“Without Apollo 1, we might have never made it to the moon.”Amy Thompson – Popular Science
This is the title of an article published by Popular Science 5 years ago, on the 50th anniversary of the Apollo 1 fire. It shares a sentiment which has, in the 55 years since that day, been expressed almost unanimously by those involved with the program: that with the haste with which the moon was being pursued it was almost inevitable that – at some point in the pursuit – lives would be lost, and it was the loss of Gus Grissom, Ed White and Roger Chaffee during a spacecraft systems test on AS-204, or Apollo 1, which forced NASA to stop and take what we would call today, a “reality check”.
Apollo 1 was to be flown by a “Block-I” command module (CM). These were the CM’s designed and developed by North American Aviation on the assumption that they – along with the rest of the spacecraft – would be landing on the moon, as NASA had yet to commit to a “mission mode” (the overall picture of how the moon landing would be performed). When NASA decided the CM would not be landing on the moon, but would instead serve as a mother-ship for a specialized landing vehicle (the Lunar Module, or LM), this resulted in a different revision of the CM, known as the “Block-II”. The Block-I spacecraft would still be flown, but only in the “development” (test) flights in earth orbit – both manned and unmanned.
Conducting test flights in a vehicle which is of a different design to the one you intend to use in the lunar landing missions may seem a little nuts, and it has been a point of criticism of NASA ever since but, at this stage of the Apollo Program, the flight schedule determined when the spacecraft and its associated computer programs would be ready — not the other way around.
Around the same time NASA made this decision, they also decided to switch from an oxygen/nitrogen environment for the CM (similar to what we breath on earth), to one of pure oxygen. Not only would it save weight (which was becoming an increasing concern), but maintaining an oxygen/nitrogen environment requires sophisticated equipment to sense and monitor the ratio of these two gasses and introducing more of one or the other if the balance is wrong. If this equipment malfunctions in any way, it could potentially flood the spacecraft with an almost pure-nitrogen environment. Not only would this kill the crew through oxygen depravation but nitrogen, being a non-reactive gas, would offer the crew no clues that anything was wrong until it was too late. Their mental faculties would be slowly impaired as their brains received less oxygen, clouding their awareness of the situation, and then they would lose consciousness.
On the other hand, pure oxygen also carries it’s risks. Oxygen is a highly reactive substance, which is why it is so useful to the chemistry of life. But add too much oxygen to an environment and even common every-day materials we would not normally think of as being flammable become not only flammable, but dangerously so; almost explosive. But, NASA reasoned, the “partial-pressure” (or total amount on oxygen atoms in a given space) would be so low as to make sustained combustion almost impossible.
This argument about partial-pressure would be valid during space-flight, where the CM would only be pressurized to 5 psi. But on the launch pad, with the outside atmosphere at 14.7 psi, the CM would be pressurized to 16.7 psi to maintain a positive (outward) pressure differential. This increased the partial-pressure of oxygen to a dangerous level. All it would take is a spark.
To this day, no-one knows for sure what the ignition source was on Apollo 1. But we all know the outcome: Three astronauts would lose their lives, three wives would lose their husbands, and six children would lose their fathers.
As history will attest, their sacrifices, though painful, were not made in vain. Not only were some obvious (in hindsight) changes made to the design of the command module and the pre-launch procedures, but the slip in the flight schedule removed an immense burden from those writing the software for the guidance computers.
A chronological look at the development of the flight software prior to January 27, 1967, shows that even by May, there are problems with the AS-207/208 mission, the planned crewed test flight of the CSM/LM to be launched on two Saturn-IB’s (the CSM one and the LM on the other), likely as “Apollo 3”.
Our basic problem seems to center on the time available to prepare the computer programs for these flights and on the fact that the computer is not big enough to contain all of the programs which appear to be either required or highly desirable for the mission.Spacecraft computer program requirements for AS-207/208, AS-503, and AS-504 – May 12, 1966 – Howard W. Tindall, Jr.
There are a number of us who feel that the computer programs for the Apollo spacecraft will soon become the most pacing item for the Apollo flights. This is certainly likely to be the case for AS-207/208, by which time spacecraft, and booster delivery and Cape operations are likely to have become relatively routine, with the shots going pretty much on schedule, and we working on the computer program development will still be “sloshing through the mud.”Apollo spacecraft computer program development newsletter – May 31, 1966 – Howard W. Tindall, Jr.
Then, directly related to Apollo 1, we have four crew-requested changes to the AS-204 flight programs being rejected in July, despite assurances from the programmers that it can be done, because of concern over the impact on the flight schedule:
In discussing the overall AS-204 computer program situation with MIT people on July 14, 1966, I was told that a flight-worthy program would probably not exist on August 8, the date we had established for release of the flight program tape for rope manufacture.
Considering our experience in the past, I question whether a truly flight-worthy program can be delivered on August 22, even without changes, and I’m certain that any attempt to make changes will only reduce our chances.
Accordingly, it was my recommendation, supported by a number of other MSC people, that none of the crew recommended changes be made in the AS-204 program.AS-204 computer program status – July 21, 1966 – Howard W. Tindall, Jr.
As the pressure of the flight schedule builds, a potential solution is considered to fly AS-503 (at this stage, a second manned test flight of the LM, though it would later fly as “Apollo 8”) using the same programs from AS-278. This is a sensible idea, as they are very similar missions.
One of the possible actions which has been identified to help our spacecraft computer program development schedule is to fly the AS-503 mission with the AS-278 programsCursory definition of Spacecraft Computer Program capabilities currently planned for AS-503 and AS-504 – October 12, 1966 – Howard W. Tindall, Jr.
Unfortunately, as noted earlier, the flight schedule determines everything.
You recall it was our desire to fly both the AS-278 and AS-503 missions with the same programs, but this apparently is not possible for schedule reasons for the CMC [Command Module Computer].AGC program status for AS-278 – November 14, 1966 – Howard W. Tindall, Jr.
Even with such a small sampling of memorandums, the issues with program development are clear, and so is the legacy of Apollo 1. The flight schedule simply did not allow enough time for these programs to be developed, and it was the disaster of January 27, 1967 which was the catalyst to slow things down. The fact that all these problems were overcome, and the moon landings took place with software that was not only adequate, but which today is held up as an example of robust software design is the legacy of Apollo 1. I will let Howard. W. Tindall, Jr., explain this in his own words, in a memorandum titled “A new spacecraft computer program development philosophy is taking shape”, distributed four months after the fire:
Until a few months ago, our most basic problem was getting the spacecraft computer programs – and ultimately the flight ropes – completed in time to support the official flight schedule. This presented such a challenge to the people involved that intense reluctance was created to making changes and, after a certain point, even correcting known deficiencies in the programs. Where necessary, work around procedures were invented as the only possible solution.
Since the January accident the situation has changed considerably in two ways. First of all, the flight schedule has slipped to an extent that computer program development no longer paces the flights in any way (including crew training and system tests) and, secondly, the value of quality has become supreme. These things are most clearly evident right now on LM-I where it’s almost unthinkable to fly with any known deficiencies in the program – even those which would only affect very low probability contingency situations – in spite of the fact that the flight ropes have already been manufactured.A new spacecraft computer program development working philosophy is taking shape – May 17, 1967 – Howard W. Tindall, Jr.
A rough road leads to the stars.