The Repository Root Cause

The Apollo 13 Oxygen Tank Did Not Explode

August 19, 2026 · Runtime 11:35 · Watch on YouTube

Everyone knows the sentence: an oxygen tank exploded. The Apollo 13 Review Board's own numbers say something else. The pressure in that tank rose from 887 to 1,008 psi, against a burst pressure of 2,200, and the flame crawled along the wiring at about a quarter of an inch per second. It was a slow fire in a sealed sphere — and the damage that made it possible was done fifteen days before launch, on the ground, with nobody aboard.

Chapters

  1. 0:00 One point eight seconds of silence
  2. 0:30 Two things that are not in the story
  3. 1:03 What was actually inside the tank
  4. 1:43 The part that existed only to say no
  5. 2:10 1965: the specification changes, the switch does not
  6. 2:55 Why five years went by without a symptom
  7. 3:49 A crane accident in Downey, 1968
  8. 4:39 The tank that would not empty
  9. 5:20 Eight hours on 65 volts
  10. 6:09 A thousand degrees inside a sealed sphere
  11. 6:39 The instrument was not blind
  12. 7:27 The decision to fly it
  13. 8:10 It was a fire, not a detonation
  14. 9:10 A protection that was never exercised
  15. 10:08 The fix was a thermometer, not a switch
  16. 10:47 Four episodes, one shape

Transcript

One point eight seconds of silence 0:00

At fifty-five hours, fifty-four minutes and fifty-three seconds into the flight of Apollo thirteen, telemetry from the spacecraft stopped for one point eight seconds. The crew heard a bang. When the data came back, one of the two main electrical buses was dead, oxygen was draining from a tank that had shown no fault since launch, and a panel the size of a door was missing from the side of the service module. They were three hundred and twenty thousand kilometres from Earth.

Two things that are not in the story 0:30

You already know the sentence that goes here. An oxygen tank exploded. It is in every documentary and in the film, and it is the shape of the story almost everybody carries. The accident report contains two things that are not in that story. The first is that the tank probably did not burst. The pressure inside it never came close to what the tank was built to hold. The second is that the damage which ended the mission was done fifteen days before launch, on the ground, with nobody aboard.

What was actually inside the tank 1:03

Start with the object. Each service module carried two spherical tanks holding oxygen as a supercritical fluid -- neither liquid nor gas -- at about nine hundred pounds per square inch, loaded at two hundred and ninety-seven degrees below zero. Inside each tank were two electric heaters, to raise the pressure as oxygen is drawn off, and two fans to stir the contents, because in weightlessness nothing rises and nothing settles. All of that wiring ran inside the tank, insulated with Teflon. The tank was assembled through a single opening at the top, and once it was welded shut nobody could look inside it again.

The part that existed only to say no 1:43

One part in there existed only to say no. Bolted to the heater assembly were two thermostatic switches, set to open and cut the heater current when the temperature reached eighty degrees Fahrenheit, give or take ten. They were the only thing standing between the heaters and the wiring around them. They were rated at seven amperes at thirty volts direct current, which was the correct rating, because the spacecraft runs on twenty-eight.

1965: the specification changes, the switch does not 2:10

The original specification, written in nineteen sixty-two by North American Rockwell for Beech Aircraft, said twenty-eight volts. In nineteen sixty-five North American issued a revised specification. The heaters were now to run on a sixty-five volt supply for tank pressurisation, because that is what the ground equipment at the Cape used, and a higher voltage fills a tank faster. Beech ordered the switches for the new tanks and did not change the switch specification to match. The review board's phrasing is worth quoting. The discrepancy was not detected by NASA, North American or Beech in their review of documentation. It was a serious oversight in which all parties shared.

Why five years went by without a symptom 2:55

Now the part that explains the five years of silence. A closed switch is one piece of metal touching another. Closed, these switches carried the current at sixty-five volts without any complaint at all. The failure only exists in the act of opening. Pulling contacts apart under load draws an arc, and an arc at sixty-five volts is enough to weld them back together. So the fault could only appear if the switch was ever asked to open. In flight it never was, because that only happens when a tank is nearly empty. On the ground it never was, because the heaters were only ever run with a full tank, which kept the switch cold and closed. And the qualification programme never asked either. The only test of switch opening was a continuity check in an oven, with no load on the contacts.

A crane accident in Downey, 1968 3:49

The thing that finally asked the question began as a crane accident. On the twenty-first of October, nineteen sixty-eight, at the North American plant in Downey, the oxygen shelf was being lifted out of the service module built for Apollo ten, to swap a component. One bolt holding the inner edge had not been removed. The lifting fixture took the load, raised the shelf about two inches, and broke. Everything on that shelf was jarred. It was inspected, leak tested, pressure tested and electrically checked, and it passed. None of those tests could see the thing that had probably shifted: a short coupling in the fill tube, loose enough that it might not be fully connected. A month later the shelf was installed in the service module for Apollo thirteen.

The tank that would not empty 4:39

Seventeen months after that, on the sixteenth of March, nineteen seventy, the countdown demonstration test ran at the Cape. Part of that test is emptying the oxygen tanks. Tank one emptied. Tank two stopped at ninety-two per cent and would go no further. Eleven days later it was still eighty-three per cent full and had pressurised itself to a hundred and seventy-eight pounds per square inch. Pushing gaseous oxygen down the vent line at eighty psi did nothing at all. The explanation they arrived at was the loose fill tube. Gas was leaking straight across the gap instead of driving the liquid out.

Eight hours on 65 volts 5:20

So they decided to boil it off, using the tank's own heaters, powered from the sixty-five volt ground supply. After an hour and a half they switched the fans on as well. After six hours the tank was down to thirty-five per cent, and they cycled the pressure five times to shake the rest of it out. Eight hours of continuous heater operation. Now here is what the post-accident tests found out about those switches. At thirty-one volts, carrying three and a half amperes, they opened and closed with no damage whatsoever. At sixty-five volts the contacts started to degrade at one and a quarter amperes, and at one and a half the switch fused shut the instant it tried to open. The heaters at the Cape were drawing six and a half.

A thousand degrees inside a sealed sphere 6:09

With the thermostats welded closed there was nothing left to turn the heaters off. Later tests showed the heater assembly could have reached about a thousand degrees Fahrenheit in places. Teflon insulation degrades seriously somewhere between seven hundred and a thousand: cracking, opening up along the wire, and in the worst samples disappearing from it altogether. From that afternoon onwards, oxygen tank two was hazardous whenever it held oxygen and was electrically powered.

The instrument was not blind 6:39

The version you usually hear is that nobody could have known, because the tank's thermometer only read up to eighty degrees. That part is true. It is not what the report says happened. The recorded internal tank temperature went off-scale high early in the special detanking, and off-scale high is precisely the reading that means the thermostats have hit their limit and should be opening right now. The electrical record shows they never opened at all. And the heater control panel at the Cape carried ammeters: if a thermostat had opened, the current would have dropped and the needle would have shown it. The board's finding is that these indications were not detected at the time. The instrument was not blind. Nobody was reading it as a question about the switch.

The decision to fly it 7:27

Three days later they ran a second, shorter detanking by the same method. Then came the decision about whether to fly it. Pulling the shelf out and replacing it would take forty-five hours and carried a real chance of damaging something else in the module. So the meeting was about whether the tank was acceptable as it stood, and the meeting was about the fill tube. The reasoning was that if that tube shorted in flight, the energy involved would be far too small to matter, which was correct. Effectively no consideration was given to the eight hours of heater operation. Most of the people in the room did not know it had happened. Twelve days later, Apollo thirteen launched.

It was a fire, not a detonation 8:10

Forty-six hours into the flight, the quantity gauge in tank two jumped off-scale high and stayed there. At fifty-five hours, fifty-three minutes and twenty seconds, the ground asked the crew to stir the tanks, and current went to the fan motors. Ninety-three seconds after that, the telemetry stopped. What happened in between was a fire. Bare wire arced, the arc lit the damaged Teflon, and the Teflon burned. Now take the numbers the report gives for that fire. The pressure in the tank rose from eight hundred and eighty-seven pounds per square inch to one thousand and eight. The burst pressure of that tank is two thousand two hundred. The flame crawled along the wire at about a quarter of an inch per second. This was not a detonation. What most probably failed was the conduit where the wiring passes into the tank -- a tube, weakened by heat, with high-pressure oxygen behind it.

A protection that was never exercised 9:10

The bang the crew heard was a panel leaving. Oxygen escaping into bay four pressurised the compartment, and about twenty-five pounds per square inch of even pressure is enough to blow that panel off the side of the module. It struck the high-gain antenna on the way out, and it left the tank one system leaking. So where is the root cause. It is tempting to stop at the paperwork: a specification changed in nineteen sixty-five and a switch that nobody re-specified. That is the visible mistake and it is a real one. But the reason it survived five years, three companies and a full qualification programme is less comfortable than a missed document. That switch was never once required to do its job. Not in flight, not on the ground under load, not in a single test. A protective device that is never exercised is indistinguishable, from the outside, from one that works.

The fix was a thermometer, not a switch 10:08

So look at what they actually changed, because it is not a better switch. The fans came out of the oxygen tanks entirely -- no moving parts in there at all any more. The wiring that stayed was sheathed in stainless steel. And they put a thermometer on the heater itself, within thirty degrees of the hottest spot, reading from minus three hundred and twenty up to six hundred degrees, with a red line drawn at three hundred and fifty. The design rule they wrote down for the new system was positive indication of system operating parameters. Not a better guess. A reading that means something.

Four episodes, one shape 10:47

Four episodes now, and the same shape under all four. A theory that was right inside the range it had been tested in. A checklist that was complete for every tower built before it. A criterion that was correct about every way a footbridge had ever misbehaved. And now a safety device that had never once been asked to act. Next time, a safeguard that stopped working and did not say so. On the fourteenth of August, two thousand and three, the alarm system in a control room in Ohio locked up and went silent, with nothing on any screen to say that it had stopped. For more than an hour the operators watched a display telling them everything was fine. Fifty-five million people lost power.

Description and sources

In 1962 North American Rockwell specified 28 volts for the heaters inside the Apollo oxygen tanks, with thermostatic switches rated to open at 80°F and to carry 7 amperes at 30 volts. In 1965 the heaters were moved to the Cape's 65-volt ground supply, which fills a tank faster — and nobody updated the switch to match.

For five years it didn't matter: closed, the switch carried 65 volts fine, and it only fails while opening, which happens only near empty in flight or under load on the ground — conditions that never coincided with a full tank on the pad. Qualification never caught it either, since the only opening test was a no-load continuity check in an oven.

On 27–28 March 1970, a tank that wouldn't drain was emptied by running its heaters at 65 volts for eight hours straight. Post-accident tests showed the switch welds shut above 1.5 amperes at that voltage; the heaters were drawing 6.5. The assembly hit roughly 1,000°F in spots and cooked the Teflon off the fan wiring.

The familiar excuse — 'the gauge only read to 80°F' — doesn't survive the record. The recorded temperature went off-scale high early on, exactly the reading that means the thermostat should be opening; the electrical trace shows it never did; and ammeters on the Cape's heater panel would have shown the current staying high. The instrument was not blind.

The root cause isn't the 1965 paperwork. It's that this protection had never once been required to act — not in flight, not on the ground under load, not in a single test. A protection that's never exercised is indistinguishable, from the outside, from one that works. The fix wasn't a better switch: it was a thermometer on the heater itself, reading to 600°F with a redline at 350, under a rule demanding positive indication of operating parameters.

PRINT-READY, FROM THIS CHANNEL

The Failure Atlas, Vol. 01 — Tacoma Narrows · Citicorp Center · Millennium Bridge · Apollo 13 · the 2003 blackout · Hyatt Regency

https://therepository.gumroad.com/l/failure-atlas

PRIMARY SOURCES

The 23 technical plates in this video are illustrations generated for the channel by a diffusion image model, styled to match its cyanotype identity. They are diagrams of the system, not photographs of the hardware, and no person is depicted in any of them.

Root Cause investigates why engineered systems fail, using the official investigation reports and the primary technical literature. Sources for this episode are linked above.

The technical drawings in this video are cyanotype-style illustrations produced for the channel. They are diagrams, not photographs of the real hardware. The charts and dimensioned comparisons are drawn from the figures in the sources listed above.

#engineering #failureanalysis #rootcause #apollo13 #nasa