"Houston, we've had a problem."
The Apollo 13 mission to the Moon in 1970 was a successful failure -- in that the crew returned safely to Earth but never made it to the Moon. But the explosion that jeopardized the crew's survival could have been avoided had it not been for two decisions early on.
In NASA astronaut Jim Lovell's book Lost Moon: The Perilous Voyage of Apollo 13, Lovell recalls that when the review board began its Apollo 13 accident investigation, panel members surmised that Apollo 13 was likely the result of a series of small failures that led to the mission's accident -- an accident which altered the flight's planned mission from two men walking on the Moon to an improvised mission of survival for the crew.
In any area of transportation, accidents are almost never caused by one single equipment failure. Usually an accident is the result of a series of events or failures -- often referred to as the accident chain.
Any individual link in the chain of events would likely not trigger an accident on its own. But like falling dominoes, when combined in the right sequence of events, these events or failures can lead to an accident.
In the epilogue to the 1995 movie Apollo 13, Tom Hanks (who plays the part of Apollo 13 Commander Jim Lovell) noted the cause of the accident:
"In the following months, it was determined that a damaged coil built inside the oxygen tank sparked during our cryo stir and caused the explosion that crippled the Odyssey. It was a minor defect that occurred two years before I was even named the flight's commander."
In reality, the Apollo 13 cause of the explosion was a bit more complex than that. The mission had an accident chain that was five years in the making, beginning in 1965.
North American Aviation won the contract to build the Apollo Command/Service module. The company farmed out some parts of the project to subcontractors, and Beech Aircraft was tasked with building the spacecraft's cryogenic tanks for its liquid oxygen and hydrogen.
These specialized tanks contained numerous parts powered by electricity and immersed directly in the tanks: fans, thermometers, pressure sensors, heaters and thermostat switches.
The liquid oxygen and hydrogen in the tanks were to be kept at a frigid minus 340 degrees, cold enough to keep the oxygen and hydrogen in a slushy, non-gaseous state.
The tank heaters managed the temperature of these liquids, warming the material just enough to ensure some of the slush could vaporize and flow through the tank lines to feed the fuel cells and crew compartments with breathable air.
The upper temperature limit of the tanks was 80 degrees, which was as hot as the engineers ever wanted the tanks to get.
Thermostat switches were connected to these heaters to cut power to the heating coils when needed. As a safety measure, if the temperature inside the tank reached 81 degrees, two small contacts on the thermostat would separate, break the circuit and shut off the heating system.
With so little chance that the temperature inside the tank would ever rise that high, and with 80 degrees representing the bottom of the danger zone, engineers who designed the instrument panel saw no reason to set the gauge any higher than 80 as its upper limit.
Unfortunately, this instrumentation limit proved to be an important link in Apollo 13's accident chain.
The Apollo spacecraft's electrical system was originally designed to operate on 28 volts of current.
But during the months before a launch, the spacecraft spent time connected to 65-volt generators at the launch pad.
North American became concerned that this higher voltage might fry the delicate heating system in the cryogenic tanks, and therefore changed the specifications from 28 volts to 65 volts. North American alerted its subcontractor Beech to the change, and Beech modified the heating system to be compatible with the new 65-volt requirement.
However, engineers neglected to change the specification for the thermostat switches. The 28-volt thermostat switches remained in the new 65-volt heaters. Unfortunately, nobody at North American, Beech, nor NASA ever noticed the discrepancy, another important link in Apollo 13's accident chain.
With that background, let's look at Apollo 13's accident chain, or sequence of events, that led to the accident which crippled the Command Module Oddysey, and made the Lunar Module Aquarius a lifeboat for the next four days:
The tank heaters and thermostats were originally designed for the Apollo Command Module's 28-volt power grid. The specifications for the heater and thermostat were later changed to allow a 65-volt ground supply. However, the tank thermostats were not upgraded to handle the higher voltage.
The shelf carrying Apollo 13's oxygen tanks was originally installed in the Apollo 10 Service Module, but was removed to fix an unrelated problem. During removal, the shelf was accidentally dropped about 2 inches because a retaining bolt was not removed. It was later discovered that a loosely fitting filling tube on the tank was damaged due to the dropped shelf.
March 16, 1970:
After the tank was filled for ground testing during a pre-launch countdown demonstration test for Apollo 13's launch three weeks later, the tank could not be emptied through its normal drain line, due to the dropped shelf 17 months earlier.
March 17-26, 1970:
To avoid delaying the mission, a decision was made to connect the heater to the 65-volt ground power to boil off the remaining oxygen. Teams at Kennedy Space Center, Manned Spacecraft Center, North American Aviation, and Beech Aircraft discussed and approved this procedure, as did the commander of Apollo 13 Jim Lovell.
March 27, 1970:
When the detanking procedure began, the 65-volt power supply fused the 28-volt thermostat switch contacts closed and the tank's heater remained on, raising the temperature inside the tank to an estimated 1,000 degrees.
This was the direct consequence of the overlooked action in 1965 to not upgrade the 28-volt thermostat switches to handle the higher voltage of the 65-volt generators attached to the tank.
March 27, 1970:
During the detanking procedure, because the instrument panel gauge monitoring the tank temperature maxed out at 80 degrees (with 81 degrees being the temperature at which the thermostat contacts would open and power off the heater), no one realized the temperature inside the tank went well past the desired limit of 81 degrees
This was the direct consequence of the decision to have the instrumentation gauge max out at 80 degrees.
March 27, 1970:
The high temperatures inside the tank melted the Teflon insulation on the fan power supply wires inside the tank, leaving them exposed. When the tank was later refilled with oxygen a few days later in preparation for Apollo 13's flight, it was essentially a bomb waiting to go off.
April 13, 1970:
During Apollo 13's flight to the Moon, Mission Control asked the crew to "stir the tanks". The first two cryo stirs were uneventful. During the third cryo stir, fan power passed through the bare wires which apparently shorted, producing sparks and igniting the Teflon, and boiled off the liquid oxygen faster than the tank could vent it.
April 13, 1970:
Just under two minutes after the third cryo stir began, the crew heard a loud bang, the explosion which caused both Jack Swigert and Jim Lovell to utter the now-famous words: "Houston, we've had a problem."
What can you as a pilot learn from Apollo 13's accident chain?
Sometimes accident chains can develop over a few minutes, hours, months or years.
Over a few minutes:
If you're flying a single flight, the decisions and actions (or in-actions) you make during your flight can have drastic consequences. The NTSB database is full of individual flights that developed an accident chain over the course of minutes. Flying VFR into IMC is a classic example.
Over a few hours:
If you're an experimental aircraft owner or builder, decisions you make while building your aircraft can have serious consequences. Take time to completely think out all possible "what if" scenarios. In Apollo 13's accident chain, two critical build/design decisions early on were key events that later contributed to the oxygen tank explosion.
Over a few months or years:
If you fly often, and you happen to "get away" with things repeatedly in past flights, this too can have serious consequences. As a pilot, you can't expect that you will always "get away" with something. The Space Shuttle Challenger accident in 1986, and the Space Shuttle Columbia accident in 2003, are solemn reminders of the Normalization Of Deviance -- an incremental creep from best practices.
Most aircraft accidents are caused by a chain of events rather than just one error. Study how and why they happen and you'll be a safer pilot.
Remember -- the vast majority of accidents are preventable. By reading accident reports, you'll learn what not to do.
Flight Chain App gives you every NTSB accident report in your pocket for convenient easy access.
An easier way to read NTSB aviation accident reports.