Gene Kranz - Failure Is Not an Option

Sy Liebergot, wrestling with the oxygen pressure management problem and hoping to avoid an alarm during the sleep period, decided to request a cryo tank stir prior to sleep. The stir request was passed to the crew, with Swigert acknowledging the request. As Swigert started the stir at 55:53, Liebergot focused his attention on the TV monitors displaying the fuel cell currents to nail down the exact time the stir started.

(What we could not know at this time was that a design flaw existed in the heater circuit of the cryogenic tanks. During pre-launch testing, the heater thermostat switch closed and, due to the design flaw, the Teflon insulation on the wiring internal to the tank was damaged. When the tank was serviced for the mission, the bare copper wires in the tank electrical system were submerged in liquid oxygen. Two days after liftoff two of the three conditions for an explosion existed, gaseous oxygen and damaged tank insulation. All that was required to initiate an explosion was a spark.)

Nothing happened for sixteen seconds after Swigert started the cryo stir. Then, inside tank 2, a spark jumped between the wires of the heater circuit. The pressure in the tank rose rapidly. Preoccupied with moni toring the fuel cell currents, Sy Liebergot did not notice the oxygen flow measurements on all three fuel cells fluctuating slowly for eighteen seconds. Then the pressure in oxygen tank 2 began to rise rapidly, but failed to set off a high-pressure alarm in the command module or at Liebergot’s console because the cryo pressure alarm had been disabled for the crew sleep. The tank pressure continued its upward climb, then dropped rapidly. The temperatures in the spherical tanks began to rise rapidly. One minute and fifty-three seconds after the stir began, there was a three-second telemetry data loss. When the data returned, the tank 2 pressure read 19 psi, temperature +84 degrees Fahrenheit. The normal pressure reading is 865-935 psi.

The time was now 55 hours 55 minutes and 04 seconds from launch.

Like rolling thunder, my voice loops came alive: “Flight, we’ve had a computer restart.” Then in the blink of an eye, Swigert said, “We have a problem.” Then other controllers chimed in with bad news. At this point Lovell uttered the ominous words: “Okay, Houston, we have a problem!” In both the MCC and on board the spacecraft, voices were normal, but heart rates had picked up. Seconds later Haise reported, “Right now, Houston, the voltage is—is looking good. And we had a pretty large bang associated with the Caution and Warning.”

In the MCC, you can’t see, smell, or touch a crisis except through the telemetry and the crew’s voice reports. But you can feel some instinct kicking in when something very wrong is going on. By the time I heard Lovell’s report, three controllers had related problems. I was wondering which problem Lovell was reporting, as he started relaying the long list of warning indications from the spacecraft displays. The reports and our experience indicated an electrical glitch. I believed we would quickly nail the problem and get back on track.

I was wrong.

A crisis had begun. Events followed in rapid succession, escalating and complicating the problems as the crew’s situation became increasingly perilous. It was fifteen minutes before we began to comprehend the full scope of the crisis. Once we understood it, we realized that there was not going to be a lunar mission. The mission had become one of survival.

The reports continued, but nothing made sense. Each controller stared incredulously at his display and reported new pieces to add to the puzzle. It took extra seconds sorting out what was real and credible. It appeared we were losing our oxygen and with it the fuel cells, the major source of power. When that happened we would lose control of the main propulsion system. Nothing remotely like this had ever happened in simulation.

As we watched the command module’s life-sustaining resources disappearing, like blood draining from a body, the voices of the crew were unbelievably calm and restrained. It was as if they were reporting something that was no big deal. From all sides of the cockpit, Haise, Swigert, and Lovell were continuing the dialogue, giving us the cockpit meter readings and warning light indications.

I had heard about the fog of battle, but I had never experienced it until now. The early minutes were confusing; all reports and data were suspect. Small firefights occurred as individual problems were corrected, but we had no sense of the big picture. With both electrical buses in an undervoltage condition, the crew was working independently of the control team to restore power to the craft. We were seconds behind them, slowly responding.

I remembered the call from INCO (instrumentation and communications), Gary Scott’s call, that the antenna had switched beam width at the exact time of the power problem. I became convinced that we had an electrical short caused by another antenna glitch. Again I took the wrong fork in the road, believing we would be back on track shortly.

Five minutes after the event, the significance of the crew’s words, “We had a pretty large bang…” hit me. GNC Buck Willoughby, unflappable, started speaking to me slowly, evenly, and without a hint of emotion, “Flight, have the crew verify that the Quad D helium valves are open. I suspect that the big bang shocked the valves shut, cutting off fuel to the attitude thrusters.” Buck’s call started me down a different path. On Apollo 9, I was flight director when the pyrotechnic shock occasioned while separating the CSM from the Saturn S-IVB booster closed the fuel valves. That gave us a few bad moments then. The bang heard by the 13 crew must have been awfully solid to do the same, closing the propellant valves. From this moment on, I proceeded more deliberately and methodically. We were five minutes into the crisis.

CapCom Jack Lousma, frustrated, came up on the loop. “Flight, is there any kind of lead we can give them? Is it instrumentation or have we got real problems or what?” Lousma echoed everyone’s feelings. We were making no progress, virtually every controller still had problems, but no one could see a pattern in all this. It was like living a bad dream, with every event taking place in slow motion. The frustration of the crew and controllers was starting to creep into their voices. Everything we knew about our spacecraft, all that we had learned about the design, precluded the kind of massive failures we were seeing. The data told us we were looking at multiple simultaneous failures. Two, possibly three fuel cells were down, both oxygen tanks depleted, and we had an undetermined attitude control problem that was pushing the two spacecraft around. Soon we would lose power. When that happened, we would lose everything.

The teamwork in the MCC under a crisis is spectacular. While Liebergot, Lousma, and I worked the electrical options with the crew, the remaining controllers were making their inputs to the CapCom, correcting their smaller problems. While sensing the urgency of the electrical problems, they tended their own business, protecting their systems and giving crisp, brief reports so as not to disturb or aggravate the resolution of the main problem—whatever it was.

INCO Gary Scott watched the antenna signal strengths like a hawk. He knew that the crew did not have time to point and select antennas. Gary recommended a fallback to the less powerful but adequate Omni antennas. There are four Omni antennas on the spacecraft. Through the critical first hour, until help arrived, he called out each antenna switch, protecting this vital link as the docked CSM and LM drifted out of control and were pushed around by some force we couldn’t identify. If he had missed once, we would have lost communications, diverting the attention of crew and control team from critical tasks. Scott, like many others, made hero category by his patient, timely, undistracted management of the data stream while everything else was falling down about my team.