At twenty minutes past six on the evening of Friday 27 January 1967, at Launch Complex 34 on Cape Kennedy, the countdown for a test that nobody had classed as dangerous stopped at T minus ten minutes. The three men in the spacecraft on top of the rocket could not be heard properly. They had been strapped into their couches since one o’clock, breathing pure oxygen, and the cabin around them had been sealed and purged of air until it too held nothing but oxygen, at 16.7 pounds per square inch, two pounds above the pressure of the atmosphere outside. There was no fuel in the rocket. That was the point. The test was a rehearsal of launch day with the plugs pulled, and the rules by which the Kennedy Space Center sorted its work into the hazardous and the routine looked for fuel, and found none.

Those rules had been applied to spacecraft 012 before it ever reached the pad. North American Aviation, which had built it, drew up a test outline for everything that would be done to it in Florida, and the company’s safety office went through the outline and listed the operations that were dangerous. The Kennedy Space Center’s safety office and the Air Force’s approved the list. There were 104 test outlines. Fifty-four of them were on it.

At 6:31:04.7 one of the men inside said a word that may have been “Hey” or may have been “Fire”. Seventeen seconds later the last transmission from the spacecraft ended, and the test that was not on the list had killed its crew.

Who ran it

The National Aeronautics and Space Administration was six years into the programme President Kennedy had set it in 1961, to land men on the moon before the decade ended. Its Administrator was James E. Webb; his deputy was Robert C. Seamans. Manned flight was the business of George E. Mueller, Associate Administrator for Manned Space Flight, and under him Major General Samuel C. Phillips of the Air Force, the Apollo Program Director. The spacecraft belonged to the Manned Spacecraft Center at Houston, under Robert R. Gilruth, where Joseph F. Shea managed the Apollo spacecraft programme and Donald K. Slayton, one of the first seven astronauts, was Director of Flight Crew Operations. The launch pads belonged to the John F. Kennedy Space Center in Florida, under Kurt Debus.

The command module was built by North American Aviation, Inc., at its Space and Information Systems Division in Downey, California. The company’s president was J. Leland Atwood; the division’s president was Harrison Storms; the Apollo programme manager was Dale D. Myers. On the evening of 27 January the North American pad leader, in charge of the level beside the spacecraft, was Donald O. Babbitt, with a lead technician, James D. Gleaves, and technicians Jerry W. Hawkins, Stephen B. Clemmons and L. D. Reece. The test was run by a NASA test conductor, Clarence A. Chauvin, from a control room miles away, and watched from the blockhouse near the pad, where Slayton sat at the astronaut console.

The crew had been named on 21 March 1966. Virgil I. Grissom, called Gus, the command pilot, was born on 3 April 1926 in Mitchell, Indiana, flew a hundred combat missions in Korea, and was one of the seven Mercury astronauts chosen in April 1959. On 21 July 1961 he made the second American flight into space, fifteen minutes in Liberty Bell 7, and lost the capsule in the Atlantic when its hatch blew off after splashdown; in March 1965 he commanded the first manned Gemini flight. Edward H. White II, the senior pilot, was born on 14 November 1930 in San Antonio, Texas, graduated from West Point in 1952, and was chosen in 1962; on 3 June 1965, from Gemini 4, he became the first American to leave a spacecraft in orbit. Roger B. Chaffee, the pilot, was born on 15 February 1935 in Grand Rapids, Michigan, flew photographic reconnaissance for the Navy, and was chosen in October 1963. He had not flown in space.

Grissom had said to an interviewer a few weeks before: “We’re in a risky business, and we hope if anything happens to us, it will not delay the program.”

What they were trying to find out

The test had a name and a number: the Space Vehicle Plugs-Out Integrated Test, Operational Checkout Procedure FO-K-0021-1, Spacecraft 012. Its purpose, in the words of the procedure, was “to demonstrate all space vehicle systems and operational procedures in as near a flight configuration as is practical and to verify their capability in a simulated launch.” At the start of the simulated flight the umbilical cables that fed the spacecraft from the ground would be disconnected, and it would run on simulated fuel-cell power. The procedure listed three objectives: “To verify overall spacecraft/launch vehicle compatibility and demonstrate proper function of spacecraft systems with all umbilicals and Ground Support Equipment disconnected”; “To verify no electrical interference at the time of umbilical disconnect”; and “To verify astronaut emergency egress procedures (unaided egress) at the conclusion of the test.”

The third objective had been added late, at the crew’s request. The outline North American wrote in July 1966 did not include a practice escape. In September the flight crew asked for one, and the Review Board that later took the test apart recorded why: “This addition was requested because a subsequent test, Countdown Demonstration, would involve a fully fueled Launch Vehicle and this latter test was identified as hazardous.” So the rehearsal of escape was put at the end of the plugs-out test, and the plugs-out test was left where it was, among the routine.

That was the hypothesis the test stated. There was a second claim underneath it, which no document stated, because nobody thought of it as a claim: that three men could be sealed into a cabin of pure oxygen at a pressure above that of the air outside, on the ground, with no way out that took less than a minute and a half, and that this was not a hazardous operation. The Board’s own account of the rules was a single sentence: “This Plugs-Out Test had not been classified as hazardous because only those tests involving fueled vehicles, hypergolic propellants, cryogenic systems, high pressure tanks, live pyrotechnics or altitude chamber tests were routinely classified as hazardous.”

The second claim had a history, and the organisation that held it had written much of it down. The pure oxygen on the pad went back to 1960, when a test pilot in a Mercury capsule passed out in an altitude chamber because nitrogen from the cabin air had leaked into his suit; from then on every American spacecraft was purged of air before launch and filled with oxygen at about fifteen pounds per square inch. The pure oxygen in flight, at five pounds, was a decision of 1962. In 1964 NASA published, as Special Publication 48, a review of fire hazards in space cabins by Emanuel M. Roth, written “primarily for biomedical scientists and design engineers”, which said that “The generation of an electrostatic spark within a space-cabin system is always a danger” and that “Once burning is started in a pure oxygen atmosphere, however, it proceeds much more vigorously and at higher temperatures.” That history is in The atmosphere.

None of it was in the hazard criteria. Mercury had flown six men in pure oxygen and Gemini ten crews, and every one of them had sat on the pad for hours in a sealed cabin of oxygen at sixteen pounds without a fire. Webb would recall in February “a number of instances where a clearly positive source of ignition did not result in a fire. In one such instance an electric light bulb was shattered, exposing the incandescent element to the oxygen atmosphere without starting a fire.” Spacecraft 012 itself had been pressurised with pure oxygen above atmospheric pressure four times in the altitude chamber at Kennedy in October and December 1966, with crews aboard, for six hours and fifteen minutes in all, two and a half times longer than it would be on the pad on 27 January. Those chamber tests were on the hazardous list. The chamber was the hazard; the oxygen was not. The Board’s panel on test procedures drew the conclusion everyone had drawn: “The spacecraft had successfully operated at the same cabin conditions in the Chamber for a greater period of time than on the pad up to the time of the accident.”

What they built

Apollo was to carry three men to the moon in a command module shaped like a cone, 3.9 metres across the base, with a service module behind it. The first ones, called Block I, were for flights in earth orbit; spacecraft 012 was a Block I, begun at Downey in August 1964 and certified flightworthy in August 1966 with a list of open items to be finished in Florida. The Board counted the paper that followed it: “There were 113 significant Engineering Orders not accomplished at the time Command Module 012 was delivered to NASA; 623 Engineering Orders were released subsequent to delivery.” The Board allowed for Apollo’s complexity, but “There is, however, an inference that the design, qualification and fabrication process may not have been completed adequately prior to shipment to KSC.”

The cabin held, by the Board’s later reckoning, “many types and classes of combustible material in areas contiguous to possible ignition sources.” Much of it was there for good reasons: nylon netting strung as debris traps so that a dropped screw could not vanish behind the panels, Velcro patches so that checklists and tools would stay put in weightlessness, foam cushions and nylon straps wherever a man might need them. Webb explained in February that “While most of these were constructed of low-combustion-potential material, they were not so arranged as to provide barriers to the spread of a fire.” The wiring was insulated with Teflon, chosen because it was the material least likely to burn when a wire overheated; but “Teflon has excellent fire resistance but low resistance to cold flow”, the Board found, and it could be cut through by being pressed against the structure. The cabin was cooled by ethylene glycol and water in aluminium tubing with soldered joints that leaked, and the coolant’s inhibitor left a residue that was both conductive and combustible. The Board found “numerous examples in the wiring of poor installation, design and workmanship”, and in the wreck a wrench socket that someone had left inside.

The hatch was three hatches: the outermost part of the boost protective cover that shielded the command module during launch, under it the ablative hatch in the heat shield, and under that the inner hatch, which closed the pressure vessel and opened inward. The crew’s own procedure for getting out took, at best, ninety seconds, and the Kennedy historians recorded that “in practice the crew had never accomplished the routines in the minimum time.” The inner hatch could not be opened at all against pressure: it “cannot be opened with positive cabin pressure above approximately 0.25 psi”, the Board’s design panel found. The choice had been deliberate. Grissom’s Mercury hatch had blown off in the water in 1961, and for a flight of two weeks, the Senate committee wrote, “the possibility of accidental release in space of a quick-opening hatch (like the ones used in the earlier spacecraft) was considered to impose a risk in excess of the benefits to be gained from such a hatch.” There was no fire extinguisher for the same kind of reason. “The spacecraft design objective was to eliminate all sources of ignition,” the committee wrote. “Consequently, this influenced other design criteria such as the decision not to use a quick-opening hatch nor to include a fire extinguishing system in the cabin.” The cabin was built to withstand about thirteen pounds per square inch more inside than out. On the pad it ran at two pounds above the air outside, and Frank Borman, asked in the House of Representatives why, gave two reasons: “It was to keep air from leaking in and another reason was to keep the hatch sealed.”

The spacecraft sat some 65 metres up Launch Complex 34, inside a service structure of steel levels, and level A-8 was the one beside the command module. From the umbilical tower a swing arm reached across to a small enclosed room, the white room, that fitted round the hatch; the crew walked the swing arm to get in, and would walk it to get out. On 27 January the white room held a desk, a communications box, a hatch tool, gas masks designed for toxic fumes rather than smoke, and five men. There were no firemen on the pad and no doctors: “The test in progress was not classified as hazardous; therefore, no special protective clothing was required to be available.” Nobody on level A-8 had been trained to remove the hatches, “since it was felt that the pad egress team would be available to perform this function during hazardous tests or launches.”

Two warnings about the contractor had been written down before the fire: the notes of a NASA management review that Phillips sent Atwood in December 1965 with a letter saying “I could not find a substantive basis for confidence in future performance”, and 57 pages on poor workmanship at the Cape from a dismissed North American inspector, Thomas Baron, in January 1967. Neither mentioned oxygen. Both are in The Phillips report.

The test procedure itself was a book: 275 pages approved on 13 December 1966, then a revision of 209 replacement pages handed out at 5:30 in the evening of 26 January, fourteen and a half hours before the test began, and four more pages at ten the next morning. The Kennedy Space Center’s safety office never read any of it. The Board’s panel on test procedures was exact: “The KSC Safety Office did not receive or review the procedure since it was not submitted as a hazardous test.” The panel noted, as a thing worth copying, that the Martin company, which built the Titan rockets, “uses the policy of having Safety review all procedures for possible hazardous operations, rather than giving the operations engineers the responsibility for deciding which operations are hazardous.”

Seventeen seconds

Power went on to the spacecraft at 7:55 in the morning of 27 January. The three men entered at one in the afternoon, Grissom first, and the test conductor recalled his first words: “there was a strange odor in the suit loop. He described it as a ‘sour smell’ somewhat like buttermilk.” The count was held while a sample was taken; the smell had nothing to do with the fire. The hatches were installed from 2:45 and the cabin was purged with oxygen. Then the communications began to fail. A microphone at Grissom’s position stayed live and could not be turned off, and the blockhouse, the control room and the spacecraft could not always hear each other. Chauvin told Congress that “The overall communications problem was so bad at times that we could not even understand what the crew was saying.” At 6:20, with everything done up to the moment of transferring the spacecraft to its own power, the count was held at T minus ten minutes.

For the next ten minutes, the Board found, “there are no events that appear to be related to the fire.” The last voice transmission before the one that reported it came at 6:30:14. From about 6:30:24 the instruments show a crew moving: the gyros registered slight motion, the oxygen flow into the suits rose as it did whenever someone shifted, and Grissom’s live microphone transmitted brushing and tapping until 6:30:58.6. At 6:30:54.8 the voltage on one of the alternating-current buses surged and two transmitters dropped out for a moment. The Board added that these transients “and subsequent activity of the crew may as easily be associated with the result of the fire as with the cause.”

At 6:31:04.7 a voice from the spacecraft said one word. The recording is not clear. Most listeners heard “Hey” or “Fire”; the panel that analysed the tapes added “Break”. Most of them, and the laboratory analysis at Bell Telephone Laboratories, thought it was Grissom. Then at 6:31:06.2 a second voice, probably Chaffee’s, said something that began “I’ve” or “We’ve” and went on, quite clearly, “Got a fire in the cockpit.” That transmission ended at 6:31:10. Then there was nothing for 6.8 seconds.

The Board reconstructed what the three men did from where they were found. The emergency procedure gave each a job: Grissom, in the left couch, to open the cabin vent valve on the shelf above the left-hand equipment bay; White, in the centre, to reach behind his head, unlatch the inner hatch and lower it to the floor, keeping his harness fastened; Chaffee, on the right, to keep the communications open until the hatch was out. The fire had started low on the left, “to the left of the Command Pilot, and considerably below the level of his couch”, probably from an arc where instrument wiring ran between the environmental control unit and the oxygen panel, and for the first seconds it was small. By 6:31:12 it had broken out, running up the nylon netting and across the ceiling and throwing off burning drops of molten nylon, and “a wall of flames extended along the left wall of the module”, between Grissom and the valve. The valve would not have helped: “It is estimated that opening the valve would have delayed Command Module rupture by less than one second.” Grissom was found on the floor of the cabin with his feet on his couch and his head under Chaffee’s headrest. White’s harness buckle was still fastened; the straps had burned through. People watching the television picture of the hatch window saw an arm reaching up for the hatch handle. Chaffee was in his couch, his hoses and leads connected, as the procedure said.

The first sign of rising pressure came at about 6:31:11. By 6:31:16 the cabin pressure transducer had gone off the top of its scale at seventeen pounds per square inch, and from then on the Board read the pressure from the gimbals of the guidance platform, which flexed with the hull. The second transmission began at 6:31:16.8 and is garbled throughout. The Board printed three readings among many: “They’re fighting a bad fire – Let’s get out ….Open ‘er up”; “We’ve got a bad fire – Let’s get out ….We’re burning up”; “I’m reporting a bad fire ….I’m getting out ….” It ended at 6:31:21.8, the Board wrote, “with a cry of pain.”

At 6:31:19.4 the cabin burst. The pressure inside was, at the least, 29 pounds per square inch absolute; the fire panel’s estimate ran from 29 to perhaps 37.7, against a hull built for 12.9 above the outside. The rupture was at the join of the floor and the wall, opposite the fire, and the gases rushed toward it under the couches and over the men, scattering burning material through the whole cabin. This second stage lasted about five seconds and carried a fragment of Grissom’s suit five feet out through the hole, which told the Board that his suit had failed before the burst. Data from the spacecraft stopped at 6:31:22.4. Then, with the pressure gone and the fire everywhere, the oxygen was used up in a few seconds and the flame went to smoke and carbon monoxide. “It is estimated that the Command Module atmosphere was lethal by 23:31:30 GMT,” the Board wrote. The medical panel found that consciousness was lost “between 15 and 30 seconds after the first suit failed”, and that “Chances of resuscitation decreased rapidly thereafter and were irrevocably lost within 4 minutes.”

Outside, the white room was full of fire and smoke. Babbitt had got as far as turning toward the communications box when flame came over his head and charred the papers on his desk, twelve feet from the spacecraft. He and his men ran out along the swing arm and came back. Hawkins found an extinguisher and put out two fires. Babbitt and Gleaves, with the hatch tool, forced off the boost cover hatch, which had distorted in the heat. Gleaves, with no gas mask, was choking; the masks that worked were made for toxic air and not for smoke; “Visibility in the White Room was virtually zero. It was necessary to work essentially by touch since visual observation was limited to a few inches at best.” The tool passed to Hawkins, Clemmons and Reece, who took off the ablative hatch and then unlatched the inner hatch and tried to lower it into the cabin. Five men took turns, going out to the swing arm to breathe and coming back. Babbitt’s report that all three hatches were open came, on the voice tape, five minutes and twenty-seven seconds after the call of fire; the Board rounded it to about five minutes, or 6:36.

When the inner hatch came free “intense heat and a considerable amount of smoke issued from the interior of the Command Module.” Hawkins called to the crew. “He remembers there was an unusual silence from the Command Module interior.” Gleaves, with a torch, could see the two floodlights on the couches: “The lights were within inches of his position, but they appeared to be small candles very far away.” Babbitt looked in, and then told the ground, on the open net, that he would not describe what he had seen. The firemen arrived shortly before 6:40, and none of them but the chief of the egress team had ever been shown the hatches. The three doctors reached the white room at about 6:45 and stopped the attempts to remove the crew. Twenty-seven men on the pad were treated for smoke.

What it looked like from inside

Nobody inside the spacecraft left an account, so the inside of this experiment is the white room and the blockhouse.

Babbitt gave his statement on 29 January, hoarse from the smoke. “At the time it had happened, I heard and I can almost definitely state that I believe it was Mr. Chaffee say something to the effect of fire in the command module, fire in the spacecraft, the term fire sticks to me more than anything else.” He ordered Gleaves to the hatch and turned toward the communications box. “I never made it to the comm box because at that time more or less over my head I felt a pressure and heat and flame and I never made the call to the blockhouse. My next thoughts were to get out of there as quickly as I could.” From the voice to the flame, he said, had been “at the most maybe two to three seconds”. In between he had heard a sound he knew well, the cabin relief valve venting. Gleaves heard it too, and the Board’s panel recorded his thought: that Grissom “had dumped the pressure of the Command Module in accordance with the fire emergency procedures”, and that with the cabin venting “he would have no difficulty in removing the inner hatch.” Then he saw a very bright flash through the porthole and the cabin split. Jessie Owens, a North American engineer at the pad leader’s desk, heard the valve and the gas “burst into flames somewhat like lighting an acetylene torch.”

In the blockhouse, Gary W. Propst, an RCA technician, was watching the television picture of the hatch window. He heard “Fire in the cockpit” and saw a glow, and then, by his statement to the Board, “Astronaut arm and leg movements lasting about 2 minutes until flames obscured vision.” The NASA historians give his cry: “Blow the hatch, why don’t they blow the hatch?” He did not know the hatch could not be blown. His two minutes are the one part of any witness’s account the Board could not reconcile with the instruments, which had stopped eighteen seconds after the call. Slayton, at the astronaut console, “Observed Spacecraft hatch on TV monitor. Flame around hatch. Smoke increased. Detected people trying to get to hatch door. Smoke obscured view from TV Camera.”

What the men on the pad had been given to meet a fire was what the rules gave a routine test: no protective clothing, no procedure for a fire inside the spacecraft, no firemen, no doctors, masks for the wrong kind of air, and a swing arm whose doors opened toward the men trying to get through them. On 24 October 1967 Babbitt, Gleaves, Hawkins, Clemmons, Reece and Henry H. Rogers, a NASA inspector who had gone in with them, were given the National Medal for Exceptional Bravery.

What happened

Webb established a Review Board that night, with Floyd L. Thompson, Director of the Langley Research Center, as chairman, and it met at the Kennedy Space Center the next day. Its members were Thompson; Borman; Maxime A. Faget, Houston’s director of engineering; E. Barton Geer of Langley; George C. White of NASA headquarters; John J. Williams of Kennedy; Colonel Charles F. Strang of the Air Force Inspector General’s office; and Robert W. Van Dolah, a specialist in explosions from the Bureau of Mines. The pad was impounded, and spacecraft 014 was flown from California to be taken apart alongside the burned one. Twenty-one panels were set up; by 22 February 1,500 people were working on the investigation, and every wire from the cabin was examined under a seven-power glass for the pit that an arc leaves. On 25 February Webb said the one thing the Board already knew: “The risk of fire that could not be controlled or from which escape could not be made was considerably greater than was recognized when the procedures for the conduct of the test were established.”

The report went to Webb on 5 April 1967, almost 3,000 pages in fourteen volumes. It did not find the spark. “The fire in Apollo 204 was most probably brought about by some minor malfunction or failure of equipment or wire insulation. This failure, which most likely will never be positively identified, initiated a sequence of events that culminated in the conflagration.” It found the conditions instead, six of them: “A sealed cabin, pressurized with an oxygen atmosphere. An extensive distribution of combustible materials in the cabin. Vulnerable wiring carrying spacecraft power. Vulnerable plumbing carrying a combustible and corrosive coolant. Inadequate provisions for the crew to escape. Inadequate provisions for rescue or medical assistance.” And it said how they had come to exist: “in its devotion to the many difficult problems of space travel, the Apollo team failed to give adequate attention to certain mundane but equally vital questions of crew safety.” Its second finding was the test: “The test conditions were extremely hazardous.” Its fourth was the hatch: “The crew was never capable of effecting emergency egress because of the pressurization before rupture and their loss of consciousness soon after rupture.” Its fifth was the list: “Those organizations responsible for the planning, conduct and safety of this test failed to identify it as being hazardous.”

Congress had waited. The Senate committee had heard Seamans and Mueller in executive session on 7 February; it took the Board’s report on 11 April, and its hearings ran until January 1968. The House subcommittee under Olin Teague began on 10 April, the evening the Board testified. Borman, who had been the first astronaut into the burned cabin, read the findings into the record and told the House that “none of us gave any serious consideration to a fire in the spacecraft.” Debus said on 12 April: “It is for me very difficult to find out why we did not think deeply enough or were not inventive enough to identify this as a very hazardous test.” He had searched his own past for the criteria, he said, and found that “we had no concept of the possible viciousness of this fire and its speed. We never knew that the conflagration would go that fast through the spacecraft so that no rescue would essentially help. This was not known. This is the essential cause of the tragedy.”

North American’s turn came in the Senate on 4 May. Senator Len Jordan asked whose decision it had been that the test was not dangerous. Myers answered with the number. “There were 104 different tests outlines that were included for the tests of Spacecraft 012, and 54 of them had been defined as hazardous in accordance with the criteria which is established by the NASA. We had consulted with them in the development of that criteria. That criteria as published did not cite full oxygen tests as a hazardous test. And we all are fully aware that in retrospect it should have been.” Jordan: “So no precautions were taken by anyone inasmuch as the pre-agreed criteria did not call for fire protection in this particular test.” Myers: “I believe that is correct.” The company’s written answer to the Board said that “With the benefit of hindsight it is evident that the criteria were not directed to the potential risk involved in the Spacecraft 012 test. We recognize that North American might well have questioned them even though it did not have the primary responsibility for determining the criteria.” Senator Charles Percy asked Atwood whether he would not now say “should have questioned them”. Atwood: “Senator, I am sure that all criteria will be doubly and triply questioned.”

The hearings also turned up the Phillips report, which Webb at first denied existed. The Senate’s report, number 956, was ordered printed on 30 January 1968. Its preface began: “No single person bears all of the responsibility for the Apollo 204 accident. It happened because many people made the mistake of failing to recognize a hazardous situation.” The committee could not explain the mistake and said so: “The committee can find no other explanation for the failure of the hundreds of highly-trained people on the Apollo program, including the astronauts, to evaluate the conditions under which the test was being conducted as hazardous. Other serious oxygen fires had occured. NASA itself had commissioned research on the cause and effects of fires in oxygen-rich atmospheres.” The research in its footnote was Roth’s book of 1964. On the design: “The spacecraft design objective was to eliminate all sources of ignition.” A page later: “Of course, all ignition sources had not been eliminated.” Its summary was one sentence: “The committee can only conclude that NASA’s long history of successes in testing and launching space vehicles with pure oxygen environments at 16.7 p.s.i. and lower pressures led to overconfidence and complacency.” And it recorded the first of NASA’s changes, which took the form of a definition: “All tests taking place in 100 percent pure oxygen environments are now defined as hazardous.”

After

On 24 April 1967 the Office of Manned Space Flight instructed the centres that AS-204 would be officially recorded as Apollo 1, “first manned Apollo Saturn flight - failed on ground test.” Headquarters had approved the name before the fire, and the three widows asked that it be kept. Grissom and Chaffee were buried at Arlington and White at West Point. In the same days two airmen died in a fire in a pure-oxygen chamber at Brooks Air Force Base in Texas. Baron testified to Teague’s subcommittee on 21 April, and a week later he and his family died when a train hit their car.

Shea left the spacecraft programme and George Low took it over; Storms was replaced at Downey by William Bergen from the Martin company. All manned flights were moved to the Block II spacecraft. Three thousand laboratory tests were run on five hundred materials, and the nylon in the cabin and the suits gave way to Beta cloth, a glass fibre that does not burn. The aluminium oxygen lines with soldered joints were replaced with stainless steel. The three hatches became one, hinged to swing outward, that a man could unlatch in seconds: three, the Kennedy historians say, five by the Houston account. The pads got a slide wire to the ground, fans in the white room, water hoses, and emergency drills. The cabin in flight stayed pure oxygen at five pounds, for all the reasons of 1962; on the pad, after a year and a half of tests, the spacecraft was filled with sixty per cent oxygen and forty per cent nitrogen, and the nitrogen was flushed out after launch.

The cost was counted in the Senate’s report: the first manned flight moved from February 1967 to the autumn of 1968, and the estimate for the whole programme rose from $22.718 billion to $23.190 billion. Apollo 7, with Schirra, Eisele and Cunningham in a Block II command module, flew for eleven days from 11 October 1968. Nine months later men walked on the moon, within the decade. At Launch Complex 34 the service structure was dismantled and the concrete launch stand left standing, with a plaque to the three men who died there.

What it taught

Start with what the rules were. They were not careless. The list of hazardous operations at the Kennedy Space Center had grown out of a decade of missiles and rockets, and it named the things that had hurt people: fuel, hypergolic propellants, cryogenics, tanks under pressure, pyrotechnics, and chambers that could kill a man by vacuum. It had been right every time. The list measured what the organisation had learned. It could not measure what the organisation had not.

A hazard list is a hypothesis. It says: harm comes from these things, and not from others. The plugs-out test was examined against the hypothesis and passed, and because it passed, everything that follows from the word hazardous did not follow: the safety office did not read the procedure, no fire plan was written, no firemen or doctors came, nobody was trained on the hatches. “The hazard level was not recognized,” the Board’s panel wrote, “and consequently the procedure was processed through the review cycle as a non-hazardous procedure.” Fifty-four of a hundred and four is a serious number. It is also exactly as good as the criteria that produced it, and the criteria had never been asked about an atmosphere.

Success is not evidence of safety when the failure has not been tried. The Senate’s word was complacency, and Debus’s was closer: nobody had been “inventive enough”. Six hours and fifteen minutes in the chamber proved that the cabin would not catch fire by itself. It said nothing about what would happen if it did, and that was the only question that mattered, because the men inside could not get out in less than ninety seconds and could not get out at all against a quarter of a pound of pressure. Webb’s light bulb, shattered in oxygen and lighting nothing, was the kind of evidence that accumulates on the wrong side of the ledger.

The design had made escape the thing that could not be allowed to fail, and then given it to chance. Every choice was defensible for a flight to the moon. A hatch that opens inward cannot open by accident in space; an extinguisher adds fumes to a cabin; pure oxygen at five pounds spares the crew the bends. The design objective, the Senate found, “was to eliminate all sources of ignition”, and the other choices followed from it. “Of course, all ignition sources had not been eliminated.” Then the ground test inherited the flight design’s risks without the flight design’s reasons. On the pad there was no vacuum outside to make an inward hatch wise, and there was air a few inches away; the sixteen pounds of oxygen were there to keep the air out and the hatch tight. An experiment on the ground that borrows the conditions of flight should borrow them one at a time and ask of each what it is for.

Before a trial on a living system, write down how it ends. The crew had asked for a practice escape, and had put it at the end of this test because the next one was dangerous. That is the sentence in which the whole accident is contained. They were right that a fuelled rocket was hazardous, and right to want a rehearsal, and the rehearsal was scheduled for the end of a test in which, for five hours, the way out they would rehearse did not exist. The Board’s design panel said it flatly: “Even under optimum conditions emergency crew egress from Apollo 204 Spacecraft could not have been accomplished in sufficient time.” A plan that puts escape last assumes that nothing before it will need escape.

A warning filed is not a warning acted on. The Mercury chamber test of 1960 produced the purge procedure that put pure oxygen at sixteen pounds into every cabin on every pad. Roth’s review of 1964 was a government publication for a dollar. The Phillips team’s notes of 1965 were on the president of North American’s desk. Baron’s 57 pages were in a NASA inspector’s office on 24 January. None of them said the plugs-out test would burn; each said something that, read against the others, would have been enough. The Board’s panel wrote that “A positive method does not exist for insuring identification and documentation of all possible hazards involved in test operations”, and that is the defect: not that nobody knew, but that there was no place where what was known had to be put together before a man was sealed in.

Check the story before you learn from it. The first word on the tape is “Hey” or “Fire” or “Break”, and it was Grissom or it was not; the second transmission has as many readings as listeners, and the Bell engineers warned that it always would. The two transmissions lasted 10.3 seconds in the Board’s report and 17.1 in the panel’s, the same tape counted without and with the silence between. The cabin burst at 6:31:19 in the report, at 19.4 seconds in the fire panel’s figure, at 6:31:17 in Seamans’s first account. The hatches were open five minutes and twenty-seven seconds after the call by the tape, four minutes fifty-five by the Senate’s reading of the same data, four minutes thirty-six by what a witness told the Senate. Propst saw arms moving for two minutes; the instruments stopped at eighteen seconds. What the record supports without argument is the sequence: a list of fifty-four tests; a test not on it; a cabin of oxygen at sixteen pounds; a hatch that opened inward; a fire; seventeen seconds; and a rule, written afterwards, that every test in pure oxygen is hazardous. That rule was available for the asking before the test began. Nobody asked, because the list had already answered.

Sources

• Apollo 204 Review Board, Report of Apollo 204 Review Board to the Administrator, National Aeronautics and Space Administration, 5 April 1967. Parts IV to VI (the history of spacecraft 012 and the test, the chronology from the T minus ten minute hold through the removal of the crew, the analysis of the data and the voice transmissions, the cause, and the eleven findings, determinations and recommendations), with the letters, memoranda and interim reports of January and February 1967, Webb’s statement of 25 February 1967, and the enclosures reproduced here. NASA History Office. nasa.gov, contents and appendices, Seamans, 3 February, Webb, 25 February, report PDF
• Apollo 204 Review Board, Appendix B, Witness Statements and Releases: the statement of Donald O. Babbitt to the Board, 29 January 1967. nasa.gov
• Apollo 204 Review Board, Appendix D, Panel reports: Panel 3 (sequence of events; the transcript of the voice channel for the last 27 seconds, the third reading of the first word, and the 17.1 seconds), Panel 5 (origin and propagation of the fire; the stages, the rupture at 23:31:19.4 and the pressure of 29 to 37.7 psia), Panel 7 (test procedures; the history of the procedure, the 275 and 209 pages, the safety office, the Martin practice, and the finding on the altitude chamber), Panel 9 (design reviews; the atmosphere and the egress finding), Panel 11 (medical analysis), Panel 12 (witness statements; the summary of observations and the narrative of the hatch removal) and Panel 13 (ground emergency provisions; how hazardous tests were identified). Panels 1 to 4, Panel 5, Panels 6 to 10, Panel 11, Panels 12 to 17
• US Senate, Committee on Aeronautical and Space Sciences, Apollo 204 Accident: Report of the Committee on Aeronautical and Space Sciences, United States Senate, with Additional Views, Report No. 956, 90th Congress, 2nd session, 30 January 1968. The preface, the conditions leading to the accident, the hatch, the 14.7 seconds and the 4 minutes 55 seconds, NASA’s changes, the Phillips report, the schedule and the cost, the summary, and the additional views of Senators Brooke and Percy. nasa.gov
• US Senate, Committee on Aeronautical and Space Sciences, Apollo Accident: Hearings, Part 5, 4 May 1967, to hear officials of North American Aviation, Inc. The testimony of Atwood and Myers, the 104 test outlines and the 54, the exchanges with Senators Jordan and Percy, and North American’s written comments on the Board’s findings. govinfo.gov
• US Senate, Committee on Aeronautical and Space Sciences, Apollo Accident: Hearings, Part 3, 11 April 1967, the Board on its final report; and US House of Representatives, Committee on Science and Astronautics, Subcommittee on NASA Oversight, Investigation into Apollo 204 Accident: Hearings, Volume 1, 10 April 1967 (evening session). Borman’s reading of the findings, the 16.7 pounds, and the two reasons for the pressure. NASA’s scans. Senate, 11 April, House, 10 April
• Samuel C. Phillips, letter to J. L. Atwood, 19 December 1965, with the notes of the NASA management review of North American Aviation (the Phillips report), and George E. Mueller, letter to Atwood, 19 December 1965. NASA History Office. nasa.gov
• Emanuel M. Roth, Space-Cabin Atmospheres, Part II: Fire and Blast Hazards, NASA SP-48, 1964. The foreword, the spark, and the burning in pure oxygen. ntrs.nasa.gov
• Courtney G. Brooks, James M. Grimwood and Loyd S. Swenson, Chariots for Apollo: A History of Manned Lunar Spacecraft, NASA SP-4205, 1979, chapter 9, “Tragedy and Recovery”. The morning of the test, the people in the blockhouse and the white room, the conference in Washington, the Board, Grissom’s words, the Phillips and Baron reports, the Brooks fire, Soyuz 1, the changes and the recovery. nasa.gov
• Charles D. Benson and William Barnaby Faherty, Moonport: A History of Apollo Launch Facilities and Operations, NASA SP-4204, 1978, chapter 18, “The Fire That Seared the Spaceport”. Spacecraft 012 at the Cape, Baron, Chauvin’s testimony, the witnesses on the tower, the ninety seconds, Borman’s and Debus’s statements of April, the medals, and the changes at the pad. nasa.gov
• Ivan D. Ertel and Roland W. Newkirk with Courtney G. Brooks, The Apollo Spacecraft: A Chronology, Volume IV, NASA SP-4009, 1978, Part 1 (H), March to April 1967: the designation Apollo 1. apolloexplorer.co.uk
• Mary C. White, “Detailed Biographies of the Apollo 1 Crew”, NASA History Office, 2006. nasa.gov
• NASA, “Apollo 7”. The crew and the dates of the first manned flight. nasa.gov
• Photographs: NASA S66-58038 (the altitude chamber, 18 October 1966) and S67-21294 (the cabin, 28 January 1967), from the NASA Image and Video Library; US government works. S66-58038, S67-21294