NASA Johnson Space Center
Oral History Project
Edited Oral History Transcript
Gary W. Johnson
Interviewed by Rebecca Wright
Houston, Texas – 3 May 2010
Today is May 3rd, 2010. This oral history with Gary Johnson is being
conducted for the NASA Johnson Space Center Oral History Project in
Houston, Texas. Interviewer is Rebecca Wright, assisted by Sandra Johnson.
We want to thank you so much for coming in this afternoon to talk with
us. We know you began working with the Manned Spacecraft Center in 1964.
That’s correct. It was June 1964. I had just graduated from Oklahoma
State University with a BS [Bachelor of Science] degree in electrical
engineering. Started work on June 15th. Everything my wife and I owned
was packed in a VW Bug [Volkswagen Beetle] and we came directly down
here. Initially stayed in apartments in Dickinson, Texas—Tall
My first assignment was in the power distribution and sequencing section
of the Instrumentation and Electronic Systems Division. Ralph [S.] Sawyer
was the division chief at that time. My section head in that section
was Bob [Robert E.] Munford. Those divisions were in the Engineering
Directorate. The director at that time was Max [Maxime A.] Faget. I
was young and labeled as a project engineer, and I was put on following
the Command/Service Module [CSM] development for the power distribution
system and sequencing system.
Early first involvement was with the [Ascent] Abort testing we were
doing out at the [US Army] White Sands Missile Range [New Mexico]. The
Little Joe II launch vehicle you see there at Rocket Park at JSC was
one of the vehicles used to boost the spacecraft to particular altitudes,
and then you’d initiate an abort signal. The objectives for all
the tests out there was to test out the abort system as well as the
Earth landing parachute system.
That was a very good program. We got to work on some of the hardware
actually here at the Johnson Space Center. The work we mainly did was
on what you call the development flight instrumentation, DFI it’s
referred to. North American Aviation [Inc.], of course, was the one
that had the contract for building the Apollo Command/Service Module.
They built the basic boilerplates that were used and responsible for
the integration and the overall testing of the program, but we supported
with the DFI that was installed. I was fortunate, I got to go out to
White Sands and be there for all the launches we did.
One of them turned out to be a lessons learned for us. It’s Boilerplate
22 [Mission A-003]. That launch was one where the big fin on the Little
Joe II rocket failed in a hard over position, so the faster the rocket
went up—and it was propelled by solid rocket motors—the
faster it spun around. It spun around so fast that the launch vehicle
literally came apart. It had six solid rocket motors in it called Algols,
and those six motors all just came apart.
I was sitting there in the stands at the time. We were only a half mile
away from the launch pad, and all of a sudden these rockets were coming
flying in every direction almost like they were coming back at us, but
they weren’t of course. Well, they were coming back at us, but
they were far enough away that that was okay. To show you a little difference
in the safety requirements, we were only a half mile away there. They’re
getting ready for the Constellation Program Orion [Crew Exploration
Vehicle] project Pad Abort 1 test out in White Sands. I’ve been
involved in some of the readiness reviews, and the launch site is four
miles away from the actual launch of the pad abort. There’s a
big difference in what was perceived as being the safety distance in
the Apollo days versus now.
Anyway, the lesson out of that was the abort system to initiate the
abort for the spacecraft and the launch vehicle consisted of the opening
up of the circuit between the spacecraft and the launch vehicle to initiate
the abort. Well, when the launch vehicle came apart, that in itself
opened up that wiring and automatically initiated the launch escape
system. The pyros [pyrotechnics] fired to separate the Command Module
from the launch vehicle, the launch escape motor went off, the pitch
control motor went off, and it went through the entire sequence, which
consisted of tower jettison, deploying the apex cover [forward heat
shield covering the parachute], putting out the drogue parachutes, putting
out the main parachutes, and then safely recovering the vehicle. The
lesson there was on any future vehicles—and we did this later
on the Saturn I and Saturn V [rocket] vehicles—one of the abort
sensors should be this wiring that goes down to the launch vehicle such
that if it ever opens up due to a launch vehicle blowup or structural
breakup, that it would automatically, without any other indication,
initiate the abort.
In that particular case, it also was a great test on the Earth Landing
System [ELS], because the vehicle was going at an extremely high rate
of speed when we aborted, and when the drogue parachutes got ready to
come out, they came out and were whipping around on the upper deck.
It’s a good thing we decided to use steel risers rather than the
nylon that previously had been thought about, because those steel risers
were beating up against the upper deck and the sharp edges—if
we’d had the standard nylon risers they would have gotten cut
loose. The way it was the drogues helped stabilize it, and then later
the main [parachutes] came out and everything worked fine.
That was a couple of lessons I passed on to the Constellation folks
since we just now designed the somewhat similar [Orion Command Module].
One [lesson] is consider the use of the cables—which they made
a change. Originally the program had the nylon risers in there, and
now they’ve gone to the steel cables like we had back for Apollo.
I don’t know if they’ve implemented it yet, but I pointed
out that we needed the abort signals that come from the launch vehicle,
the spacecraft, need to be on that same concept—that if you lose
the signal all of a sudden to the spacecraft that it’ll automatically
initiate abort. Hopefully that’ll be followed through.
We then later had some other abort tests out at White Sands, and they
all turned out to be perfectly okay. Also, I was following the unmanned
testing that we did from the [NASA] Kennedy Space Center [KSC, Florida],
and I’d like to point out that one of the main responsibilities
both at White Sands and later was the sequencing system. That’s
the very system that initiates the aborts. So I was very pleased after
the Boilerplate 22, because my system worked real well and helped save
We launched one of the first full-up, what we call Block I, Apollo spacecraft
from Kennedy Space Center off of a Saturn IB [rocket]. The launch was
referred to as AS-201. AS stands for Apollo-Saturn. It was 201, and
the spacecraft was [CSM-]009. It was going to be the first launch so
it wasn’t an orbital flight, it was the ballistic launch. The
lesson that came out of that—we didn’t know it exactly in
real time at the time, but during the beginnings of the entry phase
for the Command Module, we lost all Command Module RCS [Reaction Control
System] control. The buses got shorted out, so we had a lot of problems.
It turned out the vehicle went into a stable roll position, and it did
what you call a ballistic entry, which brought the vehicle down safely
and the Earth Landing System worked fine, but it was like 200 miles
up range. So it took a while because recovery forces were down in the
nominal range. Instead of doing a normal lifting entry it did a ballistic
entry and landed upstream, but they recovered the spacecraft.
I supported these missions since I was in engineering. We actually followed
the testing alongside of our flight control counterparts in the Staff
Support Rooms in the Mission Control Center. In reviewing the data though
for that flight, we found out there was a wire that went out through
the Command/Service Module umbilical which is guillotined in flight
and was no longer being used. It was wiring that was being normally
routed out to the KSC people on the ground. Instead of removing the
wire from the vehicle, the wiring was left in the vehicle. The other
problem was this wire was still attached to one of the circuit breakers
on the panel. Matter of fact, the circuit breaker it was being used
for was System B on my Earth Landing System. When the wires were guillotined
during the entry, that interface heated up and since this one wire,
because it at that time was unused, had not been looked at as to whether
it needed to be deadfaced, opened up, so it wouldn’t short out
when you did the guillotine.
Since this wire had been unused, it had been dropped out of the drawings.
They had dropped it out even though it was still in the spacecraft.
So when the people were doing the review for how to deadface wires as
being hot with power on them, this got missed. That power on that ended
up sending power to the motor switches that control the position of
whether—if they’re in the Service Module they fire the RCS
jets for the Service Module, and then when you do the separation, the
motor switches transfer over to the Command Module so you have RCS control
in the Command Module.
Well, this wiring shorted down at the umbilical and the power that was
in there from this other circuit caused those motor switches to transfer
back to the Service Module. And of course the Service Module was no
longer there. So that’s the reason we lost all Command Module
RCS and the reason we had the shorts on the buses, because this wiring
had shorted at that umbilical. That one wire wouldn’t have shorted
that much as far as the buses, but when that motor switch transferred
all of those control wires to the Service Module, those wires then caused
a big short on the main buses and lost the power. The circuit breaker
that was feeding that, Circuit Breaker B, popped, which disabled one
half of the Earth Landing System, which was my responsibility. But the
System A worked fine, and we recovered the vehicle.
Several lessons of course came out of that. One is any time you have
circuitry in the vehicle and the function is no longer being used, if
you can’t remove the wire, you’ve got to make sure that
it’s removed from any power source, and that the drawings still
show that as an unused wire in the vehicle so it could be understood
and identified later on. Fortunately that’s pretty much the cause
of all the other problems that occurred. So in a sense that was an easy
fix to make for the later vehicles.
We then later had a flight on the Saturn V. It was the AS-501 [Apollo
4], which was spacecraft 011 [CSM-017], which was fairly uneventful.
The next, 50 of the Saturn V [Apollo 6], however, had spacecraft
017 [CM-020] on it. Before we launched, people at KSC were having problems
with a lot of noise on their instrumentation system. They had worked
and worked and couldn’t figure out what was wrong. So they actually
got ahold of JSC, our mission evaluation team—Don [Donald D.]
Arabian in those days was heading up that activity—and asked Don
if he could get some folks together to go down to the Cape [Canaveral,
Florida] to help the KSC people figure out what the noise problem was
on the Saturn.
So we went down there, and Don asked me to go since I always followed
the electrical system. We got down there and started looking at the
drawings, and understood that it was well designed in the sense that
we had what we called an I ground for the grounding that all your low-level
instrumentation would be on. Then we had an E ground that was the power
for all power; it was separated. According to the drawings, this system
would be isolated all the way down to the base of the Saturn V, the
mobile launcher. Matter of fact, that’s the launcher that goes
out with the [Space] Shuttle nowadays.
Down below in that launcher the two grounds were tied together to go
to the main ground to make sure everything was grounded. I went over
the drawings and I got with the KSC engineer, and we started up at the
top and we started walking down the grounds, opening up the various
junction boxes. Got all the way down to the base, which was in a closed
compartment underneath that launcher mobile crawler, and opened up the
one box. A link was missing between the E and I ground. The E ground,
the power ground, turned out to be really grounded. The I ground was
basically floating. It wasn’t tied, that link was just missing.
So that real quickly explained why they were having noise on the instrumentation
Once again that was an easy fix. The lesson learned there of course
was any time you have any noise on the system be sure and look at the
grounding system. And when you look at the grounding system make sure
you don’t just look at drawings and think everything’s all
right; you actually physically go out there and go through everything
to make sure everything is in place. That came up as a big help later
on when we got asked to do the Viking program. They had a problem I
might mention at this time before I forget.
The Viking was the first Mars landers we had, Viking 1, Viking 2. They
were built up at Denver [Colorado] at that time at Martin Marietta [Corporation].
Its location’s up on the sides of the hill, it’s fairly
dry there. Don Arabian got a call saying, “We’ve been trying
to check out these Vikings in our thermal vacuum chambers, and we’re
getting all kinds of noise on the instrumentation system. We’ve
had our people up here looking, going through everything, and we just
flat can’t find what’s wrong with what’s causing the
So we went up there. Once again I sat down the same way and figured
well I’ve got to look at the grounding system, because that’s
where problems are. Once again looked at the drawings. They had a similar
concept—they had what they called an I ground and an E ground,
two grounds that would be carried all the way, and then get tied together
at the very base, and then go on outside. Once again I started at the
top going all the way down with one of the Martin Marietta electrical
Everything was checking fine through the test stand. It turns out there
were two big, almost like welding cables, and the E ground and I ground
went outside the building. Because it’s dry there on the side
of the mountain, to get a good ground they actually had a water well
outside the building. So we walked all the way out to the well and I
had the guy pull the cover off the well. The two cables went down inside,
and I could see at the bottom of the well that there was water in the
well. I said, “Let’s wiggle one of the cables.” The
water didn’t move. So the water had dropped below where the cables
were, and both the E and the I ground were floating. They weren’t
grounded at all.
Once again it was an easy fix for them. They felt extremely embarrassed,
needless to say, and that was something they said in the future they’re
always going to have on their checklist, check the water in the grounding
well. Once again there was a lesson there. That needs to be mentioned
to people quite often because as you can see, it’s repeated. So
any time in the future I hear about any noise, programs and launch vehicles
or test setups or what have you, I’ll have a suspicion it might
be somewhat related to the same thing.
[Spacecraft-020, Apollo 6]. We had a launch. On that [second] Saturn
V launch there was problems later with the launch vehicle itself. They
had a POGO [longitudinal oscillation of launch vehicle] problem, having
engine shutdown. We also had some structural problems. Fortunately these
wires that sense the abort signal were located around the vehicle 120
degrees apart, and we only had a problem with one of the signals. The
abort system required two of the three wires to be open or signals to
issue an abort.
I might be a little bit out of sequence on the time here, but the next
big thing that I was involved in—like I mentioned before, we were
monitoring the testing that occurred at the Cape in the Control Center.
When the Apollo 1 crew—and that was referred to as Apollo-Saturn
204, and it was Spacecraft-012, Block 1 spacecraft at the Cape—they
were at the pad, Pad 34. It was pressurized to 16 psi [pounds per square
inch] pure oxygen. They were going through a full-up test just like
they would be ready for launch. They were in their spacesuits in the
spacecraft. I was monitoring in the [Mission] Control Center here at
Houston. I was in the backup Staff Support Room sitting on the EPS [electrical
power system] console. Turns out the test was having problems. It ran
way late. It was on a Friday about 6:00 p.m. The majority of the flight
control team, including Gene [Eugene F.] Kranz and the majority of his
team, had left the Control Center, so there were just a few of us. Dr.
Chris [Christopher C.] Kraft was in the front room on the flight director’s
console. Then back in the Staff Support Room it was only myself on the
EPS console and Mort [Morton] Silver, who was a North American flight
control engineer, was on the ECS [environmental control system] console.
About that time is when we had the fire in the spacecraft.
The other thing that was bad about that is listening to the ground crew
trying to go up and get the guys out—there’s lessons here.
Turns out the gas masks that were available at Launch Complex 34 were
not the standard ones you’d have for firemen. They had a cartridge
in them just designed to screen out toxic propellant. They were there
strictly if you had an N2O4 [nitrogen tetroxide] or MMH [monomethylhydrazine]
propellant leak. The recovery people were grabbing those gas masks and
going up, and the White Room [pre-entry chamber] of course was filled
up with smoke, and as they went in there this would not filter out.
So they were breathing in the smoke and they were actually passing out.
It was bad hearing about the guys going up trying to do something and
passing out, and turns out they didn’t have even the gas masks
for a ground crew.
Dr. Kraft came running back and told us. When I heard him announce that
they were locking up the building and for us to be looking over our
data—actually at the instant it occurred, I heard the crew talking
about fire in the cabin, I was thinking just for an instant, well, the
crew is in their space suits, they’ll probably be okay. But then
the test director at the Cape, I heard him on the loop tell Dr. Kraft
you need to go over to the private phone. I knew then. Of course what
happened was Gus [Virgil I.] Grissom, he had turned to change his com
[communications] cable, and to do that you step off with one foot off
your couch and one down—best we could tell. That fire had burned
through that part of the suit so you had the toxic gases inside the
suit as well. Fortunately for them, they expired fairly quickly because
of the toxic gases.
In going through the data, I noticed right away that the short that
occurred at that time was on Main Bus A and B. It shorted both Main
Bus A and B. That meant I’d be needing to go through all the drawings
and find out where in the spacecraft all the dioded Main Bus A and B
loads were located. Also, by the way, Kraft had told us when they’d
locked up all the doors that we could tell our wives that we’d
be late, but not say why. So I called to tell her, but she had already
been hearing on the TV and the radio. I didn’t get out of the
building until the next day, as we were getting our data together.
About a week later I got sent to the Cape to go through the vehicle,
and prior to that I’d been already mapping out everyplace we could
go look to see where the dioded loads were. I was the only engineer
that was assigned to go in and look through all the wiring. That area
over on the left-hand side was pretty much totally destroyed. That’s
where the oxygen was and aluminum and metal that burned over there,
so the wiring that was over there you couldn’t see. The rest of
the vehicle you could take a damp cloth and wipe off the smoke and it
looked brand-new. Things happened so quick, and the pressure on the
Command Module broke and it snuffed everything out at that time.
We looked at closeout photographs of the wiring in that area. It turns
out that there’s one dioded load that went in to power the environmental
control system instrumentation, and that wire was routed over the stainless
tubing and went underneath the door that’s opened up for lithium
hydroxide to get access. Earlier photos showed that they had a Teflon
wrap over that to protect that wire. However, the last photograph we
had of that area showed that Teflon protective wrap had slipped down,
so you just had the wire there. We weren’t able to prove that’s
the location, but we also know that it started somewhere in that area.
So we surmised that when Gus Grissom stepped off and stepped down with
his foot to turn and do that he probably stepped on that wire. Teflon
is not a very tough insulation, it actually has cold flow properties,
so pressure on it can extrude through. It could have been a case where
he mashed that wire and it caused a short, or it could be a case he
stepped on it and that wire had been abraded by the door that was opened
and closed. The photos showed it was probably against that door, then
maybe him stepping on it flexed the wire up—but we had an [electric]
arc that initiated the fire.
That led to later improving a lot of our quality assurance procedures
and a lot of putting in extra protection on wiring. The big factor was
making sure that our materials would all be compatible with 100 percent
oxygen. We were going to operate at 5 psi pure oxygen and not ever operate
on the ground at 16 psi pure oxygen, because there was almost no way
to make things compatible with 16 psi pure oxygen. Even metal burns.
All that was put in place, in addition to the fact that we redesigned
The hatch on the Apollo 1 spacecraft was in three segments. The inner
segment you had to unlatch it and pull it inward, it was pressure-sealing.
Then you had the heat shield one and then the boost protective cover
one on the outside. That pressure buildup from the fire prevented the
crew from being able to open that inner hatch. So the hatch was redesigned
on Apollo later to be a single rapid-opening hatch that would be outward
so you wouldn’t have this problem of higher pressure inside sealing
it. It also would allow the crew to quickly exit the spacecraft, as
well as the ground crew operating the hatch from the outside could quickly
enter the spacecraft. Some of those design features were carried forward
in today’s spacecraft. In the case of the Orion capsule, they’ve
got an integrated single hatch a lot similar to the design that was
done for Apollo.
Then after we put all of those procedures in place we had the Apollo
7 mission, which was the very first manned mission for the Apollo spacecraft
after the fire. There was a lesson on that mission in the area that
I work in, which was the electrical system. It was an Earth orbit mission
strictly for about 14 days. But when they were on the back side, out
of radio contact, all of a sudden lights went off in the spacecraft
and alarms go off on the AC [alternating current] system. Then we were
able to recover that, but what we found out—and at this time we
were operating in the Building 45 MER [Mission Evaluation Room]. Shortly
after the Apollo fire it changed where all the flight control people—matter
of fact, on those early unmanned flights with the Saturn V, Chris Kraft
came back there one time and said this room is too crowded with all
these engineering people in addition to his flight control people. He
demanded that the engineering people come up with their own facility,
and that’s what led to the Building 45 third floor arrangement.
[Regarding Apollo 7] we determined there it was the AC short. Actually
we determined this while the mission was still going on. We had motor
switches located in the Service Module that when you had them on automatic
they would automatically, depending on the pressure in the cryo [cryogenic]
tanks, cycle the heaters and the fans on and off. It turns out that
on one of those cycles is when the AC shorts occurred.
So we just told the crew for the rest of the time after we reset things
to only manually operate the cryo tank heaters. Don’t have them
on auto, and don’t operate the AC part of it, just do the DC power
for the heaters. The postflight analysis that we did, we were able to
determine that the short was in the motor switches. What we determined
was the motor switches have what we call an environmental seal, which
was a potted type seal rather than a welded hermetic seal. The nitrogen
pressure that’s inside there for sealing the compartments was
leaking out while we were on orbit, and it got down to what you consider
the critical atmosphere, where the voltage is such that you can have
corona arcing, as they call it.
That’s what happened here. With the AC system, since you’re
talking 120 volts—and then you’d be talking 240 on the phase-to-phase,
which is being switched—it turns out we were able to determine
we got down to pressure and the voltage sufficient that would cause
corona occurring and cause a short. So that was changed to make sure
that things we had in the Service Module would be hermetically sealed,
not environmentally sealed, especially if you’re talking high
voltage like the AC system was.
I followed all the Apollo missions. The next one which had a problem
related to the electrical system was Apollo 10. Tom [Thomas P.] Stafford
was the commander and John [W.] Young was the Command Module pilot on
that one. That was in lunar orbit. They had just gone on the back side
of the Moon, and all of a sudden they had had one of the fuel cells
fail, hard fail. Then they went on another—still out of contact.
Later they ended up having an alarm on their second fuel cell, which
It turns out on the one fuel cell the glycol pump shorted out, so it
was lost for the entire mission. But the other problem we just had to
watch, to reduce the loads a little bit. That brings up a point that’s
been a lot of discussion with our new design spacecraft, is what level
of redundancy and what was the philosophy. The part I’ve been
able to pass on is that the redundancy follow-up policy we had early
in Apollo was based on three factors: the criticality, flight experience,
and the technology level of the hardware.
I’ll give you an example. The fuel cells are a very good example.
Back in those days the fuel cells were the new technology. We’d
used them on Gemini, a different type of fuel cell we didn’t have
problems with. And the fuel cells were what we call Criticality 1. Flight
experience on those fuel cells except for the unmanned flights would
have been very little. Then you had the experience with the different
type of fuel cell on Gemini.
We wanted to make sure we had three fuel cells such that if one failed
we could actually continue to operate, which is what we did on Apollo
10. We continued the rest of the mission with one fuel cell totally
failed. Even if we had a second fuel cell fail, we could power down
the spacecraft and safely return. So we had what you call fail op/fail
safe, or triple redundancy.
But if you go to something like the main buses, which are bus bars in
boxes, and the main switching components were like big hard contractors—those
were devices that had proven flight experience, didn’t have any
problems. Even though they were Criticality 1 it wasn’t new technology.
If anything it was old technology, well utilized in aircraft as well
as other aerospace and spacecraft applications, so for the main buses
we only had two. For the area that was the low technology concerns,
you had three. In other words the redundancy level varied.
The same thing occurred on the AC system. The bus structure for AC and
the switching components for AC was dual redundant, but for Apollo for
weight savings we’d gone for the first time to what you call a
three-phase solid state inverter, which was brand-new to the aerospace
world. Once again because this was new technology and we didn’t
have the flight experience on it, we had three AC inverters. However,
we only ran one AC inverter per each one of our AC buses, so the third
one was always on standby or off. It turns out the inverter system was
very reliable, and we never really had to rely on the third inverter.
The only time we used the third inverter is when we had to do powerdowns
for other reasons to keep this vehicle from getting too cold. We turned
that inverter on to just put heat into the cold plates. It was used
like a heater almost for the cold plates. And that was about the only
use we used for the [spare] solid state inverter. They worked very well.
I passed over Apollo 8—I was involved in that. If you remember,
I had talked about how on Apollo 7 we had the shorts with the AC system.
Like I said, we had pretty much determined what that was and felt like
we’d fixed it. But George [M.] Low was the program manager at
the time, and there was a lot of concern because Apollo 8 was going
to be the first launch to go to the Moon. There was a big concern at
that time because we thought the Russians were going to go with a circumlunar
flight before we were. We felt that some apparent data indicated they
were getting ready for that so there was a real concern about making
this launch and flight.
George Low directed that we run a test on the Apollo 8 spacecraft to
carefully check out and test every AC load and component on the spacecraft,
because he didn’t want to have anything with the AC system. So
I worked for a week or so here at Houston working up what needed to
Then I went to the Cape and Apollo 8 was on the pad. I spent a week
at the Cape writing what we call TPS [Test Preparation Sheet] test procedure,
for the Cape to run the test on the spacecraft. I was, to be honest,
very nervous at that time because I’d run tests on spacecraft
here in Houston. We’d had the 2TV-1 vehicle and Spacecraft-008
vehicle that actually were full-up vehicles that were tested in the
big large vacuum chamber here at JSC. One of [the tests], 2TV-1, was
actually a full-up manned test for 14 days. So I’d been involved
in doing tests on the actual vehicle, but this was the first time I’d
ever been responsible for something being tested at the pad on a mission
getting ready to be launched to the Moon for the first time, and having
to make sure it worked with all the ground support and connections we
do for JSC for checkout. I spent time going through, and it turned out
to be a pretty thick procedure and very carefully checking things.
I got to thinking, a JSC engineer running the test here at KSC, I’m
sure these KSC guys are going to really check me over and make sure
I got everything right, so they’ll really look at things well.
Well, when I started taking this big procedure through the signature
chain, guys would thumb through it and look through it and say we know
you feel like you’ve checked with the right people and done the
right thing, and they just signed off. I went through all the required
signature chains, and nobody had really gone through and carefully checked
everything. That even made me more nervous.
The test was scheduled to be run on what you call third shift, which
would be in the evening. I was out at the Saturn V launch pad actually
sitting just inside the White Room with my procedure there and my headset
on to monitor the test, and the ground crew was in the spacecraft—I
could see in the spacecraft, the hatch was open and they were going
through the test.
About halfway through the test all of a sudden everything went black.
The lights in the White Room went off, all that. Almost had a heart
attack. I thought my goodness what have I done. Then there was comments
in the Control Center about we’ve lost power. But I looked inside
the hatch and all the lights were on, everything was fine. Well, turned
out Florida light and flicker as we called it in those days [Florida
Power and Light Company] had gone off, and it was just the ground facility
power had gone off. So the lights in the White Room had gone off, which
caused everything to go dark and led to the talk in the Control Center,
but the spacecraft itself was on backup emergency battery power and
all so it was fine. It turned out there was nothing wrong with my test
and everything went fine, but I almost had a heart attack. Oh boy.
Easy fix. Flip the switch, right?
All I could think was, you’re responsible for scrubbing the Apollo
8 mission. That was really something that stuck with me a long time.
Then Apollo 9 was an Earth orbit mission testing out the Lunar Module
[LM]; didn’t really have any major areas that came up in my area.
However, once again I was always in there responsible for the sequencing
and the power distribution system, monitoring those systems.
The sequencing besides the aborts was critical because it fired all
the pyros. It did the Command/Service Module separation, it did the
docking probe retract. It separated when you docked with the Lunar Module—to
pull it out of the launch vehicle, it fired the pyros to separate the
LM from the launch vehicle. It was used to deploy the apex cover and
put out all the parachutes and stuff for landing. It was a real critical
system, so needless to say I was usually on edge following the missions.
Apollo 11, I was in the control room. People of course ask you a lot
about Apollo 11 [first moon landing]. Whether you talk to Chris Kraft
or almost anybody that was involved in those days, the mission that
kept everybody on the edge of our seats and glued to the data was Apollo
8, because that was the very first time we’d launched and gone
out of Earth orbit and gone to escape velocity with a crew, and it was
the first time we’d flown the Saturn V manned. And that occurred
just after that flight that we’d had problems with the Saturn
Also it was the first mission we knew that the crew were on their way.
It was going to take three days or so to get there and be in orbit,
three days to get back—what if something goes wrong? So everybody
was really on edge watching the data the entire flight, because everything
we did was done for the first time. It turned out for that mission it’s
a good thing. That was probably one of the most problem-free flights
we had, because everybody was so on edge, that if the least little major
thing had gone wrong we’d have probably come home early or something
else. But it turned out that everything just went extremely well for
Then we had Apollo 10. The new thing then was the activities in lunar
orbit and the activities with the Lunar Module going down and coming
back up. So when you got to Apollo 11 the part that really had you on
the edge of your seat of course was that final last bit of doing the
actual landing itself, as well as the period for being on the surface
and the launch of the LM to go back and re-dock. The previous missions,
Apollo 8 and Apollo 10, and then of course we had Apollo 9 to check
out the Lunar Module; had checked out everything so the only thing really
new about that was the actual landing activities. In terms of the time
duration that kept us on the edge of our seats, Apollo 8 was the longer
time period at the time.
Then we had Apollo 12. This was something that I was involved in because
that’s the one, Apollo 12, where we had the two lightning strikes
right after launch. The fuel cells got disconnected from the buses,
the AC inverters all got disconnected from the AC buses, and those two
events there just lit up all the lights in the spacecraft of things
going wrong. Of course we had battery backup that came on, but still
caused everything, loss of data. John [W.] Young made the right call
to go to the backup switch for the instrumentation. We regained our
data and was able to see the status, and we were able to reset the motor
switches back to the main buses, the AC buses we were able to reset.
It turns out the reason all those things tripped—we had what we
called a circuit overload on those motor switches, and it’s a
solid state SCR, silicon-controlled rectifiers, was on there. If you
tripped it, which would normally be tripped if you had an overload or
short circuit or something, you would switch those elements offline.
Well, this lightning strike caused a very large negative voltage to
occur in the spacecraft. A negative voltage spike on an SCR will cause
it to inadvertently trip. So all of those overload sensors accidentally
tripped, and that’s what caused all the disconnects. Fortunately
that’s something we were able to always reset. So everything got
reset, reenabled the guidance system, and as everybody knows, we were
able to pull off the Apollo 12 mission the rest of the way just fine.
Everything went fine.
Apollo 13. I was in the Control Center when we had the short in the
tank on Apollo 13. We were very concerned. Matter of fact, some of the
men in the MER there were very visibly upset, and everybody was upset,
but some of them were very upset thinking we surely lost the crew. That
turned out to be another time that we didn’t get out of the building
till the next day, sitting there looking at our data.
Being responsible for the power system like I was, we were very closely
helping look at the loads and what needed to be done. We were mainly
over in the Lunar Module, and one thing that I had developed with my
Lunar Module subsystem manager before Apollo 13—turns out the
Command/Service Module had a battery charger, because we operated off
fuel cells and we also had the batteries for reentry when we separate
the fuel cells. We had the capability to recharge the batteries on the
Command/Service Module before we’d get ready to reenter. We did
have some connections that went over—so myself and my Lunar Module
power distribution manager were concerned about it’d sure be nice
if we had a way to charge the batteries in the Lunar Module using the
Command/Service Module. So we’d actually developed a procedure
on how to connect up wiring between the Command Module to go over to
the Lunar Module that would allow us to maybe put the charger on and
charge the Lunar Module, if for some reason we’d do that.
All of a sudden here’s a case where we didn’t have power
in the Command/Service Module, and the Lunar Module had power. So I
went over right quick to get that old procedure out of the file cabinet.
In those days, we just wrote things up in memos. Later when we were
bringing the crew back, we were faced with a case of having to power
the Command/Service Module up, and you wanted to conserve the entry
batteries in the Command Module to do that.
One of the things we did was we used that procedure basically, except
we did it in reverse. We used these wires that were connected from the
Lunar Module back to the Command/Service Module to use some of the Lunar
Module power to power up the Command Module and then eventually put
the entry batteries on. The other thing I was doing though—and
very busy doing—was what should be the switch configuration for
the spacecraft, because now we’re going to be separating from
the Service Module first, getting rid of it, and then hanging on to
the Lunar Module as long as we could, and then separate from the Lunar
Module. That in turn would change our switch positions and the things
we should have in place for the normal Command Module entry. So I was
busy with the drawing of the control and display panel, and I’d
mark and go around and talk to the various systems people and say on
their system whether the circuit breakers had to be open or closed and
what the position of the switches was. I marked in red the ones that
had to be open and the ones I marked in blue was the circuit breakers
that had to be closed for that configuration.
Then we sent that procedure over to the flight control team, which was
just this drawing with the markup on it, and the flight control team
then converted that into a checklist format, and then Ken [Thomas K.]
Mattingly checked it out in the simulator. That of course was checked
out all right, was used by the crew. That was used by the actual crew.
I’ve still got that original control and display drawing that’s
got the blue and red markings on it that I kept. It’s one of the
things I still have from that mission. And of course as we knew we got
the crew back.
One thing I’ve done both for Apollo 1, since I was heavily involved
in that, and Apollo 13, there’s presently available on the Knowledge
Site at JSC a case study for Apollo 1, that I do the presentation on,
that’s a video and charts, and then there’s one on Apollo
13 that I do the study on.
Apollo 13, on the other hand, is not about what we did during the mission.
Apollo 13 is all the things that happened to cause the problem in the
tank. There’s a whole series of things, and that’s where
the real lessons for Apollo 13 came about—what caused the problem.
Early on out at Downey, California, North American, which was later
Rockwell [North American Rockwell Corporation]—they were using
a type of a forklift procedure to put in the shelf that had the cryo
tanks on it in the Service Module out there for assembly. They had a
hang-up of a bolt and it caused the thing to drop, so the shelf dropped,
and you had a shock on the cryogenic tanks. They took the oxygen tanks
out of that Service Module and ran them through a lot of tests to see
whether they felt the tanks were still okay. It had a lot of complex
circuitry down inside the tank for the heaters and the wiring for the
fans that was down inside. Then you had a vent structure, for not only
the heaters, but you had to have a path for venting of the tank as well
It turns out you can’t see inside the tank, even though they X-rayed
the tank. Even though they checked all the tank out, that oxygen tank
is the one that got put in Apollo 13, even though they thought everything
was all right. In retrospect we feel like that caused this tubing to
slip down, because when they filled up the cryogenic tanks in the countdown
test for Apollo 13—when they finished the test, they weren’t
able to get the oxygen out of the tank. It wouldn’t drain properly.
We feel like there was a problem caused way back when that drop was
made that caused that to occur.
One way to get the oxygen out of a tank is turn on the heaters and heat
it up, and so-called boil it off. So the KSC people went that way and
turned the heaters on. It turns out though there’d been change
in what they were doing. In the past, in order to speed up using that
mechanism to get the oxygen out of the tanks, they had changed the voltage
that the switches used for the heaters. They had changed the voltage
from 28 volts—which is your normal voltage for the heaters and
the thermostat switches that operate—to 65 volts, which increased
the heater power in the tank and would cut down the time. The problem
was, and there’s your lesson here, nobody had gone back to see
if that thermostatic switch was certified to operate at switching 65
volts instead of the 28 volts. They didn’t bother to go back to
the vendor or anything else. Well, the switch was not rated for that.
The other thing that happened is the tank—the display on the temperature
inside the Control Room was at a temperature level that was on the upper
end of the heater, but didn’t display [above that] heating range.
What happened is that the heater was turned on, the temperature went
up to the upper limit, the temperature limit pegged out, but the people
in the Control Room didn’t notice, thinking the thing was normal.
Meanwhile the thermostatic switch that’s supposed to open when
you get to the high temperature did attempt to open, but because of
the high voltage the contacts welded closed, so the heater stayed on.
The temperatures are estimated to maybe have gotten up to 1,000 degrees
or very high before they got turned. Of course it did boil off the oxygen.
It turns out that extremely high temperature had damaged the Teflon
wiring insulation on those wires in the tank. So when Apollo 13 was
launched you were sitting there waiting for almost like a bomb to go
off, because you had high voltage AC wiring, as well as the heater wiring
that was damaged, and of course we know when Apollo 13, the explosion
happens is when the crew were told to stir up the cryo in the tanks.
Well, that’s turning on those AC fans in the tanks, which is that
higher 120-volt AC, and that’s what set that off. So lessons had
to do with the fact that operating something outside of its design limits
like that electrical switch, and the displays in the Control Center
should have covered temperature ranges above where that was at, and
there should have been some sort of alarm system in the Control Center
that says if you got excessive temperature.
Other factors had to do with the design of that tank itself, with its
blind assembly and difficult to install components, that needed to be
improved. Later there was changes made to a lot of that. The wiring
in the tank was changed to metallic, something to take the high temperatures
to make sure. Of course we never had any more problems with that.
Apollo 14 was the next flight. It went fairly well except when it got
into Earth orbit and you separate the Command Module from the Service
Module and the Command/Service Module turn around and they come back,
you have to dock with the Lunar Module in order to operate the pyros
to separate it from the Spacecraft/LM Adapter and be able to pull it
out and dock. Well, Apollo 14 they went in to try to dock and on the
docking probe itself there’s three capture latches, and you’ve
got to close two of the three latches in order to enable the pyro firing
circuit to fire and retract the probe.
Once you retract the probe, you had a bunch of latches around the rim
that were spring-loaded such that when it was pulled back, you would
trip those latches and they’d all latch up. But you had to retract
that probe to get back at that. The Apollo 14 crew kept trying to bang
into the Lunar Module, and they couldn’t get two out of the three
indications to come on to retract the probe. Due to concerns that we
might one day have some relays fail in the sequencing system or something,
I had written out a procedure—we had a test connector on the sequencing
boxes that you had to use at the Cape for going in and checking out
the pyros after they installed before you closed everything out. On
this test connector you had wiring that would go directly into the pyros
if you applied power to it.
I had developed a procedure that if it ever got down to it that we couldn’t
fire a pyro the nominal way and something we needed, we could take a
utility cable or something and cut off one connector and make wires
and be able to go over and insert them in the proper pins and then hook
it up to a utility power outlet and use that switch to operate it. I’d
already written this procedure out that said how you got to the connector
and the box and what pins need to be used. So all of a sudden I thought
gosh, I may have to use that thing. Because there’s a chance if
you retracted the probe and carefully went in you could maybe make contact
and trip those other latches and latch up without the probe capture
latches working, but until you retracted that probe you wouldn’t
be able to do that.
Don Arabian said yes. In those days we always had a Command Module in
the Teague Auditorium. It used to be on display there all the time,
it was usually a spacecraft of one of the previous flights. So I got
one of the other astronauts and we got his toolkit that he has on board,
and we went over to the [Teague Auditorium] and the astronaut got in
there with his tools and basically went through this procedure I’d
outlined to see if we could really do it. We confirmed you could probably
do that, but it was difficult having to make the cable, and you had
to be sure you got it in the connector.
Apollo 14, they finally after many repeated attempts were able to bang
it in there and got the latches, and it worked. They were good, so we
didn’t have to do that after all. But that made me think it’s
occurred on Apollo 14, it may happen again. I finally got through a
change board to have on board what we call a contingency docking cable
that one end would connect up to the utility power outlet and the other
end you just connect right to the Lunar Docking Events Controller test
connector. You didn’t have to worry about getting all their own
pins or anything else, and you’d be able to retract the probe.
On the other Apollo missions, fortunately, we didn’t have to use
that. I’ll mention later on, when we get into Skylab, there was
a case that occurred. The rest of Apollo 14 went fine.
Apollo 15. Everything was fine there except [when] they got into Earth
orbit. As soon as we got into zero g [gravity] we got an indication
on the entry monitor system that their light came on indicating they
might have had an SPS [Service Propulsion Subsystem] engine enabled.
Then shortly it went away and didn’t show up again. Meanwhile,
when we finally did our TLI [Translunar Injection] burn and was on our
way to the Moon, this came up again and stayed there. That’s a
no-go condition to be able to continue the mission, because you’re
maybe one failure away from [inadvertently] firing the SPS engine, which
would be catastrophic. So with that indication on, we were no-go till
we figured out what’s wrong. Even though the service propulsion
system engine wasn’t my system, I still got out the drawings.
I was really looking at that, and I got to thinking this thing has only
shown up when we’re in zero g—it’s almost like it’s
got to be something floating around.
Our section was also responsible for the controls and displays on the
spacecraft. We were responsible for circuit breakers, the panel switches,
and the design of them so we knew what they looked like. I remembered
that in the toggle switches we had on board, even though there was an
insulator around the case, there was a braided type wire that went from
the toggle handle to the contacts. It had fine strands of wire along
to make the bigger wire, to make it flexible so you could operate. I
got to thinking, “Well, what if one of those small strands broke
off and floated and got down in close to the contacts.” Because
this circuit was switching ground, a short to ground would look like
it turned on the switch. The circuits to fire the engine was the same
thing, you switched the ground return to do that. When I was looking
at this, this switch had to do with the entry monitoring system, and
looking at the circuitry that if the short occurred there it would be
in the indication circuit. It’s not in the actual circuit that’s
closing the valve to the engine; that’d be instrumentation.
I went over that with Don Arabian, and Don said, “Well, your theory
sounds pretty valid. We’ll give you an access badge, and you need
to go over to the Control Center and talk to the flight control group.”
So I went over there. Chris Kraft was in the back, so I actually sat
with Chris Kraft and went through the logic, because you didn’t
want to bother the flight directors and the flight controllers on console.
I went through my logic and the drawing, went over that with Chris Kraft,
and Chris Kraft said, “That sounds logical, but this is such a
critical thing, you guys have got to get together and perform a test
to prove absolutely that that’s the case, otherwise we can’t
take a chance.”
We were going to be doing the SPS midcourse correction, an SPS engine
burn on the way to the Moon. I got with the flight control people and
the SPS engine people, and if everything went according to our procedure,
when we made that burn with the SPS engine it would prove that it’s
not engine circuitry and prove that it’s just the instrumentation
part of it. And sure enough, that happened, so the Apollo 15 mission
When we got the hardware back and pulled that switch out, one of those
broken strands had gotten down in the switch. The data of actually taking
the switch apart proved that that was really the case. Because I basically
did save that mission, I ended up receiving a Manned Spacecraft Center
special certificate of recognition for coming up with that. I kept thinking
that evening, later when the mission was still going on, I thought well
I’ll get interviewed on TV. But as everybody knows the guys that
got the TV coverage were the flight controllers. The guys in that Building
45 MER, the engineering guys, we didn’t get any of that. But that’s
all right, even though we provided the flight control people a lot of
the engineering data they used.
I supported all the other missions, but there wasn’t anything
that came out in terms of problems or lessons that I was involved in.
On the other hand, I did get involved in one of the later missions.
On Apollo 15, 16 and 17, we flew the lunar rover that was deployed from
the Lunar Module on the lunar surface. The lunar rover was the responsibility
of the [NASA] Marshall Space Flight Center [Huntsville, Alabama] so
we really weren’t following it per se, but it turns out that even
on Apollo 15 and 16 when they experienced real cold temperatures on
the Moon, they were getting funny readings on the voltmeter and the
amp-hour meter and some of the other meters. They were still able to
operate the rover, but they were having a lot of what appeared to be
unrelated indications on the rover. The Marshall people had formed a
blue-ribbon team or panel to go investigate and try to understand exactly
what it was, and apparently they’d even formed this after Apollo
15, and been working and hadn’t been able to solve it.
Rocco [A.] Petrone was the Marshall [Center] Director at that time.
He called up Don Arabian and said, “Don, we’ve been working
on this a long time, we haven’t figured out what it is, can your
MER team”—we had a history of being able to solve flight
problems—“come look at this and maybe figure out what’s
wrong for us before we make this last Apollo 17 flight?” Don said,
“Sure”. Initially Don said, “Well let’s hurry
up.” I said, “Don, wait a minute, let’s get all the
drawings in here and look over everything ahead of time.”
Going back to my previous example, since they had all these unrelated
instrumentation funnies I was already thinking something with the grounding
system. I got the Marshall drawings. They didn’t have what we
call integrated system schematics where everything gets tied together
like we use on spacecraft, but we did get the so-called wire list. I
made a great big schematic on the wall over in Building 45 there in
the MER room and tied all the grounding system together. Then we had
all the data that indicated which problems they’ve had. When I
was drawing the grounding system, all the grounds associated with the
problems were going to one spot. So we checked into that and it was
a splice. The battery, which was the main power source, had a real heavy-gauge
wire on it, and these other indicators, like the voltmeter and the thing
that read the amp-hours and some other meters, were all low instrumentation,
very small wires, but they were all coming into this single splice.
When you have a large barrel-type crimp splice—on the spacecraft
side there was rules that you shouldn’t use any major difference
in the wire gauge and you shouldn’t put any more than like three
wires and splice a crimp splice and the wire gauge couldn’t vary
by so much. Well, turns out there was four or five wires in this one
crimp splice, and it had this very large battery return wire in it and
it had all these small wires. When you take a crimp and try to crimp
down on it, those small wires were probably not properly crimped like
they should be, and so when you got into the real cold temperatures
and things tend to shrink or contract, apparently that’s when
these wires loosened up in that crimp splice.
The hooker on that in terms of the data was the amp-hour meter they
had, the electronics box for that—the crew would be reading a
real steady increase in amp-hours instead of a decrease in the battery
as they were running the rover. It was a steady rate, just like some
fixed rate. Well, lo and behold, when you disconnect the ground wire
for that electronics box on that amp-hour integrator, the circuitry
in there is looking for a ground. There was like a ten-milliamp draw
on the circuitry. The way they did the amp-hour meter is they had a
column of mercury in there and you transfer mercury from one end to
the other depending on how the current flowed through it. It just so
happened that when you removed the ground from the circuitry, for it
to find another ground through the chassis of the box, this current
through that mercury column would go in a reverse direction, and that
ten milliamps exactly corresponded to the rate of increase on the battery
charger. So that data in itself has pretty much proven that you had
ten milliamps of current flowing through that in the wrong direction.
The other thing we looked at—because the lunar rover had been
checked in a thermal vacuum, the full-up flight had been checked in
the thermal vacuum chamber down at the real cold temperatures and the
hot temperatures—that’s what had gotten the Marshall people
buffaloed on the problem was hey, we fully checked out the design. Well,
when we investigated the qual rover [Qualification Test Rover], they
had solder connections. They didn’t use the crimp connections.
So the lesson here was number one, follow the proper procedures about
not putting the large wires with the small wires in the crimp, but it
also is an indication of a very minor configuration difference between
the test vehicle and flight difference, that using solder connections
instead of the crimp was another factor in them not being able to uncover
The other thing that we found out when we first went to Marshall—we
did listen to their team give us a discussion of everything they’d
done before we even said anything. When we went to Marshall we knew
what the problem was, but anyway we listened to them. What their approach
was, they had each one of the—like the man in the company that
was responsible for the electronic box on the charger, they had that
guy do a failure analysis on his box to determine is there any failure
in his box that would cause that thing to do that. But the individuals,
and each one in these various areas was told to do that, obviously assumed
that external to their box everything was connected up right, because
their action was to see if anything in the design of their box could
cause the problem. They all came back and said, “No, we couldn’t
come up with anything that caused a failure like that.” Of course
they were right because the problem was the grounding outside the box.
If you’re a review panel or something else investigating something,
the point is to go back like we did. Go back to the actual wire list,
go back to the actual drawings, go back to the flight data, make sure
everything fits, review the testing and all details. Needless to say
that committee was pretty embarrassed. Before we made the announcement
and went through our presentation to that team of Marshall folks, Don
[Arabian] called Rocco Petrone up and said, “Rocco, come down
here and we’ll tell you what’s wrong.” Rocco walks
into the room, and I was surprised because they were apparently a lot
more regimented. Everybody at the table except us stood to attention
when Rocco walked in the room, it was almost like a military thing.
Then Don laid out what was really wrong. They were all pretty embarrassed
about the deal. Here it was such a simple thing and they had spent all
this time and effort, and couldn’t solve it. We went away once
again pleased that the JSC mission evaluation team had been able to
solve a problem, and also we were able to get some important lessons
Now we finished Apollo, we went into Skylab [space station]. The first
Skylab crew mission [Skylab 2], as a lot of people know, we had this
thermal problem with the Skylab. It was overheating because it had been
damaged on ascent going up [Skylab 1], had problems in the venting.
I won’t go into that because it’s Marshall-administered,
but apparently the design hadn’t gone through the proper analysis
for venting as you go up quickly. And when that trapped air and atmosphere
in there tried to get out it actually caused structural damage and damaged
the workshop such that they weren’t able to deploy the thermal
shield to protect the vehicle.
Of course the MER was heavily involved in developing some technique
the [Skylab 2] crew could take up to maybe deploy and protect that area.
I wasn’t involved in that, but then when they went up there and
got ready to dock with the workshop they ran into the same problem as
Apollo 14. They couldn’t get the capture latches to engage and
they kept [trying] numerous times, and it still didn’t—in
this case fortunately they had the contingency cable on board. So the
crew was able to connect up the contingency cable and retract the probe
and they carefully went in and latched up those outer latches. And it
worked just like we had hoped it would, and they were able to do the
So in a sense that little special cable ended up getting built, and
putting it on board, did save that mission, and saved all of Skylab
because they could have never docked, and of course they would have
never been able to put up the thermal shield that worked and saved the
How large was this cable that you’re talking about?
The cable was probably only about six feet or so. Initially the thinking
was it was like a standard utility cable they use for powering their
cameras and other stuff, but we made sure that the length was such that
it would definitely go from [the panel] over the right-hand side where
the Lunar Docking Events Controllers were located.
I did talk to PJ [Paul J.] Weitz, he was on that mission, out of curiosity
because I never had heard. I asked PJ, “Did you guys ever get
any training on that contingency docking cable?” He said, “No,
all we did is they gave us a briefing one time. They said, ‘Oh
by the way there’s this contingency docking cable on board if
you ever need it.’” So he said they never got to use it
till they got on orbit, but at least they’d been told it was there.
Of course we on the ground, the flight control team, told them.
The other thing is that on the last crewed mission to Skylab, which
was considered Skylab 4—Skylab 1 was the one that launched the
workshop and 2 was the crew mission, and the third [crewed mission]
was called Skylab 4. Ed [Edward G.] Gibson was on that mission. Ed,
it turns out, was the chairman of our Orion standing review board I
just recently was a member of.
On the Skylab 4 mission we did have a problem with one of the circuit
breakers not closing to get ready for reentry early on when they were
checking out. I developed a procedure in case that breaker didn’t
ever close that we could still connect up that battery using the connections
that normally would power the inverters. Turns out we didn’t have
to use that procedure. But something that did occur on that mission
that could have been catastrophic that Ed Gibson reminded me about is
that on the deadfacing of circuits—remember going back to that
one problem—it turns out there’s circuitry going to the
Service Module for the SPS, service propulsion system, gimbal motors.
You’ve got three circuit breakers, pitch, yaw and roll, for the
SPS engines. There’s also three breakers called SCS, stabilization
and control system. That’s your automatic control system, pitch,
roll and yaw.
Those three breakers for the SPS and the three breakers for the SCS
were located on the same left-hand panel that the commander would operate,
and the breakers were located close to one another. When they were getting
ready for doing the Command/Service Module separation, they go through
the checklist to make sure they deadface, which some of that is opening
breakers. The checklist called out to open up SPS pitch, yaw and roll—SPS.
Well, here you got SCS pitch, yaw and roll. For whatever reason, he
pulled the SCS breakers. He didn’t know it. He pulled the three
SCS breakers. When you jettison the Service Module you’re in an
orientation such that the Command Module is in what we call apex forward
position. That’s the pointed end forward rather than the heat
When they separated from the Service Module—and of course they
lose the Service Module control—he went to his hand controller
to orient the spacecraft around to the proper orientation for the heat
shield, and guess what? Nothing worked because those SCS breakers were
open, he had no power to his hand controller from the automatic system
side of it. They were beginning to get worried because if they were
to come in forward like that, you’d cause the loss of the vehicle
because you’d be coming in without the heat shield, and you’d
burn off the end that’s got the parachutes and everything else.
So they would have lost that crew. Well, as a backup we had what we
called manual RCS control. There was a switch that allowed power to
go from the hand controller—instead of going to the automatic
system, the power would go directly to the RCS jets in other words.
They remembered they had this manual RCS control switch, so they flipped
it, and sure enough they oriented around to the proper direction and
came in and everything was okay.
The crew themselves didn’t realize it till they got on the ground
that the whole problem was caused by the mistake they made, but the
lesson out of that has to do with the design and the layout of switches.
You can see if they’re putting three functions that had to be
open and three functions that had to be closed labeled almost identical
in the same location is just setting yourself up for a chance of crew
error. That was the real lesson that came out of that, and fortunately
we had the manual capability otherwise they might have never figured
That was the last Skylab mission, Skylab 4. The next for Command/Service
Module effort to follow was the Apollo-Soyuz Test Project [ASTP]. I
was assigned to Working Group 4 on that. It was my first experience
working with the Russians, and I got to make my first trip over to the
Soviet Union shortly before the launch back in May of 1975.
Gary, can you tell us when you learned that you were going to begin
working with the Russians and your thoughts of this partnership?
Back in 1973, maybe even beginning a little bit in ’72, NASA had
already as an agency decided to jointly work with the Russians. The
NASA Administrator that really came up with it is [Thomas O.] Paine,
and it goes all the way back to when [Richard M.] Nixon was president.
Paine had been thinking at that time, even though we were in this competition
with the Russians, that we ought to try to work together. He was especially
concerned about there ought to be a common way of rescuing one another
if need be during orbit.
So Paine was on the same Air Force One [presidential airplane] with
Richard Nixon. They were actually flying out to the Pacific to greet
the lunar Apollo 11 team, so that goes that far back to 1969. Paine
at the time asked President Nixon about his idea that we ought to work
together and try to develop something, and Nixon gave Paine the go-ahead.
It took quite a bit of time and several summit meetings, but then they
finally reached agreement between the US and also between NASA and the
Russians to come up with this joint mission. That became the basis of
it. It was very exciting to me, because we did always have an admiration
for the Russians because they were first in so much stuff and done so
much. It was one of these things that we [were] just really interested
in knowing more about them. They knew a lot about us, more so than we
even thought they did, but we knew very little about them. You’re
always interested in what they were doing. So it was very interesting
to me to work with the Russians when they came over, and I became impressed
with some of the things they did and the way they did things. I was
lucky to be with Working Group 4, which turned out to be the only working
group that got to go to Baikonur [Kazakhstan], their launch site, which
was really off limits back in those days. The reason for that is NASA
had provided the Russians a Lunar Module transponder—that’s
the thing that you use for the signal to dock with the Lunar Module,
or in this case we were going to be docking with Soyuz [spacecraft].
It gave the Russians a Lunar Module transponder that was going to be
mounted in the Soyuz. Once we docked with the Russians we were going
to have to have a way to connect up cables between the two spacecraft
for both TV and audio.
We went over to be at Baikonur to be there involved in the actual checkout
of the Lunar Module transponder, to check that out in the Soyuz spacecraft.
That’s the reason we were there, and we actually spent ten days
at Baikonur going out there to do the checkout. I was responsible for
the cabling that we do, so I actually got to go inside the Soyuz spacecraft
to check to see where best to put the so-called speaker box that the
crew would use when they were over there, and it would be hardwired
back to the Command Module. The Russians used what we would call Velcro
also, so went in there to see what it was like.
The Russians were concerned. They wanted to make sure that their part
of the mission came off right. They actually had two spacecraft all
ready to go for the ASTP missions, two launch pads, two launch vehicles.
While I was there I got to go in the two spacecraft. They’d told
us that both of these spacecraft were identical. I went in the one spacecraft
and saw a good location, a shelf and had some Velcro. I went in the
next spacecraft and the Velcro wasn’t in that same spot. So when
I came out—we always met in the evenings with them to tell them
what all happened, we’d jointly get together—I started off
by asking, “Are you sure that both these things are identical?”
“Of course yes, oh yes, they’re identical.” Then I
pointed out that there was this difference, and you could see they were
visibly upset. They insisted that that couldn’t be right. “They’re
identical, you must have been wrong.” I didn’t argue. The
next day, first thing in the morning, I was told I was to go in and
look at the other spacecraft. So I went in there and you could still
smell the glue—they had glued the Velcro in that spot. I came
back out and said, “Yes, everything’s fine, we can mount
it in the same place.” But it was an indication of how they did
not want to be embarrassed.
At the same time we knew we were monitored. We also checked out the
TV equipment while we were there, the signal. We were in one of the
rooms upstairs, and there were windows there and we weren’t allowed
while we were there to take any photographs or anything, very well restricted
to an area all the time, and we knew we were being monitored. An engineer
from Westinghouse [Electric Corporation]—Westinghouse was responsible
for the TV—he was kind of a cutup all the time. One day we were
going to run the TV test. The Russians had stepped out or something,
so we were by ourselves. He says, “Hey,” in kind of a quiet
way, “Why don’t we pan the TV out the window since we can’t
take pictures?” In those days we didn’t record anything
so there was no recording in the TV, it was just TV. Well, next day
when we got ready to run the tests, the blinds were all pulled, and
of course what we were doing was just doing that to see if we proved
we were being monitored.
You weren’t alone.
We weren’t alone. We all got a big kick out of that.
What an interesting time period for you to be there and be able to work
in that environment where no one had actually gone before.
Right, right. It turns out just briefly before us that Tom [Thomas P.]
Stafford and Vance [D.] Brand and Deke [Donald K.] Slayton had made
arguments insisting that they wouldn’t do the mission unless they
got to go there. So they briefly got to go there on just a real quick
thing, but we were the only ones to be there actually for that extended
period of time working. We actually stayed at what they called the Cosmonaut
Hotel. At the time the town was called Leninsk, named after [Vladimir
Ilyich] Lenin. It’s the place the cosmonauts stay at now, the
same place. We went back there every night, and there was always an
empty bus behind our bus that transported us, the idea being if one
bus had a problem we’d go to that one. Even around the Cosmonaut
Hotel you had a barbed wire fence all the way around, and it was always
being guarded so we were always being watched all the time. We left
our cameras in the rooms and we’re pretty sure they checked to
make sure the frame count on the cameras was what it should be.
Otherwise they really tried to be very nice and accommodating. You could
tell in the building we were in that the floors were polished, everything
had just been painted, just spiffed up just right. In the little breakout
room we had—this is in a desert type area, so it gets pretty warm
during the day—there was a room air conditioner. We look, and
it’s Whirlpool [Corporation]. They had bought it probably just
for our visit, because that’s the only place there was a room
with an air conditioner. They knew that things were air-conditioned
over here, so they’d gone out of their way to make sure everything
was just as good. And they wore these white coats and dressed a lot
like we did.
The other thing that we found out which was strange is they kept insisting
that when we were doing our testing it had to be in 30-minute blocks.
We’d have to stop. Well, come to find out, because their spacecraft
didn’t have active cooling, there was a timer in the Control Center
independent of the flight control team that at 30 minutes it turned
off all power to the spacecraft automatically. For a long time we couldn’t
figure out why they kept insisting we could only do the test for 30
minutes. I guess they were embarrassed about it. Then they finally indicated
to us that there’s this timer that turns the power off. We understand
that, cooling. But it’s funny how they didn’t want to explain
initially what that was about.
Did you feel in your findings that the spacecraft was a good spacecraft?
Oh yes, yes. The other thing that we did getting ready for that mission—and
a lot of people didn’t realize—we worked on joint safety
assessment documents. We worked on a large number of detailed joint
engineering documents. Those documents detailed the Soyuz systems, the
safety of them, what they’d done. Likewise we shared with the
Russians the design and the operation and the safety of the Apollo spacecraft.
Matter of fact, here recently I ended up having to write a paper for
Bryan [D.] O’Connor on the safety of the Soyuz, and a lot of that
report I did was about what all we did way back in Apollo-Soyuz to make
sure it was safe for our crew to go over to the Soyuz spacecraft. Even
though it was on orbit, we didn’t launch on it. Likewise the Russians
came across. [NASA/SP-2010-578 - NASA
Astronauts on Soyuz: Experience and Lessons for the Future, August 2010]
To do all that we had what we called a Docking Module because the Command
Module operated at 5 psi pure oxygen, and the Soyuz spacecraft worked
at nominal 14.7 mixed gas atmosphere so to transfer crews you had to
go through an air lock. Our crewmen would have to pressurize the Docking
Module to 5 psi pure oxygen, and then go in there and shut the hatch
behind them, and then you add the nitrogen and other oxygen to it to
build it up to 14.7 mixed gas, and then you’d open up the hatch
to the Russian vehicle. Of course you did the reverse to bring the Russians
over to the Apollo spacecraft.
Now we come to the mission itself. This is where I’ll have a couple
lessons that I mention, because we had some problems. First, Tom Stafford
was the commander for ASTP, and Tom Stafford was also the commander
back on Apollo 10. The early Apollo crews were always concerned about
making sure the parachutes didn’t come out early. We had a panel
switch that said ELS auto, and if you had that switch in the automatic
position when you got ready to return, then the parachutes would deploy
automatically at the correct altitudes based on the barometric switches
we had inside the sequencers. That’s something we usually wanted
to have the crew do because before Command/Service Module separation,
later you get blackout during entry, you don’t get any data. So
we were always arguing, and the spacecraft was designed to put the switch
in auto, such that after we’ve lost contact with them, even if
they did nothing else, we’d know we’d get the capsule back.
But at least early on [the crews] were worried about that’s a
single switch, what if it were to short and inadvertently enable the
system. Even though the baro-switches would be open, they were still
concerned about enabling that system and applying power to it early.
So they always insisted on not turning that switch to auto until they
got down to like 40,000 or 50,000 feet during entry, and then arm it
up and let the [para]chutes come out in the proper sequence.
Because of that concern, and because I always myself worried since I
was responsible for the sequencing system, I always wanted them to arm
it up and make sure things were right. I argued through the program—and
at the time Aaron Cohen was the Apollo program manager—I argued
very long and over many trips to the control board that we needed to
add a redundant switch in there so they had two switches, and the switch
contacts would be put in series so a single switch contact would not
enable the system. Turns out in ground testing one time we did have
one contact fail so that’s when the program said okay, we’ll
do that. So they added the redundant switches with the redundant contacts.
Then the Apollo crews did agree to go ahead and go to auto, and we’d
been doing that on the later Apollos—14, 15, 16, 17. Came up to
getting ready, going through reviews over the procedures with the ASTP
crew. Tom Stafford kept insisting that he was going to not put the switches
in auto before separation. I personally argued with him that we purposely
made this design change to allow that to happen and we wanted to make
sure that that would take place, and the previous Apollo flights the
crews had been doing that and things had been fine. Tom insisted, “No,
I’m not going to do that till the normal time like I did on Apollo
10.” He said, “We’re never going to forget to put
out the parachutes, we’re never going to forget to put out the
parachutes.” Famous last words.
They were coming in for entry on ASTP and they were getting lower and
lower and lower, and nothing was happening. We did have the capability
to manually—we had push buttons that you could flip the switch
open, and it was guarded, and you could arm the system up and go ahead
and individually jettison [deploy parachutes]. Without messing with
that auto switch you could automatically punch out the apex cover and
punch out the drogues and punch out the mains and do all those steps
individually. All of a sudden the crew recognizes hey, we’re way
low. So they went through their manual steps for doing that, not recognizing
that they failed to put the switch in auto. Of course we didn’t
know any of this was going on because this was all during the blackout
It turns out that when they were doing this at low altitude, part of
that sequence is to dump propellant. You didn’t want to land with
the RCS propellant in the tanks in case they broke or whatever. So when
you say dump, you’re firing all the jets to get rid of the propellant,
but you always do the loading such that one propellant runs without
the other. N2O4 is actually more toxic than the MMH, which brings me
back to mention something about Apollo 15.
Apollo 15 was the one and only mission where we lost one of the main
parachutes when we landed. We only landed with two chutes actually deployed.
At that time, because the N2O4 was considered more toxic, the MMH was
loaded more than the N2O4, such that when you were in this dump sequence
you were dumping MMH, you were not dumping N2O4. After this when we
were trying to understand why the Apollo 15 chute was lost, the testing
showed the MMH coming out of the hot engines was actually burning above
the spacecraft in the atmosphere high. We were lucky that it only burned
one of the parachute risers. Because we found out this MMH would be
burning, it was decided let’s make the N2O4 because it didn’t
have the burning problem, it’s already the oxidizer rather than
propellant—load it so that when you get to the dump sequence you’re
dumping N2O4, not MMH.
Now going back to ASTP, the crew were down at a low altitude when they
were going through this dump sequence. When they were dumping N2O4 overboard,
they were low enough altitude the cabin relief valve was venting from
the outside in. Now very toxic N2O4 fumes were being sucked inside the
Command Module. The ASTP crew got exposed to higher levels than most
people have ever seen before. They spent a couple weeks after that mission,
people didn’t realize, in the hospital under observation getting
cleaned and X-rays.
It turns out it was a blessing for Deke Slayton because in the very
careful X-rays and analysis they were doing of his lungs they found
a small spot, turned out to be cancer. They took that out. Deke had
been a real heavy smoker. Deke lived a lot of years after that, but
later as we know, Deke eventually did die of lung cancer, but he lived
a lot longer because they found this at a stage it’s almost hard
to detect. The only reason they found it is they were doing all these
special procedures because they’d been exposed to the N2O4.
I talked to Susan [N.] Brand. Susan Brand works for NASA now, and she
was Vance Brand’s daughter. Unfortunately Tom Stafford always
let Vance Brand, since he was the command module pilot, take the blame
for not throwing the switch. Susan told me that really bothered Vance.
The command module pilot’s job was to throw the switches, the
commander’s job was read the checklist. Tom skipped over and forgot
to call out the ELS to auto [command], so Vance didn’t throw the
switch because it wasn’t called out. Though Tom does say in his
book that he came out with later [We Have Capture, 2002] that there
was that mistake.
Going back to the ASTP mission, [Thomas P. Stafford] did the initial
docking with the Russians, and it went super smooth. Tom was an outstanding
spacecraft pilot. He did outstanding dockings in Gemini and his dockings
on Apollo 10, and the docking here was super smooth, right on. There
was also going to be a second docking attempt and a flyaround, and this
was Deke’s first space mission. Initially, which was probably
an indication of concern, the Russians even commented that the Command
Module was doing the flyaround the opposite direction of what the checklist
and all the planning had done beforehand. Then, when he got in position
to try to get ready to do the docking, the lighting conditions weren’t
what they had been planned pre-mission. When Deke was coming in, the
lighting was such it tended to block out the docking target. Meanwhile,
Deke thought he was in close enough anyway. Even though he couldn’t
see the target, he pressed on. He slammed into the Russians so hard
they thought they had been done in. Then the vehicle swung around, it
stroked the docking system to the max limits. If you’ve ever seen
a view of ASTP, the Command/Service Module is a much larger vehicle
than the Soyuz. So you had this very large vehicle coming in and slamming
and hitting at a little bit of an off angle and a much harder force
than ever planned on, so the Russians were scared to death, them and
the ground controllers. They thought they had really been severely damaged.
Nothing, of course. Per our usual rules in writing up our flights we
never mention crew procedure problems.
There’s some lessons that came out of that, particularly the thing
about the switch not armed, circuitry. Then also there’s lessons
there about how one thing led to another. This change in the propellant—because
we had a problem we went to the N2O4, which was more hazardous. I believe
that’s all the lessons out of ASTP, then we can go into the Space
Shuttle and the orbiter design.
After the Apollo 1 fire, one thing that was done is what we call management
walk-through inspections where myself, being responsible for power distribution,
was responsible for wiring. Just before the Command/Service Modules
were shipped to the Kennedy Space Center, the NASA subsystem managers
and their North American or Rockwell counterpart as engineers actually
got to go and actually crawl in. They’d open up the panels and
you got to inspect, so I got to inspect all the wiring. That was a part
of after the Apollo 1 fire, make sure everything was all right. We had
not only me looking at the wiring, but you had materials experts making
sure the materials were right in the right quantities they had to be,
had people responsible for plumbing. Did that on every vehicle.
This goes back to the ASTP vehicle. We had what we call a SIM bay, Scientific
Instrument Mission bay, in the Service Module to have experiments on
when you were in lunar orbit. We had booms that went out on some of
these, and you had limit switches to indicate whether the boom had been
retracted far enough away that you could fire the SPS engine without
that boom coming back and banging into you. We even had a pyro system
if need be to sever that. On one or two of those missions we’d
had a problem with the limit switches not sensing like they should,
and a problem with the booms. When I was doing the wiring inspection
on the Service Module for the Apollo-Soyuz missions at Downey [North
American Aviation, Inc. plant at Downey, California], I was looking
carefully at those same limit switches because we’d had that previous
problem. I noticed that the little lever arm that’s supposed to
trip the switch was not making very good contact with the boom piece
itself so I flagged that as part of this walk-around inspection.
Then we were checking how’d that get missed. The quality people
always inspect [the vehicle] to make sure it’s per the installation
drawing. Turns out this was per the installation drawing. The problem
was there’d been a long time lag since the last Apollo flight.
When they’d had this same problem back earlier they’d made
an EO, engineering order. Instead of changing the actual drawing, which
is more expensive, they had an EO which would have an attached small
drawing that shows the change that was made, that modified the limit
switch and moved it such that it would make better contact with the
boom. That was on the EO. When they came to the drawings for the ASTP
mission, it was going to have a SIM bay in it also. They pulled those
drawings out to do that, but they failed to pick up that EO. When the
quality people inspected, it was per the drawing, but it wasn’t
per the design change that was in the system. The designer can look
at something and say that wasn’t designed the way it ought to
be. That was the beauty of this wiring inspection. Of course there’s
a lot of other little things we often picked up, but that was one of
the major ones. We did carry that process over to the Shuttle as well.
Other Centers don’t do that, but JSC always stated on any of the
manned spacecraft that we were responsible, we’ll do these final
inspections that way. That was carried over to the Space Shuttle orbiter,
and on one of those walk-through inspections on the first orbiter, Columbia,
one of the Rockwell design engineers picked up on this. They were out
there looking at the plumbing. The Freon [coolant] on those lines that
went out going through the payload bay—according to the design
they were supposed to be mounted on isolation standoffs from the actual
structure, because you had a metal line and you wanted to make sure
it was thermally isolated. Actually there were heaters on that line
to make sure it stayed warm.
Well, when he was out there inspecting those lines, they were actually
mounted to the aluminum structure. The thermal insulators weren’t
on the lines. So he caught that, and it’s a good thing that he
caught that because if we’d ever gone into flight, which may have
been the only time we’d pick it up, those lines would have probably
frozen, because the heaters wouldn’t have been capable of keeping
up with them, would tax the structure that way. That was the lesson
there. That was another thing about how these walk-through inspections
by the designers were able to pick up something, because it turns out
that was a mistake in the installation drawings. The quality people
are inspecting per the hardware drawings, but they don’t look
at the design criteria that went in before then.
That’s interesting. Were there others or is that the main one
you can think of?
Those are the two biggies that stand out. The one I was involved in,
and then this one was a major item. There were other things found, but
these were the two major, the reason I remember.
When did you start getting involved in the Shuttle operations?
I was still in engineering. At that time I was a section head, and we
were still responsible for designing the power distribution system.
We developed a power distribution lab that’s JSC that included
all the contactors [electrical power switches]. One of the design changes
we made was changing the wire insulation from the Teflon, which had
all the problems we had in Apollo, to Kapton, which is a tougher, harder
wire insulation. We made sure there was a lot more wire trays and covers
to protect the wiring. That’s the reason I was always involved
still in doing the wiring inspections on the orbiters. We also helped
develop the SAIL [Shuttle Avionics Integration Laboratory] that was
While I was in engineering I got asked to go over to be on Dr. Kraft’s
staff. Dr. Kraft had a management training where they would invite engineers
to come over and work for three months on the ninth floor and we were
staff. I didn’t know anything about the program at the time, but
I got identified—they’d requested I be one of the people
to go up and work there, and I did. Previous to that I’d always
had an interest in maybe going to work for flight operations, but it
turns out early on in Apollo Engineering Directorate had disapproved
my request. At the time flight control had some positions opening and
wanted to hire me, but because I was subsystem manager engineering they
refused to let me transfer, so I stayed in engineering with them.
While I was up there on that training program with Dr. Kraft, the idea
was when you finished the program you would go back to the organization
you came from. It turns out that prior to me doing that, my former branch
chief that was real knowledgeable about power distribution, had retired.
Instead of having a chance to compete for the branch chief job, me and
the other section head were still section heads, and a GS-15 manager
that was basically on staff with the division was directed to come down
and be the power distribution and sequencing branch chief. He really
didn’t have a background or real interest in power distribution
so I wasn’t all that enthused about going back to working in that
branch. In the meantime George [W.S.] Abbey, who was in charge of flight
operations at the time, gave me an offer to come over and be the deputy
branch chief to Rod [Thomas Rodney] Loe in what was called Flight Control
Division at that time. [M.P.] Pete Frank [III] was the division chief.
So I accepted that job and went over to be in flight operations.
That branch had the INCO [Instrumentation & Communications Officer]
section, which Ed [Edward I.] Fendell was the section head on, and Bill
[William L.] Peters headed up the electrical section, which would be
the EGILs [Electrical Generation and Integrated Lighting Systems engineers],
and then Charlie [Charles L.] Dumis was the section head for the environmental
control or EECOMs [Electrical, Environmental & Communications Controllers]
in the training. When I went over, I was able to be in training as a
flight room flight controller at the EGIL position, given all my electrical
background. At that time when we were getting ready for the STS-1, a
lot of branch chiefs were the actual flight controller people who picked
out the most experienced people to be on the flight control team for
that first Shuttle flight, because we were launching it without a manned
flight that preceded. I was the orbit EGIL for that mission.
Right after that STS-1, which flight went well, Gene Kranz put out an
order that branch chiefs would no longer be allowed the fun, if you
want to call it that, of operating a flight control position. You had
to focus on being branch chief, and you’d work what we called
SPAN [Spacecraft Planning and Analysis]. SPAN is where the managers
worked. That was an interface between the flight control team and the
MER, so I was banned to SPAN as they say.
About that same time Gene had a reorganization. They were going to organize
a separate Flight Director Office, and Pete Frank was going to head
it up. Pete Frank wanted me to go over and be a flight director, which
at one time was one thing I really wanted to do. At the same time Gene
Kranz was reorganizing the Systems Division and organizations. He wanted
to create a new branch in the Systems Division that had upper stages
and RMS [Remote Manipulator System] and mechanical systems. He came
to me and wanted me to be the branch chief for that new branch. I decided—well,
it’s tough to tell Gene no. I figured when it came to competition
for a GS [government service level]-15, I’d have a better chance
at getting it as a branch chief than I would being the rookie flight
director. Because everybody in the Flight Director Office—their
whole life had been flight control, so I knew I’d be the low man
on the totem pole to ever make flight director over there. So that’s
what I opted for.
It was an interesting branch, it had all these new elements to it. One
of the areas was the upper stages. We had one case that comes lessons
learned. It had to do with the Space Shuttle STS-5 mission. That was
going to be the first mission that we launched satellites from the Shuttle.
They were called PAMs, payload assist modules, built by McDonnell Douglas
[Corporation]. We were going to have two of them in the payload bay.
When we were at Kennedy Space Center getting ready for going through
some of the ground checkouts of the system, all of a sudden instead
of going through the test sequence for launching the satellites, it
started going through the flight sequence and undoing latches.
It turns out at the pad the lines were not hooked up to the pyros or
ordnance system, so there was no way you could fire the motor, which
would have been catastrophic, but it did operate other functions. If
they’d been connected up, it would have caused a problem because
all of a sudden this thing was going through the flight sequence. Here
it was pretty late, close to launch so I got asked to go out to investigate
with McDonnell Douglas people what could have caused that with their
sequence controller. They had two controllers.
We were able to finally pin it down to one of the memory locations.
It had solid state memory in the computers, and on the solid state memory
you had a voltage on it to be one and then it switched to ground for
zero. Well, one of those little transistors in the solid state memory
had shorted to ground so it always read zero. When the software was
loaded, and there’s lessons here, there was only a one-bit difference
between the test sequence command and the flight sequence command. The
flight sequence was a zero and the test command was a one in that particular
slot location. When the test program was loaded it just so happened
that particular memory location that’s always going to be reading
zero was the one that was looking at that time. It read a zero when
it should have been reading a one, and that’s the reason it went
into the flight sequence.
We quickly corrected that in the computers, and then because we knew
that could go into an inadvertent sequence like that, we put in some
inhibit switches such that you would only enable that system—and
the heater system would be enabled on a different arrangement—if
you got on orbit such that you were ready, the payload bay doors were
opened and ready to deploy. That way if the computer inadvertently went
into that, you’d still be okay. That worked. There was a lesson
there in terms of the way you build your software.
So in the Space Shuttle and a lot of other things you have to have what
they call a two-bit change. You have to have two memory slots be failed.
The other thing that’s changed also is you had two computers but
they were always in parallel; they weren’t series to one another.
That always brings up another concern about making sure you don’t
put inadvertent commands out from one computer or the other.
Dale [E.] Moore was my RMS section head. Skip [Axel M.] Larsen, who
later became the Space Shuttle payload safety chairman, was my upper
stage section head. Larry [Arthur L.] Schmitt was my mechanical systems
section head. This is one thing that’s different about mission
operations versus engineering. I’ll admit I was a poor manager
in a sense when I was a section head in engineering. What I mean by
that is I didn’t really rely on my people and let my people do
the work. Engineering unfortunately has got a bad structure that even
though you became the section head, you were still being held responsible
for all the technical detail and often being called up to meetings.
Because you felt like you were obligated to do that and know that, you
were involved in a lot of stuff where you should have been focusing
more on administrative matters. It demotivates your young engineers
if they see the manager is doing it.
Well, over in mission operations, Gene really graded you heavily and
ensured that the managers did management jobs and didn’t get involved.
One of the good things when I went to MOD [Mission Operations Directorate]—when
you’re in engineering you’re always pretty much confined
to the discipline you have your degree in, and it was always going to
be in that electrical area. Operations, they shift you around, where
you learn. I was put in charge of a branch that had mechanical systems,
upper stage and the RMS, totally different than the electrical distribution
that I’d been used to. That, in a sense, forces you to stay out
of that. So you relied on your section heads and flight controllers
and you concentrated on making sure the administrative functions of
the branch were being done. At the same time staying technically on
top, because the other thing you did, during simulations you’d
been in the SPAN. You were involved in certifying your own flight controllers.
You’d listen on the loops to score them, see how they did and
so forth. Part of your responsibility is the training and certification
of all the people that you have under you. The branch chief is at the
time the one that did that.
The other thing Gene did is every two years he shifted you around. About
the time you get comfortable in running this one branch, Gene would
shift, did the branch chief rotation. I got rotated over to the DF6
[Systems Division, Guidance and Propulsion Systems] branch, which had
RMS, [RCS (Reaction Control System)], booster systems and GNC [Guidance
Navigation & Control], once again totally out of that area, but
I had to work on that. To show you how long ago that was, I picked Ron
[Ronald D.] Dittemore to be my section head for the RCS system [Propulsion
Systems Section], and [N.] Wayne Hale and [William H.] Gerstenmaier
and all of them were in that same section. So tells you how long ago
Quite a crew.
But I had a really sharp group of people in that group. There was a
lot of flight directors that came out of that particular branch, particularly
that RCS Propulsion Systems section.
Gary, you want to take a break for today, and we can pick up tomorrow?
Then we can finish with Shuttle.
Johnson Photo Gallery
Return to JSC Oral History Website