# Method in Action: Apollo 1 and the FMEA Mandate (1967)

> *This example is part of the [inversion](../SKILL.md) skill.*

A worked example. Not a pop-figure parable — primary-source documented.

On **January 27, 1967**, a cabin fire during a launch-rehearsal test at Cape Kennedy killed astronauts **Virgil "Gus" Grissom, Edward White, and Roger Chaffee** in roughly 17 seconds. The Apollo 1 command module had a pure-oxygen atmosphere at above-ambient pressure, plastic and Velcro throughout the cabin, an inward-opening hatch that took 90+ seconds to unbolt, and a wiring harness with chafe points. NASA's culture going into Apollo had been forward-thinking — *how do we get to the Moon by 1969?* — with engineers reporting that anomalies and risk concerns were often subordinated to schedule.

The Apollo 204 Review Board (chaired by Floyd Thompson, with Frank Borman among its members) issued its **Final Report on April 5, 1967**. Its principal recommendation was not "try harder" or "fly safer." It was structural: **systematically invert every component, every system, every procedure** — asking, for each one, "what failure modes does this have, what would they cause, and what is the mitigation?"

This became the formal practice of **Failure Mode and Effects Analysis (FMEA)** as a *gate*, not an option. After Apollo 1:

- Every Apollo subsystem went through documented FMEA before flight certification — categorized criticality (Cat. 1 = loss of crew, Cat. 2 = loss of mission, Cat. 3 = neither), and required mitigation or waiver-with-justification for every Cat. 1 failure mode
- The cabin atmosphere was changed from pure O₂ at 16.7 psi to a mixed-gas atmosphere on the pad, switching to lower-pressure O₂ only in flight
- The hatch was redesigned to open outward in seconds
- A separate **Mission Operations** discipline was built around in-flight failure-mode coverage, leading to the now-famous "tiger team" practice used during Apollo 13 (April 1970), where pre-cataloged failure-response procedures and the inverted question "what is the *minimum* configuration that gets the crew back" produced the LM-as-lifeboat plan in hours, not weeks

The numbers: from Apollo 7 (October 1968) through Apollo 17 (December 1972), eleven crewed Apollo missions flew. **Zero in-flight crew fatalities.** Apollo 13 was a near-loss, but the same inverted-thinking culture that built the FMEA process is what brought the crew home.

The inversion move is exact: refuse to ask only "how do we succeed?"; force the parallel question "for every component and procedure, what is the failure mode, what is the consequence, and what is the response?" — then make that question the *gate*, not optional analysis. Apollo 1's price bought the discipline.

**Sources:** Apollo 204 Review Board, *Final Report* (April 5, 1967), NASA Historical Reference Collection: https://history.nasa.gov/Apollo204/ ; Murray, Charles & Cox, Catherine Bly. *Apollo* (Simon & Schuster, 1989); NASA, *Apollo Program Summary Report* JSC-09423 (April 1975). On FMEA's institutional codification: U.S. Military Standard MIL-STD-1629A (Procedures for Performing a Failure Mode, Effects and Criticality Analysis), 1980 — a direct descendant of Apollo-era practice.