The MSC Safety Office Activities

¶THE MSC SAFETY OFFICE ACTIVITIES Evolution of Systems Safety Discipline Under the new organization previously described, the MSC Safety Office activities were defined as follows.

1. To examine all phases of each mission for hazards (i.e., flight plans, crew

¶procedures, mission rules, design changes, contingency plans, training, etc. )

2. To examine all mission-related ground activities that involved the flightcrews

¶and backup crews for hazards (i.e., extravehicular-activity (EVA) procedures, crew training, ground test and checkout, simulated flight tests, vacuum chamber tests, recovery training, etc. )

3. To assure that hazards identified in items (1)and (2) were appropriately

¶resolved for future missions and ground operations (Resolution of hazards was to be accomplished through normal channels used to implement the Apollo Spacecraft Program. ) Asapart of the foregoing effort, the safety offices of the major contractors were strengthened to ensure the proper integration of their own and their subcontractors' safety efforts. The MSC did not require that the subcontractors institute a dedicated safety office; it was considered that the responsibility for safety should rest with the major contractors who would eventually receive the hardware/software from the subcontractors. In this manner, the major contractors maintained an overall safety effort' with their own safety staffs. The approach proved acceptable.

¶The Safety Office personnel conducted their duties by active participation in design reviews, test procedure reviews, and the development of crew procedures.

¶As safety issues were identified, they were resolved immediately or were presented to the ASPO for resolution at scheduled meetings and milestone reviews. Typical reviews that safety personnel participated in areas follows:

1. Configuration Control Board

2. Configuration Control Panel

3. Preliminary Design Review

4. Critical Design Review

5. Design Certification Review

6. Customer Acceptance Readiness Review

7. Flight Readiness Review

8. Crew Procedures Change Board

9. Mission Rules Review

10. Launch Readiness Review

¶The ASPO and the MSC directorates involved in the Apollo Spacecraft Program provided adequate forums for formal discussion by the MSC Safety Office of any hazards that required attention. This management visibility in depth, operating in an atmosphere that encouraged personnel with problems to come forth and be heard, was a major contributing factor in enhancing the safety of the Apollo missions. In addition to these meetings and milestone reviews, the MSC Safety Office presented formal analyses and assessments of systems safety and mission risks to the ASPO and to the Center Director at each mission Flight Readiness Review. At that time, the Mission Hazard Analysis (refer to the appendix), which identified safety concerns as well as the rationale for acceptance of the risks, was documented for the Flight Readiness Review Board.

¶Hazardous andCritical Tests The MSC flight safety engineers participated with teams composed of specialists from varying disciplines in reviewing the development and installation of facilities, test procedures, and special safety procedures to support hazardous test activities at MSC. Chief among these were the thermal-vacuum tests conducted in the Space Environment Simulation Laboratory in which manned spacecraft modules were subjected to simulated space environments in vacuum chambers. Safety personnel were concerned with the safety of test personnel and test subjects. They assessed and evaluated the safety of the chambers including the associated plumbing, wiring, evacuation systems, environmental control systems, and pressure vessels. Detailed and thorough operational readiness inspections and test readiness reviews were conducted before commencement of manned tests. Safety personnel had key roles in these tasks and in the development of safety parameters and their limits for use in manned testing.

¶Certified test safety officers participated in the manned tests to ensure adherence to these established parameters and limits.

¶System Safety Assessments System safety assessments consisting of hazard analyses and special safety studies of Apollo contractor-furnished equipment, Government-furnished equipment, ground support equipment, and experiments were performed. These assessments were accomplished by (1) analyses of ground support equipment to determine interfaces with flight hardware that could adversely affect crew safety; (2) performance of detailed evaluations in those design and operational areas shown to exhibit risk potential; (3) performance of or participation in hazard trade-off studies of designs, operational procedures, and mission concepts; and (4) detailed analyses of those proposed changes to subsystems, operational procedures, plans, rules, and activities considered to have safety impact.

¶To aid in the safety analysis of extremely complex systems, "fault-tree" analyses were conducted. These were logic diagrams that represented the mechanical, electrical, and/or chemical interfacing points between subsystems. The analyses were a valuable tool in identifying potential hazards.

¶In the Apollo Program, hazard analyses were performed for man/machine interface to isolate crew safety concerns. Trade-off studies and engineering assessments for compliance with system safety criteria were performed relating to crew safety, operational personnel safety, and system safety. Trade-off studies were also performed for specific hardware and operational areas, so that the relative crew risks for any of several alternative solutions might be compared.

¶Operational safety assessments were performed on crew procedure changes, flight plans, mission rules, crew checklists, and crew training to ensure adequacy and compatibility of crew procedures and flight operations for each Apollo mission.

¶Hazardous procedures were identified and recommendations were made to reduce the risk by modification of the existing procedures. The review of operational tasks resulted in procedure change requests, special studies of potential operational concerns, safety evaluation of mission operations, and documentation of crew and mission operational hazards.

¶Safety evaluations of flight hardware consisted of (1)assessment of the configuration differences between vehicles to determine whether system or subsystem changes had introduced any new hazards into the vehicle; (2) review of waivers or deviations of specifications in manufacturing, test, or checkout procedures; and (3) sneak circuit analyses (SCA) of wiring systems to detect potential hazards from wiring or electrical system incompatibilities. A sneak circuit is a latent electrical path that can cause an unwanted function to occur or inhibit a desired function without regard to component failures. The SCA was first used on the Apollo 7 spacecraft and was performed for all subsequent spacecraft of the Apollo Program, both the LM and the CSM.

¶Mission Risk Assessment Concurrent with the effort to provide system safety assessments, each individual mission was analyzed as an integral unit in an effort to isolate and assess risks to mission operations and crew safety. Once a hazard was identified and evaluated, it was brought to the attention of program management. It was then tracked throughout the mission preparation period until corrected by an engineering or procedural change (usually a decision of the Configuration Change Board or Panel) or approved by the Safety Office and the ASPO as an acceptable risk.

¶Periodic meetings were held with the safety personnel of the major contractors to discuss and evaluate hardware and operational problems that might have potential crew safety impact. The reports emanating from these meetings provided an up-to-date status of safety concerns under evaluation and of safety issues to be resolved. A safety concern was a specific hazard requiring positive action to correct; a safety issue wasa potential hazard, the implications of which had not been completely The status report was forwarded to the ASPO and to the R&QA organizations resolved.

¶which, in periodic meetings with safety personnel, considered each safety concern for proper resolution.

¶A mission risk assessment was performed for each Apollo mission to provide a final and definitive evaluation of residual hazards and risks affecting the crew.

¶The mission risk assessment supported the Flight Readiness Review at MSC. This report highlighted the more significant crew safety risksassessed during the mission buildup period, the results of analyses of these risks, and supporting rationale for acceptance of residual hazards, where appropriate. A portion of the Apollo 16 Mission Risk Assessment is included in the appendix.

¶Mission Monitoring and Postflight Eva1uation The work described in previous paragraphs dealt with preflight safety activities.

¶However, the responsibility of the MSC Safety Office did not end with the launch of an Apollo mission. Mission monitoring support was provided to enable real-time safety engineering support in the assessment and evaluation of mission discrepancies and identification of hazardous trends that might have a potential impact on crew safety or mission success. Continuous monitoring of flight hardware and the flightcrew made possible the identification of real or potential safety hazards. Recommendations for the resolution or elimination of these hazards were routed through the Spacecraft Analysis Network (SPAN) for verification by the appropriate subsystem monitor, and to the Mission Control Center for final approval and implementation by the Flight Director.

¶The Safety Office further participated in the postflight review of failures and anomalies associated with system performance or crew procedures that had safety implications on succeeding missions. Any such failure or anomaly was examined at the appropriate contractor's plant to make a determination of the actual cause. When such a determination was made, the suspect part or procedure for each succeeding mission was reevaluated, redesigned, retested, rewritten, or eliminated.

¶Audits To ensure that the safety requirements were being met and that continued emphasis was being placed on system safety by all participants, periodic audits were performed by the MSC Safety Office at major contractor production, assembly, checkout, and test facilities. The contractors were required to develop system safety checklists that detailed those steps introduced in their facilities to ensure adherence to the safety requirements. The checklists were used by MSC Safety Office personnel at the contractor facilities to provide on-the-spot assurance that the requirements were actively implemented.

¶Motivational Programs To achieve a high level of safety, reliability, and quality consciousness in all program participants, it became evident that a singular motivational program was required. People tend to think of safety, reliability, and quality as abstract terms; the problem was to make that abstraction real, tangible, and relatable and then to keep the awareness of these important functions as an active effort constantly before them.

¶The Manned Flight Awareness Program was introduced early in the Apollo Pro - gram to fill this need. The cooperation of a popular cartoonist was solicited to make his comic beagle "Snoopy" (from the cartoon strip "Peanuts") the principal spokesman for the program. Motivational posters featuring Snoopy in space togs were soon in evidence wherever people were at work on the Apollo Program. The Snoopy messages constantly emphasized the need for care and attention to detail.

¶The astronauts contributed to the success of the program. They attended functions at each of the space-flight centers, honoring contributors to the program by presenting Snoopy pin awards. Apollo crewmen toured the facilities of the major contractors to meet the workers who were building and testing the Apollo mission hardware.

¶Special Studies and Assessments As the Apollo Program matured and progressed, missions became longer and 1 more complex. The NASA began to take optimum advantage of lunar surface exploration through the use of more sophisticated experiments packages and of the command I and service module (CSM) lunar orbits by incorporation of experiment hardware in a , bay of the service module. Each element of growth contained potential crew hazards, and each was the subject of a special safety assessment by the MSC Safety Office.

¶I The principal special assessments are discussed in the following paragraphs.

¶Extravehicular activities. - The Apollo Program included a wide variety of EVA'S beginning with Apollo 9 when the lunar module (LM) pilot first stepped out of the LM while in Earth orbit. The first Apollo EVA safety assessment (conducted before the mission) resulted ina listing of 10 criticality 1 hazards, each of which had to be analyzed to determine its probability of occurrence. Each potential hazard was finally deemed improbable after a lengthy rationale was prepared, which reinforced confidence in the hardware design and testing. None of the following 10 potentially hazardous events occurred.

1. Ventricular fibrillation in the LM pilot could occur.

2. Collision with the spacecraft might rupture the pressure garment assembly

¶(PGA).

3. The EVA astronaut might lose contact with and attachment to the spacecraft,

4. The EVA astronaut might have a failed portable life-support system/oxygen

¶purge system (PLSS/OPS).

5. Undetected carbon monoxide might be present in the EVA astronaut PGA.

6. The open failure of the oxygen purge system (OPS) might cause a rupture in

¶the PGA.

7. The EVA astronaut rescue capability might not be immediately available.

8. The OPS redundancy might be lost.

9. Degradation of the OPS would leave only marginal contingency EVA capability.

10. Loss of the LM attitude control might render the LM unstable and would make

¶recovery difficult.

¶In a similar manner, the first lunar surface EVA on Apollo 11 was analyzed before the mission, and this analysis isolated the following 11 potentially hazardous areas of concern. The Safety Office prepared recommendations for the elimination or reduction of these potential hazards and forwarded them to the appropriate organizations for consideration. Most of the recommendations were accepted.

1. Pyrophoric reaction of lunar material with the LM oxygen atmosphere

¶might occur.

2. A rupture of the lunar contingency sample container might occur in the cabin.

3. Damage to the extravehicular mobility unit (EMU) might occur if a crewman

¶were to fall on the lunar surface.

4. Crewmen might be unable to detect the presence of sinkholes, deep dust

¶pits, or subsurface faults.

5. Because of scratching or tearing on spacecraft protuberances, a compromise

¶of the EMU pressure, thermal, or radiation integrity might occur.

6. Inability of the crewmen to obtain adequate footing on the plus-Z footpad

¶could be caused by dust or debris acquired at landing.

7. Inability to determine the temperature of tools, equipment, et cetera, could

¶result in damage to the EMU upon touch.

8. A fallen crewman might be unable to recover and return to the LM before

¶the loss of EMU consumables.

9. Crewmen ingressoregress could be difficult when the plus- Z footpad is not

¶in contact with the lunar surface.

10. Deployed television camera cable and S-band antenna cables could pose a

¶tripping hazard to crewmen.

11. The crewman inside the LM might be unable to observe the egressing

¶crewman.

¶Apollo lunar surface experiments. - Apollo 11 carrieda comparatively simple package of scientific hardware for deployment on the lunar surface. These experiments, however, had some inherent potential hazards that were assessed before the flight. Of major concern was the fuel capsule for the radioisotopic thermoelectric generator used to supply power to the Apollo lunar surface experiments package.

¶The capsule used plutonium-238 as its isotope, and the. inadvertent release of this radioactive substance was a matter of great concern. The capsule was subjected to analysis by the Safety Office and representatives of the Atomic Energy Commission who concluded that the device was safe to use when used according to the prescribed procedures. To illustrate the thoroughness of this assessment, consideration was given to the possibility that the fuel capsule might be returned to the Earth atmosphere in the event of a mission abort. The analysis concluded that the capsule, as designed, was adequate to survive reentry and would release no radioactivity. This conclusion proved correct when the Apollo 13 mission aborted and the LM (which had served as a "lifeboat" for the astronauts when the CSM was partly disabled) reentered the Earth atmosphere and broke up over the Pacific Ocean. The fuel capsule was still on board and, as predicted by the preflight analysis, did not contaminate the atmosphere with radioactive material.

¶Other significant studies. - Other significant studies made between 1969 and 1972 included a system safety engineering hazard analysis of the LM pyrotechnics and the CSM launch vehicle separation pyrotechnics (Feb. 1969), a LM-6 critical switch study I (Sept. 1969), a CSM circuit breaker accessibility study (Sept. 1969), a LM circuit II breaker review (Sept. 1969), a study of crew distractions during critical mission phases (Feb. 1970), a system safety assessment of the Apollo 12 anomalies and of the failure mechanism during the initial boost phase (Feb. 1970), a study of the active seismic experiment (Aug. 1970), a study of the CSM return enhancement provisions I (Dec. 1970), and a study of the lunar seismic profiling experiment (Dec. 1972).