13 MORE Things That Saved Apollo 13, part 1: The Failed Oxygen Quantity Sensor

In our original series 5 years ago on the “13 Things That Saved Apollo 13,” the first item we discussed was the timing of the explosion. As NASA engineer Jerry Woodfill told us, if the tank was going to rupture and the crew was going to survive the ordeal, the explosion couldn’t have happened at a better time.

An explosion earlier in the mission (assuming it would have occurred after Apollo 13 left Earth orbit) would have meant the distance and time to get back to Earth would have been so great that there wouldn’t have been sufficient power, water and oxygen for the crew to survive. An explosion later, perhaps after astronauts Jim Lovell and Fred Haise had already descended to the lunar surface, and all three crew members wouldn’t have been able to use the lunar lander as a lifeboat. Additionally, the two spacecraft likely couldn’t have docked back together, and without the descent stage’s consumables left on the Moon (batteries, oxygen, etc.) that would have been a fruitless endeavor.

Now, for our first article in our subsequent series “13 MORE Things That Saved Apollo 13,” we’re going to revisit that timing, but look more in detail as to WHY the explosion happened when it did, and how it affected the rescue of the crew. The answer lies with the failure of a pressure sensor in Oxygen Tank 2, an issue unrelated to the uninsulated wires in the tank that caused the explosion.

Apollo 13 crew:  Jim Lovell, Jack Swigert and Fred Haise.  Credit: NASA
Apollo 13 crew: Jim Lovell, Jack Swigert and Fred Haise. Credit: NASA

Most who are familiar with the story of Apollo 13 are acquainted with the cause of the explosion, later determined by an accident investigation committee led by Edgar Cortright, Director of the Langley Research Center.

The tank had been dropped five years before the flight of Apollo 13, and no one realized the vent tube on the oxygen tank was jarred out of alignment. After a Count Down Demonstration Test (CDDT) conducted on March 16, 1970 when all systems were tested while the Apollo 13 spacecraft sat atop the Saturn V rocket on the launch-pad, the cold liquid oxygen would not empty out of Oxygen Tank 2 through that flawed vent pipe.

The normal approach was to use gaseous oxygen to push the liquid oxygen out of the tank through the vent pipe. Since that wasn’t working, technicians decided the easiest and quickest way to empty the liquid oxygen would be to boil it off using the heaters in the tank.

A graphic depicting the details of oxygen tank number 2 and the heater and thermostat unit.  Credit: NASA.
A graphic depicting the details of oxygen tank number 2 and the heater and thermostat unit. Credit: NASA.

“In each oxygen tank were heaters and a paddle wheel fan,” Woodfill explained. “The heater and fan (stirrer) device encouraged a portion of the cold liquid 02 to turn into a higher pressure 02 gas and flow into the fuel cells. A fan also known as the cryo-stirrer was powered each time the heater was powered. The fan served to stir the liquid 02 to assure it was uniformly consistent in density.”

To protect the heater from being overly hot, a switch-like device called a relay turned off heater power anytime the temperature exceeded 80 degrees F. Also, there was a temperature gauge which technicians on the ground could monitor if temperature exceeded 80 degree F.

The original Apollo spacecraft worked on 28 volts of electricity, but after the 1967 fire on the Launchpad for Apollo 1, the Apollo spacecraft’s electrical systems had been modified to handle 65 volts from the external ground test equipment. Unfortunately Beech, the tank’s manufacturer failed to change out this tank, and the heater safety switch was still set for 28 volt operation.

“When the heater was powered up to vent the tank, the higher voltage “fused” the relay contacts so that the switch could not turn off power when the temperature of the tank exceeded 80 degrees F (27 C),” said Woodfill.

Additionally, the temperature gauge on the ground test panel only went to 88 degrees F (29.5 C), so no one was aware of this excessive heat.

A graphic of the interior of the Apollo  13 Service Module and the location of the oxygen tanks relative to the other systems. Credit: NASA.
A graphic of the interior of the Apollo 13 Service Module and the location of the oxygen tanks relative to the other systems. Credit: NASA.

“As a result,” said Woodfill, “the heater and the wires which powered it reached estimated temperatures of around 1000 degrees F. (538°C), hot enough to melt the Teflon insulation on the heater wires and leave portions of them bare. Bare wires meant the potential for a short-circuit and an explosion since these wires were immersed in the liquid oxygen.”

Because the tank had been dropped, and because its heater design had not been updated for 65 volt operation, the tank was a virtual bomb, Woodfill said. Anytime power was applied to those heaters to stir the tank’s liquid oxygen, an explosion was possible.

At 55:54:53 Mission Elapsed Time (MET), the crew was asked to conduct a stir of the oxygen tanks. It was then that the damaged wires in Oxygen Tank 2 shorted out and the insulation ignited. The resulting fire rapidly increased pressure beyond its nominal 1,000 psi (7 MPa) limit and either the tank or the tank dome failed.

But back to the quantity sensor on Oxygen Tank 2. For a reason yet to be understood, during the early part of the Apollo 13 flight, the sensor failed. Prior to launch, that Tank 2 quantity sensor was being monitored by the onboard telemetry system, and it apparently worked perfectly.

“The failure of that probe in space is, perhaps, the most important reason Apollo 13’s crew lived,” said Woodfill.

Here’s the explanation of why Woodfill makes that claim.

Cover to the Apollo 13 flight plan. Credit: NASA.
Cover to the Apollo 13 flight plan. Credit: NASA.

Woodfill’s research of Apollo 13 indicated that standard operating procedure (SOP) had Mission Control request a stirring of the cryos approximately every 24 hours. For the Apollo 13 mission, the first stir came about 24 hours into the mission (23:20:23 MET). Ordinarily, the next cryo stir would not be called for until 24 hours later. The heater-cryo stir procedure was done to assure accuracy of the quantity gauge and proper operation of the system through the elimination of O2 stratification. The sensor read more accurately because the stir made the liquid oxygen more uniform and less stratified. After the first stir, 87 % remaining oxygen quantity was indicated, a bit ahead of expectations. The next stir came about a day later, about 46:40 MET.

At the time of this second heater-cryo-stir, Oxygen Tank 2’s quantity sensor failed. Post mission analysis by the investigation committee indicated the failure was not related to the bare heater wires.

The loss of ability to monitor Oxygen Tank 2’s quantity caused mission control to radio to the crew: “(Because the quantity sensor failed,) we’re going to be requesting you stir the cryos every six hours to help gage how much 02 is in tank 2.”

However, Mission Control chose to perform some analysis of the situation in Tank 2 by calling for another stir, not at 53 hours MET but at 47:54:50 MET and still another at 51:07:41 . Because the other oxygen tank, Tank 1, indicated a low pressure, both tanks were stirred at 55:53.

“Count the number of stirs since launch,” Woodfill said. “1. at 23:20:23, 2. at 46:40, 3. at 47:54:50, 4. at 51:07:44 and 5. at 55:53. There were five applications of current to those bare heater wires. The last three occurred over a period of only 8 hours rather than 72 hours. Had it not been for the non-threatening failure of Tank 2’s quantity probe and the low pressure in O2 Tank 1, this would not have been the case.”

Woodfill explained that anyone who has analyzed hardware failures understands that the more frequent and shorter the period between operations of a flawed component hastens ultimate failure. NASA performs stress testing on hundreds of electrical systems using this approach. More frequent power-ups at shorter intervals encourages flawed systems to fail sooner.

The short circuit in Oxygen Tank 2 after the fifth heater-cryo-stir resulted in the explosion of Apollo 13’s Oxygen Tank 2. Had the normal sequence of stirs been performed at 24 hour intervals, and the failure came after the fifth stirring, the explosion would have occurred after the lunar module, the life boat, was no longer available.

“I contend that the quantity sensor malfunction was fortuitous and assured the lander would be present and fully fueled at the time of the disaster,” Woodfill said.

5 heater actuations at 24 hours periods amounts to a MET of 120 hours.

“The lunar lander would have departed for the Moon at 103.5 hours into the mission,” Woodfill said. “At 120 hours into the mission, the crew of Lovell and Haise would have been awakened from their sleep period, having completed their first moon walk eight hours before. They would receive an urgent call from Jack Swigert and/or Mission Control that something was amiss with the Mother ship orbiting the Moon.”

Furthermore, Woodfill surmised, analysis of Swigert’s ship’s problems would likely be clouded by the absence of his two crewmates on the lunar surface. Added problems for Mission Control would have been the interruption of communications each time the command ship went behind the Moon, interrupting the telemetry so crucial to analyzing the failure. When it became evident, the cryogenic system would no longer produce oxygen, water, and electrical power, those command module emergency batteries would have been activated. Likely, Mission Control would have ordered an abort of the lunar lander earlier, but, of course, that would have been futile. Had the tiny lander’s ascent stage rendezvoused and docked with the depleted CM, all the life supporting descent stage consumables would remain on the Moon.

“The nightmare would have the Apollo 13 crew saying their last farewells to their families and friends,” said Woodfill. “One can only speculate how the end might have come.”

And there likely would not have been Apollo 14, 15, 16 and 17 — at least not for a very long time.

Apollo 13 launch. Credit: NASA
Apollo 13 launch. Credit: NASA

Another aspect of the timing of the explosion that Woodfill has considered is, why didn’t the tank explode on the Launchpad?

Following the March 16 CDDT, no additional “power-up” or tests were planned. However, it is not uncommon for pre-launch re-verification to be performed.

“One such re-check might easily have been these heater circuits since they had been used in a non-standard way to empty the oxygen from the cryo tanks after the Countdown Demonstration Test (CDDT) weeks earlier,” Woodfill said. “Such re-do’s often occur for myriad reasons. For Apollo 13, despite the compromised system, none occurred until the craft was safely on its way to the Moon.”

However, such a routine re-test involving cryo stirring would have unknowingly jeopardized the launch vehicle, support persons, or astronaut crew.

Or, if the quantity sensor had failed on the ground, likely the same kind of trouble shooting that was done by Mission Control and the Apollo 13 crew, would have been performed by the KSC ground team.

Had the sensor failed at that time, a series of heater actuations/stirrings would have been executed to trouble-shoot the device.

“Of course, the result would have been the same kind of explosion nearly 55 hours 55 minutes after launch,” Woodfill said. “On the ground, the Apollo 13 explosion could have taken the lives of Lovell and crew if trouble-shooting had been done while the crew awaited launch.”

If the trouble-shooting had been done earlier, with several heater actuations/stirrings during the days before the launch, Woodfill said, “a terrible loss of life would have ensued with, potentially, scores of dedicated Kennedy Space Center aerospace workers bravely attempting to fix the problem. And the towering thirty-six story Saturn 5 would have collapsed earthward in a ball of fire reminiscent of that December 1957 demise of America’s Vanguard rocket.”

“Yes, the fact that the Oxygen Tank 2 quantity sensor did not fail on the launch pad, but failed early in the flight was one of the additional things that saved Apollo 13.”

Read our introduction to this series here.

Additional articles in this series that have now been published:


Part 1: The Failed Oxygen Quantity Sensor

Part 2: Simultaneous Presence of Kranz and Lunney at the Onset of the Rescue

Part 3: Detuning the Saturn V’s 3rd Stage Radio

Part 4: Early Entry into the Lander

Part 5: The CO2 Partial Pressure Sensor

Part 6: The Mysterious Longer-Than-Expected Communications Blackout

Part 7: Isolating the Surge Tank

Part 8: The Indestructible S-Band/Hi-Gain Antenna

Part 9: Avoiding Gimbal Lock

Part 10: ‘MacGyvering’ with Everyday Items

Part 11: The Caution and Warning System

Part 12: The Trench Band of Brothers

Find all the original “13 Things That Saved Apollo 13″ (published in 2010) at this link.

5 Replies to “13 MORE Things That Saved Apollo 13, part 1: The Failed Oxygen Quantity Sensor”

  1. “To protect the heater from being overly hot, a switch-like device called a relay turned off heater power anytime the temperature exceeded 80 degrees F.” — This is not a relay but a thermostat, which acts like a switch that will open up when it reaches a certain temperature and turns off power to the circuit it is connected to.

    Very interesting article.

  2. What an incredibly fortuitous stroke of luck that the disaster happened when and where it did. Of course it was incredibly short sighted that the voltage upgrade was not done on the tank in the first place. Someone should calculate the odds that an additional failure of the sensor would lead to an incredibly fortunate outcome of setting the explosion of the tank in a small window that would preclude loss of crew. This is a very rare example of two wrongs resulting in a right. I would not be surprised if the odds were 100 million to 1. Then ask yourself if you don’t believe that someone was looking after these brave men as well as the U.S. Space program.

  3. Had the LOX tank exploded on the pad, why would it have killed the crew and /or caused destruction of the Saturn 5? Wasn’t most of the energy directed laterally away from the both the capsule and launch vehicle?

  4. Wonderful analysis! Amazing how many things had to line up (including at least one “needed failure”) for the men to return safely home.

    Two little corrections: The Vanguard explosion was in 1957, not 1958. And the Apollo One fire was in ’67, not ’65.

Comments are closed.