Apollo 1

Under the technical designation AS-204, the mission was to be the first crewed flight of the Apollo programme: a low Earth orbit test of the command and service module, launched by a Saturn IB from Launch Complex 34 at Cape Kennedy Air Force Station. The flight plan called for checking launch operations, ground tracking and control facilities and the behaviour of the Apollo-Saturn assembly, and it could have lasted up to two weeks depending on how the spacecraft performed. Launch was set for 21 February 1967, after delays in readying the spacecraft caused the last-quarter 1966 target to be missed.

The assigned spacecraft was CSM-012, built by North American Aviation. It was a Block I vehicle, designed before lunar orbit rendezvous was adopted as the landing strategy, and therefore had no ability to dock with the lunar module; that capability, together with the lessons drawn from Block I, was to be built into the Block II design. Director of Flight Crew Operations Deke Slayton had picked the crew in January 1966 with Grissom as command pilot, White as senior pilot and rookie Donn F. Eisele as pilot; a shoulder injury forced Eisele's replacement by Chaffee, and NASA announced the final crew on 21 March 1966. James McDivitt, David Scott and Russell Schweickart were named as backups, and were replaced in December by Walter Schirra, Eisele and Walter Cunningham when the second Block I flight was cancelled.

The Apollo command and service module was far larger and considerably more complex than any crewed spacecraft flown before. North American shipped CSM-012 to the Kennedy Space Center on 26 August 1966 under a conditional certificate of flight worthiness: 113 significant planned engineering changes still had to be completed there, and a further 623 engineering change orders were raised and carried out after delivery. Keeping the training simulator abreast of those modifications proved so difficult that Grissom, exasperated, hung a lemon on it.

A week before delivery, at a review meeting held on 19 August 1966 with Apollo Spacecraft Program Office manager Joseph F. Shea, the crew voiced concern about the amount of flammable material in the cabin, chiefly nylon netting and Velcro that astronauts and technicians alike found convenient for holding tools and equipment in place. Shea passed the spacecraft, and instructed his staff to tell North American to remove those materials, but did not follow the matter up himself.

Altitude chamber testing was run first uncrewed and then with both the prime and the backup crews, between 10 October and 30 December. During those runs a design flaw was found in the command module's environmental control unit, which had to go back to the manufacturer; the returned unit leaked water/glycol coolant and was sent back a second time. Once the outstanding problems had been fixed, the spacecraft passed an altitude chamber test with the backup crew on 30 December; according to the accident board's final report, at the post-test debriefing that crew expressed satisfaction with the condition and performance of the spacecraft. On 3 January 1967 CSM-012 came out of the altitude chamber, and on 6 January it was mated to its Saturn IB on pad 34.

The 27 January 1967 exercise was a "plugs-out" test: its purpose was to establish whether the spacecraft would work normally on its own simulated internal power with every cable and umbilical disconnected. Passing it was a condition of holding the February launch date. The test was rated non-hazardous because neither launch vehicle nor spacecraft carried propellant or cryogenics and all pyrotechnic systems were disabled.

At one o'clock in the afternoon, Eastern time, the crew entered the command module in fully pressurised suits, were strapped into their couches and hooked up to the spacecraft's oxygen and communications systems. Grissom immediately noticed an odd smell in the air circulating through his suit, which he likened to sour buttermilk; the count was held at twenty past one while air samples were taken and resumed at 2:42 without the cause having been found. The later investigation concluded that the odour had nothing to do with the fire.

Three minutes after the count resumed, hatch installation began. The hatch came in three parts: a removable inner hatch that stayed inside the cabin, a hinged outer hatch that formed part of the heat shield, and an outer cover belonging to the boost protective cover that enveloped the command module. That cover was only partly latched, because the flexible boost protective cover was slightly distorted by cabling run beneath it to supply the simulated internal power. With the hatches sealed, the cabin air was replaced by pure oxygen at 16.7 psi (115 kPa), two psi above atmospheric pressure.

Communications trouble between the cabin, the Operations and Checkout Building and the Complex 34 blockhouse dominated the afternoon. One of Grissom's microphones stuck open, and his frustration produced a remark that has been quoted ever since: how were they going to get to the Moon if they could not talk between two or three buildings. The count was held again at 5:40 pm while the fault was investigated; by 6:20 pm every function up to the simulated internal power transfer had been completed, and at 6:30 the count was still holding at T minus ten minutes.

The crew were using the wait to run through their checklist again when a momentary rise in AC Bus 2 voltage was recorded. Nine seconds later came an exclamation and, immediately afterwards, the call that raised the alarm: there was a fire in the cockpit. After a few seconds of silence a second, badly garbled transmission asked for the hatch to be opened so they could get out. Some blockhouse witnesses said they saw White on the television monitors reaching for the inner hatch release handle as the flames spread from left to right.

Fed by pure oxygen, the fire drove the internal pressure up to 29 psi (200 kPa) and ruptured the command module's inner wall. Flames and gases escaped through open access panels onto two levels of the pad service structure. Intense heat, dense smoke and gas masks designed for toxic fumes rather than smoke hampered the ground crew, who also feared that the module might explode or that the fire might ignite the solid propellant motor of the launch escape tower above it. As the cabin rupture released the pressure, the flames swept across the cabin; when the oxygen was consumed and replaced by atmospheric air the fire effectively quenched itself, leaving the cabin full of smoke and high concentrations of carbon monoxide.

It took the pad crew five minutes to open all three hatch layers. The autopsy established that the primary cause of death for all three astronauts was cardiac arrest brought on by high concentrations of carbon monoxide, and that burns were not a major factor. The board concluded that White had tried to open the hatch as the emergency procedure required, but could not do so against the internal pressure of the cabin.

Following the in-flight failure of Gemini 8 on 17 March 1966, NASA Deputy Administrator Robert Seamans had written and put into force, in April 1966, a management instruction defining mission failure investigation policy and procedures, which gave him the option of running independent investigations of major failures. Immediately after the fire, Administrator James E. Webb asked President Lyndon B. Johnson to let NASA conduct the investigation under that procedure, promising to be truthful in assigning blame and to keep the relevant congressional leaders informed.

Seamans then ordered the establishment of the Apollo 204 Review Board, chaired by Langley Research Center director Floyd L. Thompson and including, among others, astronaut Frank Borman and spacecraft designer Maxime Faget. All mission hardware and software was impounded and could be released only under the board's control. After thorough stereo photographic documentation of the interior of CSM-012, the board ordered its disassembly using procedures rehearsed on the identical CM-014, examined every part, reviewed the autopsy results and interviewed witnesses. Its final report was issued on 5 April 1967.

The board identified several factors which, combined, caused the fire and the deaths: an ignition source most probably related to vulnerable wiring carrying spacecraft power and to vulnerable plumbing carrying a combustible and corrosive coolant; a pure oxygen atmosphere at higher than atmospheric pressure; a sealed cabin with a hatch cover that could not be removed quickly at that pressure; an extensive distribution of combustible materials in the cabin; and inadequate emergency preparedness.

No single ignition source could be identified conclusively. The board determined that electrical power failed momentarily moments before the alarm and found evidence of several electric arcs in the interior equipment, with the fire most probably starting near the floor in the lower left section of the cabin, close to the environmental control unit. It also singled out a silver-plated copper wire running through that unit, stripped of its Teflon insulation and abraded by the repeated opening and closing of a small access door; that weak point ran near a junction in the ethylene glycol and water cooling line, which had been prone to leaks. In May 1967 it was discovered at the Manned Spacecraft Center that electrolysis of the glycol solution with the wire's silver anode could produce a violent exothermic reaction capable of igniting the mixture in a pure oxygen atmosphere.

As to the atmosphere, the test had reproduced the nominal launch condition: pure oxygen at 16.7 psi (115 kPa), two psi above sea-level pressure and more than five times the partial pressure of oxygen in ordinary air, an environment in which materials not normally regarded as flammable burn readily. The overpressure was deliberate, both to drive out nitrogen-bearing air and to seal the plug door hatch; during ascent the pressure would have been reduced gradually to the in-flight level of 5 psi (34 kPa). The prime crew had run that procedure successfully in the vacuum chamber in October 1966, and the backup crew had repeated it on 30 December.

On materials, the board cited many types and classes of combustible material close to ignition sources: NASA's crew systems department had installed some 34 square feet (3.2 m2) of Velcro throughout the spacecraft, almost like carpeting, and that Velcro proved flammable in a high-pressure pure oxygen environment.

The inner hatch was a plug door, sealed by the higher pressure inside the cabin. The emergency procedure required Grissom to open the cabin vent valve first so that White could remove the cover, but the valve lay to the left, behind the initial wall of flames; and while the system could easily vent normal pressure, its flow capacity was wholly inadequate for the rapid rise to 29 psi (200 kPa). North American had originally proposed an outward-opening hatch with explosive bolts, as used in Project Mercury, but NASA rejected it for fear of accidental opening — as had happened on Grissom's Liberty Bell 7 flight — and chose a purely mechanical design. The astronauts had already recommended a change to an outward-opening hatch before the fire, and it was slated for Block II, though on grounds of ease of exit for spacewalks and at the end of a flight rather than emergency escape.

The fifth factor was emergency preparedness: the test planners had not identified the exercise as hazardous, the emergency equipment was inadequate for a fire of that kind, fire, rescue and medical teams were not in attendance, and the work and access areas around the spacecraft were full of obstacles — steps, sliding doors and sharp turns — to any rapid response.

The choice of a pure oxygen atmosphere went back to the design of the Mercury spacecraft. NASA had considered a nitrogen and oxygen mixture to reduce the fire risk around launch, but rejected it for several reasons: pure oxygen is comfortably breathable at 5 psi (34 kPa), which greatly reduces the pressure load on the structure in vacuum, and nitrogen, combined with the in-flight pressure reduction, brought the risk of decompression sickness. The decision hardened after an accident in April 1960 in which a McDonnell Aircraft test pilot passed out and was seriously injured while testing the Mercury cabin and suit atmosphere system in a vacuum chamber, because oxygen-poor air was leaking into his suit feed. North American had suggested an oxygen and nitrogen mixture for Apollo, but NASA overruled it: pure oxygen was judged safer, simpler and lighter.

Fires in oxygen-rich environments were not without precedent. In 1962 a pure oxygen chamber at Brooks Air Force Base in San Antonio was destroyed during a test of the Gemini suit; in November of that year another fire broke out in a chamber at the Navy's Air Crew Equipment Laboratory when a faulty ground wire arced onto insulation; and in February 1965 two United States Navy divers were killed in a decompression chamber fire. Apollo's own environmental control system had suffered accidents from hardware malfunctions, among them a fire in April 1966 whose investigation already recommended better material selection and warned of the potential for arcing and short circuits. Something worse had happened in the Soviet programme and been kept quiet: cosmonaut Valentin Bondarenko died in March 1961 of burns suffered in an oxygen-rich isolation chamber, a fact not disclosed until 1986. Four days after the Apollo fire, two United States airmen were killed in another flash fire in a pure oxygen chamber at the School of Aerospace Medicine at Brooks. Seamans later wrote that NASA's worst mistake in engineering judgement was not having run a fire test on the command module before the plugs-out test.

Committees in both houses of Congress with oversight of the space programme opened their own inquiries, among them the Senate Committee on Aeronautical and Space Sciences chaired by Senator Clinton P. Anderson. At the hearing of 27 February, Senator Walter F. Mondale asked Webb whether he knew of a report on extraordinary problems with North American Aviation's performance on the Apollo contract. Webb said he did not. In late 1965 Apollo Program Director Samuel C. Phillips had led a team investigating the causes of inadequate quality, schedule slippage and cost overruns in both the command and service module and the second stage of the Saturn V, and had presented its findings orally to his superiors and in a memorandum to North American's president.

That material became known as the Phillips Report. Mondale's persistence, and his anger at what he saw as the concealment of serious programme problems from Congress, put NASA in an awkward position, and Webb eventually supplied a controlled copy of the memorandum. The Senate committee's final report recorded NASA's testimony that the task force findings had no effect on the accident, did not lead to it and were not related to it, but reproached the agency for not having informed the committee of the situation. The political threat eventually faded, largely thanks to President Johnson's support. Relations between NASA and North American deteriorated over the assignment of blame: Webb demanded that either the company's president or its chief engineer resign, and the chief engineer was dismissed. Shea, for his part, was reassigned to NASA headquarters in Washington six months after the fire and left two months later.

The programme was grounded for review and redesign. The command module was found to be extremely hazardous and, in places, carelessly assembled — a misplaced wrench socket was found inside the cabin. It was decided that the remaining Block I spacecraft would be used only for uncrewed Saturn V test flights and that all crewed missions would fly Block II, which underwent deep changes.

The cabin atmosphere at launch became a mixture of 60 per cent oxygen and 40 per cent nitrogen at sea-level pressure, 14.7 psi (101 kPa); during ascent the cabin vented rapidly to 5 psi (34 kPa) and was then purged very slowly until the nitrogen concentration fell to zero over the following day. Inside the suits pure oxygen was retained, to avoid decompression sickness during the rapid pressure drop of ascent. The nylon of the Block I suits was replaced in Block II by Beta cloth, a non-flammable, highly melt-resistant fabric woven from fibreglass and coated with Teflon. The Block II hatch, already planned before the accident, opened outward and could be operated in less than five seconds, using a cartridge of pressurised nitrogen rather than explosive bolts so that accidental opening remained impossible. Combustible materials in the cabin were replaced with self-extinguishing versions, plumbing and wiring were covered with protective insulation, aluminium tubing gave way to stainless steel with brazed joints wherever possible, and thorough protocols were introduced for documenting spacecraft construction and maintenance.

Three days after the accident Gene Kranz gathered his staff in Mission Control and delivered a speech that became one of NASA's guiding principles: they had been too impatient with the schedule and had blocked out the problems they saw every day; from then on every member of every team was to be tough and competent.

The astronauts' widows asked that the name Apollo 1 be reserved for the flight their husbands never made, and on 24 April 1967 NASA made it official: AS-204 would be recorded as Apollo 1, the first crewed Apollo Saturn flight, failed on a ground test. As a consequence the next mission, the first uncrewed Saturn V test flight, was designated Apollo 4, and the names Apollo 2 and Apollo 3 went officially unused.

Crewed flights were suspended for twenty months, a pause that allowed work to catch up on the Saturn V and the lunar module, both of which had delays of their own. The mission's own Saturn IB, AS-204, was taken down from Complex 34, reassembled at Complex 37B and used to launch Apollo 5, the uncrewed orbital test of the first lunar module, in January 1968. Apollo 4 flew in November 1967 and Apollo 6 in April 1968. The first successful crewed flight of the programme was made in October 1968 by Apollo 1's backup crew — Schirra, Eisele and Cunningham — as Apollo 7, in a Block II command module.

Complex 34 was used again only for the launch of Apollo 7 and was later dismantled down to the concrete launch pedestal, which still stands with two commemorative plaques; the crew's families are invited to a memorial there every year, and in January 2005 three granite benches bearing the astronauts' names were installed at the site. Grissom and Chaffee are buried at Arlington National Cemetery and White at the West Point Cemetery. Their names appear on the Space Mirror Memorial at the Kennedy Space Center Visitor Complex; Grissom received the Congressional Space Medal of Honor posthumously in 1978, and White and Chaffee in 1997. The Apollo 11 crew left an Apollo 1 mission patch on the lunar surface, and Apollo 15 placed there the small Fallen Astronaut statue with a plaque bearing their names among others. Three stars in the Apollo navigation catalogue still carry the nicknames the crew gave them as a joke — Navi, Dnoces and Regor — which later Apollo crews went on using.

The command module has never been placed on public display: after the investigation it was kept in a secured warehouse at the Langley Research Center in Hampton, Virginia. On 27 January 2017, the fiftieth anniversary of the fire, NASA put the Apollo 1 hatch on show for the first time at the Kennedy Space Center Visitor Complex, alongside the memorials to the crews of Challenger and Columbia.