident in its key phases: initiation, propagation of combustion, loss of oxygen tank no. 2 system integrity, and loss of oxygen tank no. 1 system integrity. INITIATION ---------- Key Data ........ In evaluating telemetry data, consideration must be given to the fact that the Apollo pulse code modulation (PCM) system samples data in time and quantizes in amplitude. 55:53:20 Oxygen tank no. 2 fans turned on. 55:53:22.757 1.2 volt decrease in AC bus 2 voltage. 55:53:22.772 11.1 ampere "spike" recorded in fuel cell 3 current followed by drop in current and rise in voltage typical of removal of power from one fan motor, indicating opening of motor circuit. 55:53:36 Oxygen tank no. 2 pressure begins to rise. The evidence points strongly to an electrical short circuit with arcing as the initiating event. About 2.7 seconds after the fans were turned on in the SM oxygen tanks, an 11.1 ampere current spike and simultaneously a voltage drop spike were recorded in the spacecraft electrical system. Immediately thereafter, current drawn from the fuel cells decreased by an amount consistent with the loss of power to one fan. No other changes in spacecraft power were being made at the time. No power was on the heaters in the tanks at the time and the quantity gauge and temperature sensor are very low power devices. The next anomalous event recorded was the beginning of a pressure rise in oxygen tank no. 2, 13 seconds later. Such a time lag is possible with low-level combustion at the time. These facts point to the likelihood that an electrical short circuit with arcing occurred in the fan motor or its leads to initiate the accident sequence. The energy available from the short circuit was probably 10 to 20 joules. Tests conducted during this investigation have shown that this energy is more than adequate to ignite Teflon of the type contained within the tank. (The quantity gauge in oxygen tank no. 2 had failed at 46:40 g.e.t. There is no evidence tying the quantity gauge failure directly to accident initiation, particularly in view of the very low energy available from the gauge.) This likelihood of electrical initiation is enhanced by the high probability that the electrical wires within the tank were damaged during the abnormal de-tanking operation at KSC prior to launch. Furthermore, there is no evidence pointing to any other mechanism of initiation. PROPAGATION OF COMBUSTION ------------------------- Key Data ........ 55:53:36 Oxygen tank no. 2 pressure begins to rise (same event noted previously). 55:53:38.057 11 volt decrease recorded in AC bus 2 voltage. 55:53:41.172 22.9 ampere "spike" recorded in fuel cell 3 current, followed by drop in current and rise in voltage typical of one fan motor -- indicating opening of another motor circuit. 55:54:00 Oxygen tank no. 2 pressure levels off at 954 psia. 55:54:15 Oxygen tank no. 2 pressure begins to rise again. 55:54:30 Oxygen tank no. 2 quantity gauge reading drops from full scale (to which it had failed at 46:40 g.e.t.) to zero and then read 75 per cent full. This behavior indicates the gauge short circuit may have corrected itself. 55:54:31 Oxygen tank no. 2 temperature begins to rise rapidly. 55:54:45 Oxygen tank no. 2 pressure reading reaches maximum recorded value of 1008 psia. 55:54:52.763 Oxygen tank no. 2 pressure reading had dropped to 996 psia. The available evidence points to a combustion process as the cause of the pressure and temperature increases recorded in oxygen tank no. 2. The pressure reading for oxygen tank no. 2 began to increase about 13 seconds after the first electrical spike, and about 55 seconds later the temperature began to increase. The temperature sensor reads local temperature, which need not represent bulk fluid temperature. Since the rate of pressure rise in the tank indicates a relatively slow propagation of burning, it is likely that the region immediately around the temperature sensor did not become heated until this time. There are materials within the tank that can, if ignited in the presence of super-critical oxygen, react chemically with the oxygen in exothermic chemical reactions. The most readily reactive is Teflon used for electrical insulation in the tank. Also potentially reactive are metals, particularly aluminum. There is more than sufficient Teflon in the tank, if reacted with oxygen, to account for the pressure and temperature increases recorded. Furthermore, the pressure rise took place over a period of more than 69 seconds, a relatively long period, and one which would be more likely characteristic of Teflon combustion than metal-oxygen reactions. While the data available on the combustion of Teflon in super-critical oxygen in zero-g are extremely limited, those which are available indicate that the rate of combustion is generally consistent with these observations. The cause of the 15 second period of relatively constant pressure first indicated at 55:53:59.763 has not been precisely determined; it is believed to be associated with a change in reaction rate as combustion proceeded through various Teflon elements. While there is enough electrical power in the tank to cause ignition in the event of a short circuit or abnormal heating in defective wire, there is not sufficient electric power to account for all of the energy required to produce the observed pressure rise. LOSS OF OXYGEN TANK NO. 2 SYSTEM INTEGRITY ------------------------------------------ Key Data ........ 55:54:52 Last valid temperature indication (-151ø F.) from oxygen tank no. 2. 55:54:52.763 Last pressure reading from oxygen tank no. 2 before loss of data: 996 psia. 55:54:53.182 Sudden accelerometer activity on X, Y, and Z axes. 55:54:53.220 Stabilization control system body rate changes begin. 55:54:53.555 Loss of telemetry data begins. 55:54:55.35 Recovery of telemetry data. 55:54:56 Various temperature indications in SM begin slight rises. 55:54:56 Oxygen tank no. 2 temperature reads off-scale high. 55:54:56 Oxygen tank no. 2 pressure reads off-scale low. After the relatively slow propagation process described above took place, there was a relatively abrupt loss of oxygen tank no. 2 integrity. About 69 seconds after the pressure began to rise, it reached the peak recorded (1008 psia), the pressure at which the cryogenic oxygen tank relief valve is designed to be fully open. Pressure began a decrease for 8 seconds, dropping to 996 psia before readings were lost. Several bits of data have been obtained from this "loss of telemetry data" period. All signals from the spacecraft were lost about 1.85 seconds after the last presumably valid reading from within the tank, a temperature reading, and 0.8 second after the last presumably valid pressure reading (which may or may not reflect the pressure within the tank itself since the pressure transducer is about 20 feet of tubing length distant). Abnormal spacecraft accelerations were recorded approximately 0.42 second after the last pressure reading and approximately 0.38 second before the loss of signal. These facts all point to a relatively sudden loss of integrity. At about this time, several solenoid valves, including the oxygen valves feeding two of the three fuel cells, were shocked to the closed position. The "bang" reported by the crew also probably occurred in this time period. Telemetry signals from Apollo 13 were lost for a period of 1.8 seconds. When signal was re-acquired, all instrument indicators from oxygen tank no. 2 were off-scale, high or low. Temperatures recorded by sensors in several different locations in the SM showed slight increases in the several seconds following re-acquisition of signal. Photographs taken later by the Apollo 13 crew as the SM was jettisoned show that the bay 4 panel was ejected, undoubtedly during this event. The data are not adequate to determine precisely the way in which oxygen tank no. 2 system lost its integrity. However, available information, analyses, and tests performed during this investigation indicate that most probably the combustion within the pressure vessel ultimately led to localized heating and failure at the pressure vessel closure. It is at this point, the upper end of the quantity probe, that the 0.5 inch Inconel conduit is located, through which the Teflon-insulated wires enter the pressure vessel. It is likely that the combustion progressed along the wire insulation and reached this location where all of the wires come together. This, possibly augmented by ignition of the metal in the upper end of the probe, led to weakening and failure of the closure or the conduit, or both. Failure at this point would lead immediately to pressurization of the tank dome, which is equipped with a rupture disc rated at about 75 psi. Rupture of this disc or of the entire dome would then release oxygen, accompanied by combustion products, into bay 4. The accelerations recorded were probably caused by this release. Release of the oxygen then began to pressurize the oxygen shelf space of bay 4. If the hole formed in the pressure vessel were large enough and formed rapidly enough, the escaping oxygen alone would be adequate to blow off the bay 4 panel. However, it is also quite possible that the escape of oxygen was accompanied by combustion of Mylar and Kapton (used extensively as thermal insulation in the oxygen shelf compartment, and in the tank dome) which would augment the pressure caused by the oxygen itself. The slight temperature increases recorded at various SM locations indicate that combustion external to the tank probably took place. Further testing may shed additional light on the exact mechanism of panel ejection. The ejected panel then struck the high-gain antenna, disrupting communications from the spacecraft for the 1.8 seconds. LOSS 0F OXYGEN TANK NO. 1 INTEGRITY ----------------------------------- Key Data ........ 55:54:53.323 Oxygen tank no. 1 pressure drops 4 psia (from 883 psia to 879 psia). 55:54:53.555- Loss of telemetry data. 55:54:55.35 55:54:56 Oxygen tank no. 1 pressure reads 782 psia and drops steadily. Pressure drops over a period of 130 min- utes to the point at which it was insufficient to sustain operation of fuel cell no. 2. There is no clear evidence of abnormal behavior associated with oxygen tank no. 1 prior to loss of signal, although the one data bit (4 psi) drop in pressure in the last tank no. 1 pressure reading prior to loss of signal may indicate that a problem was beginning. Immediately after signal strength was regained, data show that oxygen tank no. 1 had lost its integrity. Pressure de- creases were recorded over a period of approximately 130 minutes, indicating that a relatively slow leak had developed in the tank no. 1 system. Analysis has indicated that the leak rate is less than that which would result from a completely ruptured line, but could be consistent with a partial line rupture or a leaking check or relief valve. Since there is no evidence that there was any anomalous condition arising within oxygen tank no. 1, it is presumed that the loss of oxygen tank no. 1 integrity resulted from the oxygen tank no. 2 system failure. The relatively sudden, and possibly violent, event associated with loss of integrity of the oxygen tank no. 2 system could have ruptured a line to oxygen tank no. 1, or have caused a valve to leak because of mechanical shock. APOLLO 13 RECOVERY ------------------ UNDERSTANDING THE PROBLEM In the period immediately following the caution and warning alarm for main bus B undervoltage, and the associated "bang" reported by the crew, the cause of the difficulty and the degree of its seriousness were not apparent. The 1.8 second loss of telemetered data was accompanied by the switching of the CSM high-gain antenna mounted on the SM adjacent to bay 4 from narrow beam width to wide beam width. The high-gain antenna does this automatically 200 milliseconds after its directional lock on the ground signal has been lost. A confusing factor was the repeated firings of various SM attitude control thrusters during the period after data loss. In all probability, these thrusters were being fired to overcome the effects that oxygen venting and panel blow-off were having on spacecraft attitude, but it was believed for a time that perhaps the thrusters were malfunctioning. The failure of oxygen tank no. 2 and consequent removal of the bay 4 panel produced a shock which closed valves in the oxygen supply lines to fuel cells 1 and 3. These fuel cells ceased to provide power in about 3 minutes, when the supply of oxygen between the closed valves and the cells was depleted. Fuel cell 2 continued to power AC bus 1 through DC main bus A, but the failure of fuel cell 3 left DC main bus B and AC bus 2 un-powered. The oxygen tank no. 2 temperature and quantity gauges were connected to AC bus 2 at the time of the accident. Thus, these parameters could not be read once fuel cell 3 failed at 55:57:44 until power was applied to AC bus 2 from DC main bus A. The crew was not alerted to closure of the oxygen feed valves to fuel cells 1 and 3 because the valve position indicators in the CM were arranged to give warning only if both the oxygen and hydrogen valves closed. The hydrogen valves remained open. The crew had not been alerted to the oxygen tank no. 2 pressure rise or to its subsequent drop because a hydrogen tank low pressure warning had blocked the cryogenic subsystem portion of the caution and warning system several minutes before the accident. When the crew heard the bang and got the master alarm for low DC main bus B voltage, the Commander was in the lower equipment bay of the command module, stowing a television camera which had just been in use. The Lunar Module Pilot was in the tunnel between the CSM and the LM, returning to the CSM. The Command Module Pilot was in the left-hand couch, monitoring spacecraft performance. Because of the master alarm indicating low voltage, the CMP moved across to the right-hand couch where CSM voltages can be observed. He reported that voltages were "looking good" at 55:56:10. At this time, main bus B had recovered and fuel cell 3 did not fail for another 1« minutes. He also reported fluctuations in the oxygen oxygen tank no. 2 quantity, followed by a return to the off-scale high position. When fuel cells 1 and 3 electrical output readings went to zero, the ground controllers could not be certain that the cells had not somehow been disconnected from their respective busses and were not otherwise all right. Attention continued to be focused on electrical problems. Five minutes after the accident, controllers asked the crew to connect fuel cell 3 to DC main bus B in order to be sure that the configuration was known. When it was realized that fuel cells 1 and 3 were not functioning, the crew was directed to perform an emergency power-down to lower the load on the remaining fuel cell. Observing the rapid decay in oxygen tank no. 1 pressure, controllers asked the crew to switch power to the oxygen tank no. 2 instrumentation. When this was done, and it was realized that oxygen tank no. 2 had failed, the extreme seriousness of the situation became clear. During the succeeding period, efforts were made to save the remaining oxygen in the oxygen tank no. 1. Several attempts were made, but had no effect. The pressure continued to decrease. It was obvious by about 1« hours after the accident that the oxygen tank no. 1 leak could not be stopped and that shortly it would be necessary to use the LM `as a lifeboat' for the remainder of the mission. By 58:40 g.e.t., the LM had been activated, the inertial guidance reference transferred from the CSM guidance system to the LM guidance system, and all CSM systems were turned off. RETURN TO EARTH --------------- The remainder of the mission was characterized by two main activ- ities -- planning and conducting the necessary propulsion maneuvers to return the spacecraft to Earth, and managing the use of consumables in such a way that the LM, which is designed for a basic mission with two crewmen for a relatively short duration, could support three men and serve as the actual control vehicle for the time required. TABLE 4-III CABIN ATMOSPHERE CARBON DIOXIDE REMOVAL BY LITHIUM HYDROXIDE Required: 85 hours Available in LM: 53 hours Available in CM: 182 hours ASSESSMENT OF ACCIDENT ---------------------- FAILURE OF OXYGEN TANK NO. 2 1. Findings a. The Apollo 13 mission was aborted as the direct result of the rapid loss of oxygen from oxygen tank no. 2 in the SM, followed by a gradual loss of oxygen from tank no. 1, and a resulting loss of power from the oxygen-fed fuel cells. b. There is no evidence of any forces external to oxygen tank no. 2 during the flight which might have caused its failure. c. Oxygen tank no. 2 contained materials, including Teflon and aluminum, which, if ignited, will burn in super-critical oxygen. d. Oxygen tank no. 2 contained potential ignition sources: electrical wiring, unsealed electric motors, and rotating aluminum fans. e. During the special de-tanking of oxygen tank no. 2 following the countdown demonstration test (CDDT) at KSC, the thermo- static switches on the heaters were required to open while powered by 65V DC in order to protect the heaters from over- heating. The switches were only rated at 30V DC and have been shown to weld closed at the higher voltage. f. Data indicate that in flight the tank heaters located in oxygen tanks no. 1 and no. 2 operated normally prior to the accident, and they were not on at the time of the accident. g. The electrical circuit for the quantity probe would generate only about 7 millijoules in the event of a short circuit and the temperature sensor wires less than 3 millijoules per second. h. Telemetry data immediately prior to the accident indicate electrical disturbances of a character which would be caused by short circuits accompanied by electrical arcs in the fan motor or its leads in oxygen tank no. 2. i. The pressure and temperature within oxygen tank no. 2 rose abnormally during the 90 seconds immediately prior to the accident. 2. Determinations a. The cause of the failure of oxygen tank no. 2 was combustion within the tank. b. Analysis showed that the electrical energy flowing into the tank could not account for the observed increases in pressure and temperature. c. The heater, temperature sensor, and quantity probe did not initiate the accident sequence. d. The cause of the combustion was most probably the ignition of Teflon wire insulation on the fan motor wires, caused by electric arcs in this wiring. e. The protective thermostatic switches on the heaters in oxygen tank no. 2 failed closed during the initial portion of the first special de-tanking operation. This subjected the wiring in the vicinity of the heaters to very high temperatures which have been subsequently shown to severely degrade Teflon insulation. f. The telemetered data indicated electrical arcs of sufficient energy to ignite the Teflon insulation, as verified by sub- sequent tests. These tests also verified that the 1 ampere fuses on the fan motors would pass sufficient energy to ignite the insulation by the mechanism of an electric arc. g. The combustion of Teflon wire insulation alone could release sufficient heat to account for the observed increases in tank pressure and local temperature, and could locally overheat and fail the tank or its associated tubing. The possibiIity of such failure at the top of the tank was demonstrated by subsequent tests. h. The rate of flame propagation along Teflon-insulated wires as measured in subsequent tests is consistent with the indicated rates of pressure rise within the tank. SECONDARY EFFECTS OF TANK FAILURE 1. Findings a. Failure of the tank was accompanied by several events including: (1) A "bang" heard by the crew, (2) Spacecraft motion as felt by the crew and as measured by the attitude control system and the accelerometers in the command module (CM), (3) Momentary loss of telemetry, (4) Closing of several valves by shock loading, (5) Loss of integrity of the oxygen tank no. 1 system, (6) Slight temperature increases in bay 4 and adjacent sectors of the SM, (7) Loss of the panel covering bay 4 of the SM, as observed and photographed by the crew, (8) Displacement of the fuel cells as photographed by the crew, and (9) Damage to the high-gain antenna as photographed by the crew. b. The panel covering of bay 4 could be blown off by pressuri- zation of the bay. About 25 psi of uniform pressure in bay 4 is required to blow off the panel. c. The various bays and sectors of the SM are inter-connected with open passages so that all would be pressurized if any one were supplied with a pressurant at a relatively slow rate. d. The CM attachments would be failed by an average pressure of about 10 psi on the CM heat shield and this would separate the CM from the SM. 2. Determinations a. Failure of the oxygen tank no. 2 caused a rapid local pressurization of bay 4 of the SM by the high pressure oxygen that escaped from the tank. This pressure pulse may have blown off the panel covering bay 4. This possibility was substantiated by a series of special tests. b. The pressure pulse from a tank failure might have been augmented by combustion of Mylar or Kapton insulation or both when subjected to a stream of oxygen and hot particles emerging from the top of the tank, as demonstrated in subsequent tests. c. Combustion or vaporization of the Mylar or Kapton might account for the discoloration of the SM engine nozzle as observed and photographed by the crew. d. Photographs of the SM by the crew did not establish the condition of oxygen tank no. 2. e. The high-gain antenna damage probably resulted from striking by the panel, or a portion thereof, as it left the SM. f. The loss of pressure on oxygen tank no. 1 and the subsequent loss of power resulted from the tank no. 2 failure. g. Telemetry, although good, is insufficient to pin down the exact nature, sequence, and location of each event of the accident in detail. h. The telemetry data, crew testimony, photographs, and special tests and analyses already completed are sufficient to under- stand the problem and to proceed with corrective actions.