Once-classified anomaly nearly killed Apollo 11 astronauts, a new book reveals

The Rocketry Forum

Help Support The Rocketry Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.


Lorenzo von Matterhorn
Jan 31, 2009
Reaction score
A once-classified anomaly nearly killed Apollo 11 astronauts, a new book reveals


The service module became useless and posed a collision risk after the two parts separated, so it was supposed to skip off Earth's atmosphere like a stone thrown across a pond.

But it did not.

Instead, as Atkinson explains, the service module chased the astronauts during their descent.
"Houston, we got the service module going by. A little high and a little bit to the right," Aldrin, who was looking out of the command module's window, told Mission Control over the radio.

Moments later he added: "It's coming across now from right to left."

Gary Johnson, who worked as an electrical engineer on the Apollo program, told Atkinson that the service module should have been "absolutely nowhere close to the command module" as it descended.

If the part had collided with the command module carrying the astronauts, it could have crippled or destroyed the vehicle or sent it flying out of control. Chunks of the disintegrating service module could also have struck the capsule, which could have led to catastrophe as well, Atkinson wrote.

"If things had gone bad, we could have lost the Apollo 11 crew," Johnson told Atkinson. "We were lucky."
NASA launched an investigation based on their reports and found that two prior missions — Apollo 8 and Apollo 10 — had suffered the same glitch. Those astronauts did not see the service module outside their windows, however, so they didn't report it, Atkinson wrote. (A review of old radar recordings showed the service modules on those missions did also fly dangerously close to the command modules, though.)

The problem's cause turned out to be a bad sequence in a controller that helped jettison, or separate, the command and service modules. NASA knew the same problem was baked into the Apollo 12 spacecraft, which launched in November 1969, but decided not to fix it due to time constraints, Atkinson said.

According to Johnson, NASA kept the Apollo 11 astronaut debriefs classified for some time. An official report about the anomaly came out in November 1970 — about six months after the harrowing Apollo 13 mission — and somehow managed to stay out of newspapers.

"The event never made it into the Apollo 11 mission reports and somehow was largely forgotten — I think due to the frantic-ness of the time, of needing to move on to the next flight, etc.," Atkinson said. "The first time the fix for this anomaly was in place was for Apollo 13. And of course, you know what happened with 13, and I think the anomaly was probably largely forgotten due to all the other excitement."

An Apollo astronaut explains how he nearly killed himself 'horsing around' on the moon in 1972


They were just "horsing around," Duke said, but he was able to leap 4 feet in the air — an impressive height for anyone, especially a person wearing a bulky spacesuit. However, he straightened his body mid-jump, and that turned out to be a huge mistake, he said.

The lunar-surface spacesuits Apollo astronauts wore weighed more than 300 pounds each on Earth. This wasn't as much of an issue on the moon because of its weaker surface gravity; there, the suits weighed about 50 pounds. Still, the Apollo spacesuit's backpack made up more than half of the mass, creating balance issues (especially for leaping humans).

"The backpack weighed as much as I did. So I went over backwards," Duke said. "It's a fiberglass shell, and it contained all your life-support systems. If it broke, I was dead."

Duke said he rolled right to break his fall but still bounced onto his backpack, also called a portable life-support system, or PLSS.

If he'd cracked his PLSS or ripped open his suit, it would have caused a "hiss-out," or loss of breathable air. This would have knocked Duke unconscious and likely killed him before Young could drag him back to the lunar module, close the air lock, and pressurize the spacecraft.

"My heart was pounding. John Young, my commander, came over and looked down and says, 'That wasn't very smart, Charlie.' And I said, 'Help me up, John,' and I got real quiet," he said.

Duke said that once he got up, he listened to the sounds of the PLSS to determine whether anything had broken.

"You could hear the pumps running. And I said, 'Well, I think I'm OK,'" he said, adding: "I learned a lesson: Never do anything in space that you haven't practiced. And we had not practiced the high jump."
You'd think the SM would have had some command programmed in after separation which would have allowed it to back a couple hundred meters off the CM, make a 90 degree pitch maneuver, then ignite the SPS engine and burn the tanks dry. That would have sent it away at a pretty good clip; it would be hundreds of miles away by entry interface.
The Service Module's Guidance system was in.... the Command Module. So it could not do any maneuvers after the CM was gone.

I wish there was more info on what the actual modifications were. To me, a simple fix would be to assure the CM/SM were sideways to the flight path and parallel to the horizon ] when they sepped, so the CM say "go north", and the SM to the south, drifting away from each other horizontally rather than one behind the other. Also, the CM was designed to fly at an angle of attack on re-entry to create some lift, a "glide" rate of up to 1 foot for every 3 feet it traveled. That could also have been used to steer more "north" in the early part of re-entry, then after a possible SM collision was no longer an issue, roll 180 degrees to steer "south" awhile to make up for the northward steering. BTW - this lifting re-entry steering by roll is indeed how the CM steered to get close to the intended landing spot in the ocean, it was not a pure ballistic reentry like the Mercury flights.

Also, the article's mention of the SM skipping off the atmosphere, is BS. If a SM ever skipped off the atmosphere, the CM would have too.

Well, actually...... the CM is the one that skipped IN the atmosphere....a little bit, but not "off". In the graph below, the CM descended to below 200,000 feet, then "skipped" up to 250,000 feet (thanks to the lifting re-entry), before dipping down for good. This made the re-entry gentler and with less max heating than a re-entry that didn't skip like that. Also, since it was the lifting re-entry that allowed that kind of skip to happen, the SM would NEVER have been able to skip, it was ballistic and broke up easily.

But a true skip, the nightmare scenario, would not have been a lifting re-entry problem. And nothing AT ALL like skipping a flat stone across water. It would have been a too-shallow re-entry at such a high speed that it never slowed down from 25,000 mph returning from the moon to under 17,500 mph (if the velocity is under 17,500 and touches the atmosphere, it's coming down. If it touches the atmosphere but never gets slower than say 18,000 mph, it's going to regain altitude and stay in orbit for awhile). So would have "kissed" the atmosphere briefly then kept on going out of it ballistically.
Last edited:
The Service Module's Guidance system was in.... the Command Module. So it could not do any maneuvers after the CM was gone. I wish there was more info on what the actual modifications were.
Probably in the book, but I'm beyond having any room left on my bookshelves:

Eight Years to the Moon: The History of the Apollo Missions Hardcover – July 2, 2019


There's a whole bunch of text to look at via the "Look Inside" feature.

Found this about the CM:



Separation of the SM from the CM occurs shortly before entry. The sequence of events during separation is controlled automatically by two redundant service module jettison controllers, located on the forward bulkhead of the SM.

A number of events must occur in rapid sequence or at the same time for proper separation. These include physical separation of all the connections between the modules, transfer of electrical control, and firing of the service module's reaction control engines to increase the distance between the modules.

Before separation, the crewmen in the CM transfer electrical control to the CM reaction control subsystem (the SM reaction control subsystem is used for attitude maneuvers throughout the mission up to entry) so that they can pressurize it and check it
out for the entry maneuvers.

Electrical control is then transferred back to the SM subsystem. Separation is started manually, by activation of either of two redundant switches on the main display console. These switches send signals to the SM jettison controllers. The controllers first send a signal to fire ordnance devices which activate the CM-SM electrical circuit interrupters; these interrupters deadface (cut off all power to) the electrical wires in the CM-SM umbilical.

A tenth of a second after the wires are deadfaced the controllers send signals which fire ordnance devices to sever the physical connections between the modules. These connections are three tension ties and the umbilical. The tension ties are straps which hold the CM on three of the compression pads on the SM. Linear-shaped charges in each tension-tie assembly sever the tension ties to separate the modules. At the same time, explosive charges drive guillotines through the wiring and tubing in the umbilical.

Simultaneously with the firing of the ordnance devices, the controllers send signals which fire the SM reaction control engines. Roll engines are fired for 5 seconds to alter the SM's course from that of the CM, and the translation (thrust) engines are fired continuously until the propellant is depleted or fuel cell power is expended. These maneuvers carry the SM well away from the entry path of the CM. [THAT was the PLAN anyway! - W]

So, there must have been simple control circuitry within the SM to keep those engines firing after separation. That controller's specific timing of thrusting and RCS engine selection probably wasn't easily changed as there was no requirement for that which was foreseen. Or it might have been a matter of changing magnetic core ROM in the CM to change sequencing and/or timing commands sent. Thus, they "decided not to fix it due to time constraints." I'll continue to look for NASA documents which might have more detail about the specific problem.

Also found this interesting PDF about the CM during the search:

Full answer to this question:

How did sloshing prevent the Apollo Service Module from moving safely away from the Command Module and how was this fixed?
asked 5 days ago
viewed 3,304 times

...is found here:


Apollo 11 Mission
Anomaly Report No. 3
Service Module Entry


Not related, but still interesting:


S71-16823 (January 1971) --- A line drawing illustrating a cutaway view of the Apollo 14 Command and Service Modules, showing the engineering changes in the CSM which were recommended by the Apollo 13 Review Board. (The Apollo 13 abort was caused by a short circuit and wiring overheating in one of the SM cryogenic oxygen tanks.) The major changes to the Apollo 14 CSM include adding a third cryogenic oxygen tank installed in a heretofore empty bay (in sector one) of the SM, addition of an auxiliary battery in the SM as a backup in case of fuel cell failure, and removal of destratification fans in the cryogenic oxygen tanks and removal of thermostat switches from the oxygen tank heater circuits. Provision for stowage of an emergency five-gallon supply of drinking water has been added to the CM.

Apollo 11 Mission Report (includes all Apollo 11 anomalies - very interesting)


16.1.11 Service Module Entry

Photographic data were obtained of the service module entering the earth's atmosphere and disintegrating near the command module. Preflight predictions indicated the service module should have skipped out of the earth's atmosphere and entered a highly elliptical orbit. The crew observed the service module about 5 minutes after separation and indicated the reaction control thrusters were firing and the module was rotating about the X plane.

Based on the film, crew observation of the service module, and data from previous missions, it appears that the service module did not perform as a stable vehicle following command module/service module separation. Calculations using Apollo 10 data show that it is possible for the remaining propellants to move axially at frequencies approximately equal to the precessional rate of the service module spin axis about the X body axis. This effect causes the movement to resonate, and the energy transfer between the rotating vehicle and the propellants may be sufficient to cause the service module to go into a flat spin about the Y or Z axis and become unstable.

Six-degree-of-freedom calculations, with a spring-mass propellant movement model, have been performed, and they do indicate that a trend toward instability is caused by propellant movement. Certain trends exist now which indicate that the service module could flip over as a result of propellant movement and attain a retrograde component of reaction control thrusting before going unstable. Service module separation instability is being reassessed to determine any change in the separation maneuver which may be desirable to better control the trajectory of the service module.

Additional analysis is continuing to determine the cause of the apparent instability.

This anomaly is open.



Latest posts