50. Findings

ENTRY PROCEDURES AND CHECKLISTS

(a) Preparation for reentry required nonstandard procedures because of the lack of SM oxygen and electrical power supplies.

(b) The SM RCS engines normally provide separation between the SM and the CM by continuing to fire after separation.

(c) Apollo 13 SM RRCS engines could not continue to fire after separation because of the earlier failure of the fuel cells.

(d) The CM guidance and navigation system was powered down due to the accident. The LM guidance and navigation system had also been powered down to conserve electrical energy and water. A spacecraft inertial attitude reference had to be established prior to reentry.

(e) The reentry preparation time had to be extended in order to accomplish the additional steps required by the unusual situation.

(f) In order to conserve the CM batteries, LM jettison was delayed as long as practical. The LM batteries were used to supply part of the power necessary for CM activation.

(g) The procedures for accomplishing the final course correction and the reentry preparation were developed by operations support personnel under the direction of Mission Control.

(h) An initial set of procedures was defined within 12 hours after the accident. These were refined and modified during the following 2 days, and evaluated in simulators at MSC and KSC by members of the backup crew.

(i) The procedures were read to the crew about 24 hours prior to reentry, allowing the crew time to study and rehearse them.

(j) Trajectory evaluations of contingency conditions for LM and SM separation were conducted and documented prior to the mission by mission-planning personnel at MSC.

(k) Most of the steps taken were extracted from other procedures which had been developed, tested, and simulated earlier.

Determinations

(1) The procedures developed worked well and generated no new hazards beyond those unavoidably inherent in using procedures which have not been carefully developed, simulated, and practiced over a long training period.

(2) It is not practical to develop, simulate, and practice procedures for use in every possible contingency.

51. Findings

(a) During the reentry preparations, after SM jettison, there was a halfhour period of very poor communications with the CM due to the spacecraft being in a poor attitude with the LM present.

(b) This condition was not recognized by the crew or by Mission Control.

Determination

Some of the reentry preparations were unnecessarily prolonged by the poor communications, but since the reentry preparation time-line was not crowded, the delay was more of a nuisance than an additional hazard to the crew.

52. Findings

(a) The crew maneuvered the spacecraft to the wrong LM roll attitude in preparation for LM jettison. This attitude put the CM very close to gimbal lock which, had it occurred, would have lost the inertial attitude reference essential for an automatic guidance system control of reentry.

(b) If gimbal lock had occurred, a less accurate but adequate attitude reference could have been reestablished prior to reentry.

Determination

The most significant consequence of losing the attitude reference in this situation would have been the subsequent impact on the remaining reentry preparation timeline. In taking the time to reestablish this reference, less time would have been available to accomplish the rest of the necessary procedures. The occurrence of gimbal lock in itself would not have significantly increased the crew hazard.

PART 4. RECOMMENDATIONS

The cryogenic oxygen storage system in the service module should be modified to:

a. Remove from contact with the oxygen all wiring, and the unsealed motors, which can potentially short circuit and ignite adjacent materials; or otherwise insure against a catastrophic electrically induced fire in the tank.

b. Minimize the use of Teflon, aluminum, and other relatively combustible materials in the presence of the oxygen and potential ignition sources.

2. The modified cryogenic oxygen storage system should be subjected to a rigorous requalification program, including careful attention to potential operational problems.

3. The warning systems on board the Apollo spacecraft and in the Mission Control Center should be carefully reviewed and modified where appropriate, with specific attention to the following:

a. Increasing the differential between master alarm trip levels and expected normal operating ranges to avoid unnecessary alarms.

b. Changing the caution and warning system logic to prevent an out-oflimits alarm from blocking another alarm when a second quantity in the same subsystem goes out of limits.

c. Establishing a second level of limit sensing in Mission Control on critical quantities with a visual or audible alarm which cannot be easily overlooked.

d. Providing independent talkback indicators for each of the six fuel cell reactant valves plus a master alarm when any valve closes.

4. Consumables and emergency equipment in the LM and the CM should be reviewed to determine whether steps should be taken to enhance their potential for use in a "lifeboat" mode.

5. The Manned Spacecraft Center should compete the special tests and analyses now underway in order to understand more completely the details of the Apollo 13 accident. In addition, the lunar module power system anomalies should receive careful attention. Other NASA Centers should continue their support to MSC in the areas of analysis and test.

6. Whenever significant anomalies occur in critical subsystems during final preparation for launch, standard procedures should require a presentation of all prior anomalies on that particular piece of equipment, including those which have previously been corrected or explained. Furthermore, critical decisions involving the flightworthiness of subsystems should require the presence and full participation of an expert who is intimately familiar with the details of that subsystem.

7. NASA should conduct a thorough reexamination of all of its spacecraft, launch vehicle, and ground systems which contain high-density oxygen, or other strong oxidizers, to identify and evaluate potential combustion hazards in the light of information developed in this investigation.

8. NASA should conduct additional research on materials compatibility, ignition, and combustion in strong oxidizers at various g levels; and on the characteristics of supercritical fluids. Where appropriate, new NASA design standards should be developed.

9. The Manned Spacecraft Center should reassess all Apollo spacecraft subsystems, and the engineering organizations responsible for them at MSC and at its prime contractors, to insure adequate understanding and control of the engineering and manufacturing details of these subsystems at the subcontractor and vendor level. Where necessary, organizational elements should be strengthened and in-depth reviews conducted of selected subsystems with emphasis on soundness of design, quality of manufacturing, adequacy of test, and operational experience.

STATEMENTS OF DR. THOMAS O. PAINE, ADMINISTRATOR OF NASA; EDGAR M. CORTRIGHT, DIRECTOR, LANGLEY RESEARCH CENTER AND CHAIRMAN OF THE APOLLO 13 REVIEW BOARD; DR. CHARLES D. HARRINGTON, CHAIRMAN, AEROSPACE SAFETY ADVISORY PANEL; DR. DALE D. MYERS, ASSOCIATE ADMINISTRATOR FOR MANNED SPACE FLIGHT; AND DR. ROCCO A. PETRONE, APPOLLO PROGRAM DIRECTOR

Dr. PAINE. I would like to ask Mr. Cortright to begin the testimony this morning, Mr. Chairman, by giving a brief summary of the report of the Apollo 13 Review Board.

(Biographical data of the witnesses appear at the end of this hearing.)

STATEMENT BY MR. CORTRIGHT

Mr. CORTRIGHT. Mr. Chairman, members of the committee, with your permission I would like to submit for the record today a statement and summarize it for the committee. The statement recounts in some detail the establishment and operation of the Apollo 13 Review Board including the extensive test program conducted for the Board.

SUMMARY OF BOARD'S REPORT

The Board's report which was submitted to the Administrator on June 15 and copies of which were submitted to this committee on the same date contains over 30 pages of findings and determinations. It is these findings and determinations which I would like to summarize for you this morning by reading from the introduction to chapter 5 of the report.

Slide 1 (see fig. 1) shows the simplified drawing of the oxygen storage tank in which the accident occurred. I will just say a brief word about this slide to orient you to the nature of the problem that was encountered.

The tank itself was a high-pressure vessel which contains oxygen in a supercritical high density state. The tank is made of high strength Inconel. It is a doubled wall tank. The inner wall carries the pressure and the outer wall is there for insulation purposes. There is insulation between the two walls.

Now, the two major assemblies within the tank are a quantity gage which is shown on the left and a heater-fan assembly which is shown on the right. The problem as I will describe shortly, occurred primarily with the heater-fan assembly which was overheated and damaged. I will come to the next slide in a moment.

On the table in front of me are the quantity probe itself and the heater-fan assembly which I will be happy to show you after the hearing if you care to look at it.

In addition, on my left is a cut open tank which was subjected to a fire simulating that which actually occurred during the mission, and this tank is available for your examination.

Now, in brief, this is what happened. After assembly and acceptance testing the oxygen tank No. 2 which flew on Apollo 13 was shipped from Beech Aircraft Corp. to North American Rockwell in apparently satisfactory condition. It is now known, however, that the tank contained two protective thermostatic switches on the heater assembly. These switches were inadequate and subsequently failed during ground test operation at Kennedy Space Center.