This is the time of year for all of us in this business to reflect on the horrific outcomes of our most egregious mistakes. While there were a lot of cultural & behavioral contributors, we've taken plenty of design lessons learned that will always be relevant. https://twitter.com/NASAArtemis/status/1354814190599331840

While in my @NASA_Orion role, I've gone through our official Apollo 1 Case Study, read the account in Jeffrey Kluger's Apollo 8 book, another account from a book on engineering development mishaps, & gone through portions of the official report.

https://history.nasa.gov/Apollo204/appendices/AppendixD12-17.pdf

We know the likely starting point for that fire was a section of exposed wiring under a crew seat, a spark that ignited in the 100% oxygen environment, consumed flammable materials in the cockpit & grew so hot, so quickly, that it ruptured the pressure vessel.

The risk of operating in a 100% O2 environment was known & ignored. We certainly don't ignore it today, but what everyone should understand is that just lowering the concentration of O2 doesn't preclude a fire, it just means we'd have a slower rate of reaction if one did start.

Most of the time Orion will operate at 20% O2, but that will go up to ~30% when we dock with HLS. Knowing this, all of our materials are certified for that environment. That cert doesn't mean materials won't catch fire, just that a fire won't propagate if it does start.

As much as I wish we could, we can't completely eliminate flammable materials in the cabin. Paper is still a desired item, clothes or sleeping bag liners are still made for comfort, and we'll never be able to get rid of the velcro.

We can limit quantities though. And we now set strict limits on the size and distance between velcro patches. Flammable items will be packaged differently with labels indicating where they are stowed.

We've taken a hard look at the possible ignition sources in the cabin. We introduce nitrogen into the cabin in the avionics bay, we've encase fan motors in ceramic cans, and we've minimized operational use of the O2 system. None of that is foolproof.

I spent 8 years training crews for the ISS program. You learn pretty quickly as an instructor that reality is far more creative than you can ever be. one of the important roles of an instructor is to beat "that could never happen" out of your flight controller counterpart.

So fires can still happen and we have the basic hardware to extinguish them. Orion has a water-based extinguisher, sized to put out lithium ion battery fires for large laptop batteries. Those batteries burn extremely hot and are incredibly toxic.

While crew should be able to put out a fire, for an incident on the pad like Apollo 1, we want crew to just get out of the capsule & only worry about fighting the fire if it's in your way. Orion has a tandem hatch system (2 hatches- Orion side hatch & LAS hatch).

In the middle of that side hatch is a t-handle the crew can pull. The hatch itself won't get blown off at that point, but the linkages holding it in place will sever and a counterbalance will open the hatch in less than 10 seconds.

Crew would then be able to rush out of Orion and escape to safety without assistance from the ground crew, unlike the Apollo 1 crew.

While these systems are in place, none of them guarantee success. The goal in all of these design decisions has been to try to give the crew enough capability to respond to whatever the needs of the moment are.

I can't reflect as well on Challenger. Orion has a launch abort system, demonstrated on AA-2, that will carry the crew to safety should something happen during ascent.

Crew would experience 15gs through their chest over the course of a few terrifying brief moments, but they will be carried to safety and picked up by EGS wherever they land.

From the Columbia accident, an incident that occurred while I was an ISS instructor, we're able to apply lessons learned on giving the crew a fighting chance during descent.

Though Orion is a capsule and not a winged spacecraft, crew still does have the ability to manually control the roll of the spacecraft during descent as well as manual parachute deploy, and manually cutting the chutes in case spacecraft systems fail.

But the biggest lesson incorporated in the Orion design is to build around the expectation that crew will be in a pressure suit during descent. If the cabin goes to low pressure at high altitude, crew will still be protected.

All the controls, displays, and switches are designed to be operable with the crew wearing the gloves of their pressure suit. They should never have to take off their helmet to see or take off their gloves to flip a switch, compromising the pressure integrity of the suit.

We have learned from these tragedies and those lessons persist. There will be other accidents in the future. They could be the result of cultural issues, design issues, assembly issues, or who knows what.

One of the most important lessons for me is that our knowledge is finite, our ability to predict what will happen is limited, & our best guesses of today may not be good enough. There will always be risk & we have to approach that risk smartly.

We should never assume that just because we have more knowledge than our predecessors that we cannot repeat the same mistakes they made.