Gene Kranz - Failure Is Not an Option

Everything is Go, and for the moment, the energy level of the room has settled down. We are running by the clock and are a quarter of the way to the surface. Bales again reports the downrange error is not increasing, and again states that he thinks we will make it through his mission rule gate. I have the fleeting impression that if it is close, he will bias his call on the Go side. After a visual position check against lunar landmarks, the crew indicates they also think they are a little long. I add up the pieces. Three data sources now say we are not going to hit the planned landing point. We are going to be long. I dig into my memory for the description of the landing site near the toe of the footprint. I know it is rough, full of craters and boulders. I hope Armstrong can find a landing site.

I relax prematurely, and once again the data gets ratty. I tell the controllers to make their Go NoGo decision based on the last data they think is valid. I trust enough in their judgment and the spacecraft to keep descending without data for a while. I go rapidly around the horn, and all controllers are Go, especially Bales. His “Go!” resounds clearly through the room like a cymbal. He does not need a voice loop today. I chuckle as I continue polling the controllers.

Duke advises the Eagle that they are Go to continue powered descent.Communications are noisy but usable, making it tough for me to pull the voices out of the background noise. It is the kind of workload that SimSup routinely put us through, and his training is paying off with my team today. Tindall must have been holding his breath, for he exhales noisily, and he knocks a book to the floor as he stirs in his chair.

Data returns just as the LM radar locks on to the lunar surface. Bales reports, “Radar, Flight,” and his voice briefly quivers, betraying his true feelings. Steve has passed another of his Go NoGo milestones. Then, Aldrin reports, “Program alarm. It’s a 1202.”

Controllers are still studying radar quality prior to incorporating the data into the computers and do not immediately pick up the alarm call. Seconds later, activity at the guidance console comes to an abrupt halt as the implications of the alarm sink in. Bales calls, “Stand by, Flight,” when his backroom support, Jack Garman, brings the alarm to his attention. Duke repeats, “It’s a 1202 alarm,” in a questioning voice. “It’s a 1202 alarm” echoes across the loops for several seconds.

Aldrin requests a reading. It is like coming to a fork in the road where you’re uncertain which direction to take. Many of the controllers are oblivious to the alarm and are continuing the decision processes related to accepting the descent radar. Bales, Duke, and I start work to resolve the program alarm. I don’t think anyone outside the flight control team understands the real significance of the alarm, in the midst of the rapid-fire exchange of communications. Duke muses aloud on the flight director loop, “It’s the same one we had in training.” He audibly expresses our collective feeling, almost wonderment. These were the same exact alarms that brought us to the wrong conclusion, an abort command, in the final training run when SimSup won the last round. This time we won’t be stampeded.

The significance of this is not lost on any of us. The alarm tells us that the computer is behind in its work. If the alarms continue, the guidance, navigation, and crew display updates will become unreliable. If the alarms are sustained, the computer could grind to a halt, possibly aborting the mission. Each alarm must be accounted for. They have the capacity to create doubt and distraction, two of a pilot’s deadliest enemies.

Prompted by Gibson in the back room, Bales says, “We’re Go on that alarm. If it doesn’t recur, we are Go.” Then, in the blink of an eye, he swerves back to the nominal mission and says, “He’s [Aldrin] taking in the radar data.” We pass the throttle-down times, continue the routine assessments, and a backroom controller inadvertently comes on the loop, saying, “This is just like a simulation.” I smile and agree. There is nothing like working out a problem to relieve the tension on a team. Controllers always work best under pressure, and they are doing well during today’s final exam.

The radar data smoothly corrects the altitude difference in the computer, and as we watch, we see another program alarm. Aldrin calls, “Same alarm, and it appears to come when we have a 1668 up.” (1668 is the LM computer display of time, landing site range, and altitude.)

Bales quickly responds, “We are Go. Tell him [Aldrin] we will monitor his altitude data. I think that is why he is getting the alarm.” This information is quickly passed to the crew. Above all, we have to prevent a rapid string of these alarms, which will cause the computer to go into an idle mode and abort the landing. With pressure mounting on the team, I get on the loop, “Okay, all flight controllers, hang tight. We should be throttling down soon.”

Today we are gobbling up the alarms as they occur. I mentally thank SimSup for the final training run on program alarms. Throttle-down comes uneventfully. LM systems and trajectory are good, and Duke advises the crew they are looking great. As the crew continue to pitch over to the vertical for the start of the landing phase, they select the steerable antenna to assure continued communications.

We seem to gain strength as the problems mount. Again, I repeat, “Okay, everybody, hang tight… seven and one half minutes.” I run out of breath with that statement. Bales comes on the loop. “The landing radar has fixed everything, the LM velocity is beautiful.” Carlton, the LM CONTROL, has been watching the fuel gauging system, and he selects the fuel quantity measuring probe that will be used for giving the crew and control team voice call-outs on “seconds of fuel remaining.” The voice loop calls are now back to the expected traffic levels, and eight minutes after checking with Bales that the landing radar has updated the computers, I start to close out my final mission rules for landing. We have met all of the mission rule requirements. It is time to make the final landing Go NoGo decision.

After the LM pitches toward the landing attitude the computer automatically completes the braking phase and switches to the final approach program. I know we are long, and the crew is now able to verify that the automatic system approach will take them into a large crater. My console telemetry display indicates the LM is about 7,000 feet above the surface, with a descent rate of 125 feet per second. Armstrong now selects a new landing point in the computer to overfly the crater, and Carlton reports that Armstrong has checked out the manual attitude control.

I start around the loop for the landing Go NoGo. I have met all of my rule criteria, and I am sure that controllers have, too. We are about to hand over the control for the final phase to Armstrong and Aldrin. Soon, we will be spectators just like the rest of the world. The controllers respond crisply and again Bales gives a “Go!” that rings through the room. I continue with my final polling. All controllers are “Go!”

With deliberate emphasis, I say, “CapCom, we are Go for landing . ” The voice exchanges become furious as Duke gives the Go to the crew, now busy trying to find a landing site. There is a brief pause, then Aldrin responds, “Roger, understand. Go for landing,” and then continues, “3,000 feet… program alarm… 1201.” Duke acknowledges, “1201,” and it echoes through the intercom loops with Bales advising, “Go… same type… we’re Go.” As it gets tougher, the team gets tighter. I am about to bust a gut with pride for my people.

The intensity increases and all calls become even swifter. They are emotional, but crisp and shorn of excess verbiage. Controllers now report what they are seeing, and Duke starts to choose data from the controllers to send up to the crew. As the LM passes through 2,000 feet, Duke picks up another alarm, this time a 1202, and he advises the crew we copy. Throughout the descent so far we have not seen any discernible effect of the alarms on LM computer performance.