$Unique_ID{USH00004} $Pretitle{1} $Title{Apollo Expeditions To The Moon Chapter 4 The Spaceships By George M. Low} $Subtitle{} $Author{Cortwright, Edgar M.} $Affiliation{NASA} $Subject{apollo module spacecraft lunar flight oxygen changes lm moon system} $Volume{} $Date{1975} $Log{Lunar Module*0000401.scf Command Module*0000402.scf Service Module*0000403.scf Lunar Ascent Stage*0000404.scf Lunar Descent Stage*0000405.scf Wally Schirra*0000406.scf Reentry Test*0000407.scf } Book: Apollo Expeditions To The Moon Author: Cortwright, Edgar M. Affiliation: NASA Date: 1975 Chapter 4 The Spaceships By George M. Low On April 3, 1967, NASA 2, a Grumman Gulfstream, was taxiing for takeoff at Washington National Airport. Bob Gilruth, Director of NASA's Manned Space- craft Center and 1 (his Deputy at that time) were about to return to Houston after a series of meetings in Washington. But just before starting down the runway, the pilot received a cryptic message from the tower: return to the terminal and ask the passengers to wait in the pilot's lounge. Soon arrived Administrator Jim Webb, his Deputy Bob Seamans, George Mueller, the head of Manned Space Flight, and Apollo Program Director Sam Phillips. Counting Bob Gilruth, everybody in the NASA hierarchy between me and the President was there. [See Lunar Module: Lunar module in Earth orbit.] Jim Webb, using fewer words than usual, came right to the point: Apollo was faltering; the catastrophic fire on January 27 that had taken the lives of three astronauts had been a major setback. All its consequences were not yet known; time was running out on the Nation's commitment to land on the Moon before the end of the decade. Then the punch line: NASA wanted me to take on the task of rebuilding the Apollo spacecraft, and to see to it that we met the commitment. Thus began the most exciting, most demanding, sometimes most frustrating, and always most challenging 27 months in my career as an engineer. Not that Apollo was completely new to me. Six years earlier I had chaired the NASA committee that recommended a manned lunar landing and provided the background work for President Kennedy's decision to go to the Moon. In the intervening years I had not been involved in the day-to-day engineering details of the Apollo spaceships - met 27 months later, sitting at a console in the Launch Control Center during the final seconds of the countdown for Apollo 11, I had come to know and understand two of the most complex flying machines ever built by man. Two Magnificent Flying Machines But in April 1967 these machines were essentially strangers to me. How were they designed? How were they built and tested? What were their strengths and their weaknesses? Above all, what flaw in their design had caused the fire, and what other flaws lurked in their complexity? First there was the command and service module - the CSM - collectively a single spacecraft, but separable into two components (the command module and the service module) for the final minutes of reentry. It was built by North American Rockwell in Downey, California, a place which would become one of my many "homes" for the next 27 months. The command module was compact, solid, and sturdy, designed with one overriding consideration: to survive the fiery heat of reentry as it abandoned the service module and slammed back into the atmosphere at the tremendous speed of 25,000 miles an hour. It was a descendant of Mercury and Gemini, but its task was much more difficult. The speed of reentry from the Moon is nearly one and one-half times as fast as returning from Earth orbit; to slow down from that speed required the dissipation of great amounts of energy. In fact, there is enough energy at reentry to melt and vaporize all the material in the command module several times over, so the spacecraft had to be protected by an ablative heat shield that charred and slowly burned away, thereby protecting all that it surrounded. The command module was also crammed with equipment and subsystems: and of course three men lived in it for most of the lunar journey, and one of them for all of it. It was cone-shaped, with a blunt face for reentry; it was 11 feet long, 13 feet in diameter, and weighed 6 tons. The service module was the quartermaster of the pair. It carried most of the stores needed for the journey through space; oxygen, power-generation equipment, and water as a byproduct of power generation. More than that, it had a propulsion system bigger and more powerful than many upper stages of present launch vehicles. It made all the maneuvers needed to navigate to the Moon, to push itself and the lunar module into lunar orbit, and to eject itself out of orbit to return to Earth. The service module was a cylinder 13 feet in diameter and 24 feet long. Fully loaded it weighed 26 tons. Then there was the lunar module (LM, pronounced LEM, which had actually been its designation - for lunar excursion module until someone decided that the word "excursion" might lend a frivolous note to Apollo). LM was the first true space-ship; it was hidden in a cocoon during the launch through the atmosphere because it could operate only in the vacuum of space. Built by Grumman in Bethpage, New York (another of my many homes away from home), it was somewhat flimsy, with paperthin walls and spindly legs. Its mission was to carry two explorers from lunar orbit to the surface of the Moon, provide a base for them on the Moon, and then send its upper half back into lunar orbit to a rendezvous with its mother ship, the CSM. Designed by aeronautical engineers who for once did not have to worry about airflow and streamlining, it looked like a spider, a gargantuan, other-world insect that stood 23 feet tall and weighed 16 tons. When Jim McDivitt returned from Apollo 9, LM's first manned flight, he gave me a photograph of his Spider in space, with this caption: "Many thanks for the funny-looking spacecraft. It sure flies better than it looks." These were the Apollo spacecraft: two machines, 17 tons of aluminum, steel, copper, titanium, and synthetic materials; 33 tons of propellant; 4 million parts, 40 miles of wire, 100,000 drawings, 26 subsystems, 678 switches, 410 circuit breakers. To look after them there was a brand-new program manager who would have to leap upon this fast-moving train, learn all about it, decide what was good enough and what wasn't, what to accept, and what to change. In the meanwhile, the clock ticked away, bringing the end of the decade ever closer. Complex Subsystems Performed Vital Functions At the heart of each spacecraft were its subsystems. "Subsystem" is space-age jargon for a mechanical or electronic device that performs a specific function such as providing oxygen, electric power, and even bathroom facilities. CSM and LM subsystems performed similar functions, but differed in their design because each had to be adapted to the peculiarities of the spacecraft and its environment. Begin with the environmental control system - the life-support system for man and his machine. It was a marvel of efficiency and reliability, with weight and volume at a premium. A scuba diver uses a tank of air in 60 minutes; in Apollo an equivalent amount of oxygen lasted 15 hours. Oxygen was not simply inhaled once and then discarded: the exhaled gas was scrubbed to eliminate its CO, recycled, and reused. At the same time, its temperature was maintained at a comfortable level, moisture was removed, and odors were eliminated. That's not all: the same life-support system also maintained the cabin at the right pressure, provided hot and cold water, and a circulating coolant to keep all the electronic gear at the proper temperature. (In the weightless environment of space, there are no convective currents, and equipment must be cooled by means of circulating fluids.) Because astronauts' lives depended on this system, most of the functions were provided with redundancy - and yet the entire unit was not much bigger than a window air conditioner. [See Command Module: Command module.] [See Service Module: Service module.] [See Lunar Ascent Stage: Lunar module ascent stage.] [See Lunar Descent Stage: Lunar module descent stage.] How do you generate enough electric power to run a ship in space? In the CSM, the answer was fuel cells: in the LM, storage batteries. Apollo fuel cells used oxygen and hydrogen stored as liquids at extremely cold temperatures that when combined chemically yielded electric power and, as a byproduct, water for drinking. (In early flights the water contained entrapped bubbles of hydrogen, which caused the astronauts no real harm but engendered major gastronomical discomfort. This led to loud complaints, and the problem was finally solved by installing special diaphragms in the system.) The fuel-cell power system was efficient, clean, and absolutely pollution-free. Storing oxygen and hydrogen required new advances in leakproof insulated containers. If an Apollo hydrogen tank were filled with ice and placed in a room at 70 degrees_F, it would take 8.5 years for the ice to melt. If an automobile tire leaked at the same rate as these tanks, it would take 30 million years to go flat. "Houston, this is Tranquility." These words soon would be heard from another world, coming from an astronaut walking on the Moon, relayed to the LM, then to a tracking station in Australia or Spain or California, and on to Mission Control in Houston with only two seconds' delay. Communications from the Moon were clearer and certainly more reliable than they were from my home in Nassau Bay (a stone's throw from the Manned Spacecraft Center to downtown Houston. At the same time, a tiny instrument would register a reading in the astronauts' life-support system, and a few seconds later an engineer in Mission Control would see a variation in oxygen pressure, or a doctor a change in heart rate: and around the world people would watch on their home television sets. Behind all of this would be the Apollo communications system designed to be the astronauts' life line back to Earth, to be compact and lightweight, and yet to function with absolute reliability; an array of receivers, transmitters, power supplies and antennas, all tuned to perfection, that allowed the men and equipment on the ground to extend the capabilities of the astronauts and their ships. (Later on, when the computer on Apollo 11's LM was overloaded during the critical final seconds of the landing, it was this communications system that enabled a highly skilled flight controller named Steve Bales to tell Neil Armstrong that it was safe to disregard the overload alarms and to go ahead with the lunar landing.) If you had to single out one subsystem as being most important, most complex, and yet most demanding in performance and precision, it would be Guidance and Navigation. Its function: to guide Apollo across 250,000 miles of empty space; achieve a precise orbit around the Moon; land on its surface within a few yards of a predesignated spot; guide LM from the surface to a rendezvous in lunar orbit; guide the CM to hit the Earth's atmosphere within a 27-mile "corridor" where the air was thick enough to capture the spacecraft, and yet thin enough so as not to burn it up; and finally land it close to a recovery ship in the middle of the Pacific Ocean. Designed by the Massachusetts Institute of Technology under Stark Draper's leadership, G&N consisted of a miniature computer with an incredible amount of information in its memory; an array of gyroscopes and accelerometers called the inertial- measurement unit; and a space sextant to enable the navigator to take star sightings. Together they determined precisely the spacecraft location between Earth and Moon, and how best to burn the engines to correct the ship's course or to land at the right spot on the Moon with a minimum expenditure of fuel. Precision was of utmost importance; there was no margin for error, and there were no reserves for a missed approach to the Moon. In Apollo 11, Eagle landed at Tranquility Base, after burning its descent engine for 12 minutes, with only 20 seconds of landing fuel remaining. But the guidance system only told us where the spacecraft was and how to correct its course. It provided the brain, while the propulsion system provided the brawn in the form of rocket engines, propellant tanks, valves, and plumbing. There were 50 engines on the spacecraft, smaller but much more numerous than those on the combined three stages of the Saturn that provided the launch toward the Moon. Most of them - 16 on the LM, 16 on the SM, and 12 on the CM - furnished only 100 pounds of thrust apiece; they oriented the craft in any desired direction just as an aircraft's elevators, ailerons, and rudder control pitch, roll, and yaw. Three of the engines were much larger. On the service module a 20,500- pound-thrust engine injected Apollo into lunar orbit, and later brought it back home; on the LM there was a 10,500-pound-thrust engine for descent, and a 3500 pounder for ascent. All three had to work: a failure would have stranded astronauts on the Moon or in lunar orbit. They were designed with reliability as the number one consideration. They used hypergolic propellants that burned spontaneously on contact and required no spark plugs; the propellants were pressure-fed into the thrust chamber by bottled helium, eliminating complex pumps; and the rocket nozzles were coated with an ablative material for heat protection, avoiding the need for intricate cooling systems. Three other engines could provide instant thrust at launch to get the spacecraft away from the Saturn if it should inadvertently tumble or explode. The largest of these produced 160,000 pounds of thrust, considerably more than the Redstone booster which propelled Alan Shepard on America's first manned spaceflight. (Since we never had an abort at launch, these three were never used.) There were other subsystems, each with its own intricacies of design, and, more often than not, with its share of problems. There were displays and controls, backup guidance systems, a lunar landing gear on the LM and an Earth landing system (parachutes) on the CM, and a docking system designed with the precision of a Swiss watch, yet strong enough to stop a freight car. There were also those things that fell between the subsystems: wires, tubes, plumbing, valves, switches, relays, circuit breakers, and explosive charges that started, stopped, ejected, separated, or otherwise activated various sequences. A Tragic Fire Takes Three Lives Apollo in January 1967 was adjudged almost ready for its first manned flight in Earth orbit. And then disaster. A routine test of Apollo on the launching pad at Cape Kennedy. Three astronauts - Grissom, White, and Chaffee in their spacesuits in a 100-percent oxygen environment. A tiny spark, perhaps a short circuit in the wiring. It was all over in a matter of seconds. Yet it would be 21 months before Apollo would again be ready to fly. By April 1967, when I was given the Apollo spacecraft job, an investigation board had completed most of its work. The board was not able to pinpoint the exact cause of the fire, but this only made matters worse because it meant that there were probably flaws in several areas of the spacecraft. These included the cabin environment on the launch pad, the amount of combustible material in the spacecraft, and perhaps most important, the control (or lack of control) of changes. Apollo would fly in space with a pure oxygen atmosphere at 5 psi (pounds per square inch), about one-third the pressure of the air we breathe. But on the launching pad, Apollo used pure oxygen at 16 psi, slightly above the pressure of the outside air. Now it happens that in oxygen at 5 psi things will generally burn pretty much as they do in air at normal pressures. But in 16 psi oxygen most nonmetallic materials will burn explosively; even steel can be set on fire. Mistake number one: Incredible as it may sound in hindsight, we had all been blind to this problem. In spite of all the care, all the checks and balances, all the "what happens if's," we had overlooked the hazard on the launching pad. Most nonmetallic things will burn even in air or 5 psi oxygen unless they are specially formulated or treated. Somehow, over the years of development and test, too many nonmetals had crept into Apollo. The cabin was full of velcro cloth, a sort of space-age baling wire, to help astronauts store and attach their gear and checklists. There were paper books and checklists, a special kind of plastic netting to provide more storage space, and the spacesuits themselves, made of rubber and fabric and plastic. Behind the panels there were wires with nonmetallic insulation, and switches and circuit breakers in plastic cases. There were also gobs of insulating material called RTV. (In Gordon Cooper's Mercury flight, some important electronic gear had malfunctioned because moisture condensed on its uninsulated terminals. The solution for Apollo had been to coat all electronic connections with RTV, which performed admirably as an insulator, but, as we found out later, burned in an oxygen environment.) Mistake number two: Far too much nonmetallic material had been incorporated in the construction of the spacecraft. There is an old saying that airplanes and spacecraft won't fly until the paper equals their weight. There was a time when two men named Orville and Wilbur Wright could, unaided, design and build an entire airplane, and even make its engine. But those days are long gone. When machinery gets as complex as the Apollo spacecraft, no single person can keep all of its details in his head. Paper, therefore, becomes of paramount importance: paper to record the exact configuration; paper to list every nut and bolt and tube and wire; paper to record the precise size, shape, constitution, history, and pedigree of every piece and every part. The paper tells where it was made, who made it, which batch of raw materials was used, how it was tested, and how it performed. Paper becomes particularly important when a change is made, and changes must be made whenever design, engineering, and development proceed simultaneously as they did in Apollo. There are changes to make things work, and changes to replace a component that failed in a test, and changes to ease an astronaut's workload or to make it difficult to flip the wrong switch. Mistake number three: In the rush to prepare Apollo for flight, the control of changes had not been as rigorous as it should have been, and the investigation board was unable to determine the precise detailed configuration of the spacecraft, how it was made, and what was in it at the time of the accident. Three mistakes, and perhaps more, added up to a spark, fuel for a fire, and an environment to make the fire explosive in its nature. And three fine men died. [See Wally Schirra: Wally Schirra makes sure his crew cannot be trapped.] And then the Rebuilding Began Now time was running out. The race against time began, with only 33 months remaining from April 1967 and the end of the decade. The work to be done appeared to be overwhelming and dictated 18-hour days, seven days a week. My briefcase was my office, my suitcase my home, as I moved from Houston to Downey, to Bethpage, to Cape Kennedy, and back to Houston again. At Tranquility Base, the Sun would only rise 33 more times before 1970. Rebuilding meant changes and changes meant trouble if they were not kept under perfect control. Our solution was the CCB, the Configuration Control Board. On it were some of the best engineers in the world: my two deputies, Ken Kleinknecht and Rip Bolender; Apollo's Assistant for Flight Safety, Scott Simpkinson; Max Faget, Houston's Chief Engineer; Chris Kraft, the Chief of Flight Operations; Deke Slayton, the head of the astronauts; Dale Myers for North American Rockwell; and Joe Gavin for Grumman. The Board was rounded out with Chuck Berry for medical inputs and Bill Hess for science. It was organized by my technical assistant, George Abbey, who knew everything about everybody on Apollo, and who was always able to get things done. I was its chairman and made all decisions. Arguments sometimes got pretty hot as technical alternatives were explored. In the end I would decide, usually on the spot, always explaining my decision openly and in front of those who liked it the least. To me, this was the true test of a decision to look straight into the eyes of the person most affected by it, knowing full well that months later on the morning of a flight, I would look into the eyes of the men whose lives would depend on that decision. One could not make any mistakes. When I wasn't sure of myself or when I didn't trust my judgment, I knew where to go to get help -- Bob Gilruth, my boss, who himself had been through every problem in Mercury. An extremely able engineer, Bob had acquired great wisdom over the years dealing with men and their flying machines. Bob was always there when I needed him. The CCB met every Friday, promptly at noon, and often well into the night. From June 1967 to July 1969 the Board met 90 times, considered 1697 changes and approved 1341. We dealt with changes large and small, discussed them in every technical detail, and reviewed their cost and schedule impact. Was the change really necessary? What were its effects on other parts of the machine, on computer programs, on the astronauts, and on the ground tracking systems? Was it worth the cost, how long would it take, and how much would it weigh? We redesigned the command module hatch to open out instead of in, because the old hatch had been a factor in trapping Grissom, White, and Chaffee inside their burning craft. This may sound simple, but it wasn't. An inward-opening hatch was much easier to build, because when it was closed it tended to be self-sealing since the pressure inside the spacecraft forced it shut. The opposite was true for an outward-opening hatch, which had to be much sturdier, and hence heavier, with complicated latches. We rewired the spacecraft, rerouted wire bundles, and used better insulation on the wires. We looked at every ounce of nonmetallic material, removed much of it, and concocted new materials for insulation and for pressure suits. We invented an insulating coating that would not burn, only to find that it would absorb moisture and become a conductor, so we had to invent another one. Pressure suits had to shed their nylon outer layer, to be replaced with a glass cloth; but the glass would wear away quickly, and shed fine particles which contaminated the spacecraft and caused the astronauts to itch. The solution was a coating for the glass cloth. We solved the problem of fire in the space atmosphere of 5 psi oxygen; but try as we might, we could not make the ship fireproof in the launch-pad atmosphere of 16 psi oxygen. Then Max Faget came up with an idea: Launch with an atmosphere that was 60 percent oxygen and 40 percent nitrogen, and then slowly convert to pure oxygen after orbit had been reached and the pressure was 5 psi. The 60-40 mixture was a delicate balance between medical requirements on the one hand (too much nitrogen would have caused the bends as the pressure decreased) and flammability problems on the other. It worked. Weight is a problem in the design of any flying machine. Apollo, with its many changes, was anything but an exception. Problems are always easier to solve if one can afford a little leeway for making a change, but difficult and expensive if there is no weight margin. In the command module, we found a way to gain an extra 1000 pound margin by redesigning the parachute to handle a heavier GM. This margin made other CM changes relatively simple, and certainly less costly and time consuming. For LM there was no such solution. We had to shave an ounce here, another there, to make room for the changes that had to be made. It was difficult, lengthy, and expensive. Testing and Retesting to Get Ready for Flight We tested for "sneak circuits" (inadvertent electrical paths), discovered some, and made changes. We ran a "failure mode and effects analysis" a search for all the "what happens if's" and made more changes. We tested, and retested, and changed and fixed and tested again. We set off small explosive charges inside the burning rocket engines, and to our horror found the all-important LM ascent engine was prone to catastrophic instability - a way of burning that could destroy the engine on takeoff and leave the astronauts stranded on the Moon. Much to the consternation of my bosses in Washington, we sent out new bids and selected a different contractor who built a new engine faster than anyone believed possible. But it worked. No detail was too small to consider. We asked questions, received answers, asked more questions. We woke up in the middle of the night, remembering questions we should have asked, and jotted them down so we could ask them in the morning. If we made a mistake, it was not because of any lack of candor between NASA and contractor, or between engineer and astronaut; it was only because we weren't smart enough to ask all the right questions. Every question was answered, every failure understood, every problem solved. We built mockups of the entire spacecraft, and tried to set them on fire. If they burned, we redesigned, rebuilt, and tried again. By vibration we tried to shake things apart; we tested in chambers simulating the vacuum of space, the heat of the Sun, and the cold of the lunar night. We subjected all systems to humidity and salt spray, to the noise of the booster, and the shock of a hard landing. We dropped the command module into water to simulate normal landings and on land to test for emergency landings; we plopped the lunar module on simulated lunar terrain. We over-stressed and overloaded until things broke, and if they broke too soon, we redesigned and rebuilt and tested again. The final exam came in flight. First the command module was tested with only the launch-escape tower, against the possibility of a Saturn exploding on the launch pad. Then we launched the GSM on a special booster, the Little Joe II, to see whether it would survive if the Saturn should fail in the atmosphere, when air loads are at their peak. (There is a big difference between manned and unmanned flight. If the launch vehicle should stray off course while lifting an automated payload, the range safety officer could press a button and destroy booster and payload together; in manned flight the spacecraft would first be separated from the errant booster, which would then be blown up before it wandered off, leaving the GM to be carried to safety by the launch escape tower. This separation maneuver demanded the utmost in speed and power.) The CSM, unmanned, was flown twice on the Saturn 1B (1,600,000 pounds of thrust). Then, on November 9, 1967, came the most critical test of all: Apollo 4, the first flight of the Saturn V (7,500,000 pounds), would subject the CSM to the lunar return speed of 25,000 mph. After achieving an altitude of 10,000 miles, the spacecraft's engines drove Apollo back down into the atmosphere at unprecedented speed. Temperatures on the heat shield reached 50000 F, more than half the surface temperature of the Sun. The heat shield charred as expected, but the inside of the cabin remained at a comfortable 700 F. A major milestone had been passed. [See Reentry Test: Charred but perfectly intact, the CM here had passed its most severe test of reentry at a speed of 25,000 mph.] Apollo 5 on January 22, 1968, was the first flight test of LM - an unmanned flight in Earth orbit that put the lunar module through its paces. There were problems. The computer shut down the LM's descent engine prematurely on its first burn. But then the flight controllers on the ground took over and continued the flight with an alternate mission. Now another question arose: Should we repeat this flight? Grumman felt we should; 1 disagreed. After considerable technical debate, we decided that the next flight with LM would be manned which it was, 14 months later. Apollo 6, three months after Apollo 5, was to be a simple repeat of Apollo 4, but it wasn't. The Saturn had problems, and so did the spacecraft adapter - that long conical section which joined the CSM to the booster, and which also served as LM's cocoon. (The spacecraft itself did a beautiful job.) After a fantastic piece of detective work by Don Arabian, our chief test engineer, we found a flaw in the manufacturing of the honeycomb structure of the adapter, and how to fix it. October 11, 1968. Eighteen months since that day in the pilot's lounge at Washington Airport when 1 said yes, 1 would take on Apollo. Eighteen of the greatest months an engineer could ask for. In that time 150,000 Americans had worked around the clock, dedicating their skills and their lives to forge two of the most magnificent flying machines yet devised: CSM and LM. It was a beautiful morning in Florida, just the kind of morning for another launch. This time Apollo was ready for its men.