Apollo’s Worst Day

No matter how hard I try to forget, I still see the smoke and flames,” wrote former launch pad technician Stephen Clemmons in an essay posted online in 2009. “I can still hear the cries of my teammates as we try to get the hatches open. I can still see the flames reaching up toward the Solid Booster Rocket mounted on top of the spacecraft. I can remember my hopes that the astronauts’ suits would just hold until we could get in.” Clemmons, who died in 2014, spent most of his life haunted by the trauma of having been one of the few eyewitnesses to NASA’s first disaster.

At 6:31 p.m. Eastern time on the evening of January 27, 1967, Clemmons and a handful of colleagues were working 220 feet above ground level at Cape Canaveral’s Launch Complex 34, just steps away from the Apollo 1 command module, which had been built by the company Clemmons worked for, North American Aviation. Sealed inside, three astronauts—veterans Gus Grissom and Ed White and rookie Roger Chaffee—were slowly making their way through the plugs-out test, a simulated countdown that was one of the many practice runs for the first piloted Apollo mission, a two-week, Earth-orbit flight scheduled for late February. All afternoon the test had been marred by problems, especially with the communications system, but no one had reason to be apprehensive. Because the giant Saturn 1B booster beneath the spacecraft had not been fueled, the exercise wasn’t classified as hazardous.

Suddenly the technicians’ monitors filled with a call of alarm from Grissom: “We’ve got a fire in the cockpit!” Seconds later came a frantic transmission from Chaffee—“We’re burning up!”—that ended with an unintelligible cry. Then, just as suddenly, the line from the spacecraft went dead. Through the craft’s windows the technicians could see an orange glow. At the base of the command module, fire shot out of access panels into the adjoining room. With a loud whoosh and a blast that sent Pad Leader Donald Babbitt reeling, the spacecraft’s hull ruptured, spewing a sheet of flame that charred the papers on Babbitt’s desk. One of the technicians scrambled for the tool they needed to open the craft’s three-piece side hatch, each part of which was secured by a set of latches. To get to it, they raced into the small enclosure called the White Room, which was filled with dense, choking smoke. “You couldn’t see six inches from your face,” one of them later recalled. After only a few seconds they had to retreat, gasping for air, before resuming their desperate efforts to rescue the astronauts. Everyone knew there was a danger that the fire might ignite the spacecraft’s big solid-fuel escape rocket. “If it did, all of us were cooked,” wrote Clemmons.

It took him and his teammates five long minutes to get the hatches off so they could finally look inside. Clemmons would always remember Babbitt, tears streaming down his face, getting on the open communications line to a nearby blockhouse and saying, “I can’t describe what I see.” It was a message to the launch controllers, all of whom had listened helplessly to the sudden and shocking calls from the spacecraft, that the situation was as bad as they feared.

First to enter the spacecraft was fireman Jim Burch, who was met by a dense pall of smoke. “People were hollering for me to get them out and I was confused,” Burch said later. “I couldn’t see anybody; it didn’t seem real. Where were they? I backed off with my light. Then I could see the bodies.” He told Babbitt, “They’re all dead.” It would be hours before the bodies could be removed, not only because of the need for photographers to document everything inside the blackened craft, but because the heat of the fire had fused nylon netting from inside the cabin to the astronauts’ spacesuits.

Throughout NASA, shock gave way to grief. NASA life-support engineer Dick Johnston likened the deaths of the Apollo 1 crew to the loss of a father or brother, and called it “the worst tragedy I’ve ever been through.” Astronaut Deke Slayton, who considered Grissom his best friend among the astronauts, later called that day the “worst I ever had.” Said Flight Director Chris Kraft, “I don’t know how I survived it.”

Mixed with their sorrow was another reaction: disbelief. Before each piloted Mercury and Gemini flight, the same test had been carried out, without incident. How could a practice countdown that wasn’t supposed to be hazardous suddenly turn deadly? That was the question NASA’s accident review board tried to answer in the months after the fire, after administrator James Webb persuaded President Lyndon Johnson to let the agency run its own investigation. In a processing facility at Florida’s Kennedy Space Center, the command module was subjected to what North American engineer Marty Cioffoletti called “the most excruciating technical dissection of a machine I could ever imagine happening.”

Astronaut Donn Eisele later wrote that inside the charred cockpit “the acrid smell of burned plastic, paint, and nylon was overpowering.” Even more harrowing was the audio tape of the astronauts’ last transmissions, which Eisele and others listened to again and again in an attempt to glean clues. For a while, Eisele wrote, the experience gave him nightmares.

For weeks, as the review board went about its grim task, engineers at NASA and its contractors silently prayed that the fault wouldn’t be with them. “I hate to say that, but you really thanked God it wasn’t your system, that it was somebody else’s, and you could breathe easy again,” Cioffoletti later confessed to writers Charles Murray and Catherine Cox for their book Apollo: The Race to the Moon.

In the end, the board never determined the exact cause—at the fire’s likely starting point, temperatures high enough to melt aluminum had destroyed key evidence—but the investigators did conclude that no one system was responsible. Instead, in terse, dispassionate language, their report called attention to “many deficiencies in design and engineering, manufacture and quality control,” including the command module’s exposed electrical wiring, some of which may have become damaged by repeated opening and closing of a sharp-edged access door during the months before the fire. The hazard was compounded by the difficulty of exiting through the spacecraft’s innermost, inward-opening side hatch, which had trapped the astronauts in their burning craft. Under ideal conditions that hatch took 40 to 70 seconds to open; as it was, the men couldn’t undo the latches before the fire overwhelmed them.

But the biggest culprit, in hindsight, was horrifyingly obvious: At the time of the fire, the command module had been pressurized with pure oxygen at 16.7 pounds per square inch. Studying Apollo 1’s scorched interior, the investigators determined that once the fire began—probably ignited by an electrical arc from damaged wires below and to the left of Grissom’s couch—it propagated with merciless swiftness, spread by nylon nets used for catching dropped objects and by strips of Velcro attached to the cabin walls. Less than 20 seconds after it began, the mounting pressure split the command module’s hull, and with oxygen now escaping, it took only a few more seconds for the fire to exhaust itself. By then Grissom, White, and Chaffee were doomed; they lost consciousness when their suits’ oxygen hoses burned through, and died within minutes—not from their burns, which might have been survivable, but from inhaling carbon monoxide and other toxic gases generated by the fire.

To test this scenario, investigators set up a duplicate of the Apollo 1 cabin inside a boilerplate command module, pressurized it with pure oxygen at 16.7 psi, and triggered an igniter. Astronaut Stu Roosa, who had looked into Apollo 1 an hour after the fire, thought the results of the test “looked exactly like the real spacecraft,” he recalled in 1988. “Everything was the same except the bodies.”

When the review board’s report came out in April 1967, NASA was showered with criticism, including a New York Times editorial entitled “Incompetence and Negligence” that lambasted the agency for putting Grissom, White, and Chaffee “into what even a high school chemistry student would know was a potential oxygen incendiary bomb, one needing only a spark to initiate catastrophe.”

However, when I talked to Gemini and Apollo astronaut Michael Collins about the fire in 1988, he spoke not of incompetence or negligence but rather a kind of blindness. “Given the sophistication of NASA, given the intelligence of its engineers, given the keen, in-depth analysis that they applied to various problems, it’s just amazing that the most simple, elementary things in the world are what bit them,” he said. “I mean, 16 psi of pure oxygen on the pad, and just not considering that to be a tinderbox. Putting a hatch on with about 28 goddamn [latches], where you couldn’t get it off!… And all of this just, somehow, I don’t know why, we’re blind to them. I mean, it makes us think that the quality of our engineering across the board was juvenile, yet it wasn’t! It was very good engineering.”

Collins was right: The fire’s root cause lay in what cognitive scientists call perceptual blindness, in which even very smart people, sure that they are paying attention, can miss what is right in front of them.

**********

The origins of the Apollo fire go back to 1959, when NASA and McDonnell Aircraft were designing the one-man Mercury capsule. One of the toughest challenges was the environmental control system, which would provide the astronaut with a breathable atmosphere. Experts disagreed on what that atmosphere should contain; some felt it should be an air-like mixture of nitrogen and oxygen at 14.7 psi—ordinary sea-level pressure. But a spacecraft sturdy enough to contain that pressure in the vacuum of space would be too heavy for its Atlas booster. Also, a mixed-gas atmosphere would require precisely regulating the amounts of oxygen and nitrogen, a task beyond the capabilities of available sensors. In the end, designers chose an atmosphere of pure oxygen at a pressure of 5 psi during spaceflight: light, simple, and reliable.

What about on the ground? The plan for practice runs in the spacecraft was to have the astronaut breathe pure oxygen at low pressure through the suit hoses, while the cabin would be pressurized with air as a precaution against fire. But when a McDonnell test pilot passed out during a test run in 1960, engineers realized that because of its greater pressure, cabin air was able to seep undetected into the pilot’s oxygen supply loop, causing nitrogen to build up until the man lost consciousness. There was no way to prevent this, so they decided that during all ground operations, Mercury’s 36-cubic-foot cabin would be pressurized with pure oxygen at 15 psi. McDonnell’s chief spacecraft engineer John Yardley later recalled, “It was a very small capsule, and nobody was really worried about fire there. As a matter of fact, I made some back-of-the-envelope calculations that said it would burn itself out in a few seconds because there just wasn’t that much oxygen in there.”

By mid-1962 Mercury had flown two orbital missions, and NASA had no reason to reconsider its choice. But at North American, engineers designing the Apollo command module knew its cabin would have nearly six times the volume of Mercury’s, so if it were filled with pure oxygen, it would have a correspondingly greater risk of fire. They insisted Apollo have a mixed-gas atmosphere, but NASA rejected the idea for both engineering and  medical reasons. In addition to concerns about a mixed-gas system’s weight and complexity, doctors had warned that in the event of a sudden loss of cabin pressure, astronauts breathing nitrogen would risk decompression sickness, also known as the bends, a painful and sometimes fatal condition. Reflecting NASA’s carefully weighed decision, Apollo spacecraft program manager Charlie Frick informed North American that the command module would be pressurized with pure oxygen. Frick and his North American counterpart began shouting at each other until Frick finally declared flatly, “You are the contractor. You do as you’re told. Period.”

Based on their own documents, it’s clear that managers at NASA headquarters understood the risks of the decision. Noting that combustion takes place faster, and at higher temperatures, in pure oxygen than in air, they included in their July 1963 Apollo contingency plan the imperative “Fires in the spacecraft must be precluded at all costs.” Chillingly, the plan added, “It has been observed that a number of otherwise nonflammable materials, even human skin, will burst into flame in a pure oxygen atmosphere.”

Reading this, it’s hard to imagine anyone at NASA forgetting about the risk of a spacecraft cabin fire, including Frick’s successor as the Apollo spacecraft program manager, Joe Shea—a brilliant, arrogant engineer who’d come to NASA after leading the development of the guidance system for the U.S. Air Force Titan missile. But as Apollo moved ahead, Shea and everyone else was focused on the possibility of a fire not on the ground but in flight. If that happened, plans called for the astronauts to seal themselves in their spacesuits and depressurize the cabin until the fire was out. That changed in late 1965, as Frank Borman and Jim Lovell readied for their two-week orbital marathon aboard Gemini 7. Knowing they would be the first Americans to remove their suits during a spaceflight, Borman and Lovell thought long and hard about how to fight a cockpit fire. NASA’s best efforts to develop an effective zero-G fire extinguisher had come up short; no one could be sure that, in weightlessness, spraying a fire wouldn’t cause it to spread. They decided their best weapon would be the water gun they used to rehydrate their meals. Fortunately, they never had to find out whether that would have worked.

Look at photos of Gemini 7’s tiny cockpit, however, and you can spot a foreshadowing of the Apollo fire: Strips of Velcro are everywhere. Astronauts had come to rely on the flammable material as a way of securing loose gear in zero-G, and they asked for generous amounts of it as they customized their spacecraft before each flight. So did Gus Grissom and his Apollo 1 crew. The problem was, no one at NASA or North American was controlling the process to keep it in line with established fire-prevention rules, which called for any flammable materials to be at least 12 inches away from any possible ignition source. By the time Apollo 1 was ready to be shipped to Cape Canaveral in August 1966, one North American engineer described the situation inside the command module as “wall-to-wall Velcro.” The issue surfaced near the end of an all-day review of the spacecraft in Downey, California, and after a protracted back-and-forth between NASA and North American engineers, Joe Shea put an end to the discussion. “Walk through the goddamned spacecraft,” he said, and make sure the Velcro and other flammable materials are cleaned up.

But they weren’t cleaned up. As the spacecraft was checked out at Kennedy Space Center, technicians added even more Velcro. They also installed nylon nets to catch items dropped during tests. Samples of these materials had dutifully been tested for flammability in pure oxygen—at 5 psi. Not until after the fire would the review board determine that at 16.7 psi, they burn at least twice as fast.

Meanwhile, throughout the fall of 1966 Joe Shea and his staff battled a formidable array of problems with Apollo 1, everything from an environmental control system that had burst into flames during a test to indications that when the service module’s propellant tanks were pressurized, they might suddenly explode. Eclipsed by such threats, the situation with flammable materials was rarely on Shea’s radar.

Then, in early October, Shea got a letter from Hilliard Paige, a vice president at General Electric, whose NASA contract included serving as a watchdog on safety issues. Paige had recently witnessed a combustion experiment by one of his own people working at the Houston space center. “He wanted to show me the flammability of Velcro material,” Paige recalled to historian Henry Lambright in 1991. “He lit a fire in an oxygen environment, and poof. It went up in flames immediately.” Shocked, Paige asked the engineer if he’d talked to the NASA people about this. Yes, he was told, but “it didn’t seem to be registering.” In his letter, Paige gave Shea a warning that seems remarkably prescient: “I do not think it technically prudent to be unduly influenced by the ground and flight success history of Mercury and Gemini under a 100 percent oxygen environment,” Paige wrote. “The first fire in a spacecraft may well be fatal.”

Shea gave the letter to a deputy, Bill Bland, and asked him to look into it. Seven weeks later, delayed by what he called “our usual press of more significant problems,” Bland told Shea that a new study had confirmed that “our inherent hazards from fire in the spacecraft are low.” In his letter to Paige, Shea assured him everything was under control, and enclosed a copy of the study “so that you can see how secure we are.” But in a handwritten postscript, Shea revealed his own lurking doubts. “The problem is sticky,” he wrote. “We think we have enough margin to keep fire from starting—if one ever does, we do have problems.”

Preparations for Apollo 1’s flight continued. With exposed and possibly damaged electrical wiring and an ample supply of flammable materials throughout the cabin, the command module, once it was filled with high-pressure pure oxygen for a seemingly harmless test, was a bomb waiting to go off.

**********

After the fire, NASA and its contractors exerted almost superhuman effort to redesign the Apollo spacecraft. A one-piece, outward-opening hatch guaranteed quick escape in an emergency. New materials, including a fire-resistant form of Velcro, made the craft fireproof—at least in the 5 psi pure oxygen atmosphere that would be used in space. At 16.7 psi, fireproofing was impossible, but engineers devised a solution: Before launch, the command module cabin would be temporarily filled with a mixture of 40 percent nitrogen and 60 percent oxygen that would prevent the spread of a fire but would not pose any medical risks to the crew. During launch the cabin atmosphere would slowly be vented and replaced with 5 psi pure oxygen. In October 1968 the Apollo 7 astronauts flew the redesigned craft on its maiden voyage. It was one of the most remarkable recoveries in NASA’s history.

But for some, the fire’s toll was lasting. After the tragedy, Joe Shea fell into a deep depression, suffering what some have called a breakdown. In the spring of 1967 he was transferred to NASA headquarters but found himself, as he later wrote, wandering the gardens at Washington’s Dumbarton Oaks, “alone with a life I wished had ended with the three [astronauts].” Even after he left NASA to return to private industry, the accident tormented him. He would sit in his den at night, going over the events in his mind again and again. Shortly before the plugs-out test, Gus Grissom had asked him to join the astronauts in the spacecraft, to see for himself how “messy” the procedures were. Shea had considered it and decided that since there was no way to provide a communications line for him inside the command module, it wasn’t a workable idea. What if he had made a different decision? Sitting on the cabin floor during the test, would he have noticed the first spark before it became a blaze, and been able to smother it?

In time, Shea was able to move on. Over the years, in interviews, he defended his actions, saying—as so many at NASA did—that he never knowingly compromised the astronauts’ safety. As for his orders to clean up the spacecraft, he told Charles Murray in 1988, “The time that we felt they had to be implemented was at launch, not at some arbitrary test point a month before launch. It would have been fixed by launch time, had to have been fixed by launch time.” In fact, a walkthrough of the command module had been scheduled for January 29, 1967—two days after the fire.

Joe Shea wasn’t alone in his misperception of risk. A month after the fire, NASA’s director of manned spaceflight, George Mueller, said in a Congressional hearing that NASA’s experiences with Mercury and Gemini “had demonstrated that the possibility of a fire in the spacecraft cabin was remote.” Mueller’s words lay bare the false logic that, in the pressure to meet President Kennedy’s end-of-the-decade deadline for a lunar landing, had skewed the thinking of nearly everyone at NASA: It hasn’t bitten us, so we must be okay. This fallacy would strike NASA again, with the O-ring leaks that brought down the space shuttle Challenger in 1986 and the broken-off chunk of foam insulation that doomed its sister ship Columbia in 2003.

Today Apollo 1 sits in a storage facility at NASA’s Langley Research Center in Virginia, where it has rested since the review board finished its work half a century ago. Over the years the agency has turned down requests to put it on public display, but NASA managers would do well to place it in view of their own people, to remind them how unforgiving spaceflight is of blindness, of any kind.

Andrew Chaikin | | READ MORE

Andrew Chaikin is the author of A Man on the Moon, A Passion for Mars, and other books on space exploration. He has been an adviser to NASA on space policy, and is currently writing a book on Principles of Success in Spaceflight.