Apollo 13 - Review Board Accident Analysis

Review Board Accident Analysis

The oxygen tank failure was caused by an unlikely chain of events, as found by the Apollo 13 Review Board investigation, based on detailed manufacturing records and logs. Tanks storing cryogens, such as liquid oxygen and liquid hydrogen, require either venting, extremely good insulation, or both, in order to avoid excessive pressure buildup due to vaporization. The Service Module oxygen tanks were so well insulated that they could safely contain supercritical hydrogen and oxygen for years. Each oxygen tank held several hundred pounds of oxygen, which was used for breathable air and the production of electricity and water. The construction of the tanks made internal inspection impossible.

The tank contained several components relevant to the accident:

• a quantity sensor;
• a fan to stir the tank contents for more accurate quantity measurements;
• a heater to vaporize liquid oxygen as needed;
• a thermostat to protect the heater;
• a temperature sensor;
• fill and drain valves and piping.

The heater and protection thermostat were originally designed for the command module's 28-volt DC bus. The specifications for the heater and thermostat were later changed to allow a 65-volt ground supply, in order to pressurize the tanks more rapidly. Beechcraft, the tank subcontractor, did not upgrade the thermostat to handle the higher voltage. The temperature sensor could not read above the highest operational temperature of the heater, which was approximately 100 °F (38 °C). This was not normally a problem because the thermostat was designed to open at 80 °F (27 °C).

The oxygen shelf carrying the oxygen tanks was originally installed in the Apollo 10 service module, but was removed to fix a potential electromagnetic interference problem. During removal, the shelf was accidentally dropped about 2 inches (5 cm) because a retaining bolt had not been removed. The tank appeared to be undamaged, but a loosely-fitting filling tube was apparently damaged, and photographs suggested that the close-out cap on the top of the tank may have hit the fuel cell shelf. The report of the Apollo 13 review board considers the probability of tank damage during this incident to be "rather low". After the tank was filled for ground testing, it could not be emptied through the normal drain line. To avoid delaying the mission by replacing the tank, the heater was connected to 65-volt ground power to boil off the oxygen. Lovell signed off on this procedure. It should have taken a few days at the thermostatic opening temperature of 80 °F (27 °C). However, when the thermostat opened, the 65-volt supply fused its contacts closed and the heater remained powered.

This raised the temperature of the heater to an estimated 1,000 °F (540 °C). A chart recorder on the heater current showed that the heater was not cycling on and off, as it should have been if the thermostat was functioning correctly, but no one noticed it at the time. Because the temperature sensor could not read higher than 100 °F (38 °C), the monitoring equipment did not register the true temperature inside the tank. The gas evaporated in hours rather than days.

The sustained high temperatures melted the Teflon insulation on the fan power supply wires and left them exposed. When the tank was refilled with oxygen, it became a bomb waiting to go off. During the "cryo stir" procedure, fan power passed through the bare wires which apparently shorted, producing sparks and igniting the Teflon. This in turn boiled liquid oxygen faster than the tank vent could remove it.

The other oxygen tank or its piping, located near the failed tank, was damaged, allowing it to leak also. Design fixes included moving the tanks farther apart, and removing the stirring fans. This required adding a third tank, so that no tank would go below half full. An emergency battery was also added to another sector in the service module.

In June 1970, the Cortright Report provided an in-depth analysis of the mission in an extremely detailed five-chapter report with eight appendices. It showed a copy of established NASA procedures for alleviating high pressure in a cryogenic oxygen tank, to include:

• Turning the four tank heaters and fans off;
• Pulling the two heater circuit breakers to open to remove the energy source;
• Performing a 2-minute purge, or directly opening the O₂ valve.

This procedure was designed to prevent hardware failure so that the lunar landing mission could be continued. However, the EECOM Mission Report (on pg E-10) recounts how the master caution and warning alarm had been turned off for a previous low-pressure reading on hydrogen tank 2, and so it did not trigger to call attention to the high oxygen pressure reading.

Oxygen tank 2 was not the only pressure vessel that failed during this mission. Prior to the accident, the crew had moved the scheduled entry into the Lunar Module forward by three hours. This was done to get an earlier look at the pressure reading of the supercritical helium (SHe) tank in the LM descent stage, which had been suspect since before launch. After the abort decision, the helium pressure continued to rise and Mission Control predicted the time that the burst disc would rupture. The helium tank burst disc ruptured at 108:54, after the lunar flyby. The expulsion reversed the direction of the passive thermal control (PTC) roll (nicknamed the "barbecue roll").

While the investigation board did recreate the oxygen tank failure, it did not report on any experiments that would show how effective the Cryogenic Malfunctions Procedures were to prevent the system failure by de-energizing the electrical heater and fan circuits.