National Aeronautics and Space Administration

APOLLO 204 REVIEW BOARD

April 5, 1967

The Honorable James E. Webb

Administrator

National Aeronautics and Space Administration

Washington, D. C. 20546

Dear Mr. Webb:

Pursuant to your directive as implemented by the memorandum of

February 3, 1967, signed by the Deputy Administrator, Dr. Robert C. Seamans, Jr., the Apollo 204 Review Board herewith transmits its final, formal report, each member concurring in each of the findings, determinations, and recommendations.

===============

Part VI

BOARD FINDINGS, DETERMINATIONS AND RECOMMENDATIONS

In this Review, the Board adhered to the principle that reliability of the Command Module and the entire system involved in its operation is a requirement common to both safety and mission success. Once the Command Module has left the earth’s environment the occupants are totally dependent upon it for their safety. It follows that protection from fire as a hazard involves much more than quick egress. The latter has me_it only during test periods on earth when the Command Module is being readied for its mission and not during the mission itself. The risk of fire must be faced; however, that risk is only one factor pertaining to the reliability of the Command Module that must received adequate consideration. Design features and operating procedures that are fire risk must not introduce other serious risks to mission success and safety.

1. FINDING:
   1. There was a momentary power failure at 23:30:55 GMT.
   2. Evidence of several arcs was found in the post fire investigation.
   3. No single ignition source of the fire was conclusivelyidentified.

   DETERMINATION:

   The most probable initiator was an electrical arc in the sector between the -Y and +7 spacecraft axes.

   The exact location best fitting the total available information is near the floor in the lower forward section of the left-hand equipment bay where Environmental Control System (EGS) instrumentation power wiring leads into the area between the Environmental Control Unit (ECU) and the oxygen panel. No evidence was discovered that suggested sabotage.

2. FINDING:
   1. The Command Module contained many types and classes of combustible material in areas contiguous to possible igntion sources.
   2. The test was conducted with a 16.7 pounds per square inch absolute, 100 percent oxygen atmos-phere.

   DETERMINATION:

   The test conditions were extremely hazardous.

   RECOMMENDATION:

   The amount and location of combustible materials in the Command Module must be severely restricted and controlled.

3. FINDING:
   1. The rapid spread of fire caused an increase in pressure and temperature which resulted in rupture of the Command Module and creation of a toxic atmosphere. Death of the crew was from asphyxia due to inhalation of toxic gases due to fire. A contributory cause of death was thermal burns.
   2. Non-uniform distribution of carboxyhemoglobin was found by autopsy.

   DETERMINATION:

   Autopsy data leads to the medical opinion that unconsciousness occurred rapidly and that death followed soon thereafter.

4. FINDING:

   Due to internal pressure, the Command Module inner hatch could not be opened prior to rupture of the Command Module.

   DETERMINATION:

   The crew was never capable of effecting emergency egress because of the pressurization before rupture and their loss of consciousness soon after rupture.

   RECOMMENDATION:

   The time required for egress of the crew be reduced and the operations necessary for egress be simplified.

5. FINDING:

   Those organizations responsible for the planning, conduct and safety of this test failed to identify it as being hazardous. Contingency preparations to permit escape or rescue of the crew from an internal Command Module fire were not made.

   1. No procedures for this type of emergency had been established either for the crew or for the spacecraft pad work team.
   2. The emergency equipment located in the White Room and on the spacecraft work levels was not designed for the smoke condition resulting from a fire of this nature.
   3. Emergency fire, rescue and medical teams were not in attendance.
   4. Both the spacecraft work levels and the umbilical tower access arm contain features such as steps, sliding doors and sharp turns in the egress paths which hinder emergency operations.

   DETERMINATION:

   Adequate safety precautions were neither established nor observed for this test.

   RECOMMENDATIONS:

   1. Management continually monitor the safety of all test operations and assure the adequacy of emergency procedures.
   2. All emergency equipment (breathing apparatus, protective clothing, deluge systems, access arm, etc.) be reviewed for adequacy
   3. Personnel training and practice for emergency procedures be given on a regular basis and reviewed prior to the conduct of a hazardous operation.
   4. Service structures and umbilical towers be modified to facilitate emergency operations.
6. FINDING:

   Frequent interruptions and failures had been experienced in the overall communication system during the operations preceding the accident.

   DETERMINATION:

   The overall communication system was unsatisfactory.

   RECOMMENDATIONS:

   1. The Ground Communication System be improved to assure reliable communications between elements as soon as possible and before the next manned flight.
   2. A detailed design review be conducted on the entire spacecraft communication system.
7. FINDING:
   1. Revisions to the Operational Checkout Procedure for the test were issued at 5:30 pm EST January 26, 1967 (209 pages) and 10:00 am EST January 27, 1967 (4 pages).
   2. Differences existed between the Ground Test Procedures and the In-Flight Check Lists.

   DETERMINATION:

   Neither the revision nor the differences contributed to the accident. The late issuance of the revision, however, prevented test personnel from becoming adequately familiar with the test procedure prior to its use.

   RECOMMENDATIONS:

   1. Test Procedures and Pilot’s Checklists that represent the actual Command Module: configuration be published in final form and reviewed early enough to permit adequate preparation and participation of all test organization.
   2. Timely distribution of test procedures and major changes be made a constraint to the beginning of any test.
8. FINDING:

   The fire in Command Module 012 was subsequently simulated closely by a test fire in a full-scale mock-up.

   DETERMINATION:

   Full-scale mock-up fire tests can be used to give a realistic appraisal of fire risks in flight-configured spacecraft.

   RECOMMENDATION:

   Full-scale mock-ups in flight configuration be tested to determine the risk of fire.

9. FINDING:

   The Command Module Environmental Control System design provides a pure oxygen atmosphere:.

   DETERMINATION:

   This atmosphere presents severe fire hazards if the amount and location of combustibles in the Command Module are not restricted and controlled.

   RECOMMENDATIONS:

   1. The fire safety of the reconfigured Command Module be established by full-scale mock-up tests.
   2. Studies of the use of a diluent gas be continued with particular reference to assessing the problems of gas detection and control and the risk of additional operations that would be required in the use of a two gas atmosphere.
10. FINDING:

    Deficiencies existed in Command Module design, workmanship and quality control, such as:

    1. Components of the Environmental Control System installed in Command Module 012 had a history of many removals and of technical difficulties including regulator failures, line failures and Environmental Control Unit failures. The design and installation features of the Environmental Control Unit makes removal or repair difficult.
    2. Coolant leakage at solder joints has been a chronic problem.
    3. The coolant is both corrosive and combustible.
    4. Deficiencies in design, manufacture, installation, rework and quality control existed in the electrical wiring.
    5. No vibration test was made of a complete flight-configured spacecraft.
    6. Spacecraft design and operating procedures currently require the disconnecting of electrical connections while powered.
    7. No design features for fire protection were incorporated.

    DETERMINATION:

    These deficiencies created an unnecessarily hazardous condition and their continuation would imperil any future Apollo operations.

    RECOMMENDATIONS:

    1. An in-depth review of all elements, components and assemblies of the Environmental Control System be conducted to assure its functional and structural integrity and to minimize its contribution to fire risk.
    2. Present design of soldered joints in plumbing be modified to increase integrity or the joints be replaced with a more structurally reliable configuration.
    3. Deleterious effects of coolant leakage and spillage be eliminated.
    4. Review of specifications be conducted, 3-dimensional jigs be used in manufacture of wire bundles and rigid inspection at all stages of wiring design, manufacture and installation be enforced.
    5. Vibration tests be conducted of a flight-configured spacecraft.
    6. The necessity for electrical connections or disconnections with power on within the crew compartment be eliminated.
    7. Investigation be made of the most effective means of controlling and extinguishing a spacecraft fire. Auxiliary breathing oxygen and crew protection from smoke and toxic fumes be provided.
11. FINDING:

    An examination of operating practices showed the following examples of problem areas:

    1. The number of the open items at the time of shipment of the Command Module 012 was not known. There were 113 significant Engineering Orders not accomplished at the time Command Module 012 was delivered to NASA; 623 Engineering Orders were released subsequent to delivery. Of these, 22 were recent releases which were not recorded in configuration records at the time of the accident.
    2. Established requirements were not followed with regard to the pre-test constraints list. The list was not completed and signed by designated contractor and NASA personnel prior to the test, even though oral agreement to proceed was reached.
    3. Formulation of and changes to pre-launch test requirements for the Apollo spacecraft program were unresponsive to changing conditions.
    4. Non-certified equipment items were installed in the Command Module at time of test.
    5. Discrepancies existed between NAA and NASA MSC specifications regarding inclusion and positioning of flammable materials.
    6. The test specification was released in August 1966 and was not updated to include accumulated changes from release date to date of the test.

    DETERMINATION:

    Problems of program management and relationships between Centers and with the contractor have led in some cases to insufficient response to changing program requirements.

    RECOMMENDATION:

    Every effort must be made to insure the maximum clarification and understanding of the responsibilities of all the organizations involved, the objective being a fully coordinated and efficient program.