Report of the Apollo 204 Review Board

Source: Report of Apollo 204 Review Board. NASA Historical Reference Collection, NASA History Office, NASA Headquarters, Washington, DC. (Summary and Appendices also linked below)

PART IV. History of Spacecraft 012 and the Accident

1. Events From Initiation Of Fabrication Until The Initiation Of The "Plugs Out" Test

Spacecraft 012, assigned to Mission AS-204, was built at North American Aviation, Inc., Space and Information Systems Division, Downey, California. Enclosure 1 shows sketches of the complete space vehicle, the spacecraft and the Command Module. Fabrication was begun in August 1964 and the basic structure was completed in September 1965. While the structure was being fabricated, each component of every subsystem was subjected to acceptance tests and subsystems were assembled. During this period a series of Preliminary Design Reviews were held between November 1964 and January 1965. Installation and final assembly of subsytems into the Command Module took place between September 1965 and March 1966. Critical Design Reviews were held during February and March 1966. Checkout of all subsystems was then initiated followed by integrated testing of all spacecraft subsystems. A series of reviews of the spacecraft and checkout was held during the checkout and integrated testing process. A two-phase Customer Acceptance Readiness Review was conducted by NASA at Downey in conjunction with NAA in July and August 1966. After the August review NASA issued a Certificate of Flight Worthiness and authorized the spacecraft to be shipped to the John F. Kennedy Space Center (KSC), Florida. The Certificate included a listing of open items and work to be completed at KSC.

The Command Module was received at KSC on August 26, 1966. It was mated with the Service Module in the altitude chamber at KSC early in September 1966 and alignment, subsystems and system verification tests and functional checks were performed. Many open design change orders were completed and various malfunctions were noted and corrected. The first combined systems tests were begun on September 14 and completed on October 1, 1966. Several malfunctions were noted and correction of some these was deferred to a later date.

A Design Certification Review was held at NASA Headquarters during September and October 1966. This detailed review was conducted by a Board chaired by the Associate Administrator for Manned Space Flight. Board Members were Office of Manned Space Center Directors. This Board issued a Design Certification Document on October 7, 1966 which certified the design as flightworthy, pending satisfactory resolution of listed open items.

After the combined systems tests were completed at KSC in the altitude chamber, the first manned test in this facility was performed. This test was conducted in air at sea level pressure and was made to verify total spacecraft system operation. The test was initiated on October 10 and discontinued on October 11 to replace bent umbilical pins. The test was begun again on October 12 and completed on October 13. On October 14 and 15, an unmanned test was performed at altitude pressures using oxygen to verify spacecraft system operation under these conditions before a manned altitude test was run. The manned test (with the flight crew) was initiated on October 18 but was discontinued after reaching a simulated altitude of 13,000 feet because of the failure of a transistor in one of the inverters in the spacecraft. The inverter was replaced and the test was completed on October 19. A second manned altitude test (with the backup crew) was initiated on October 21 but it was discontinued when a failure occurred in an oxygen system regulator in the spacecraft Environmental Control System. This regulator was removed and found to have a design deficiency. While redesign was being accomplished various spacecraft work items were completed.

On October 27 the Environmental Control Unit was removed and returned to the factory for a design change to the water/glycol evaporator.

During this period a propellant tank had ruptured in the Service Module of Spacecraft 017 at Downey. Therefore, it was decided that the tanks on the Spacecraft 012 Service Module should be checked by special testing at KSC. In order to conduct this testing in parallel with further checking of the Spacecraft 012 Command Module was removed from the altitude chamber. The Service Module was later removed for tests related to the propellant tanks. The Service Module and Command Module were reinstalled in the altitude chamber and ECU was installed. A water/glycol leak developed in the ECU, and it was again returned to the factory for further examination of the leak problem. It was returned on December 14, 1966.

Also, during this period on December 21, 1966 the Apollo Program Director conducted a Recertification Review which closed out the majority of the open items remaining from previous reviews.

After the Command and Service Modules were reinstalled in the altitude chamber and testing in the chamber was resumed. The sea level and unmanned altitude tests were conducted on December 27 and 30.

It should be noted that this final manned test in the altitude chamber was very successful with all spacecraft systems functioning normally. At the post-test debriefing the backup flight crew expressed their satisfaction with the condition and performance of the spacecraft.

It should also be noted that in the altitude chamber tests the Command Module was pressurized with pure oxygen four times at pressures greater than 14.7 psia for a total time of 6 hours and 15 minutes. The total time was about 2 1/2 times longer than the time the Command Module was pressurized with oxygen during the test which was in progress when the accident occurred.

The Command Module was removed from the altitude chamber on January 3, 1967 and the spacecraft was mated to the launch vehicle on January 6 at Launch Complex 34. Various tests and equipment installations and replacements were then performed.

The system was determined to be ready for the initiation of the Plugs-Out Test on January 27, 1967.

Of the many events which took place at KSC subsequent to the arrival of the spacecraft a few stand out as possible indications of deficiencies in the program and some appear to have possible relation to the fire.

The events that possibly may be related to the fire are those concerned with the occasions when water/glycol spillage or leakage from the Environmental Control System was noted. This may be of significance in that water.glycol coming into contact with electrical connectors can cause corrosion of these connectors. Dried water/glycol on wiring insulation leaves a residue which is electrically conductive and combustible. Of the six recorded instances where water/glycol spillage or leakage occurred (a total of 90 ounces leaked or spilled is noted in the records) the records indicate that this resulted in wetting of conductors and wiring on only one occasion. Action was taken to clean the water/glycol from the connectors and wiring on this one occasion. There is no evidence which indicates that damage resulted to the conductors or that faults were produced on connectors due to water/glycol which contributed to the fire. If the cleaning was inadequate, residue would have remained on the wires. Also, undetected wetting could have occurred, which would leave a residue. Small quantities of water/glycol were found in the Command Module after the fire. This, however, could have been due to water/glycol line breakage which is known to have occurred during the fire. And while water/glycol and its residue may have contributed to the spread of the fire there is no positive evidence that residue was related to the ignition of the fire.

The number of open items at the time of shipment of Command Module 012 was not known. There were 113 significant Engineering Orders not accomplished at the time Command Module 012 was delivered to NASA; 623 Engineering Orders were released subsequent to delivery. Of these, 22 were recent releases which were not recorded in configuration records at the time of the accident.

The effort and rework required on Spacecraft 012 at KSC was greater than that experienced on the first manned Gemini spacecraft. However since the Apollo Spacecraft are considerably more complex than Gemini Spacecraft this does not necessarily indicate that the quantity of problems encountered was excessive. There is, however, an inference that the design, qualification and fabrication process may not have been completed adequately prior to shipment to KSC.

Another item should be noted when considering the problems that were found at KSC including some of the problems encountered in the Plugs-Out Test prior to the fire. The prime purpose of all tests conducted prior to launch is to verify and demonstrate that the space vehicle ground support equipment, procedures and personnel are all ready for flight operations. Many of the tests involve a “first time” operation particularly in an overall sense. Therefore, inherent in the verification process is the likelihood that faults will be found in procedures and in equipment. This Plugs-Out Test had not been classified as hazardous because only those tests involving fueled vehicles, hypergolic propellants, cryogenic systems, high pressure tanks, live pyrotechnics or altitude chamber tests were routinely classified as hazardous.

2. Events From Initiation Of The Plugs-Out Test Until The T-10 Minute Hold

The purpose of the Space Vehicle Plugs-Out Integrated Test, Operational Checkout Procedures (OCP) FO-K-0021-1, Spacecraft 012 is to demonstrate all space vehicle systems and operational procedures in as near a flight configuration as is practical and to verify their capability in a simulated launch. System verification is performed, an abbreviated final countdown conducted and a flight simulation made. All communication and instrumentation systems are activated and proper measurements are monitored at appropriate ground stations. At the start of the simulated flight, umbilicals are disconnected and the spacecraft is on simulated fuel-cell power.

Specific objectives of this test for Spacecraft 012 as stated in the Final Procedure Document were:

1. To verify overall spacecraft/launch vehicle compatibility and demonstrate proper function of spacecraft systems with all umbilicals and Ground Support Equipment disconnected.
2. To verify no electrical interference at the time of umbilical disconnect.
3. To verify astronaut emergency egress procedures (unaided egress) at the conclusion of the test.

The preliminary outline for this test procedure was written by North American Aviation, Inc. (NAA) in July 1966. The test procedure was reviewed and revised periodically over the next few months. In September the flight crew requested that emergency egress practice which was not in the original test outline be added. This addition was requested because a subsequent test, Countdown Demonstration, would involve a fully fueled Launch Vehicle and this latter test was identified as hazardous. This egress test was then added to the Space Vehicle Plugs-Out Integrated Test.

The first draft of the Procedure was issued on September 26, 1966. After informal review and revision a second draft was issued on October 19, 1966. After formal review by both NASA and NAA, and further revision the formally approved procedure was issued on December 13, 1966. This procedure was reviewed at KSC and operational and minor technical changes made. A major revision was issued at 5:30 p.m. EST on January 26, 1967 and 4 additional pages were issued at 10:00 a.m. EST on January 27, 1967.

The Plugs-Out Test was initiated on January 27, 1967 at 12:55 GMT (7:55 a.m. EST) when power was applied to the spacecraft for this test. After completion of initial verification tests of system operation the flight crew entered the Command Module. The Command Pilot entered at 18:00 GMT (1:00 p.m. EST) followed by the Pilot and Senior Pilot. The Command Pilot noted an odor in the Spacecraft Environmental Control System suit oxygen loop and the count was held at 18:20 GMT while a sample of the oxygen in this system was taken. This odor has been determined from subsequent analysis not to be related to the fire. The count was resumed at 19:42 GMT with hatch installation and subsequent cabin purge with oxygen beginning at 19:45 GMT. Communication difficulties were encountered and the count was held at approximately 22:40 GMT to troubleshoot the problem. Various final countdown functions were still performed during the hold as communications permitted. From 22:45 GMT until about 22:53 GMT the flight crew interchanged equipment related to the communications systems in an effort to isolate the communications system problem. This problem consisted of a continuously live microphone that could not be turned off by the crew. The live microphone condition was first noted by the test crew about 22:25 GMT and records indicate that the condition first occurred between about 20:57 GMT and 22:18 GMT. During the troubleshooting period problems developed in the ability of various ground stations to communicate with one another and with the crew. None of the communications problems appear to have had a direct bearing on the fire.

By 22:20 GMT (6:20 p.m. EST) all final countdown functions up to the transfer to simulated fuel cell power were completed and the count was held at T-10 minutes pending resolution of the communications problems.

3. Events From Initiation Of The T-10 Minute Hold At 23:20 GMT Until The Report Of Fire

From the start of the T-10 minute hold at 23:20 GMT until about 23:30 GMT there are no events that appear to be related to the fire. The major activity during this period was routine troubleshooting of the communications problem. The records show that except for the communications problem all systems were operating normally during this period. There were no voice transmissions from the spacecraft from 23:30:14 GMT until the transmission reporting the fire which began at 23:31:04.7 GMT (6:31:04.7 p.m. EST).

During the period beginning about 30 seconds before the report there are indications of crew movement. These indications are provided by the data from the Biomedical Sensors, the Command Pilot’s live mike, the Guidance and Navigation System and the Environmental Control System.

There is, however, no evidence as to what this crew movement was or that it was related to the fire.

The biomedical data indicate that just prior to the fire report the Senior Pilot was performing essentially no activity (or was in the baseline “rest” condition) until about 23:30:21 GMT when a slight increase in pulse and respiratory rate was noted. At 23:30:30 GMT the electrocardiogram indicates some muscular activity for several seconds. Similar indications are noted at 23:30:39 GMT. The data show increased activity but are not indicative of an alarm type of response. By 23:30:45 GMT, all of the biomedical parameters had reverted to the baseline “rest” level.

Beginning at about 23:30 GMT, the Command Pilot live microphone transmitted brushing and tapping noises which are indicative of movement. The noises were similar to those transmitted earlier in the test by the live mike when the Command Pilot is known to have been moving. These sounds end at 23:30:58.6 GMT.

Any significant crew movement results in minor motion of the Command Module. This motion is detected by the Guidance and Navigation System and is indicative of crew movement; however, the type of movement cannot be determined. Data from this system indicate a slight movement at 23:30:24 GMT with more intense activity beginning at 23:30:39 GMT. More movement begins at 23:31:00 GMT and continues until loss of data transmission during the fire.

Increases of oxygen flow rate to the crew suits also indicate movement. All suits have some small leakage. This leakage rate varies with crew positions. Earlier in the Plugs-Out Test, the crew reported that a particular movement, the nature of which was unspecified, provided increased flow rate. This is also confirmed from the flow rate data records. The flow rate shows a gradual rise at 23:30:24 GMT which reaches the limit of the sensor at 23:30:59 GMT.

There is a variation at 23:30:50 GMT in the signal output from the gas chromatograph cable (the gas chromatograph was not installed in the Command Module). When the gas chromatograph is not connected, the cable acts as an antenna. Thus, changes in the electromagnetic field within the spacecraft are sensed when the cable is approached closely, touched or moved or voltage fluctuations occur in other equipment. Variations found in the signal level from the gas chromatograph cable at earlier times in the test have been correlated with either crew movement or voltage transients when equipment was turned off or on at these earlier times. The variation at 23:30:50 GMT, may have resulted because it was touched or approached by the crew since there does not appear to be any voltage transient condition at this time which could have given the observed signal.

A significant voltage transient was recorded at 23:30:54.8 GMT. The records show a surge in the AC Bus 2 Voltage.

Several other parameters being measured also showed anomalous behaviour at this time. There was a 1.7-second dropout in signal from the C-band decoder and transmitter outputs, a brief dropout of the VHF-FM carrier, a fluctuation in the rotation controller null outputs and a fluctuation in the gas chromatograph signal.

4. Events From The Report Of Fire Until Crew Removal

The events that occurred during this period can be comprehended most readily by examination of Enclosures 2, Enclosures 3, Enclosures 4, Enclosure 5 and Enclosure 6. These enclosures show a sketch of Launch Complex 34, the Space Vehicle in the service tower and the interior of a mock-up of a Command Module detailed reconstruction of Spacecraft 012.

Beginning at 23:31:04.7 GMT (6:31:04.7 P.M. EST), the crew gave the first verbal indication of an emergency—a fire in the Command Module was reported.

Emergency procedures called for the Senior Pilot, occupying the center couch, to unlatch and remove the hatch while retaining his harness buckled. A number of witnesses who observed the television picture of the Command Module hatch window during this stage of the fire discerned motion that suggests that the Senior Pilot was reaching for the inner hatch handle. The Senior Pilot’s harness buckle was found unopened after the fire, indicating that he initiated the standard hatch-opening procedure. Data from the Guidance and Navigation System indicate considerable activity within the Command Module after the fire was discovered. This activity is consistent with movement of the crew prompted by proximity of the fire or with the undertaking of standard emergency egress procedures.

Personnel located on adjustable level 8 (A-8) adjacent to the Command Module responded to the report of the fire. The Pad Leader ordered crew egress procedures to be started and technicians started toward the White Room which surrounds the hatch and into which the crew would step upon egress. Then the Command Module ruptured.

All transmission of voice and data from the spacecraft terminated by 23:31:22.4 GMT, three seconds after rupture. Witnesses monitoring television showing the hatch window report that flame spread from the left to the right side of the Command Module and shortly thereafter covered the entire visible area.

Flames and gases flowed rapidly out of the ruptured area, spreading flames into the toroidal space between the Command Module pressure vessel and heat shield, through access hatches and into levels A-8 and A-7 of the service structure. These flames ignited combustibles, endangered pad personnel, and impeded rescue efforts. The burst of fire, together with the sounds of rupture, caused several pad personnel to believe that the Command Module had exploded or was about to explode. Pad personnel fled from the immediate area.

The immediate reaction of all personnel on level A-8 was to evacuate the level. This reaction was promptly followed by a return to effect rescue. Upon running out on the swing arm from the umbilical tower, several personnel obtained a fire extinguisher and returned along the swing arm to the White Room to begin rescue efforts. Others obtained fire extinguishers from various areas of the service structure and rendered assistance in fighting the fires.

The time interval between exit to the swing arm and return to the White Room is estimated variously by the participants. Persons viewing television monitors could not see movement early in the White Room because of heavy smoke. Approximately one minute and thirty seconds after the first crew report of the fire the Pad Leader reported over his headset that attempts had been started to remove the hatches. This report was made after the Pad Leader had gone out on the swing arm, returned and entered the White Room one or two times and left to reach breathable air and his headset. It is therefore estimated that attempts to remove the hatches began one minute after the fire was first reported.

Three hatches were installed on the Command Module. The outermost hatch, called the boost protective cover (BPC) hatch, is part of the cover which shields the Command Module during lauch and is jettisoned prior to orbital operation. The middle hatch is termed the ablative hatch and becomes the outer hatch when the BPC is jettisoned after launch. The inner hatch closes the pressure vessel wall of the Command Module and is the first hatch to be opened by the crew in an unaided crew egress.

The outer or BPC hatch was in place but not fully latched because of distortion in the BPC caused by wire bundles temporarily installed for the test. The middle hatch and inner hatch were in place and latched after crew ingress.

Although the BPC hatch was not fully latched it was necessary to insert a specially-designed tool into the hatch in order to provide a hand-hold for lifting the hatch from the Command Module. At this time the White Room was filling with dense, dark smoke from the Command Module interior and from secondary fires throughout level A-8. While some personnel were able to locate and don operable gas masks others were not. Some proceeded without masks while others attempted without success to render masks operable. Even operable masks were unable to cope with the dense smoke present because they were designed for use in toxic rather than dense smoke atmospheres.

Visibility in the White Room was virtually zero. It was necessary to work essentially by touch since visual observation was limited to a few inches at best. A hatch removal tool was in the White Room. Once the small fire near the BPC hatch had been extinguished and the tool located the Pad Leader and an assistant removed the BPC hatch. Although the hatch was not latched, removal was difficult.

The personnel who removed the BPC hatch could not remain in the White Room because of the smoke. They left the White Room and passed the tool which was necessary to open each hatch to other individuals. A total of five individuals took part in opening the three hatches and each made several trips into the White Room and out for breathable air.

The middle hatch was removed with less effort than was required for the outer or BPC hatch.

The inner hatch was unlatched and an attempt was made to raise it from its support and to lower it to the Command Module floor. The hatch could not be lowered the full distance to the floor and was instead pushed to one side. When the inner hatch was opened intense heat and a considerable amount of smoke issued from the interior of the Command Module.

When the Pad Leader ascertained that all hatches were open, he left the White Room, proceeded a few feet along the swing arm, donned his headset and reported this fact. From a voice tape it has been determined that this report came approximately five minutes, twenty-seven seconds after the first report of the fire. The Pad Leader estimates that his report was made no more than thirty seconds after the inner hatch was opened. Therefore, it is concluded that all hatches were opened and the two outer hatches removed approximately five minutes after the report of fire or at about 23:36 GMT. A log maintained by a person monitoring voice transmissions from level A-8 sets the time of the Pad Leader’s report at 23:36 GMT. All records in this log are noted in minutes with no indication of seconds. Medical opinion, based on autopsy reports, has concluded that chances of resuscitation decreased rapidly once consciousness was lost and that resuscitation was impossible by 23:36 GMT.

Visibility within the Command Module was extremely poor. Although the lights remained on, they could be perceived only dimly. No fire was observed. Initially, the crew was not seen. The personnel who had been involved in removing the hatches attempted to locate the crew without success.

Throughout this period, other pad personnel were fighting secondary fires on level A-8. There was considerable fear that the launch escape tower, mounted above the Command Module, would be ignited by the fires below and destroy much of the launch complex.

Shortly after the report of fire, a call was made to the fire department. From log records, it appears that the fire apparatus and personnel were dispatched at about 23:32 GMT. After hearing the report of the fire, the doctor monitoring the test from the blockhouse near the pad proceeded to the base of the umbilical tower.

The exact time at which firemen reached Level A-8 is not known. Personnel who opened the hatches unanimously state that all hatches were open before any firemen were seen on the level or in the White Room. The first firemen who reached Level A-8 state that all hatches were open, but that the inner hatch was inside the Command Module, when they arrived. This places arrival of the firemen after 23:36 GMT. It is estimated on the basis of tests, that seven to eight minutes were required to travel from the fire station to the launch complex and to ride the elevator from the ground to Level A-8. Thus, the estimated time of firemen arrival at level A-8 is shortly before 23:40 GMT.

When the firemen arrived, the positions of the crew couches and crew could be perceived through the smoke but only with great difficulty. An unsuccessful attempt was made to remove the Senior Pilot from the Command Module.

Initial observations and subsequent inspection reveal the following facts. The Command Pilot’s couch (the left hand couch) was in the “170 degree position,” in which it is essentially horizontal throughout its length. The foot restraints and harness were released and the inlet and outlet oxygen hoses were connected to the suit. The electrical adapter cable was disconnected from the communications cable. The Command Pilot was lying supine on the aft bulkhead or floor of the Command Module, with his helmet visor closed and locked and with his head beneath the Pilot’s head rest and his feet on his own couch. A fragment of his suit material was found outside the Command Module pressure vessel five feet from the point of rupture. This indicates that his suit had failed prior to the time of rupture (23:31:19.4 GMT) allowing convection currents to carry the suit fragment through the rupture.

The Senior Pilot’s couch (the center couch) was in the “96 degree” position in which the back portion is horizontal and lower in the raised position. The buckle releasing the shoulder straps and lap belts was not opened. The straps and belts were burned through. The suit oxygen outlet hose was connected but the inlet hose was disconnected. The helmet visor was closed and locked. The Pilot was supine on his couch.

From the foregoing it has been determined that in all probability the Command Pilot left his couch to avoid the initial fire, the Senior remained in his couch as planned for emergency egress, attempting to open the hatch until his restraints burned through and the Pilot remained in his couch to maintain communications until the hatch could be opened by the Senior Pilot as planned. With a slightly higher pressure inside the Command Module than outside, opening the inner hatch is impossible because of the resulting force on the hatch. Thus the inability of the pressure relief system to cope with pressure increase due to the fire made opening of the inner hatch impossible until after cabin rupture, and after rupture the intense and widespread fire together with rapidly increasing carbon monoxide concentrations further prevented egress.

Whether the inner hatch handle was moved by the crew cannot be determined because the opening of the inner hatch from the White Room also moves the handle within the Command Module to the unlatched position.

Immediately after the firemen arrived, the Pad Leader on duty was relieved to allow treatment for smoke inhalation. He had first reported over the headset that he could not describe the situation in the Command Module. In this manner he attempted to convey the fact that the crew was dead to the Test Conductor without informing the many people monitoring the communication channels. Upon reaching the ground the Pad Leader told the doctors that the crew was dead. The three doctors proceeded to the White Room and arrived there shortly after the arrival of the firemen. The doctors estimate their arrival to have been at 23:45 GMT. The second Pad Leader reported that medical support was available at approximately 23:43 GMT. The three doctors entered the White Room and determined that the crew had not survived the heat, smoke, and thermal burns. The doctors were not equipped with breathing apparatus, and the Command Module still contained fumes and smoke. It was determined that nothing could be gained by immediate removal of the crew. The firemen were directed to stop removal efforts.

When the Command Module had been adequately ventilated, the doctors returned to the White Room with equipment for crew removal. It became apparent that extensive fusion of suit material to melted nylon from the spacecraft would make removal very difficult. For this reason it was decided to discontinue efforts at removal in the interest of accident investigation and to photograph the Command Module with the crew in place before evidence was disarranged.

Photographs were taken, and the removal efforts resumed at approximately 5:30 GMT (12:30 a.m. EST) on January 28. Removal of the crew took approximately 90 minutes and was completed about seven and one-half hours after the accident.

PART V. Investigation and Analyses

1. Inspection and Disassembly

Immediately after the accident additional security personnel were positioned at Launch Complex 34 and the Complex was impounded. Prior to disturbing any evidence numerous external and internal photographs were taken of the spacecraft. After crew removal, two experts entered the Command Module to verify switch positions. Small groups of NASA and North American Aviation management, Apollo 204 Review Board Members, Representatives and Consultants inspected the exterior of Spacecraft 012. On January 28, 1967 an astronaut entered the Command Module to verify additional switch positions needed to clarify data.

The Board established procedures for disassembly of Spacecraft 012. The first step of disassembly was to establish safe working conditions at the spacecraft. This was accomplished by:

1. Removal of the Launch Escape System
2. Removal or safetying of all pyrotechnics
3. Examination of spacecraft structure for integrity
4. Examination of all pressure vessels for potential hazards
5. Sampling of spacecraft atmosphere for harmful contaminants

After safe working conditions were established disassembly proceeded. A series of close-up stereo photographs of the Command Module was taken to document the as-found condition of the spacecraft systems.

The task of searching the physical evidence was difficult and time-consuming because of the small entrance and confined area of the Command Module. In order to remove the components as quickly as possible, two persons at a time were permitted to enter the Command Module for component removal. After the removal of each component, photographs were taken of the exposed area. This step-by-step photography was used throughout the disassembly of the spacecraft (Enclosures 1 through 11). Approximately 5,000 photographs were taken.

After the couches were removed, a special false floor with removable 18-inch transparent squares was suspended from the existing couch strut fittings to provide access to the entire inside of the Command Module without disturbing evidence (Enclosure 12). A detailed inspection of the spacecraft interior was then performed followed by the preparation and approval by the Board of a Command Module disassembly plan. Command Module 014 was shipped to KSC on February 1, 1967 to assist the Apollo 204 Review Board in the investigation. This Command Module was placed in the Pyrotechnics Installation Building and was used to develop disassembly techniques for selected components prior to their removal from Command Module 012.

By February 7, 1967 the disassembly plan was fully operational. The concentrated effort of organized and coordinated component removal continued on a three-shift, seven-day-a-week basis. All suspect circumstances or conditions were brought to the attention of the Apollo 204 Review Board.

All interfaces such as electrical connectors, tubing joints, physical mounting of components, etc. were closely inspected and photographed immediately prior to, during and after disassembly. Each item removed from the Command Module was appropriately tagged, sealed in clean plastic containers and transported under the required security to bonded storage (Enclosure 13).

On February 17, 1967, the Board decided that removal and wiring tests had progressed to a point which allowed moving the Command Module without disturbing evidence. The Command Module was moved to the Pyrotechnics Installation Building at KSC where better working conditions were available.

With improved working conditions, it was found that a work schedule of two eight-hour shifts per day for six days a week was sufficient to keep pace with the analysis and disassembly planning. The only exception to this was a three-day-period of three eight-hour shifts per day used to remove the aft heat shield, move the Command Module to a more convenient work station and remove the crew compartment heat shield (Enclosures 14 and 15). The disassembly of the Command Module was completed on March 27, 1967.

From the beginning of disassembly, action was taken to catalog and place on display the hundreds of items that would be removed from the Command Module. The Pyrotechnics Installation Building was assigned to the Board for this purpose. A bonded storage room was established to receive and catalog components as they were removed. Command Module components were then displayed in a bonded area. The purpose of this area was to permit investigators to make visual examination of Command Module components (Enclosure 16). During the course of the disassembly over 1,000 items were removed from the Command Module. A list of all removed components was maintained and distributed weekly to the Board. This list identified the location of components in the Pyrotechnics Installation Building as well as those undergoing further analysis and tests at other locations.

Throughout the disassembly operation, experts meticulously studied the exposed portions of the Command Module. The relative consumption of combustibles and sooting patterns were studied for clues as to the site of the ignition source. All structural elements, covers and panels were examined for evidence of association with the ignition. Component systems and parts were studied inch by inch with magnifying glasses and frequently parts were taken into the laboratory for microscopic or metallurgical analysis. Wire bundles were given particular attention and after separation, the individual wires were examined under 7-power magnification for sites of possible arcing.

All components that showed evidence of abnormal fire effects were examined internally and many were tested for functionality. Many components showed burning of internal insulation or plotting material but in all cases they were exonerated on the basis of direction of flame travel or on the basis that there could be no communication with combustibles outside the component. Particularly suspect components were disassembled for detailed examination and analysis. All of the data developed by these visual and laboratory examinations were coordinated in making the final analysis as to probable ignition sources.

2. Chronology of the Fire

It is most likely that the fire began in the lower forward portion of the left-hand equipment bay. This would place the origin to the left of the Command Pilot, and considerably below the level of his couch.

Once initiated, the fire burned in three stages. The first stage with its associated rapid temperature rise and increase in the cabin pressure, terminated approximately 15 seconds after the verbal report of fire. At this time (about 23:31:19 GMT) the pressure vessel, which constitutes the Command Module cabin, ruptured. During this first stage of the fire, flames moved rapidly from the point of ignition, traveling along the Raschel net debris traps which were installed in the Command Module to prevent items from dropping into equipment areas during tests or flight. At the same time, Velcro strips positioned near the ignition point also burned.

Based upon pressure and temperature measurements taken during the fire, the fire was not intense until about 23:31:12 GMT. The slow rate of buildup of the fire during the early portion of the first stage is consistent with the view that ignition occurred in a zone containing little combustible material. The slow rise of pressure could also result from absorption of most of the heat by the aluminum structure of the Command Module. The original flames rose vertically and then spread out across the cabin ceiling. The debris traps provided not only combustible material and a path for the spread of the flames but also firebrands of burning molten nylon. The scattering of these firebrands contributed to the spread of the flames.

By 23:31:12 GMT the fire had broken from its point of origin. Evidence is strong that a wall of flames extended along the left wall of the module, preventing the Command Pilot, occupying the left hand couch from reaching the valve which would vent the Command Module to the outside atmosphere. Although operation of this valve, located on a shelf above the left hand equipment bay, is the first step in established emergency egress procedures, such action would have been to no avail because the venting capacity was insufficient to prevent the rapid build-up of pressure due to the fire. It is estimated that opening the valve would have delayed Command Module rupture by less than one second.

Emergency procedures called for the Senior Pilot, occupying the center couch, to unlatch and remove the hatch while retaining his harness buckled. A number of witnesses who observed the television picture of the Command Module hatch window during this stage of the fire discerned motion that suggests that the Senior Pilot was reaching for the inner hatch handle. The Senior Pilot’s harness buckle was found unopened after the fire indicating that he initiated the standard hatch opening procedure. Data from the Guidance and Navigation System indicate considerable activity within the Command Module after the fire was discovered. This activity is consistent with movement of the crew prompted by proximity of the fire or with the undertaking of standard emergency egress procedures.

The Command Module is designed to withstand an internal pressure of approximately 13 pounds per square inch above external pressure without rupturing. Data recorded during the fire show that this design criteria was exceeded late in the first stage of the fire and that rupture occurred at about 23:31:19 GMT. The point of rupture was where the floor or aft bulkhead of the Command Module joins the wall, essentially opposite the point of origin of the fire. About three seconds before rupture, the final crew communication began at 23:31:16.8 GMT (a detailed discussion of the two voice transmissions during the fire is given in a subsequent section).

Rupture of the Command Module marked the beginning of the brief second stage of the fire. This stage is characterized by the period of greatest conflagration due to the forced convection that resulted from the outrush of gases through the rupture in the pressure vessel. The swirling flow scattered firebrands throughout the crew compartment spreading the fire. This stage of the fire ended at approximately 23:31:25 GMT. Evidence that the fire spread from the left hand side of the Command Module toward the rupture area was found on subsequent examination of the module. For example, the leg rest control handle on the left side of the left hand couch is fabricated from aluminum tubing. Tongues of flame pouring over the control handle melted its left side. However, a nylon button at the base of the handle was unconsumed and only slightly deformed. Similarly, flames spreading across the floor beneath the couches caused more burning on the left side of three nylon helmet covers than on the right. The underside of the couches above the helmet covers was relatively unsooted. A lack of soot indicates a fire of only short duration beneath the couches some time after the couch structure had become heated. Further, storage boxes situated on the floor were damaged only slightly. Fire across the floor of the spacecraft lasted but a few seconds and spread from left to right.

Damage to the crew suits is also indicative of the spread of the fire from left to right. The Command Pilot’s suit was damaged worst while Senior Pilot’s and Pilot’s suits sustained progressively less damage.

Evidence of the intensity of the fire includes burst and burned aluminum tubes in the oxygen and coolant systems at floor level.

The pressure in the Command Module is estimated to have dropped to atmospheric pressure five or six seconds after rupture. The third and final stage of the fire began at about 23:31:25 GMT.

The third stage was characterized by rapid production of high concentrations of carbon monoxide. Following the loss of pressure in the Command Module and with fire now throughout the crew compartment, the remaining atmosphere quickly became deficient in oxygen so that it could not support continued combustion. Unlike the earlier stages where the flame was relatively smokeless, heavy smoke now formed and large amounts of soot were deposited on most spacecraft interior surfaces as they cooled. The third stage of the fire could not have lasted more than a few seconds because of the rapid depletion of oxygen. It is estimated that the Command Module atmosphere was lethal by 23:31:30 GMT, five seconds after the start of the third stage.

Although most of the fire inside the Command Module became extinguished shortly because of lack of oxygen, a localized, intense fire lingered in the area of the Environmental Control Unit. This unit is located in the left hand equipment bay, near the point where the fire is believed to have started. Failed oxygen and water/glycol lines in this area continued to supply oxygen and fuel to support the localized fire that melted the aft bulkhead and burned adjacent portions of the inner surface of the Command Module heat shield.

The loss of telemetry data at 23:31:22.4 GMT during the second phase of the fire makes determination of precise times of subsequent occurrences impossible. Thus all further times are based on less precise evidence such as entries in logs maintained by personnel monitoring various facets of the activity, review of voice tapes maintained of conversations between the Pad Leader and blockhouse monitors, and where so indicated, witness estimates.

3. Data Analysis

a. SCOPE OF INVESTIGATION

All data have been analyzed by the panels and the Board with frequent help from consultants and outside specialist groups. Specific tests of Spacecraft 012 equipment were initiated on approval by the Board where results would contribute to an understanding of the cause of the accident.

A summary of these results follows.

b. ANALYSIS OF RELEVANT TIME LINES

Enclosure 17 displays significant data that were obtained just prior to the report of the fire by the astronaut crew. These time lines cover the period of one minute before the fire report until all data signals were lost. The data shown includes signals from the gas chromatograph channel, the voltage of the AC Bus 2, the C-band beacon, the VHF telemetry carrier, the flow of oxygen into the suit loop, various indicators of spacecraft motion, the biomedical data from the Senior Pilot, and audio signals (voice and noise) received on the S-band communication link. An analysis of each item and a summary of their correlation follows.

(1) Gas Chromatograph Telemetry Data Anomaly

The gas chromatograph was not installed for the Plugs-Out Test and the connector that carried the telemetry data signals and the required AC power was open ended and was placed on the gas chromatograph shelf prior to the test. Power to the AC in the connector was turned on during the test as required by the test plan.

A careful examination of the data records disclosed activity on this channel eight times up to and including the activity shown at approximately 23:30:50 GMT. Subsequent testing has demonstrated that the telemetry data lead in the connector has the characteristics of an antenna, and consequently can detect changes in electromagnetic fields within the spacecraft. Movement of this cable within a constant electromagnetic field will also produce signals of the magnitude observed during the Spacecraft 012 accident.

The disturbance at approximately 23:30:50 GMT indicates that such a change in the electromagnetic field took place. This change could have resulted from movement of the connector. Evidence indicates that although the connector was not in its originally stored position after the accident, it probably was there during the initial stages of the fire.

(2) AC Bus 2 Voltage Anomaly

A momentary increase in AC Bus 2 voltage on all three phases was noted at approximately 9 seconds before the report of fire, and at the same time telemetry data from equipment powered from AC Bus 2 showed abnormalities. These were:

1. Dropout of C-band decoder and transmitter outputs for 1.7 seconds.
2. Momentary dropout of VHF-FM transmitter.
3. Fluctuation of rotation controller null outputs.
4. Gas chromatograph telemetry signal transient. Other equipment connected to AC Bus 2 at this time had no data monitoring capability that would detect effects of power transients.

The power distribution system was in the standard configuration at the time of the anomaly. DC bus A was receiving power from the ground DC “A” power supply. This power supply in turn powered AC Bus 1 through inventor no. 1. Similarly DC Bus B received power from the DC “B” power supply and powered AC bus 2 through inverter no. 2.

A possible explanation for dropout of the C-band decoder and transmitter, the interruption of the VHF-FM transmitter and rise in AC Bus 2 voltage follows. The post-landing bus supplies power through a single conductor and circuit breaker to the power relay holding coils for both the C-band beacon and the VHF-FM transmitter. Temporary loss of voltage to the relay holding coils by unknown cause, would temporarily interrupt power to the C-band decoder and VHF-FM transmitter. The resulting transient to the voltage level on AC Bus 2 could account for other measured phenomena.

The most probable cause of the AC Bus 2 transient and associated indications was a momentary short or interruption of DC Bus B. Analysis and subsequent testing correlate with this conclusion as follows:

1. AC Bus Transient. This high voltage indication can be interpreted as evidence of a momentary drop of DC voltage input to the inverter which results in a drop in AC output and a subsequent overshoot upon recovery. First indication of a disturbance was noted during apparent recovery. The voltage decrease was not seen because the channel was sampled only 10 times a second.
2. C-band Beacon Dropout. The 1.7 second dropout observed is the minimum recovery time of the protective circuit internal to the beacon. A momentary interruption of AC Bus 2 power for a period as short as 10 milliseconds would cause the C-band beacon dropout. These results were verified by special tests on a C-band beacon similar to the one used in Spacecraft 012. The most probable cause of the beacon dropout was a momentary loss of AC input power to the beacon particularly since the transponder dropout was coincident with a transient on the AC Bus 2 and the beacon performed normally after recovery from the dropout unit loss of data.
3. VHF-FM Transmitter Signal Dropout. The RF carrier dropout was observed by all monitoring ground stations and the duration of the dropout was approximately 20 milliseconds. The recorded data wave train from the VHF-FM transmitter also indicated dropout. A dropout of this nature has been duplicated by several special tests with a similar transmitter under similar conditions. Because the VHF transmitter recovered, the most probable cause of the dropout was a momentary interruption of the AC input power.
4. Rotation Controller Null Output Transients. Momentary transients were noted on each of the three control axes. The rotation controller, whose output was reading slightly off null just prior to the anomaly (the controller was pinned), was supplied by phase A of AC Bus 2. Transient voltages on the phase A Bus would most likely be detected on the controller output. Special tests have shown that the null output transients experienced can be duplicated by a momentary interruption of AC Bus 2 phase power.
5. Gas Chromatograph Telemetry Signal Transient. As previously discussed this transient could result from a change in the electromagnetic field. Such a change in the electromagnetic field could also be the result of electric arcing.

(3) Anomalies in Oxygen Flow

Enclosure 18 is a schematic of the suit loop. Oxygen is normally supplied from the surge tank and the service module cryogenic storage tanks through an oxygen regulator which controls the supply pressure to approximately 100 psi. An oxygen flow transducer is installed in the supply line downstream of the oxygen regulator and oxygen is supplied to the suit loop through a demand regulator. The oxygen in the suit loop is circulated to the three astronauts through three separate branches. Each branch has an individual flow rate transducer.

The flow rate of oxygen started to increase approximately 40 seconds before the reported fire. The output limit or saturation of the flow transducer, which corresponds to a flow of 1.033 pounds per hour, was reached approximately 5 seconds before the first fire report. The oxygen flow transducer stayed in this saturated condition until loss of data occurred. The Caution and Warning Alarm was actuated 15 seconds after the oxygen flow exceeded one pound per hour. This delay is normal and prevents actuation of the Caution and Warning Alarm during normal short duration, high flow conditions.

The stable oxygen surge tank pressure, coupled with the normal oxygen regulated pressure, indicates that oxygen flow rate was not greater than 3 to 6 pounds per hour until approximately 7 seconds after the first fire report. Beyond that time the oxygen flow rate was much higher.

The initial flow rate increase is probably due to crew movement which normally results in increased leakage to the cabin at low differential pressure conditions. Enclosure 19 shows that at approximately 23:31:03 GMT the oxygen flow had increased to the suit loop to the extent that the pressure differentials across the suits and compressor were increasing. There was an indication that suit circuit flow through the Senior Pilot’s suit was interrupted for about two seconds at approximately 23:31:09 GMT. This interruption in flow to the Senior Pilot’s suit is not completely understood; however, it probably was caused by manipulation of the suit hoses or associated controls.

(4) Indications of Spacecraft Motion

A number of individual signals were received which are indicative of slight motions of the spacecraft within the last minute prior to the first fire report. These signals were of a random nature and are similar to signals that were obtained from the spacecraft during known crew movement.

These signals included corrective torque signals to the gyrocompasses in the Inertial Measuring Unit, a brushing or tapping of the Command Pilot’s live microphone, the previously mentioned increase in oxygen flow attributed to suit leakage and an increase in the attention level of the Senior Pilot most noticeable between 23:30:30 GMT and 23:30:45 GMT. The Senior Pilot was the only member of the crew for whom biomedical data were recorded.

The nature of activity of the crew during this period could not be determined.

(5) S-Band Transmissions

There were no voice transmissions from the spacecraft from 23:30:14 GMT until the first indication of fire in the spacecraft by the crew. During this time the Command Pilot had a live microphone condition as noted previously. Two voice transmissions were subsequently received. The first of these was the first indication of the existence of a fire by the crew.

(a) The Live Microphone Anomaly

Voice tape analysis and instrumentation data records show that a live microphone, constant-keying condition, existed from the Command Pilot position during a considerable portion of the final test period. This condition apparently did not exist beyond the first of the final two voice transmissions from the spacecraft.

Audio circuits are normally actuated by a crewman pressing his Push-to-Talk (PTT) button on the cobra cable or in the Command Pilot’s case by pressing his controller PTT or his cobra cable PTT button (Enclosure 20). This action serves to ground the microphone amplifier in the individual crewman’s audio panel as well as the diode gate in the audio center on the S-band audio output. These functions allow signals to modulate the S-band transmitter.

The problem has been isolated to the PTT or keying line that runs between the cobra cable, translation controller, Command Pilot audio control panel and the audio center. Crew attempts to isolate the problem were unsuccessful although the Command Pilot’s cobra cable was absolved after troubleshooting. Subsequent testing has also failed to disclose the cause of this problem.

Power limitations and subsequent testing of this circuitry indicates that sufficient current cannot be carried by this keying circuitry for it to be considered a possible ignition source.

(b) Voice Transmission

The final two voice transmissions were made on S-band. No voice communications on VHF were made from the spacecraft during this period. The first transmissions lasted from 23:31:04.7 GMT through 23:31:10 GMT and the second lasted from 23:31:16.8 GMT through 23:31:21.8 GMT. The tape recordings of these transmissions have been analyzed extensively and the results are presented subsequently.

(6) Cabin Pressure Rise

The cabin pressure for the period from first report of the fire through loss of signal is shown in Enclosure 21.

First indication by either the cabin pressure or battery compartment (open to the cabin) sensors of a pressure increase occurred at approximately 23:21:11 GMT or about 6 seconds after the crew first reported the fire. The pressure exceeded the range of these transducers, 17 pounds per square inch absolute (psia) for the cabin and 21 psia for the battery compartment transducers by 23:31:16 GMT. Data from this time until loss of signal were derived from the response of Guidance and Navigation equipment to the different pressure changes. The cabin ruptured at a time of about 23:31:19 GMT and at a pressure of at least 29 psia.

Rupture occurred in the -Y, +Z quadrant and the resulting jet of hot gases caused extensive damage to the exterior structure (Enclosures 22 through 25).

(7) Summary of Relevant Events

Between 30 and 45 seconds prior to the report of fire, both the Command Pilot and Senior Pilot were active. The nature and level of the activity remain unknown. Except for the transients in data measurements that occurred approximately 9 seconds prior to the report of the fire, there are no other identified relevant events that preceded the fire. It should be noted that these data transients and subsequent activity of the crew may as easily be associated with the result of the fire as with the cause.

The increase in oxygen flow to the suit loop prior to and immediately following the report of the fire and its effect on the pressure distribution within the suit loop is the result of normal demand regulator response to oxygen leaking from the circuit to the cabin. This is further compounded by the response of the regulator to the rise in cabin pressure.

c. Analysis of Crew Voice Transmission during the Fire

The tape transients of the voice tapes from the Command Module during the period of the fire have been analyzed extensively. These analyses included a review of all transmissions prior to the fire that were made by the crew during the test in an attempt to aid in the determination of who made these last two transmissions and what was said. These analyses were made by NASA personnel familiar with the communication systems, the crew and their voice characteristics, the sequence of events before, during and after the fire as determined during the investigation. The Board also reviewed these transmissions. Experts at the Bell Telephone Laboratories performed extensive analyses of the tape record.

Except for a portion of the first transmission which is quite clear, the remainder of the transmissions are not clear and it is impossible to define exactly what was said by the crew.

Two points made by the Bell Telephone Laboratory experts should be noted:

1. The present state-of-the-art of analysis of voice records is such that little if anything can be determined as to what was said if the recording is not sufficiently clear to be intelligible by listening alone. Analysis can provide some clues as to who may have made the transmissions; however, these clues are not definitive.

2. When the recording of the transmission is not clear, there will be nearly as many interpretations of what was said as there are qualified listeners.

A summary of various interpretations of these transmissions is made in the following paragraphs.The analysis of the first transmission is as follows:

This transmission began at 23:31:04.7 GMT with an exclamatory remark. This transmission is not clear. Listeners believe this initial remark was “Hey ” or “Fire” but this is not certain.

Some listeners believe and laboratory analysis supports this belief that this transmission was made by the Command Pilot. This remark is followed by a short period of noise (bumping sound, etc.).

The second portion of this first transmission begins at 23:31:06.2 GMT with unclear word. Most listeners believe the first word to be one of the following:

• “I’ve”
• “We’ve”

The remainder of this transmission is quite clear and is: “…Got a fire in the cockpit,” followed by a clipped word sounding like “Uheh,” which ended at 23:31:10 GMT. Many listeners believed this transmission was made by the Pilot and laboratory analysis tend to support this belief. However, no firm conclusion can be drawn.

The analysis of the second transmission is as follows:

Following a 6.8-second period of no transmission, the second transmission began at 23:31:16.8 GMT and ended at 23:31:21.8 GMT. The entire second transmission is garbled and is, therefore, subject to wide variation of interpretation as to content and as to who made the transmission and no definitive transcription is possible.

The general content of this transmission consists of what appears to be three separate phrases. It has been interpreted several ways by many listeners. The following is a list of some of the interpretations that have been made:

1. “They’re fighting a bad fire – Let’s get out ….Open ‘er up.”
2. “We’ve got a bad fire – Let’s get out ….We’re burning up.”
3. “I’m reporting a bad fire ….I’m getting out ….”

This transmission ended with a cry of pain. Some listeners believe this transmission was made by the Pilot.

It should be noted that:

1. The total duration of these two transmissions was brief, lasting 10.3 seconds; the first lasted 5.3 seconds and the second lasted 5.0 seconds, with a 6.8-second period of no transmission.
2. The transmissions provide evidence only of the time the crew first reported the existence of the fire and do not provide any information as to the cause of the fire.

d. Medical Analyses

Loss of consciousness was due to cerebral hypoxia due to cardiac arrest resulting from myocardial hypoxia. Factors of temperature, pressure and environmental concentrations of carbon monoxide, carbon dioxide, oxygen and pulmonary irritants were changing extremely rapidly. It is impossible to integrate these variables on the basis of available information with the dynamic physiological and metabolic conditions they produced, in order to arrive at a precise statement of time when consciousness was lost and when death supervened. The combined effect of these environmental factors dramatically increased the lethal effect of any factor by itself. It is estimated that consciousness was lost between 15 and 30 seconds after the first suit failed. Chances of resuscitation decreased rapidly thereafter and were irrevocably lost within 4 minutes.

4. Cause of the Apollo 204 Fire

The fire in Apollo 204 was most probably brought about by some minor malfunction or failure of equipment or wire insulation. This failure, which most likely will never be positively identified, initiated a sequence of events that culminated in the conflagration.

A great deal of effort has been expended in an attempt to find this specific initiator. Although unsuccessful in this search, this effort has produced a fairly good understanding of the types of things that may have been the initiator and the types of things that probably could not have been the initiator.

Electrostatic discharge, spontaneous combustion of flammable material, mechanically produced heat by machinery and heat from the impact of a struck object have been eliminated as reasonable possibilities of ignition of the fire. The flow of oxygen through orifices or metering valves can create heat through the excitation of resonating frequencies in the gas. However, a thorough examination of the hardware and evaluation of recorded performance of the equipment eliminates the energy of flowing oxygen as a possible initiator.

The most obvious source of energy needed to initiate the fire existed in the spacecraft’s power distribution system. Current carrying wires were distributed throughout every major region of the Command Module. The most likely ways in which electrical power can initiate a fire are the following:

1. Through malfunction of the equipment being powered which in turn ignites or initiates a fire in nearby combustibles.
2. Overload in the conductor resulting from shorts in equipment or wiring. This overload will cause the conductor to overheat and ignite nearby combustibles (Enclosure 26).
3. Electric arcs that are created when the insulation is defeated between power carrying conductors and the spacecraft structure or equipment.

A large majority of the wires were left undamaged. However, there were a number of cases where exposed wire showed extensive burning, overheating or complete destruction. There were also several places where pitting of exposed conductors and adjacent structure indicate that an electric arc had occurred.

a. Malfunction of Electrical Powered Equipment

After removal from the spacecraft, each component or subassembly was critically examined to determine whether or not it could be associated with the initiation of the fire. The vast majority of these could be classified as non-initiators on the basis of external examination and recorded performance. If, however, there was any suspicion that an item was involved with the initiation of the fire, it was subjected to intensive scrutiny that involved one or more of the following procedures:

1. Laboratory analysis of damage, electrical continuity and resistance tests.
2. Functional performance using established procedures for “bench checks.”
3. Careful disassembly which included repeating some of the above steps on individual parts of the assembly.

The results of this effort led to the conclusion that none of the electrically powered spacecraft systems or subassemblies was associated with the initiation of the fire.

b. Electrically Overloaded Conductors

The Apollo spacecraft wiring is protected with Teflon insulation. Teflon was chosen as the insulating material after a series of tests clearly showed that it was the least likely to burn when overheated by shorting. Individual conductors in a wire bundle using Teflon-insulated wires could be melted to destruction without initiating a sustained fire in the bundle when located in a 100-percent oxygen atmosphere at 5 psia. The Teflon-insulating material provided a high degree of fire protection to wire bundles which may contain electrically overloaded wires. Primary protection to wiring in the spacecraft, however, was provided by circuit breakers and fuses which protected all power-carrying conductors. Critical analysis of all circuit breaker installations showed that this protection was provided adequately with only a few exceptions. Several indications of shorted wiring were made the subject of individual detailed investigations. These investigations have all proved negative except for a few cases that could not be exonerated completely.

c. Electric Arcs

Teflon has excellent fire resistance but low resistance to cold flow. The Teflon covering on the wire used in Apollo 204 could be damaged easily or penetrated by abrasion. The covering could also be damaged when forced against the structure by poor installation. The Board found numerous examples in the wiring of poor installation, design and workmanship (an example is shown in Enclosure 27 where a wrench socket was found in the spacecraft.). If a power conducting wire experiences penetration of its insulation by the metal structure of the spacecraft or spacecraft components, an instantaneous short to ground is created at the point of conductor contact. An arc or a series of arcs between conductor and structure results. The arcing action may be terminated by the blowing away of molten metal at the point of contact, or if sufficient mechanical pressure exists, fusion between the conductor and structure may occur to create a continuous short. The previous occurrence of an arc can be determined through examination of hardware because a characteristic pit or crater is left at the location of contact. Tests in a 16.5 psia oxygen atmosphere have shown that sparks blown from arcs can ignite combustible material several inches from the arc. Circuit breakers and other practical circuit interrupting devices cannot act rapidly enough to prevent an arc. Thus, arcs cannot be eliminated as a potential source of ignition energy. As noted previously, there were strong data indications of an abrupt, short-duration voltage decrease. This is consistent with a quickly terminated arc. During the examination of hardware and wiring, particular emphasis was placed on locating craters near power cables. While several such craters were found, only one appeared to be linked closely to the time of the fire by other supporting evidence. A complete investigation of the evidence associated with this possible ignition source has relegated it to a low probability. Studies of fire damage patterns indicate that the most likely region for the start of the fire is underneath the lithium hydroxide access door. Damage is so extensive in this location that the physical evidence remaining provides little interpretive information (Enclosure 11). Power cable insulation passing under this door was potentially vulnerable to abrasion from the corner along the lower edge of the door. (Enclosure 28 shows this cable as it is installed on Spacecraft 014.) If this cable were the cause, it cannot be proven since both the power cable and the inside edge of the door were completely destroyed. It is most probable that the fire was initiated by an electric arc either in this location or in some other region near the Environmental Control Unit. Other powered cable in the Environmental Control Unit may have been the source but extensive destruction of them precludes a positive determination. The time of initiation probably coincides with the spacecraft power interruption at 23:30:55 GMT.

The Board’s investigation was facilitated by the wide application of simulation techniques. The consequences of several types of electrical faults were studied in this way. The most valuable simulation, however, employed full-scale fire tests in a boilerplate mock-up with combustibles arranged in the configuration of Command Module 012. These tests were conducted by KSC for the Board. Ignition was obtained by a hot wire in the general area in which ignition is suspected to have occurred in the fire and provisions were made for simulating rupture at proper time and location.

Total time of the fire and the pressure history reproduced those of the fire quite closely thus adding confidence to the deduced origin and mode of propagation of the fire. Such simulation techniques should be applied in examining the fire hazards of future spacecraft. They provide a reliable means of assessing fire hazards. They have also demonstrated that laboratory tests on small samples may give misleading results.

d. Effect of Coolant on Electrical Wires and Equipment

The discussion of possible electric power distribution malfunctions in Apollo 204 cannot be complete without inclusion of the effect of Environmental Coolant System coolant leakage. The Apollo Block I Spacecraft uses RS-89 as a coolant. This coolant is a mixture of 62.5 percent ethylene glycol, 35.7 percent water, and 1.8 percent stabilizer and corrosion inhibitor. Although the mixture is not highly combustible, leakage and spillage of this fluid present a considerable fire hazards. The water evaporates more readily than the ethylene glycol and the inhibitor consists of two combustible salts which do not evaporate. Consequently, spilled coolant can become a dangerous combustible if it is not removed properly. The inhibitor mixture presents a second hazard in that it is also hygroscopic and electrically conductive. Thus, the residue from coolant that was spilled and subsequently evaporated, remained slightly wet. This residue is corrosive and may conduct electricity if it wets electrical wiring or equipment that does not have water-proof insulation. The conductive path so formed will progressively improve itself as dendrites grow through electrolytic action. The RS-89 coolant is particularly dangerous in the presence of damaged or improperly insulated electrical equipment and harnesses. During the design of Apollo Block I Spacecraft a decision was made to seal electrical components and connectors. As a result, many of the Spacecraft 012 electrical systems were watertight (Block II Spacecraft are designed to have complete sealing of electrical equipment and harnesses).

Coolant in the spacecraft is used to extract heat from the cabin atmosphere and from the circulation loop to the spacesuits. It also provides direct cooling through coldplates to numerous pieces of electrically powered equipment. Thus, the cooling system is extensive throughout the Command Module. The plumbing that carries the coolant is assembled from aluminum tubing utilizing both metallurgical (soldered, brazed or welded) and mechanical joints. Numerous plumbing designed in that strength margins were inadequate to resist damage from unplanned loads. Such loads may result during equipment installation or when tubing is used as hand-holds or is bumped by technicians working in the Command Module. The result was that a number of leaks in solder joints were experienced during the history of all Block I spacecraft. The mechanical joints also had leakage problems.

There is no substantial evidence that coolant was involved in the initiation of the fire. However, this coolant, when spilled on damaged electrical wires and equipment, provides both the fuel and the ignition mechanism to start a fire. This has been demonstrated in laboratory tests.

e. Spacecraft Atmosphere

The use of pure oxygen in American spacecraft has been the subject of much consideration. The use of a diluent gas, either nitrogen or helium, in large proportions would undoubtedly reduce the risk of fire to a significant degree. At the same time it would introduce other operational problems and risks. There is no obvious advantage of one diluent over the other, although much progress has been made in developing the complex technology required for controlling gas concentrations to maintain a proper mixture reliably. This technology is still far from being fully developed. Furthermore, there are many difficult operational problems that must be solved in a reliable manner in order to decrease rather than increase the risks before undertaking the use of a two-gas system.

The desirable characteristics of a two gas system, however, should not be ignored. The development of technology that will warrant confidence in the sue of such a system should be continued.

f. Summary

Although the Board was not able to determine conclusively the specific initiator of the Apollo 204 fire, it has identified the conditions which led to the disaster. These conditions were:

1. A sealed cabin, pressurized with an oxygen atmosphere.
2. An extensive distribution of combustible materials in the cabin.
3. Vulnerable wiring carrying spacecraft power.
4. Vulnerable plumbing carrying a combustible and corrosive coolant.
5. Inadequate provisions for the crew to escape.
6. Inadequate provisions for rescue or medical assistance.

Having identified the condition that led to the disaster, the Board addressed itself to the question of how these conditions came to exist. Careful consideration of this question leads the Board to the conclusion that in its devotion to the many difficult problems of space travel, the Apollo team failed to give adequate attention to certain mundane but equally vital questions of crew safety. The Board’s investigation revealed many deficiencies in design and engineering, manufacture and quality control. When these deficiencies are corrected the overall reliability of the Apollo Program will be increased greatly.

PART VI: Board Findings, Determinations and Recommendations

In this Review, the Board adhered to the principle that reliability of the Command Module and the entire system involved in its operation is a requirement common to both safety and mission success. Once the Command Module has left the earth’s environment the occupants are totally dependent upon it for their safety. It follows that protection from fire as a hazard involves much more than a quick egress. The latter has merit only during test periods on earth when the Command Module is being readied for its mission and not during the mission itself. The risk of fire must be faced; however, that risk is only one factor pertaining to the reliability of the Command Module that must receive adequate consideration. Design features and operating procedures that are intended to reduce the fire risk must not introduce other serious risks to mission success and safety.

1. FINDING:

1. There was a momentary power failure at 23:30:55 GMT.
2. Evidence of several arcs was found in the post-fire investigation.
3. No single ignition source of the fire was conclusively identified.

DETERMINATION: The most probable initiator was an electrical arc in the sector between -Y and +Z spacecraft axes. The exact location best fitting the total available information is near the floor in the lower forward section of the left-hand equipment bay where Environmental Control System (ECS) instrumentation power wiring leads into the area between the Environmental Control Unit (ECU) and the oxygen panel. No evidence was discovered that suggested sabotage.

2. FINDING:

1. The Command Module contained many types and classes of combustible material in areas contiguous to possible ignition sources.
2. The test was conducted with a 16.7 pounds per square inch absolute, 100-percent oxygen atmosphere.

DETERMINATION: The test conditions were extremely hazardous.

RECOMMENDATION: The amount and location of combustible materials in the Command Module must be severely restricted and controlled.

3. FINDING:

1. The rapid spread of fire caused an increase in pressure and temperature which resulted in rupture of the Command Module and creation of a toxic atmosphere. Death of the crew was from asphyxia due to inhalation of toxic gases due to fire. A contributory cause of death was thermal burns.
2. Non-uniform distribution of carboxyhemoglobin was found by autopsy.

DETERMINATION: Autopsy data leads to the medical opinion that unconsciousness occurred rapidly and that death followed soon thereafter.

4. FINDING: Due to internal pressure, the Command Module inner hatch could not be opened prior to rupture of the Command Module.

DETERMINATION: The crew was never capable of effecting emergency egress because of the pressurization before rupture and their loss of consciousness soon after rupture.

RECOMMENDATION: That the time required for egress of the crew be reduced and the operations necessary for egress be simplified.

5. FINDING: Those organizations responsible for the planning, conduct and safety of this test failed to identify it as being hazardous. Contingency preparations to permit escape or rescue of the crew from an internal Command Module fire were not made.

1. No procedures for this type of emergency had been established either for the crew or for the spacecraft pad work team.
2. The emergency equipment located in the White Room and on the spacecraft work levels was not designed for the smoke condition resulting from a fire of this nature.
3. Emergency fire, rescue and medical teams were not in attendance.
4. Both the spacecraft work levels and the umbilical tower access arm contain features such as steps, sliding doors and sharp turns in the egress paths which hinder emergency operations.

DETERMINATION: Adequate safety precautions were neither established nor observed for this test.

RECOMMENDATIONS:

1. Management continually monitor the safety of all test operations and assure the adequacy of emergency procedures.
2. All emergency equipment (breathing apparatus, protective clothing, deluge systems, access arm, etc.) be reviewed for adequacy.
3. Personnel training and practice for emergency procedures be given on a regular basis and reviewed prior to the conduct of a hazardous operation.
4. Service structures and umbilical towers be modified to facilitate emergency operations.

6. FINDING: Frequent interruptions and failures had been experienced in the overall communication system during the operations preceding the accident.

DETERMINATION: The overall communication system was unsatisfactory.

RECOMMENDATIONS:

1. The Ground Communication System be improved to assure reliable communications between all test elements as soon as possible and before the next manned flight.
2. A detailed design review be conducted on the entire spacecraft communication system.

7. FINDING:

1. Revisions to the Operational Checkout Procedure for the test were issued at 5:30 p.m. EST January 26, 1967 (209 pages) and 10:00 a.m. EST January 27, 1967 (4 pages).
2. Differences existed between the Ground Test Procedures and the In-Flight Check Lists.

DETERMINATION: Neither the revision nor the differences contributed to the accident. The late issuance of the revision, however, prevented test personnel from becoming adequately familiar with the test procedure prior to its use.

RECOMMENDATIONS:

1. Test Procedures and Pilot’s Checklists that represent the actual Command Module configuration be published in final form and reviewed early enough to permit adequate preparation and participation of all test organization.
2. Timely distribution of test procedures and major changes be made a constraint to the beginning of any test.

8. FINDING: The fire in Command Module 012 was subsequently simulated closely by a test fire in a full-scale mock-up.

DETERMINATION: Full-scale mock-up fire tests can be used to give a realistic appraisal of fire risks in flight-configured spacecraft.

RECOMMENDATION: Full-scale mock-ups in flight configuration be tested to determine the risk of fire.

9. FINDING: The Command Module Environmental Control System design provides a pure oxygen atmosphere.

DETERMINATION: This atmosphere presents severe fire hazards if the amount and location of combustibles in the Command Module are not restricted and controlled.

RECOMMENDATIONS:

1. The fire safety of the reconfigured Command Module be established by full-scale mock-up test.
2. Studies of the use of a diluent gas be continued with particular reference to assessing the problems of gas detection and control and the risk of additional operations that would be required in the use of a two-gas atmosphere.

10. FINDING: Deficiencies existed in Command Module design, workmanship and quality control, such as:

1. Components of the Environmental Control System installed in Command Module 012 had a history of many removals and of technical difficulties including regulator failures, line failures and Environmental Control Unit failures. The design and installation features of the Environmental Control Unit makes removal or repair difficult.
2. Coolant leakage at solder joints has been a chronic problem.
3. The coolant is both corrosive and combustible.
4. Deficiencies in design, manufacture, installation, rework and quality control existed in the electrical wiring.
5. No vibration test was made of a complete flight-configured spacecraft.
6. Spacecraft design and operating procedures currently require the disconnecting of electrical connections while powered.
7. No design features for fire protection were incorporated.

DETERMINATION: These deficiencies created an unnecessarily hazardous condition and their continuation would imperil any future Apollo operations.

RECOMMENDATIONS:

1. An in-depth review of all elements, components and assemblies of the Environmental Control System be conducted to assure its functional and structural integrity and to minimize its contribution to fire risk.
2. Present design of soldered joints in plumbing be modified to increase integrity or the joints be replaced with a more structurally reliable configuration.
3. Deleterious effects of coolant leakage and spillage be eliminated.
4. Review of specifications be conducted, 3-dimensional jigs be used in manufacture of wire bundles and rigid inspection at all stages of wiring design, manufacture and installation be enforced.
5. Vibration tests be conducted of a flight-configured spacecraft.
6. The necessity for electrical connections or disconnections with power on within the crew compartment be eliminated.
7. Investigation be made of the most effective means of controlling and extinguishing a spacecraft fire. Auxiliary breathing oxygen and crew protection from smoke and toxic fumes be provided.

11. FINDING: An examination of operating practices showed the following examples of problem areas:

1. The number of the open items at the time of shipment of the Command Module 012 was not known. There were 113 significant Engineering Orders not accomplished at the time Command Module 012 was delivered to NASA; 623 Engineering Orders were released subsequent to delivery. Of these, 22 were recent releases which were not recorded in configuration records at the time of the accident.
2. Established requirements were not followed with regard to the pre-test constraint list. The list was not completed and signed by designated contractor and NASA personnel prior to the test, even though oral agreement to proceed was reached.
3. Formulation of and changes to pre-launch test requirements for the Apollo spacecraft program were unresponsive to changing conditions.
4. Non-certified equipment items were installed in the Command Module at time of test.
5. Discrepancies existed between NAA and NASA MSC specifications regarding inclusion and positioning of flammable materials.
6. The test specifications was released in August 1966 and was not updated to include accumulated changes from release date to date of the test.

DETERMINATION: Problems of program management and relationships between Centers and with the contractor have led in some cases to insufficient response to changing program requirements.

RECOMMENDATIONS: Every effort must be made to insure the maximum clarification and understanding of the responsibilities of all the organizations involved, the objective being a fully coordinated and efficient program.

The Report of Apollo 204 Review Board (PDFs)

• Summary
• Appendix A (132 pages)
• Appendix B (181 pages)
• Appendix C – Section 1 (1012 pages)
• Appendix C – Section 2 (453 pages)
• Appendix D – Panels 1–4 (242 pages)
• Appendix D – Panel 5 (96 pages)
• Appendix D – Panels 6–10 (390 pages)
• Appendix D – Panel 11 (45 pages)
• Appendix D – Panels 12–17 (256 pages)
• Appendix D – Panel 18 (377 pages)
• Appendix D – Panels 19–21 (49 pages)
• Appendix E (94 pages)
• Appendix F (58 pages)
• Appendix G – Part 1 (66 pages)
• Appendix G – Part 2 (172 pages)