Three men died on January 27th, 1967. They suffocated in the Command Module of Apollo 1, not in the depths of space, or the surface of the moon, but on Launch Pad 34, at Cape Kennedy, Florida. They died not from an unexpected technical failure, or an unknown risk, but rather due to lack of diverse critical thinking, and a disconnect between broad knowledge and specific action. They died not because of the unknown, but because of the disconnected.
This post is one of a series as i #WorkOutLoud to complete my latest Social Age Guidebook: it’s a series of Leadership Reflections on the Apollo programme at 50 years.
Their deaths, the first US astronauts to die in the American space programme , almost halted the race to the moon, and the lessons learned resonate through the mindset and approach of NASA to this day .
Commander Gus Grissom, veteran Ed White, and rookie Roger Chaffee, knew that they were not going to the moon that day. In fact, they knew that they were not going to the moon at all: the test was of a Command Module called ‘Block 1’, designed as a prototype of the full Command Module, but only to orbit the earth. Apollo 1 would carry this module into orbit, and use the data on it’s performance to finalise work on ‘Block 2’, currently being finalised by North American, the aerospace company leading on this element. This type of incremental development sat at the heart of the rapid schedule of development that would ultimately deliver success to the programme: the modular nature of the Saturn V and Apollo components, and the ability to ‘plug’ different configurations together, meant sequential testing could be fluid and fast.
But Block 1 had it’s issue: nobody had built a spaceship before, but nonetheless, it was clear to Grissom and his crew that this one had issues: so many changes were being made, in service of different needs and goals, that the engineers could barely keep up. The floor of the Command Module was draped with bundles of wire, largely unprotected, constantly getting damaged, and one result of this was that the engineers began to resist the astronauts suggestions for further change . For the engineers, getting to completion, managing complexity, may have started to shift focus away from the broader mission objective: to fly a man safely to the moon and back.
There was a broad perspective that this Apollo craft was not just slightly flawed, but downright dangerous: in an earlier test of the Service Module engine, the one that would put the craft in lunar orbit, but more importantly fire again to send it home, had resulted in the engine nozzle shattering like glass. Indeed, by this stage, the complete vehicle had logged around 20,000 individual failures .
Apollo had been preceded by the Gemini programme, during which the astronauts had had regular and welcome input into engineering teams who had seemed part of the crew. But NASA had been smaller then, with less political oversight and pressure. And there was something of a dynastic change: some felt that the Apollo leaders saw Gemini as quaint and irrelevant: a sense that the mass, momentum, and might, of Apollo negated the need to learn lessons from it’s little brother. The hierarchy, system, and programme itself bred an arrogance, alongside a systemic disconnect: it was not always clear who could make a final decision, and the expanded teams led to sometimes fragmented pathways. All of which was a recipe for failure.
This particular test was not considered dangerous: the Saturn V was not even fuelled, but when the astronauts had first entered it, there had been a strong smell of sour milk in the atmosphere, which had taken an hour to resolve. Eventually, the cabin was sealed with the heavy hatch: it came in two parts, with an outer door, and an inner frame that opened inwards. And it was a compromise.
Throughout the design, NASA engineers, astronauts, and even some engineers at North American, had questioned the design, but it had two a key benefits of being light, and simple. And as everyone knew, opening inwards meant that, when pressurised in flight, it was far easier to keep an airtight seal. But weight was likely the deciding factor: development of the Apollo modules was substantially a battle against weight, because every single kilo of equipment took dozens of kilos of fuel to heft into orbit.
Throughout the day, as the three astronauts sweated inside their suits, communications were problematic: the radio links between the Command Module, the Blockhouse, and the Capsule Communicator, were erratic at best. “Jesus Christ… how are we going to get to the moon if we can’t talk between two or three buildings?” asked Grissom?
That morning, Grissom and Deke Slayton, chief of Crew Operations, and an astronaut himself, had run through the litany of faults: coolant leaks, faulty wiring, environmental control systems, “If you don’t believe it, you ought to get in there with us” said Grissom, an offer that Slayton considered, as there would have been space for him to crouch in the equipment bay in his shirt sleeves. But ultimately he decided he would have been better off in the blockhouse, where he could gain a wider view of the test. The decision saved his life, but haunted him through the rest of his life .
At 18:31, an abrupt transmission came from the Command Module, “Fire”.
Several hundred meters away, in the Blockhouse, designed to withstand an explosion at launch, Slayton glanced at the black and white monitor which had a camera trained on the exterior of the Command Module: it showed the window in the hatch glowing white, flaring out on the monitor.
A second voice cut in on the radio, in the clear, clipped, tones of a Test Pilot: “We’ve got a fire in the cockpit”. It was Chaffee, whose role, in an emergency, was to keep in contact with the Blockhouse.
Slayton could see on the monitor that Ed White was reaching behind, and over his head, to try and undo the bolts that held the hatch shut, a futile effort as this required a special tool to undo the bolts. “We’ve got a bad fire… we’re burning up”, came a more desperate voice. Less than half a minute after that came the final transmission from Apollo one: it was a brief cry of pain.
Outside, the pad technicians fought to get close, but even on the outside, it was too hot: time and again for several minutes, they were beaten back by the intense heat. Inside the capsule, in the pure oxygen pressurised atmosphere, even materials that would normally be considered fire resistant burned with a fierce heat: velcro, the cargo nets, electrical insulation, all exploded into fire, driving temperatures up to over 2,500 Fahrenheit. The huge pressure that built up meant that opening the hatch, a fairly monumental effort even at the best of times, would have been impossible: it was sealed shut with several thousand pounds of force, until the skin of the module itself ruptured after fifteen seconds, venting flames to the outside.
In the event, the astronauts did not burn to death: their air hoses melted in the inferno, and as the cabin ruptured, their breathing apparatus was flooded with carbon monoxide. They lost consciousness in between fifteen and thirty seconds, and were dead within four minutes.
As the smoke cleared, only blame and sorrow were left behind, both of which would remain in the atmosphere for years to come.
Accusations towards North American may have been partly unfounded: the need to save weight was all consuming, and none of the decisions had been taken without oversight of NASA. Some of the most damning elements concerned the use of pure oxygen: pure oxygen was used because the complexity of an oxygen/nitrogen (safer) mix was prohibitive. In orbit, pure oxygen was necessary, but cabin pressure was only 5psi. On the ground, the cabin was pressurised to 16.7 psi, which was significant: oxygen is flammable at any pressure, but it becomes terrifyingly flammable at these higher pressures. But nobody questioned why this high pressure was used: it was not necessary for the test, but it had always been done. And an arrogance assumed that all fire risks were correctly managed within the capsule.
The final review board concluded that there had been a spark from damaged wiring on the floor, which ignited vapour from a leaking coolant pipe: that lit the nylon netting (fearsomely flammable in pure oxygen).
In subsequent modules, electrical cables were encased in metal trays, to protect the wiring. The amount of velcro and nylon was reduced, but despite their best efforts, it proved impossible to create a cabin that was fireproof in the enhanced risk of 16psi. So engineer Max Faget came up with a different idea : at launch, the atmosphere would be 60% oxygen to 40% nitrogen, but as the rocket ascended, and pressure dropped, they would bleed out the nitrogen, until in orbit it was pure oxygen, but at the safe pressure of 5psi. This necessitated protecting the astronauts from getting the bends, like deep sea divers, so they breathed pure oxygen through their masks the whole way up.
Grissom, Chaffee, and White, were buried with full military honours, and today, Pad 34 stands as a monument to their sacrifice: if you visit the Cape, it’s possible to take a bus out to view it. The plaque reads ‘ad astra per aspera’ .
‘A rough path leads to the stars’.
When Armstrong and Aldrin finally made it to the surface of the moon on Apollo 11, Aldrin had a space suit that different very slightly from the others: in a special pouch he carried an original mission patch that honoured the three men from Apollo 1 and, in a nice touch, a medal for Soviet cosmonaut Vladimir Komarov, who had died on Soyuz 1, which he left on the moon .
The effort to get a man to the moon, and return him safely, resulted in the construction of the most complex machine ever built by humankind. But the failure of this system came from known risk in a known context: it was not some kind of emergent, radically complex, unknown risk, but rather a pragmatic and clearly visible one, hidden by familiarity and possibly an arrogance of system and design.
Lessons were learned, in part because the accident happened on the pad, meaning a full analysis could take place, but the Apollo programme was no longer innocent: the first steps on the moon had claimed their first price beyond money.
- Arrogance can be held individually, or within a system.
- Our knowledge traps us within a frame: it can be hard to hear weak voices of dissent.
- Risk may sit in plain sight, but be normalised.
- The things that ‘we have always done’ may be the things that we most need to change: do not assume they are there because of the brilliance of others.
- All systems fail: complexity cannot be infinitely layered.
 One could argue that a number of Test Pilots died in precursors of the various modules that ultimately evolved into the Saturn V, and several astronaut candidates died in training accidents, but the Apollo 1 fire was the first as part of the full up Apollo programme.
 Although the lessons resonate, they were arguably not learned: the Challenger Space Shuttle disaster, caused by systems of power and consequence that silenced dissenting voices carried some parallels.
 A key observation in Chaikin (1994), and one which demonstrates how momentum trumped excellence and adaptation, a likely component of the Apollo 1 failure.
 In Lovell and Kluger (2015), who also recount how, in an early test of the splashdown, the heat shield had split in two, and the $35 million lander had sunk to the bottom of the test tank. An inauspicious return to earth.
 Slayton’s own journey is interesting: barred from flight due to a heart irregularity, he sat at the heart of crew operations throughout Apollo, before finally being cleared for his own flight in 1975, on the Apollo-Soyuz project.
 In Riley and Dolling (2009), who provide a useful insight into the entire Apollo 11 hardware setup.
 In Nelson (2010), who also recounts the long struggle that the three widows of the deceased astronauts went through to gain paltry compensation: ultimately Ed White’s wife committed suicide twenty years later, whilst organising a widows reunion. As i said, the shadows of the failure of Apollo 1 ran long.
 Recounted in Magnificent Desolation (p3) (Aldrin, 2009).
Bibliography and further reading
Chaikin, Andrew (1994): A man on the moon: the voyages of the Apollo Astronauts. Penguin, London.
Aldrin, Buzz (2009): ‘Magnificent Desolation: the long journey home from the moon. Bloomsbury, London.
Riles, Christopher, and Dolling, Phil (2009): ‘NASA Mission AS506, Apollo 11, 1969 (including Saturn V, CM-107, SM-107, LM-5), Owners’ Workshop Manual’. Haynes, Somerset.
Woods, David (2016): ‘NASA Saturn V, 1967-1973 (Apollo 4 to Apollo 17 & Skylab), Owner’ Workshop Manual’. Haynes, Somerset.
Morton, Oliver (2019): ‘The Moon’. Profile Books, London.
Lovell, James, and Kluger, Jeffrey (2015): ‘Apollo 13’. Hodder and Stoughton, London.
Mailer, Norman, (2009): ‘Moonfire’. Taschen, Germany.
Muir-Harmony, Teasel and Collins, Michael (2018): ‘A history in 50 objects – Apollo to the moon’. National Geographic, Washington DC.
Day, Dwayne (2006): ‘Saturn’s fury: effects of a Saturn 5 launch pad explosion’. http://www.TheSpaceReview.com (retrieved 23rd July 2019) http://www.thespacereview.com/article/591/1
Kranz, Gene (2000): ‘Failure is not an option: Mission Control from Mercury to Apollo 13 and beyond’. Simon and Schuster, New York.
Nelson, Craig (2010): ‘Rocket Men: the epic story of the first men on the moon’. John Murray, London.
‘Computers in Spaceflight: the NASA Experience – Chapter Nine – Making New Reality: Computers in Simulations and Image Processing’ https://history.nasa.gov/computers/Ch9-2.html (Retrieved 25th July 2019)
Stodd, Julian (2016): ‘The Limits of Hierarchy – Brittle Systems’. https://julianstodd.wordpress.com/2016/05/23/the-limits-of-hierarchy-brittle-systems/ retrieved 26th July 2019
Riley, Christopher, and Dolling, Phil (2009): ‘NASA Mission AS-506 – Apollo 11 – 1969 (Including Saturn V, CXM-107, LM-5) An insight into the hardware from the first manned mission to land on the Moon’. Haynes Publishing, UK.