Apollo 13 launched on April 11, 1970 as NASA's third planned lunar landing mission. At 55 hours and 55 minutes into the flight, with the spacecraft approximately 200,000 miles from Earth, Command Module Pilot Jack Swigert performed a routine cryo stir of the oxygen tanks. Seconds later, O₂ Tank #2 exploded — damaging the Service Module, rupturing plumbing to O₂ Tank #1, and knocking out two of three fuel cells. The crew lost their primary supply of electricity, water, and breathable oxygen. The lunar landing was aborted, and after four days of improvised survival using the Lunar Module as a lifeboat, all three astronauts returned safely on April 17. This report examines the root cause of the explosion — from the physical failure mechanism down to the organizational gaps that allowed it — and the countermeasures implemented before Apollo 14.
During a pre-launch detanking procedure at KSC, the tank failed to empty. To boil off the remaining oxygen, the internal heater was left ON for 8 hours. The heater system was designed for 28V DC, but the KSC ground power supply delivered 65V DC — a 2.3× voltage overload that was never flagged.
Total loss of Service Module oxygen supply and electrical power generation. Main Bus B undervolt at 55:55 MET. Both O₂ tanks compromised — Tank 2 destroyed, Tank 1 lost through shared plumbing damage.
100% mission safety and spacecraft integrity for all future CSM missions.
Zero thermostatic switch failures during ground detanking procedures.
Prior to Apollo 14 launch — January 1971.
The 5-Why analysis above identifies the direct technical cause of the failure: the thermostatic switch contacts welded shut due to a voltage overload. This correctly explains why the tank failed. However, it does not fully explain why the failure was allowed to occur — which requires examining the management, process, and design system factors that created the conditions for the technical failure.
The thermostatic switch welded shut at 65V. This is the direct physical mechanism — the point of failure in the hardware. It answers: "What broke and why?"
No specification verification standard existed between the spacecraft design authority (28V component rating) and the KSC ground support equipment team (65V power supply). The mismatch went undetected because nobody owned the interface. There was no check, no interlock, and no standard work requiring voltage compatibility confirmation before connecting ground power to vehicle components.
The welded switch tells us what went wrong technically. The undetected voltage mismatch tells us what went wrong organizationally. A complete root cause analysis must acknowledge both layers. The countermeasures in Step 5 address both: the hardware redesign fixes the technical vulnerability, while the voltage compatibility audit and process lock address the organizational gap.