Apollo Experience Report Safety Activities

8/8/2019 Apollo Experience Report Safety Activities

http://slidepdf.com/reader/full/apollo-experience-report-safety-activities 1/18

N A S A T E C H N IC A L N O T E k$

APOLLO EXPERIENCE REPORT -

SAFETY ACTIVITIES

Chdrles Ne Rice

Lyndon Be Johnson Space Center

Hotcston, Texas 77058

N A T I O N A L A E R O N A U T I C S A N D S PA CE A D M I N I S T R A T I O N W A S H I N G T O N , D. C. A P R I L 1 9 7 5



1. Report No.

N A S A TN D-7950

APOLLO EXPERIENCEREPORTSAFETY ACTIVITIES

2. Government Accession No. 3. Recipient's Catalog No.

JSC-05864

4. Tit le and Subtit le 5. ReDOrt Date

11 . Contract or Grant No.Lyndon B. Johnson Space Center

Houston, Texas 77058

13 . Type of Report and Period Covered

7. Au tho r l s )

Charles N. Rice

9. Performing Organization Name and Address

2. Sponsoring Agency Name anti Address

National Aeronautics and Space Administration

Washington, D.C. 20546

8. Performing Organization Report No,

JSC S-422

10. Work Uni t No.

039-00-00-00-72

14. Sponsoring Agency Code

7. Key Words (Suggested by Author(s1)' Flight Safety' Safety Management ne ss Prog ram

* Hazards E ~ Adetv A~~~~~~~~~

Manned Flight Aware-

I5. Supplementary Notes

18. Dist r ibut ion Statement

STAR Subject Category:

12 (Astronautics, General)

6. Abstract

This paper desc ribe s the flight safety experiences gained during the Apollo Progr am and dis-

cu ss es safety fro m the viewpoint of pr ogr am management, engineering, missio n planning, andground test operations. Emphasis is placed on the methods used to identify the r is ks involved

in flight and in certa in ground test operations; in addition, ther e a re discussions on the manage-ment and engineering activities used to eliminate or r educe the se r is ks .

9. Security Classif. (of th is report ) 20. Security Classif. (o f this page)

Unclassified Unclassified

21. NO. of Pages 22 . Price'

18 $3.25

' Trade-off Studies' Mission Risk Assessme nt

'For sale by the Nation al Technical Information Service, Springfield, Virginia 22151



CONTENTS

Section Page

SUMMARY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

INTRGDUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .THE MSC SAFETY OFFICE ACTIVITIES . . . . . . . . . . . . . . . . . . . .

Evolution of S ystems Safety Discipline . . . . . . . . . . . . . . . . . . . .

Hazardous and Critica l Tes ts . . . . . . . . . . . . . . . . . . . . . . . . . .

System Safety Ass ess ment s . . . . . . . . . . . . . . . . . . . . . . . . . .

Mission Risk Assessme nt . . . . . . . . . . . . . . . . . . . . . . . . . . .

Mission Monitoring and Postflight Evaluation . . . . . . . . . . . . . . . . .

1

3

3

4

Audits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Motivational Pro gr am s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Special Studies and Assess ment s . . . . . . . . . . . . . . . . . . . . . . . . 7

CONCLUDING REMARKS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

APPENDIX- POLLO 16 MISSION RISK ASSESSMENT

EXCERPTS AND SUMMARIES . . . . . . . . . . . . . . . . . 11

iii



APOLLO EXPERIENCE REPORT

SAFETY ACT IV IT I ES

By C h a r l e s N . R ic eLyndon B. J o h n s o n S pace C e n t e r

S U M M A R Y

The s uc ce ss of th e United States manned space-flight pro gra m has been, to agre at extent, a direct re su lt of th e emphasi s placed on safety by NASA management .

Th e reor ganiz at ion of the NASA Lyndon B. Johnson Space Center ( fo rme rly the MannedSpacecraft Center) safety efforts aft er the Apollo spacec raft 204 fire was necessary

for a concerte d safet y effort. A l l the relevant safety activities wer e coordinated

through a single office and resu lted i n a stro ng, centralized approach to cre w and

miss ion safety. The establis hment of a form al documented hazard analysis f or each

miss ion was effective in identifying significant hazard s and ass ur ing sa tisf acto ry

resoluti on of haz ard s at an appr opri ate high level in the Lyndon B. Johnson Space

Cent er organization.

A safety pr ogr am re qui res a n adequate complement of qualified engi neer s, afree hand to conduct independent ass es sm en ts , and the full support of top management.

With th ese ingredien ts, an effective safety prog ram is assured.

The Manned Flight Awaren ess Pr og ra m introduced ea rly i n the Apollo Pr og ra m

was a motivational p rog ram to achieve a high level of sa fety , r eli abi lit y, and quality

consciou sness of all program participants. Its success w a s greatly enhanced by

astronau t participation.

INTRODUCTION

The s uc ce ss of t he United States manned space-flight pr ogr am ha s been, to agrea t extent, a di re ct r es ul t of the emph asi s placed on safety by NASA management.

The basic safety objective has been to identify hazard s and to ensu re that thes e haz ard sar e ei ther el iminated or redu ced to an acceptable level. With the exceptions of the

Apollo s pac ecr aft (SC) 204 f i re and perh aps the Apollo 13 miss ion, the haz ar ds had

been adequately identified and pro perly resolved. Throughout the series of manned

space-fl ight pr og ra ms (Mer cury , Gemini, and Apollo), the safety of the crew was

given pr im ar y consideration during hardware design, manufacturing, testing, mission

planning, and flight oper atio ns.



The purpose of thi s paper is to summarize the safety-oriented activities of

per son nel at the NASA Lyndon B. Johnson Space Cente r (JSC) (fo rme rly the Manned

Spacecraft Center (MSC)) and a t major con tra cto r plant si te s. Although everyone isexpected to be safety conscious, som e things that are inherently unsafe under certain

conditions are not easi ly recognized. The identification of ha za rd s re qu ir es adedicated and conscious ef fort by appropriate ly train ed safety personnel who pos se ss

the e xperience and capability to prop erly assess the r is ks throughout all phases of

the manned pro gra m and to take approp riate action to eliminate or reduce the risk sto an acceptable lev el.

During Project Mercury, the Gemini Program, and the early st ag es of the

Apollo Program, a Flight Safety Gffice at MSC rep or te d to the Cen ter Dire cto r. The

function of this office w a s to coordinate the overal l safety ef fort at NASA and themajor contr actor s. It had a sma ll staff and acted in an advisory capacity to each

prog ram office. Throughout Proj ect Mer cury and the Gemini Pr og ra m, ‘crew safety

and mission safety activi ties wer e car ri ed out by the Flight Safety Office, the respon-sibl e program offices, and the engineering and ot her support grou ps a t both NASA

cen ter s and major contra ctors . This method worked well because the groups wer e

sm al l enough for the individuals to maintain good communications, we re pers onally

known to each ot he r, and had a broad view of the req ui rement s so that the safetyefforts were we l l integrated.

A s the Apollo Pr ogr am p rogre ssed f rom design definition to hardware fab rica-

tion, substantial numbe rs of new personnel we re added to the prog ra m, numer ous

reas sign ments of personnel wer e made, and functional r eorg aniza tions we re imple-

mented over a period of months. Coupled with th ese changes, the ha rd ware tes tin g

phas es brought added activity, and the resolution of t es t hardwa re failu res abso rbed

mo re and mo re time. During this period, the si ze and technical makeup of the FlightSafety Office did not grow sufficiently to ma int ain visibility into the rapidly expanding

Apollo Spacecraft Pro gra m hard ware and procedure s activi ties. A l l the above

res ult ed in so me lo ss of communication and visibility between the Flight Safety Officeand the engineering and te st o perational elemen ts.

After the Apollo SC-204 fire, one of the organizational changes made a t MSC

grouped mos t of t he Cente r safety organizations into the Flight Safety Office repor tin g

direc tly to the Center Director . Another change wa s the cre ati on of a staff position

in t he Apollo Spacecra ft Pro gr am Office (ASPO) as the MSC point of contact with the

Apollo Systems Safety Office at NASA Head quart ers. Th is staff position, cal led the

ASPO Assistant Pr og ra m Manager for Fligh t Safety, was a position desi gned to

expedite implementation of the MSC Flight Safety Office po li ci es and procedures .

Thi s provided a good opportunity to int eg ra te the ef for ts of the MSC Flight Safety

Office and the ASPO flight safety activiti es. The ar rang em ent worked ve ry well by

opening up the communications channels between the var ious groups working differentaspe cts of flightcrew and mission safety. At the sa me time, sev era l reliability and

quality assur ance element s at MSC we re a ls o combined into a single office re porti ng

directly to the Center Direc tor. Although these change s in the reliability and qualityassurance (R&QA) organiza tions did not directl y affec t the Flight Safety Offi ce, they

2



had the indir ect effect of making avai labl e, on a day-to-day basis, data and information

that we re essen tial to Flight Safety Office personnel in perf ormi ng the ir ta sks . This

inte rcha nge and coordination wa s aided by placing both org anizati ons unde r the direc-

tion of one person.

A fu rt he r enhancement of th e MSC Flight Safety Office capabi liti es occ ur redin la te 1967 when additional support (con trac t) manpower wa s mad e availa ble to the

Flight Safety Office; this suppor t consiste d of experienced engi neer s train ed in

safety techniques and proce dures . The local MSC group wa s pa rt of a larg er contract

coverin g engine erin g and safety a t MSC, NASA Hea dquar ter s, and the oth er NASA

ce nt er s involved in the manned space-flight effort; thus, a lar ge res erv oir of experi-

enced enginee ring talent was available to provide assi stan ce when required . These

changes , both organiza tional and personn el, wer e sufficient to ree sta bl ish a planned,

orderly, and coordinated approach to crew and miss ion safety.

THE MSC SAFETY OFFICE ACTIVIT IES

E v o l u t i o n o f S y s t e m s Sa fe ty D i s c i p l i n e

Under the new org aniz atio n previously describ ed, the MSC Safety Office activi-

tie s wer e defined as follows.

1. To examine all pha ses of each mission fo r hazar ds ( i .e . , flight plans, cre wproc edur es, mission rul es, design changes, contingency plan s, training, etc. )

2 . To examine all miss ion -rel ated ground act ivit ies that involved the flightc rews

and backup crews for hazards (i.e. , extravehicular-activity (EVA) pro ced ure s, cr ew

training , ground te st and checkout, simulate d flight te st s, vacuum cha mber tes ts ,recovery training, etc. )

3 . To a ssu re that hazar ds identified in items (1)and (2 ) were appropriatelyreso lve d fo r fut ure mission s and ground operati ons (Resolution of h aza rds was to

be accompli shed through nor mal channels used to implement th e Apollo Spacecraft

Program. )

A s a par t of the foregoing effort, the safety offices of th e major c on tra cto rs

we re strength ened to en su re the pro pe r integration of th eir own and thei r subcon-

tra cto rs' safety efforts. The MSC did not r equire that the s ubcontrac tors institute

a dedicat ed safety office; it was consid ered that the responsib ility for safety should

rest with the majo r co nt rac to rs who would eventually re ce ive the hard ware/sof tware

fr om the subcontractors . In this manner, the major cont ract ors maintained an

ove ral l safe ty effort' with th eir own safety staffs. The approac h proved acceptable.

Th e Safety Office personnel conducted th eir d utie s by a ctiv e participatio n i n

design review s, test proce dure reviews , and the development of crew proce dures.

A s safety iss ue s were identified, they wer e resolved immediately o r were presented

3



to the ASPO for resolution at scheduled meetings and milestone revi ews . Typical

reviews that safety personnel participated in a r e as follows:

1. Configuration Control Board

2. Configuration Control Panel

3 . Pre lim ina ry Design Review

4. Critical Design Review

5 . Design Certification Review

6. Cust omer Acceptance Readine ss Review

7. Flight Readiness Review

8. Crew Pr oced ures Change Board

9 . Mission Rules Review

10. Launch Readiness Review

The ASPO and the MSC dir ec tor ate s involved in the Apollo Spacecra ft Pr og ra m

provided adequate for um s fo r for ma l discus sio n by the MSC Safety Office of any

haz ard s that requ ired attention. This management visibility in depth, op erating in

an atmosphere that encouraged personnel with p roblems to come fo rth and be hea rd,

was a major contributing fac tor in enhancing the safety of t he Apollo mis sio ns . In

addition to these meetings and milestone reviews, the MSC Safety Office presented

form al analyses and asse ssm ent s of sys tem s safety and mission r is ks to the ASPOand to the Center Di rect or a t each missi on Flight Readine ss Review. At that time ,

the Mission Hazard Analysis (refer to the appendix), which identified safety concerns

as well as the rationale for acceptance of the ri sk s, was documented for t he Flight

Readiness Review Board.

H a z a rd o u s a n d C r i t i c a l Tes t s

The MSC flight safety eng inee rs part icip ated with tea ms composed of spe cia lis ts

fr om varying discipli nes in reviewing the development and installat ion of fac ili tie s,test procedures, and special safety procedures to support hazardous test activities

at MSC. Chief among the se we re the therma l-vacuu m te st s conducted i n the Space

Environment Simulation Laboratory in which manned spacecraft modules were

subjecte d to simulated space environments in vacuum cha mbe rs. Safety personn el

were concerned with the safety of tes t personnel and te st subj ects . They ass ess ed and

evaluated the safety of th e cha mbe rs including the asso cia ted plumbing, wiring, evac-

uation syst ems, environmental control sys tem s, and p r e s s w e ves sel s. Detailed and

thorough operational re adin ess inspections and tes t r ead ine ss review s were conducted

4



befor e comm ence ment of manned te st s. Safety pers onne l had key ro les in these tasksand in the development of safety pa ra me te rs and the ir l im it s fo r use i n manned testing.

Certified test safety officers participated in the manned te st s to e nsur e adherence to

these established param eter s and limits.

System Sa fe ty Assessments

System safety ass ess men ts consisting of hazard analy ses and special safety

stu dies of Apollo cont ractor-f urni shed equipment, Government-furnished equipment,

ground support equipment, and experiments were performed. These asse ssm ent s we re

accomplish ed by (1)anal yses of ground support equipment to d ete rmi ne int erf ace s with

flight hardw are that could adver sely affect crew safety; (2 ) per for man ce of detailedevaluations i n those design and operational ar ea s shown to exhibit r is k potential;

( 3 ) performance of o r particip ation in hazard trade-off stud ies of des igns , operation al

proc edur es, and mission concepts; and ( 4 ) detailed analys es of those propose d changes

to subsystems, operational procedures , plans, ru les , and activities considered to

have safety impa ct.

To aid in the safety ana lysi s of extremely complex sys te ms , "fault-tree"

analyses were conducted. Thes e wer e logic diagrams that repre sent ed the mechanical,electrical, and/or chemical interfaci ng points between subs yste ms. The anal yses

were a valuable tool in identifying potential hazar ds.

In the Apollo Pro gr am , hazard analy ses were per formed for man/machine

inte rfac e to isolate crew safety concerns. Trade-off studies and engineering assess-ments for compliance with s yste m safety crite ria were performed relating to crewsafety, op erational personn el safe ty, and syst em safety. Trade-off stud ies werealso perf ormed f or specific hardware and operational areas, so that the relative cre w

ri sk s for any of se ve ra l alte rnat ive solutions might be compared.

Operational safety as ses sme nts were performed on crew procedure changes,

flight plans, mission rule s, crew checklists , and crew training to ensu re adequacy

and compatibility of c re w proce dur es and flight oper ations for each Apollo missi on.

Hazardou s proc edur es we re identified and recommendations we re mad e to reduc e the

r i sk by modification of the existing proce dur es . The review of oper ational ta sk s

res ult ed in proc edur e change requ est s, special studi es of potential oper ational con-

ce rn s , safe ty evaluation of mis sio n operations, and documentation of crew and mis sio n

operational hazards.

Safety evaluations of flight hard war e consist ed of (1)as se ss me nt of the config-

uration.dif ferences between vehicles to determine whether sys tem o r subsystem

changes had introduce d any new h az ar ds into the vehicle; ( 2 ) review of waivers ordeviations of specific ations in manufacturing, te st , or checkout procedures; and

( 3 ) sneak ci rcui t analy ses (SCA) of wiring syst ems to detect potential haza rds fr om

wiring o r elec tric al syste m incompatibilities. A sneak circ uit is a latent elect rical

path that ca n cau se a n unwanted function to occur or inhibit a desired function without

re ga rd to component failu res . The SCA was fi rs t us ed on the Apollo 7 spacecraft and

was performed fo r all subsequent spacec raft of th e Apollo Progr am , both the LM and

the CSM.

5



Mission R i s k Assessment

Concurrent with the effo rt to provide s yst em safety as se ss me nt s, each individual

mission was analyzed as an integral unit i n an effort to isolate and assess r i sks to

mission operations and crew safety. Once a hazar d was identified and evaluated, i t

was brought to the attention of p rogr am management. It was then tr acke d throughout

the mission preparation period until cor rec ted by a n engineering or procedural change(usually a decisio n of the Configuration Change Board or Panel) or approved by the

Safety Office and the ASPO as an acceptable ris k.

Peri odic meetings we re held with the safety personnel of th e major con tra cto rs

to dis cuss and evaluate ha rdwa re and operational prob lems t hat might have potential

crew safety impact. The repo rts emanating from these meetings provided an

up-to-date sta tus of safety conc erns under evaluation and of safety is su es to be

resolved. A safety concern was a specific hazard r equiring positive action to c orr ect ;

a safety issue w a s a potential haz ar d, the implic ations of which had not been completely

resolved. The status report was forwarded to the ASPO and to the R&QA organiza tions

which, in periodic meetings with safety pers onne l, considered eac h safety conce rn fo r

proper resolution.

A mission ris k ass ess men t was performed for each Apollo mission to providea final and definitive evaluation of resid ual ha zar ds and ri sk s affecting the cre w.

The mission ris k ass ess men t supported the Flight Readiness Review at MSC. Thisrep ort highlighted the mor e significant crew safety r is ks as se ss ed during the miss ion

buildup period, the re su lt s of an alyse s of t hese r is ks , and supporting rational e fo r

acceptance of residual hazards, where appropriate. A port ion of th e Apollo 16Mission Risk Asse ssmen t is included in the appendix.

Mission Monitoring and Postflight Eva1uation

The work des cribed in previous p aragr aphs dealt with preflight safety activit ies.

However, the respons ibi lit y of the MSC Safety Office did not end with the launch of an

Apollo miss ion. Mission monitoring support wa s provided to enable real -t im e safety

engineering support in the ass es sm en t and evaluation of missi on dis crepa ncies and

identification of haza rdous tr en ds that might have a potential impac t on cre w safety

or missio n su cces s. Continuous monitoring of flight ha rd wa re and the flightcrew madeposs ible the identification of real or potential safety haz ard s. Recommendations fo r

the resolution or elimination of the se hazards were routed through the Spacecra ft

Analysis Network (SPAN) fo r veri fica tion by the approp ria te subs yst em monitor, and

to the Mission Control Cente r fo r final approval and implementation by the FlightDirector.

The Safety Office fu rt he r part icipated in the postflight rev iew of f ai lu re s and

anomalies associated with syst em performance or cre w proce dure s that had safety

implications on succeeding missio ns. Any suc h fa il ure o r anomaly was examined atthe appropriate contractor's plant to make a determination of the actual cause. When

such a determination was made, the suspect pa rt o r procedure f or ea ch succeedingmissi on was reevaluated, redesigned, rete sted, rewr itten , o r eliminated.

6



A u d i t s

To en sur e that the safety requi remen ts were being met and that continued empha-

sis w a s being placed on system safety by all participants, periodic audits were per-

fo rm ed by the MSC Safety Office at maj or con trac tor production, ass embly, checkout,

and tes t facilities. The contract ors were required to develop syst em safety checkliststhat detailed those ste ps introduced in their facilities to en sure adherence to the safety

requirements. The checklists were used by MSC Safety Office personnel at the con-

tra cto r facil ities to provide on-the-spot assurance that the requirements were actively

implemented.

M o t i v a t i o n a l Prog r a m s

To achieve a high leve l of saf ety, reli abil ity, and quality consciousness in allprogr am participants, i t became evident that a singular motivational progr am w a srequ ired . People tend to think of s a f e t y , reliability, and quality as abstract terms;

the problem w a s to make that abstrac tion rea l, tangible, and rela table and then tokeep the awaren ess of these important functions as an active effort constantly before

them.

The Manned Flight Awareness P ro gr am was introduced ea rly i n the Apollo Pro -

gram to fill th is need. The cooperation of a popular cartoonist w a s solicited to makehis comic beagle "Snoopy" (from the cartoon st ri p "Peanuts") the principal spokes-

man for the progr am. Motivational pos ter s featuring Snoopy in spa ce togs were soonin evidence wherever people wer e at wo r k on the Apollo Pr og ra m. The Snoopy

mes sag es constantly emphasized the need fo r c ar e and attention to detail.

The astr onau ts contributed to the succ ess of th e pro gra m. They attended

functions at each of the space-flight c ent ers , honoring contrib utor s to the progr amby presen ting Snoopy pin awards. Apollo crewmen toured the fac ili tie s of the major

con tra cto rs to meet th e work ers who were building and testing the Apollo missio n

hardware.

S p e c ia l S t u d i e s a n d A s s e s s m e n t s

A s the Apollo Pr og ra m matured and progr essed , missi ons became longer and

mo re complex. The NASA began to take optimum advantage of lunar su rface explo-

and se rv ic e module (CSM) lunar orb its by incor poration of experiment har dwar e in a

bay of the s er vi ce module. Each element of growth contained potential crew haza rd s,and each w a s the subject of a special safety asses sme nt by the MSC Safety Office.

The principal special a sse ssm ent s a re discussed in the following paragraphs.

rat ion through the us e of more soph isticated expe rimen ts packages and of t he command

Extravehicular activiti es. - The Apollo Program included a wide variety of EVA'S

beginning with Apollo 9 when the lunar module ( LM ) pilot first stepped out of the LMwhile in Earth orbit. The first Apollo EVA safety ass ess men t (conducted before the

mission) resulted i n a listi ng of 10 criticality 1 hazards, each of which had to be

analyzed to determi ne i t s probability of occu rrenc e. Each potential haza rd w a s

7



finally deemed improbable a fte r a lengthy rationale was prepa red , which reinf orced

confidence in the har dwa re des ign and test ing. None of the following 10 potentially

hazardous events occurred.

1. Ventricular fibri llation in the LM pilot could occu r.

2 . Collision with the spacecraft might rupture the p re ss ur e garment assembly(PGA).

3 . The EVA astr onaut might lose contact with and attachment to the s pace craf t,

4. The EVA ast ron aut might have a failed portable life-s upport system/oxygen

purge system (PLSS/OPS).

5. Undetected carbon monoxide might be pre sen t in the EVA astron aut PGA.

6. The open fa il ure of the oxygen pur ge s ys te m (OPS) might ca use a rupture inthe PGA .

7 . The EVA astr onau t res cu e capability might not be immediately available.

8. The OPS redundancy might be lost .

9 . Degradat ion of the OPS would leave only marg inal contingency EVA capability.

10. Loss of the LM attitude contro l might ren de r th e LM unstable and would make

recovery difficult.

In a sim ila r manner, the firs t lunar surfa ce EVA on Apollo 11w a s analyzed before

the missio n, and this a naly sis isolated the following 11 potentially haza rdou s ar ea s of

conc ern. The Safety Office pre par ed recommendat ions fo r the elimination or reduc-tion of these potential haza rds and forwarded them to the approp riate organizat ions

fo r consideration. Most of the recommendation s we re accepted.

1. Pyrophoric r eact ion of lu nar mat eri al with the LM oxygen atmos pher emight occur.

2 . A rup tur e of the lunar contingency sam ple con tainer might occ ur in the cabin.

3 . Damage to the ext ravehicu lar mobility unit (EMU) might o ccu r if a crewmanwere to fall on the lunar surface.

4. Crewmen might be unable to detect the pr es ence of sinkholes, deep dustpits, or subsurface faults.

5. Because of scrat ching o r tearing on spacecra ft protuberances , a compromise

of the EMU pressure, thermal , or radiation integrity might occur.

8



6. Inability of the crew men to obtain adequate footing on the plus-Z footpad

could be cause d by dus t o r debris acquired at landing.

7. Inability to deter mine the tem per atu re of tools , equipment, et cetera, couldre sul t i n damage to the EMU upon touch.

8. A fallen crewman might be unable t o recover and r etu rn to the LM befo rethe lo s s of EMU consuma bles .

9. Crewmen ing res s or egr ess could be difficult when the plus- Z footpad is not

in contact with the lunar surface.

10. Deployed televi sion cam er a cable and S-band antenna cabl es could pose atripping ha zard to crew men.

11. The crewman inside the LM might be unable to obse rve the e gres sing

crewman.

Apollo lunar surface experiments. - Apollo 11 car r ied a comparatively simple

package of sc ientific har dwa re fo r deployment on the luna r sur face . The se experi-

ments, however, had so me inherent potential hazards that wer e asse sse d before the

flight. Of majo r con cern was the fuel capsule for the radioisotopic ther moel ectr ic

gene rato r used to supply power to the Apollo lunar s urf ace ex peri ment s package.

Th e ca psule us ed plutonium-238 as its isotope, and the. inadver tent re le as e of th isradioactive substance was a matt er of gre at concern. The capsule was subjected to

analy sis by the Safety Office and rep res en tat ive s of th e Atomic Energy Commissio n

who concluded that the dev ice wa s safe to u se when used according to the pre scri bed

procedures. To illus trat e the thoroughness of this assessment, consideration was

given to the possibility that the fuel capsule might be ret urne d to the Ear th atmo sphe re

in the event of a mission abort. The analysis concluded that the capsule, as designed,was adequate to survi ve reen try and would r ele ase no radioactivity. This conclusion

proved c or re ct when the Apollo 13 mission ab orted and the LM (which had ser ved asa "lifeboat" fo r the as tr on au ts when the CSM w a s partly disabled) reentered theEarth atmosphere and broke up over the Pacifi c Ocean. The fuel capsule was st ill

on board and, a s predict ed by the prefligh t analysis , did not contaminate th e atmos-

pher e with radioactive mater ial.

Other significant studies. - Other significant s tud ies made between 1969 and 1972

included a sy st em safety engineering hazar d analy sis of the LM pyrotech nics and the

CSM launch vehicle se para tion pyrotech nics (Feb. 1969), a LM-6 c rit ica l switch study

brea ker review (Sept. 1969), a study of cre w dist ract ions during cri tic al miss ion

phases (Feb. 1970), a sys tem safety a ss ess men t of the Apollo 12 ano malie s and of

the fail ure mech anism durin g the initial boost phase (F eb. 1970), a study of the acti ve

sei smi c experi ment (Aug. 1970), a study of the CSM re tu rn enhancement prov isio ns

(Sept. 1969), a CSM circ uit bre ake r accessi bility study (Sept. 1969), a LM circuit

(Dec. 1970), and a study of the lunar se ismi c profiling ex periment (Dec. 1972).

9



C O N C L U D I N G R E M A R K S

The succ es s of the United Sta tes manned space-flight pro gr am ha s been, to agre at extent, a dire ct r es ul t of the em pha sis placed on safety by the management ofthe NASA Lyndon B. Johnson Space Cent er (f orme rly the Manned Spacecr aft Cente r).

The basic safety objective ha s been to identify haza rds and to en su re that thes ehazards a r e either eliminated o r reduced to an acceptab le level. With the exceptionof the Apollo sp ac ec ra ft 204 f i re and perh aps th e Apollo 13 ab ort , the haz ard s have

been adequately identified and properly resolved.

The reor gan izat ion of th e NASA Headq uarte rs and Lyndon B. Johnson Space Cen ter

safety efforts after the spacec raft 204 fire was ne cess ary for the complex and ex-

panded effor ts of th e Apollo Pr og ra m. A gre atl y enhanced Safety Office visibility and

comprehension of day-to-day safety sta tus res ulte d in the re esta blis hmen t of a satis-fact ory approach to cre w and miss ion safety. The fundamental change i n organiza tion

that proved mo st effective was g athering the safe ty efforts under a sing le office that

reported to the Center Director .

The establishment of forma lly documented h azard analyses fo r each mission was

effective in identifying all significant haza rds and ass urin g a satisfactory resolution

of haza rds a t an appropriate ly high level in the cen ter organization.

A safety progr am re qu ir es an adequate complement of qualified safety eng inee rs,a free hand to make independent ass es sm en ts , and the full support of management.

With these ingredie nts, an effective safety pro gra m is assured.

The Manned Flight Awareness Program, introduced early in the Apollo P ro gr am ,

w a s a motivational tool used to achieve a high leve l of sa fety , r eli abi lit y, and quality

consciousness in all prog ram participan ts. Its suc ces s was greatly enhanced by

astronau t participation.

Lyndon B. Johnson Space Center

National Aeronaut ics and Space Administratio n

Houston, Texas, November 14 , 1974039-00-00-00-72

10



A P P E N D IX

APOLLO 16 M I S S I O N R I S K AS SE SS ME NT

EXCERPTS AND SUMMARIES

The following pages have been extr acte d as typical ex amples of the Apollo 16

Mission Assessment Report.

"1.2 PURPOSE

The purpose of th is asse ssme nt is to define and evaluate the

ri s ks asso ciat ed with the Apollo 16 flight and lunar surface

acti viti es, to provide justification for discounting or accept-

ing these ris ks , and to present an overall picture of the

mission relativ e to crew safety.

"1.3 SCOPE

"1.4

Th is document is limited to the presenta tion of the as se ss -

ment of the Apollo 16 miss ion as rela ted to flight crew safetyfr om lift-off through eart h landing. The as ses sme nt included

anal ysis of each mission phase, including proc edu res, con-

figurati ons, and potential impact of pre viously -observ ed

anomalie s on flight crew safety. Thi s document applies to

the MSC Flight Readiness comm itme nts. Subsequent anom-

alies are evaluated on a day-to-day bas is up to the launch timeand a r e incorporated into this document as required.

CONCLUSIONS

1. 4. 1 The new ri sk s introduced into the Apollo 16 mission a r e

acceptable and provide no flight con stra ints .

1 . 4 . 2 Asse ssme nt of the planned lunar surf ace activ itie s, includ-

ing the longer EVA'S, longer tr av er se s, and delta lunar

surf ace experiments ha s uncovered no safety concerns

which preclude the lunar activities o r any planned lunarsurf ace experiments. Improvement in the active seismic

experimen t fr om Apollo 14 has incr ease d the safety margin

for Apollo 16.

1.4 .3 Asse ssme nt of the rendezvous technique changes which a r e

inc orp ora ted fo r Apollo 16 indi cate they should minimize

controllable e r r o r s in the rendezvous calculations, thus

improving overall mission su cce ss and crew safety.

11



1.4.4 Boom retr ac ti on modification of adding.proximity switch es

ha s inc rea sed safety by .enabling determina tion if booms

are sufficiently re tr ac te d before an SPS burn. (See note 1below. )

1

21.4 .5 Planned CM in-flight demonstra tions have been as se ss ed

fo r concerns rela ted to crew safety, and no constraining

safety con cern s we re identified. (See note 2 below.)

The mass spec trometer and gamma ray spectromete r

expe rime nts we re extended fr om the SM Scientific Inst ru-

mentation Module by retractable booms. It is cri t ical to

have ass uran ce that the se booms are properly retract ed

before attemp ting an SPS burn; an unretra cted boom could

conceivably wra p around the SPS nozzle extension. Pro x-

imity switches we re added on Apollo 16 to provide the c rew

positive assu ranc e of boom re trac tion prio r to the SPS

bur n. In addition, a boom jettison capability was added.

Note 1.

3

Note 2. During tr an se ar th coa st, Apollo 16 cre w conducted the

following inflight demons trat ions , each requ irin g experi-

ment h ardware and proce dure s which wer e subjected to

safety analysis :

(1 ) ALFMED (Apollo Light Flash Moving EmulsionDetector)

(2 ) MEED (Microbial Ecology Evaluation)

(3) Elec trop hor esis In- Flight Demonstr ation

(4) Biostack Experiment (M 211)

1.4.6 Safety as se ss me nt s of an omal ies occurri ng during manned

environmental tests, prev ious flights, and vehicle ground

tests have disclosed no significant safety concerns.

"1.5 RECOMMENDATIONS

None.

'Service propulsion system.2

3Service module.

Command module.

12



??1 .6 SAFETY STATEMENT APOLLO 16 MISSION

The Safety Offi ce as sess me nt of the planned Apollo 16

mission, spacecraft functions, and hardware fail ures dis-

clos ed no safety c once rns which cons trai n the Apollo 16flight scheduled fo r April 16, 1972. The as se ss me nt isbase d on safety anal yses perf ormed i n coordination withand obtained fr om the Pr og ra m Office, E&D, FOD, FCOD,

MR&OD, SR&QA,4

and the hardware contr acto rs. ''

Section 2 . 0 provided a discussio n of all constraining and nonconstrainingsafety concerns evaluated during the mission assessme nt. These concerns wer e

ass ess ed fo r cre w safety during the period leading to the preparation of the rep ort

and we re published in the MSC Safety Conce rns document, re leas ed biweekly. Th e

informatio n included the issu e, action, and status of e ach concern. The following listenu mer ate s the con cern s contained in the Apollo 16 Mission As sess ment Report.

1. Range/range-rate meter glas s shattered

2. Command and se rv ic e module (CSM) crit ical ity 1 switches

3. Gyro-display coupler al ine function

4. Scra tched Lexan window shade

5 . Loose object in the cabin fan

6. Unexplained pr es su re incr eas e in the CSM tunnel

7. Broken bact eria filt er on water gun

8 . Main oxygen regul ator fa ilu re

9. Pr em at ur e deployment of main parachute

10. Fa il ur e of docking rin g to sev er

11. Extravehicular glove wear

12. Command module (CM) rea cti on control sy st em (RCS) fuel tank

excessive delta pre ssu re

13. Par ach ute reefing-line cutter

Engineer ing and Development Directorate; Flight Operations Di rect orat e;

Flight Cr ew Operations Directorate ; Medical Research and Operations Directorate ;

and Safety, Reliability, and Quality Assur anc e Office.

13



14.

15 .

16.

17.

18 .

19.

20.

21.

22.

Ent ry monitor sub sys tem "thrust on" light

Pr es su re garmen t assembly qualification tes t failure

Suited or unsuited sci entific instru ment module door jettison

The CM RCS oxid izer tank bladder overpressure

Impact te st failu re of helmet

CSM- 113 propellant utilization and gaging system anomaly

Trapped CM RCS propellant o ve rp re ss ur e

Circuit breake r mechanical latch problem

Earth landing syste m main parachute fail ure

The following information is contained in the repo rt covering ite m 22, whichill ust rat es the depth at which each ite m ( 1 to 22) was considered.

"Issue - The c rew verified and photographic coverage confirmed that one

main parachute coll apsed at an alti tude of 6,000 feet du ring the Apollo 15missi on. Four of the si x nylon risers had rele ased their suspension-line

load. Loss of one main parachute exposed the crew to higher, but acceptab le,loads; however, failu re of mo re than one para chute could re su lt in cre w los s.

"Action - An NR investigation and ana lys is revea led the caus e of main pa ra -

chute collapse not to be forwa rd heat s hield , the suspension links, or the steel

risers being pulled fr om the flower pot. The most probab le ca us e of the

anomaly w as th e burning r a w fuel (monomethylhydrazine) being expelled duringlater portions of the depletion firin g. Thi s resu lte d in the exceeding of th e

parachute-riser and suspension-line temperature limits. Corrective action

taken has been to change the mode 1A abort t imer to 6 1 seconds, to design

and qualify new connection li nk s made of Inconel 718, to load propellants toachieve a slightly oxidizer-rich mixture for a possible depletion-burn purge,

and to requi re certificatio n of the CM to land in the water with pr es su ri ze d

propellants onboard. Oxidizer and para chut e tests at the NASA WSTF

(White Sands Test Facility) are being conducted to investigate the effect s ofthe CM RCS dump burn depletion and purge on the parachute ass emb lie s.

Recovery proce dures and trainin g a re being updated to avoid possible

crew ex posure to toxic propellants as a res ult of the single failu re points

of the pressurized tanks at shutdown.

5

5North American Rockwell Corporation, pr im e Apollo con trac tor.

1 4



"Status - The concern has been closed on the basis of:

(a) The decision to land on water with press urize d tanks and

(b) The decision to extend the mode 1Z regime. The Safety Office will

continue to scrut inize the cu rre nt WSTF RCS/oxidizer te st s for impact. "Section 3 . 0 of the Mission Asses sment Report contained the Flight Operati ons

Safety Analysis. The anal ysis was divided into approximately nine a re a s with eachaddressing a mission phase; for example, launch through orb it inse rtion , lunar

orbit insertion, lunar module powered descent, lunar sur face activities, et cetera .

Section 4 .0 defined the safety evaluation of flight hardw are diff erenc es

between the mission under as ses smen t and previous missio ns, the waiv ers and

deviations, and the sneak ci rcuit analy ses for the upcoming mission.

Section 5.0 covered the manned environmental ground te st s pertinent t o the

upcoming mission p erfor med at the Space Environment Simulation Laboratoryat the MSC.

Section 6 .0 subjected anomalies from previous missions to ana lysis . Includ-

ed were numerous anomalies fro m the previous missions that were evaluated for

safety impact; breakdown by command and servi ce module, lunar module, and

Government-furn ished equipment; and the sta tus of each with respect to the up-

coming mission.

Section 7.0 was an evaluation of r eal -time flight probl ems and w a s not con-tained in the fi rs t two re le as es of the Mission Asses sment Report; this section was

added aft er splashdown and recov ery.

Documents

Apollo Experience Report Safety Activities