g.e.t. Astronauts Lovell and Haise were cleared to enter the LM to commence in-flight inspection for the LM. After this inspection period, the lunar module was powered down and preparations were underway to close the LM hatch and run through the presleep checklist when the accident in oxygen tank #2 occurred.

At about 55:53, flight controllers in the Mission Control Center at MSC requested the crew to turn on the cryogenic system fans and heaters, since a master alarm on the CM Caution and Warning System had indicated a low pressure condition in the cryogenic hydrogen tank #1. This tank had reached the low end of its normal operating pressure range several times previously during the flight. Swigert acknowledged the fan cycle request and data indicate that current was applied to the oxygen tank #2 fan motors at 55:53:20.

About 2 minutes later, at 55:54:53.5, telemetry from the spacecraft was lost almost totally for 1.8 seconds. During the period of data loss, the Caution and Warning System alerted the crew to a low voltage condition on DC Main Bus B, one of the two main buses which supply electrical power for the command module. At about the same time, the crew heard a loud "bang" and realized that a problem existed in the spacecraft. It is now clear that oxygen tank #2 or its associated tubing lost pressure integrity because of combustion within the tank, and that the effects of oxygen escaping from the tank caused the removal of the panel covering Bay 4 and a relatively slow leak in oxygen tank #1 or its lines or valves. Photographs of the service module taken by the crew later in the mission (figure 14) show the panel missing, the fuel cells on the shelf above the oxygen shelf tilted, and the high gain antenna damaged.

The resultant loss of oxygen made the fuel cells inoperative, leaving the CM with batteries normally used only during reentry as the sole power source and with only that oxygen contained in a surge tank and repressurization packages. The lunar module, therefore, became the only source of sufficient battery power and oxygen to permit safe return of the crew to earth.

SUMMARY ANALYSIS OF THE ACCIDENT

The Board determined that combustion in oxygen tank #2 led to failure of that tank, damage to oxygen tank #1 or its lines or valves adjacent to tank #2, removal of the Bay 4 panel and, through the resultant loss of all three fuel cells, to the decision to abort the Apollo 13 mission. In the attempt to determine the cause of ignition in oxygen tank #2, the course of propagation of the combustion, the mode of tank failure, and the way in which subsequent damage occurred, the Board has carefully sifted through all available evidence and examined the results of nearly 100 special tests and analyses conducted by the Apollo organization and by or for the Board after the accident.

Although tests and analyses are continuing, sufficient information is now available to provide a clear picture of the nature of the accident and the events which led up to it. It is now apparent that the extended heater operation at KSC damaged the insulation on wiring in the tank and that this set the stage for the electrical short circuits which initiated combustion within the tank. While the exact point of initiation of combustion and the specific propagation path involved may never be known with certainty, the nature of the occurrence is sufficiently well understood to permit taking corrective steps to prevent its

recurrence.

The Board has identified the most probable failure mode.

The following discussion treats the accident in its key phases: initiation, propagation and energy release, loss of oxygen tank No. 2 system integrity, and loss of oxygen tank No. 1 system integrity. Figure 15 shows the key events in the sequence.

The evidence points strongly to an electrical short circuit with arcing as the initiating event. Near the end of the 55th hour of flight, about 2.7 seconds after the fans were turned on in the SM oxygen tanks, an 11.1 ampere current spike and simultaneously a voltage drop spike were recorded in the spacecraft electrical system. Immediately thereafter current drawn from the fuel cells

decreased by an amount consistent with the loss of power to one fan. No other changes in spacecraft power were being made at the time. No power was on the heaters in the tanks at the time and the quantity gage and temperature sensor are very low power devices. The next anomalous event recorded was the beginning of a pressure rise in oxygen tank No. 2, 13 seconds later. Such a time lag is possible with low level combustion at the time. These facts point to the likelihood that an electrical short circuit with arcing occurred in the fan motor or its leads to initiate the accident sequence. The energy available from the short circuit is estimated to have been at least 10 to 20 joules. Tests conducted during this investigation have shown that this energy is more than adequate to ignite Teflon wire insulation of the type contained within the tank.

This likelihood of electrical initiation is enhanced by the high probability that the electrical wires within the tank were damaged during the abnormal detanking operation at KSC prior to launch. The likelihood of damage and the possibility of electrical ignition have been verified by tests.

Propagation

While there is enough electrical power in the tank to cause ignition in the event of an arcing short circuit in defective wire, there is not sufficient electric power to account for all of the energy required to produce the observed pressure rise.

There are materials within the tank that can, if ignited in the presence of supercritical oxygen, react chemically with the oxygen in heat-producing chemical reactions. The most readily reactive is Teflon, used for electrical insulation in the tank. Also potentially reactive are aluminum and solder. Our analyses indicate that there is more than sufficient Teflon in the tank, if reacted with oxygen, to account for the pressure and temperature increases recorded. Furthermore, the pressure rise took place over a period of more than 69 seconds, a relatively long period, and one which would be more likely characteristic of Teflon combustion than metal-oxygen reactions.

Thus, the Board concluded that combustion caused the pressure and temperature increases recorded in oxygen tank #2. The pressure reading for oxygen tank #2 began to increase about 13 seconds after the first electrical spike and about 55 seconds later the temperature began to increase. The temperature sensor reads local temperature, which need not represent bulk fluid temperature. Since the rate of pressure rise in the tank indicates a relatively slow propagation of burning along the wiring, it is likely that the region immediately around the temperature sensor did not become heated until this time.

The data on the combustion of Teflon in supercritical oxygen in zero gravity, developed in special tests in support of the Board, indicate that the rate of combustion is generally consistent with these observations.

Loss of oxygen tank #2 system integrity

After the relatively slow propagation process described above took place, there was a relatively abrupt loss of oxygen tank #2 integrity. About 69 seconds after the pressure began to rise, it reached the peak recorded, 1008 psia, the pressure at which the cryogenic oxygen tank relief valve is designed to be fully open. Pressure began a decrease for 8 seconds, dropping to 996 psia before readings were lost. About 1.85 seconds after the last presumably valid reading from within the tank (a temperature reading) and .8 seconds after the last presumably valid pressure reading (which may or may not reflect the pressure within the tank itself since the pressure transducer is about 20 feet of tubing length distant), virtually all signal from the spacecraft was lost. Abnormal spacecraft accelerations were recorded approximately .42 seconds after the last pressure reading and approximately .38 seconds before the loss of signal. These facts all point to a relatively sudden loss of integrity. At about this time, several solenoid valves, including the oxygen valves feeding two of the three fuel cells, were shocked to the closed position. The "bang" reported by the crew also occurred in this time period. Telemetry signals from Apollo 13 were lost for a period of 1.8 seconds. When signal was reacquired, all instrument indicators from oxygen tank #2 were offscale, high or low. Temperatures recorded by sensors in several different locations in the service module showed slight increases in the several seconds following reacquisition of signal.

Data are not adequate to determine precisely the way in which the oxygen tank #2 system failed. However, available information, analyses, and tests performed during this investigation indicate that the combustion within the pressure vessel ultimately led to localized heating and failure at the pressure

vessel closure. It is at this point, the upper end of the quantity probe, that the 2-inch Inconel conduit is located, through which the Teflon insulated wires enter the pressure vessel. It is likely that the combustion progressed along the wire insulation and reached this location where all of the wires come together. This, possibly augmented by ignition of other Teflon parts and even metal in the upper end of the probe, led to weakening and failure of the closure or the conduit or both.

Failure at this point would release the nearly-1000 psi pressure in the tank into the tank dome, which is equipped with a rupture disc rated at 75 psi. Rupture of this disc or of the entire dome would then release oxygen, accompanied by combustion products, into Bay 4. The accelerations recorded were probably caused by this release.

Release of the oxygen then began to rapidly pressurize the oxygen shelf space of Bay 4. If the hole formed in the pressure vessel were large enough and formed rapidly enough, the escaping oxygen alone would be adequate to blow off the Bay 4 panel. However, it is also quite possible that the escape of oxygen was accompanied by combustion of Mylar and Kapton (used extensively as thermal insulation in the oxygen shelf compartment and in the tank dome) which would augment the pressure caused by the oxygen itself. The slight temperature increases recorded at various locations in the service module indicate that combustion external to the tank probably took place. The ejected Bay 4 panel then struck the high gain antenna, disrupting communications from the spacecraft for the 1.8 seconds.

Loss of oxygen tank #1 integrity

There is no clear evidence of abnormal behavior associated with oxygen tank #1 prior to loss of signal, although the one data bit (4 psi) drop in pressure in the last tank #1 pressure reading prior to loss of signal may indicate that a problem was beginning. Immediately after signal strength was regained, data show that the tank #1 system had lost its integrity. Pressure decreases were recorded over a period of approximately 130 minutes, indicating that a relatively slow leak had developed in the tank #1 system. Analysis has indicated that the leak rate is less than that which would result from a completely ruptured line, but could be consistent with a partial line rupture or a leaking check valve or relief valve.

Since there is no evidence that there were any anomalous conditions arising within oxygen tank #1, it is presumed that the loss of oxygen tank #1 integrity resulted from the oxygen tank #2 system failure. The relatively sudden, and possibly violent, event associated with the failure of the oxygen tank #2 system could have ruptured a line to oxygen tank #1, or have caused a valve to leak because of mechanical shock.

Understanding the problem

APOLLO 13 RECOVERY

In the period immediately following the Caution and Warning Alarm for Main Bus B undervoltage, and the associated “bang" reported by the crew, the cause of the difficulty and the degree of its seriousness were not apparent.

The 1.8-second loss of telemetered data was accompanied by the switching of the CSM high gain antenna mounted on the SM adjacent to Bay 4 from narrow beam width to wide beam width. The high gain antenna (HGA) does this automatically 200 milliseconds after its directional lock on the ground signal has been lost.

A confusing factor was the repeated firings of various SM attitude control thrusters during the period after data loss. In all probability, these thrusters were being fired to overcome the effects that oxygen venting and panel blow-off were having on spacecraft attitude, but it was believed for a time that perhaps the thrusters were malfunctioning.

The failure of oxygen tank #2 and consequent removal of the Bay 4 panel produced a shock which closed valves in the oxygen supply lines to fuel cells 1 and 3. These fuel cells ceased to provide power in about three minutes, when the supply of oxygen between the closed valves and the cells was depleted.

The crew was not alerted to closure of the oxygen feed valves to fuel cells 1 and 3 because the valve position indicators in the CM were arranged to give warning only if both the oxygen and hydrogen valves closed. The hydrogen valves remained open. The crew had not been alerted to the oxygen tank #2 pressure rise or to its subsequent drop because a hydrogen tank low pressure warning

had blocked the cryogenic subsystem portion of the Caution and Warning System several minutes before the accident. A limit sense light presumably came on in Mission Control during the brief period of tank overpressure, but was not noticed.

When the crew heard the "bang" and got the master alarm for low DC Main Bus B voltage, Lovell was in the lower equipment bay of the command module, stowing a television camera which had just been in use. Haise was in the tunnel between the CSM and the LM, returning to the CSM. Swigert was in the left hand couch, monitoring spacecraft performance. Because of the master alarm indicating low voltage, Swigert moved across to the right hand couch where CSM voltages can be observed. He reported that voltages were "looking good” at 55:56:10. At this time, voltage on Main Bus B had returned to normal levels and fuel cells 1 and 3 did not fail for another 1% to 2 minutes. He also reported fluctuations in the oxygen tank #2 quantity, followed by a return to the off-scale high position.

When fuel cells 1 and 3 electrical output readings went to zero, the ground controllers could not be certain that the cells had not somehow been disconnected from their respective buses and were not otherwise all right. Consequently about five minutes after the accident, controllers asked the crew to connect fuel cell 3 to DC Main Bus B in order to be sure that the configuration was known. When it was realized that fuel cells 1 and 3 were not functioning, the crew was directed to perform an emergency power-down to reduce the load on the remaining fuel cell. Observing the rapid decay in oxygen tank #1 pressure, controllers asked the crew to re-power instrumentation in oxygen tank #2. When this was done, and it was realized that oxygen tank #2 had failed, the extreme seriousness of the situation became clear.

During the succeeding period, efforts were made to save the remaining oxygen in the oxygen tank #1. Several attempts were made, but had no effect. The pressure, continued to decrease.

It was obvious by about one-and-one-half hours after the accident that the oxygen tank #1 leak could not be stopped and that it would soon become necessary to use the LM as a "lifeboat" for the remainder of the mission.

By 58:40, the LM had been activated, the inertial guidance reference transferred from the CSM guidance system to the LM guidance system, and the CSM systems were turned off.

Return to earth

The remainder of the mission was characterized by two main activities— planning and conducting the necessary propulsion maneuvers to return the spacecraft to earth, and managing the use of consumables in such a way that the LM, which is designed for a basic mission with two crewmen for a relatively short duration, could support three men and serve as the control vehicle for the time required.

One significant anomaly was noted during the remainder of the mission. At about 97 hours 14 minutes into the mission, Haise reported hearing a "thump" and observing venting from the LM. Subsequent data review shows that the LM electrical power system experienced a brief but major abnormal current flow at that time. There is no evidence that this anomaly was related to the accident. Analysis by the Apollo organization is continuing.

A number of propulsion options were developed and considered. It was necessary to return the spacecraft to a free-return trajectory and to make any required midcourse corrections. Normally, the Service Propulsion Systems (SPS) in the SM would be used for such maneuvers. However, because of the high electrical power requirements for using that engine, and in view of its uncertain condition and the uncertain nature of the structure of the SM after the accident, it was decided to use the LM descent engine if possible.

The minimum practical return time was 133 hours to the Atlantic Ocean, and the maximum was 152 hours to the Indian Ocean. Recovery forces were deployed in the Pacific. The return path selected was for splashdown in the Pacific Ocean at 142:40 g.e.t. This required a minimum of two burns of the LM descent engine. A third burn was subsequently made to correct the normal maneuver execution variations in the first two burns. One small velocity adjustment was also made with reaction control system thrusters. All burns were satisfactory. Figures 16 and 17 depict the flight plan followed from the time of the accident to splashdown.