Apollo: The Race To The Moon

by Catherine Bly Cox

It was then that Liebergot looked up at his screen, and suffered yet another shock: The pressure on his other O2 tank was falling. In preparing for disasters during flight, the world of flight control began with certain verities. One was that structural materials like lines and bulkheads had a reliability not just of .9999 or even .999999, but 1. Most of them had margins that protected them well beyond the worst-case design requirements. A second verity was that while two of the mechanisms of the spacecraft might plausibly fail simultaneously, it was not plausible that two redundant elements within the same system would fail simultaneously. This confidence was based on simple mathematics. With thousands of parts in the spacecraft, even very small probabilities of failure in the individual components added up to a reasonably large probability that some two of those thousands of mechanisms would fail at the same time. But if there are two completely independent oxygen tanks and each of them has a reliability of .9999 (for example), then the chance that both of the oxygen tanks will fail is .0001-squared, or one in a hundred million. The likelihood of a dual failure within any of the handful of major systems—electrical, oxygen, water, propulsion, and the like—was therefore exceedingly small. Until the moment that he saw the pressure on O2 Tank 1 falling, Liebergot (if he believed his unbelievable screens) had been looking at a double failure in the fuel cells plus an oxygen t...