The Apollo 11 Landing: staring-down disaster

The multiple issues that faced the Apollo 11 Moon landing are generally well known. Alarms, fuel, … so many things happened in such a short time that could have led to disaster, or to an abort. Much has been said about the coolness of Neil Armstrong under massive pressure. In the end, the decision to make Apollo 11 a landing attempt rather than a second rehearsal, as it was originally intended to be, was vindicated. However, it could all have ended so differently.

Mission Control during the Apollo 11 moonwalk.

Unlike the later Moon landings, Apollo 11 faced issue after issue after separating from the Command Module, Columbia. The fact that the landing was successful was down to a mixture of Neil Armstrong’s determination to get Eagle down onto the lunar surface, come what may and to the support that came from the flight control team at Houston, who made the right calls and gave Armstrong the information that he needed at the critical moments. What is less well known is some of the background and much of the detail. In particular, the statement that “Neil Armstrong landed with only 20 seconds of fuel” hides a multitude of, mainly little commented issues; not for nothing were the controllers at Houston reduced to nervous wrecks by the time the call “The Eagle has landed” came.

Flight Control Teams for Apollo 11

Mission control worked on 8-hour shifts with three flight control teams. For Apollo 11 the team leaders were Cliff Charlesworth (Lead), Glynn Lunney and Gene Kranz. Apart from the regular shifts, each team got two or three critical mission phases to control. For Apollo 11 there were eight critical phases identified, starting with the launch and ending with the re-entry. In addition, each team covered one of the new mission phases that had never before been tried in space: lunar landing, moonwalk and ascent to lunar orbit from the surface. Cliff Charlesworth assigned his own team the launch and the moonwalk. The ascent and docking in lunar orbit was assigned to Glynn Lunney. And Gene Kranz, who had made no secret of his desire to have it, was given the lunar landing. Each team then had to prepare both the mission in general and the problems that might appear and for their own, critical mission phases.

Gene Kranz, on console, wearing the iconic waistcoat (“vest” for an American) that his wife, María, made for him for every mission. As Kranz was White Team leader, his wife thought that wearing a white waistcoat would be the right symbol for his team.

So, on launch day, Glynn Lunney’s Black Team would start, twelve hours before launch, with the pre-launch check-out. Four hours before launch Cliff Charlesworth’s Green Team would take over and see the mission through launch, translunar injection and the separation of the Lunar Module from the Saturn V Third Stage. And then, four hours after launch, Gene Kranz’s White Team would take over, get the crew to sleep and, while they were resting, work on any anomalies that had been seen up to that point, ideally passing solutions to Black Team to put into practice with the crew then they woke up next day.

Training to land

For the lunar landing team, their assignment meant that they had just eleven days of dedicated training to learn how to land the Lunar Module safely on the Moon, spread over the eight weeks before launch. Or rather, as Michael Collins put it, to learn how to get the Lunar Module close enough to the surface that Neil Armstrong could take over and put Eagle down, if safe to do so. Of those eleven days, just seven would be conducted with astronauts and only six with Armstrong and Aldrin themselves in the simulator, flying the Lunar Module, with CapCom Charlie Duke (later to be Lunar Module Pilot on Apollo 16, the youngest moon-walker, at 36 years old) relaying questions and instructions back and forth.

Not to put too fine a point on it, the training schedule was incredibly, alarmingly tight, even if everything went right. With simulators that were unreliable and that suffered regular breakdowns, life became even more difficult.

June 10^th 1969: Lunar Armageddon

Five weeks to launch. Three weeks into training. The third day of landing simulations. Gene Kranz had his worst ever day as a flight controller.

Seven landing simulations were run through a brutal day. SimSup – the Simulation Supervisor – decided that Kranz’s team was getting over-confident and set out to make them… or to break them.

The first simulation showed the team what was coming. Problem after problem was thrown at the controllers. Every time one was responded to, Charlie Duke called-out another report from the astronauts, or a controller saw another warning light up on his console. The final straw was when the Lunar Module ascent engine started to misbehave. Faced with leaving the astronauts stranded on the Moon, unable to take off again, Gene Kranz called the abort. The crew went through the risky “fire in the hole” procedure to separate the Descent Stage and, moments later, fire the ascent engine to slow their fall to the surface and then to return to orbit. SimSup came on the loop to congratulate him on a correct call. The team felt good. Then things got harder. Much harder.

Simulations two and three set up what was to come. The controllers were on the ragged edge of losing control but, somehow, just about managed to cope with a deteriorating situation and make the correct calls in time.

Simulation four: the three second round-trip communication delay between problem and reaction, combined with a fraction too much time being taken to make a decision, led to the first crash of training. The delay allowed the Lunar Module to build up too much speed before the abort command was given: the ascent stage was still trying to slow their fall when they hit the (simulated) lunar surface.

Simulation five: Kranz challenged the controllers to set up a similar problem to give them a second chance to resolve it. While Kranz was trying to resolve a (simulated) electrical problem in the Lunar Module, a primary computer failure was added. The decision to move to the back-up computer to abort the landing was delayed for a few fatal seconds and the Lunar Module crashed again.

Simulations six and seven went from bad to worse. The team had lost confidence, hesitated more and more before taking decisions and missed calls.

At the time, it was a chastening experience, but it served Gene Kranz’s team well when the real thing was happening. It also led to an important change in procedures to factor-in the three-second round-time communication delay when working out the time limits for making critical decisions during the landing. With the Lunar Module descending rapidly towards the lunar surface, the second or two to take a critical decision, added to those three seconds could mean the difference between aborting just in time and a high-speed crash.

July 5^th 1969: the day that saved the lunar landing

Last day of training. Instead of the Apollo 11 astronauts, who were already at Cape Canaveral, the controllers were to work, first with the Apollo 12 prime crew, as they trained for their own landing and then, to finish the day, with the Apollo 12 back-up crew. For the controllers though, it was still Apollo 11 and Eagle making the landing and this was the final rehearsal for the real thing.

The first six simulated landings with the prime crew went brilliantly. All were complicated, simulated aborts and all were called correctly. The final simulation started and, rather than give the crew a morale-boosting, relatively simple run, SimSup decided to try something new. Whether it was from a sixth sense of danger, or from a desire to see how his own team could handle what was a really tricky simulation to generate, the SimSup’s eyes alighted on an unfamiliar page of the book of simulations. Pensative, he decided to run Simulation 26 for the very first time. What Gene Kranz did not know was that, as they prepared the problem, SimSup was saying the fateful words “let’s see how well they know their computer alarms” to his simulator team.

The reality of simulations for an intensely concentrated Neil Armstrong, training before the flight.

Simulation 26 involved the crew preparing powered descent to the lunar surface and starting the final burn from 50 000 feet, just over 15km altitude. There were eight minutes of initial tranquil flight before SimSup’s words, which were his cue to trigger a 1201 computer alarm. When it appeared, neither LM Pilot, Jim Irwin, nor Steve Bales, the GUIDO (Flight Guidance Officer and thus the Lunar Module computer controller) had the remotest idea what this alarm was. Bales called for back-up from the backroom software experts. They knew that the alarm indicated computer overload and a software re-start, but they could not work out why it was happening. More worrying was that it also meant that the computer was failing to complete a task. Conscious that the crashes earlier in training were caused by taking too long to react to an abort situation, GUIDO called the abort and, on Charlie Duke’s enquiry, an angry Gene Kranz, who could not believe that the SimSup would not them finish training with a successful landing, confirmed it.

The final post-simulation de-brief started, with the team convinced that they had done the right thing, before the SimSup went through the problem and the reaction to it and gave them the awful news that the abort was a serious error of judgement. Yes, the computer was overloaded, but it was prioritising tasks: the thrusters were firing correctly, on-board displays were updating and navigation was working. There was no reason to abort the landing. He told them that they had committed a serious error of judgement.

The result was that that an extra training session on computer alarms was organised for the next day and, realising that they had no rules for what to do on receiving a computer alarm, the flight control team produced a definitive list of which exactly were the alarms that should trigger an abort.

Fortunately, alarms 1201 and 1202 were not on that list.

Incident-prone Reality

White Team took over from Black Team on the penultimate orbit before landing. This was very much the calm before the storm; the lunar landing attempt started badly.

The prelude to landing was the standard five-minute break, during which everyone made a dash to the bathroom before the doors to Mission Control were locked so that no one could enter or leave. The Lunar Module came out from behind the Moon and the landing attempt almost ended before it had started properly. With just five minutes before Kranz had to decide “Go” or “No Go” for landing, there was a communication failure. The critical telemetry needed to assess whether or not the Eagle was ready to land was not arriving. A “No Go” would not be definitive: The Lunar Module could make another orbit to give time to fix a problem and then, could even be given an extra five minutes’ grace on top (Apollo 16 made three extra orbits while controllers resolved a descent engine problem), but no one wanted to risk that. Telemetry arrived in the nick of time, but all communication was then lost again: the only way of telling the astronauts that they we “Go” for landing was relaying the information through Michael Collins in the Command Module. For several minutes, communications were dropping-out constantly. Mission rules were that that Gene Kranz would only give the go ahead to land if he felt that he had enough information arriving, which was far from clear at that point. Finally, Don Puddy, the Lunar Module Controller (call-sign TELMU) managed to improve things with a small change of Lunar Module orientation and fixed the problem by a switch to the aft antenna, again, instructions that had to be relayed by Michael Collins.

No sooner were communications restored than Steve Bales called a potential abort situation. The Lunar Module was out of position and threatening to overfly its landing point. This suggested a potential serious navigation error. There was a strict limit to the allowable error before the landing must be aborted and the Lunar Module was already half way to it. What no one knew at the time was that when the Lunar Module had undocked, the rush of air out of its docking tunnel had given it a push that had increased its velocity significantly: this is what caused the positional error. Only when it was established that the error was not increasing could the controllers relax, while the explanation for the error was only identified much later.

Here, the simulations proved their value. A standard problem set by SimSup was to have to work with noisy communications, where hearing the astronauts was difficult, as they were through the descent, so the controllers were in a familiar situation. When Buzz Aldrin, who had not been in that fateful last training day, called out the 1202 alarm, Charlie Duke as CapCom was able to exclaim in wonder “the same one we had in training” and, this time, the controllers knew how to react. At 3000 feet altitude (900m), the 1201 alarm sounded, but, thanks to the simulations, Steve Bales knew that it was of the same type as the previous 1202 and could respond immediately that the landing was go. When 1202 repeated at 2000 feet (600m), the same reaction. The official NASA record of the mission timeline shows that no fewer than four 1202 alarms and one 1201 alarm sounded over a space of four and a half minutes.

The scene was set for the final and most serious crisis.

Lunar Landing Fuel Emergency

How close was Apollo 11 to disaster on landing? The standard answer is that Neil Armstrong landed with twenty seconds of fuel remaining. The reality though is that no one knows exactly how much fuel was left. The figure of twenty seconds was an educated guess and only a guess.

The full story of this has rarely been recounted.

The descent stage carried 17880 pounds (7980kg) of fuel. During the Apollo 11 landing, it fired for a total of 13m04s, far in excess of the intended burn length for a landing. Of course, there was a fuel probe in the tanks but, with 120 seconds of fuel remaining, it gave a low level alarm: below this level the probe was no longer able to measure how much fuel was left in the tank. At that point, the flight control team knew that they had a maximum of 120s to land: less if Neil Armstrong opened the throttle and used fuel faster. In every single simulation of the landing, they had either landed or aborted by a minute before the low fuel warning sounded.

Already, 75s before the low fuel warning, as Neil Armstrong hovered at 500 feet (160m) altitude, looking for a landing point, Gene Kranz gave the order that the only calls that he wanted to have on the control loop were to be of how much fuel was left.

How did the controllers calculate the remaining fuel in the final two minutes? In a back room, there was a controller – Bob Nance – with a pen chart that recorded the throttle level. From looking at the chart and estimating how much fuel use it implied, Bob Nance had to calculate mentally how much fuel – or, more exactly, how much time to hover – remained. Nance’s estimates were passed on a private communication loop to Bob Carlton inside the locked Mission Control room and Carlton reported them to the control team. In training, Bob Nance was getting the number right to within 10 seconds. That said, by the time that the remaining fuel reached 30s, the controllers knew that the engine could flame out at any moment if Nance’s fuel usage estimate were just slightly too low.

Only when Aldrin called out that the Lunar Module was just 30 feet (10m) above the surface could the controllers be confident that they would land safely. Below that point it would probably be more dangerous to abort than to risk a hard landing after an engine flame-out.

As Bob Carlton started to call out “15 seconds”, Armstrong’s voice reported “contact light… engine stop”. So, nominally, Armstrong cut the engine with about 18s of fuel left. In reality, it could have been 5s or less… or it could have been as much as half a minute: no one will ever know.

When Charlie Duke replied to the astronauts “you’ve got a bunch of guys about to turn blue. We’re breathing again”, it was because the flight control team knew just how close to disaster they had come and, in that situation, they were simply helpless to aid the astronauts other than by holding their breath and praying.

If an abort had been called due to low fuel – Gene Kranz was obliged to call an abort had the call of zero fuel remaining been made – would Armstrong have obeyed? Michael Collins for one, believes not. He feels that Neil Armstrong would have pressed on if there was any chance of a safe landing until the motor flamed out.

Perhaps it is better not to know just how close the Lunar Module was in reality to running out of fuel.