Space

"Houston, we've had a problem": The story of NASA's most successful failure

"Houston, we've had a problem"...
The
The Apollo 13 service module showing explosion damage
View 30 Images
The crew of Apollo 13 with President Richard Nixon
1/30
The crew of Apollo 13 with President Richard Nixon
The Apollo 13 crew aboard the USS Iwo Jima
2/30
The Apollo 13 crew aboard the USS Iwo Jima
The
3/30
The Apollo 13 service module showing explosion damage
The Apollo 13 service module after separation
4/30
The Apollo 13 service module after separation
The lunar module Aquarius
5/30
The lunar module Aquarius
The Earth as seen from Apollo 13
6/30
The Earth as seen from Apollo 13
Tsilokovsky crater seen from Apollo 13
7/30
Tsilokovsky crater seen from Apollo 13
The Moon as seen from Apollo 13
8/30
The Moon as seen from Apollo 13
The Apollo 13 crew took photographs of the Moon as they swung around its far side
9/30
The Apollo 13 crew took photographs of the Moon as they swung around its far side
The "mailbox" adapter installed
10/30
The "mailbox" adapter installed
Assembling the "mailbox" adapter
11/30
Assembling the "mailbox" adapter
Ken Mattingly (center) was scrubbed from the mission at the last minute after being exposed to the measles
12/30
Ken Mattingly (center) was scrubbed from the mission at the last minute after being exposed to the measles
Mission Control in Houston
13/30
Mission Control in Houston
Apollo 13 astronauts rehearsing a lunar EVA
14/30
Apollo 13 astronauts rehearsing a lunar EVA
Apollo 13 being recovered after splashdown
15/30
Apollo 13 being recovered after splashdown
Apollo 13 in flight configuration
16/30
Apollo 13 in flight configuration
CSM Odyssey
17/30
CSM Odyssey
Lovell trying to sleep aboard Aquarius
18/30
Lovell trying to sleep aboard Aquarius
Apollo 13 lifting off
19/30
Apollo 13 lifting off
Flight Director Kranz inspects the prototype of the "mailbox" adapter
20/30
Flight Director Kranz inspects the prototype of the "mailbox" adapter
The improved oxygen tank used on Apollo 14 and later missions
21/30
The improved oxygen tank used on Apollo 14 and later missions
Diagram of the Apollo 13 oxygen tank design
22/30
Diagram of the Apollo 13 oxygen tank design
The Apollo 13 crew were in reasonable condition despite their ordeal
23/30
The Apollo 13 crew were in reasonable condition despite their ordeal
Possible abort trajectories for a lunar mission
24/30
Possible abort trajectories for a lunar mission
Haise practices removing the nuclear fuel canister from the Lunar Module
25/30
Haise practices removing the nuclear fuel canister from the lunar module
Post-flight test to reproduce the Service Module accident
26/30
Post-flight test to reproduce the service module accident
Post-flight test shows how the oxygen tank explosion blew off the service module's bay panel
27/30
Post-flight test shows how the oxygen tank explosion blew off the service module's bay panel
James A. Lovell Jr., Apollo 13 mission commander, reads a newspaper account of the mission
28/30
James A. Lovell Jr., Apollo 13 mission commander, reads a newspaper account of the mission
Lovell practices erecting the American flag
29/30
Lovell practices erecting the American flag
Mission Control celebrates the splashdown of Odyssey
30/30
Mission Control celebrates the splashdown of Odyssey
View gallery - 30 images

Fifty years ago, and just seven months after Apollo 11, the third manned lunar landing attempt was already seen as routine, even boring, but in a little over two days, the Apollo 13 mission would become one of the most remarkable stories of survival, courage, and luck in history.

On April 11, 1970, at 19:13 GMT, Apollo 13 lifted off from Launch Complex 39A at the Kennedy Space Center in Florida. Atop the giant Saturn V booster sat Command Module 109 and Service Module 109, which together formed CSM-109 (otherwise known as Odyssey), and the lunar module (LM) Aquarius.

In the couches of the command module were mission commander James A. Lovell, Jr., age 42, a US Navy captain on his third space mission and his second visit to the Moon. Next to him was command module pilot John L. "Jack" Swigert, Jr., 38, a space rookie who was a last-minute replacement for astronaut Ken Mattingly, who was scrubbed after being exposed to the measles. On the other side of Lovell was lunar module pilot Fred W. Haise, Jr., 35, on his first and only spaceflight.

CSM Odyssey
CSM Odyssey

This was to be the most ambitious Apollo mission to date. Building on the lessons learned from Apollo 12, it was to make a precise landing on the Moon in the highlands of the Fra Mauro region, farther north from the equator than Apollo 11 or 12, meaning that both the Saturn V booster and the lunar module carried more fuel than any other mission.

Apathy

But another thing that marked the mission was a sense of complacency, even apathy. If the Apollo missions now seemed routine to the men and women of NASA, the public was downright indifferent. They'd been sold Apollo as a great adventure and they were getting bored with the repeats of the same plot. It was a sentiment shared by the US Congress. NASA's budget had been going down ever since the main work on Apollo was completed in 1964, but now Apollo 20 was canceled and the trimming looked set to go much deeper.

A bomb aboard


This complacency wouldn't have lasted long if NASA knew Apollo 13 had a bomb on board. It wasn't the work of terrorists or enemy saboteurs but the result of the kind of oversight that can occur in any super-complex endeavor. In fact, it was a credit to NASA that such errors didn't happen more often. However, this time, the oversight was nearly fatal.

Diagram of the Apollo 13 oxygen tank design
Diagram of the Apollo 13 oxygen tank design

Behind the conical command module that acted as a home for the Apollo astronauts is the service module. This cylindrical assembly with a bell-like cone at one end contained the main engine and supplied Odyssey with oxygen, water, electricity, and long-range communications with Earth.

Inside the service module was a bay holding a number of systems, including two liquid oxygen tanks that were the primary source of oxygen for the command module. Also in the bay were a tank of liquid hydrogen and three fuel cells. The hydrogen and oxygen feeding into the fuel cells provided Odyssey with power and water.

There was a history to one of these units. The No. 2 oxygen tank had been previously installed in the service module of Apollo 10 but was then taken out for modification, during which it was damaged and then sent back to the factory for repairs. It was then installed in the Apollo 13 service module.

Like all NASA flight gear, the No. 2 tank was tested and retested even after installation. On March 16, 1970, the tank suddenly developed a fault. It wouldn't drain properly. It was finally decided to run the tank's electrical heater to boil the oxygen. This didn't resolve the problem entirely, but because the oxygen tanks didn't need to drain in space and due to time constraints, No. 2 was cleared for flight.

Apollo 13 astronauts rehearsing a lunar EVA
Apollo 13 astronauts rehearsing a lunar EVA

However, the heaters had been upgraded so that they could operate at 68 volts instead of the previous 28 volts, but the thermostatic switches that controlled the heaters weren't changed. As a result, during the final test, the switches welded shut and the wiring was frayed. Another problem was the use of aluminum components and Teflon insulation – both of which burn in pure oxygen.

To put it more simply, No. 2 tank was now a bomb waiting to detonate.

To the Moon

There was no sign of any trouble as Apollo 13 lifted off from the pad. The weather was good and the only difference from previous Saturn V launches was that it cleared the tower a bit slower because of the extra fuel it carried. When the second stage fired, the center of the five engines started to go into severe pogo operations and shut down. The other four engines throttled up to compensate and Mission Control and the crew thought that the mission had passed its one major glitch.

Apollo 13 lifting off
Apollo 13 lifting off

Once the S-IVB third stage separated and fired for the first time, Apollo 13 settled into an orbit 120 mi (193 km) above the Earth. Two hours later, the rocket fired its engine again and the astronauts were on their way to the Moon. The CSM Odyssey then separated from the S-IVB, Swigert turned the craft around, docked with the lunar module Aquarius and eased it out. With a slight course correction, Apollo 13 was on a trajectory to circle the Moon, while the S-IVB went on a collision course with the lunar surface where it would impact three days later – an event that would be recorded by the seismograph left behind by Apollo 12.

It was all like a Space Age milk run.

"Houston, we've had a problem"

Everything was relaxed for the first two days of the mission. At 55 hours into the flight, Lovell used the command module's television camera to provide the audience back on Earth with a tour of Odyssey and Aquarius. Unfortunately, since none of the US networks carried the broadcast, the audience was reduced to Mission Control and a few of the astronauts' relatives.

At hour 56, 210,000 mi (330,000 km) from Earth, after completing the broadcast, NASA gave the men a few minutes to recover before they went back to work, with Lovell stowing the camera and Haise testing and shutting down the lunar module's systems. Meanwhile, Swigert was carrying out routine maintenance tests on the service module's oxygen tanks to track down a sensor malfunction.

The Apollo 13 service module after separation
The Apollo 13 service module after separation

Back at Mission Control in Houston, the Electrical, Environmental, and Communication officer (EECOM) Sy Liebergot asked Swigert to activate the fans to stir the liquid oxygen in No.2 tank, so it wouldn't settle into layers.

Then, 95 seconds later, things went wrong. There was a short circuit in the heater in tank No. 2, which started a fire. Pressure increased suddenly as the oxygen flashed into a gas, and the tank's structure gave way with explosive force.

Though an entire panel fore and aft on the service module was blasted away and there was extensive damage, the first clue the astronauts had that something was wrong was a loud bang. At the same time, telemetry with Earth went out for 1.8 seconds, the power readings on the instrument panel started fluctuating, and the spacecraft was jolting as the automatic pilot kept firing the attitude control thrusters to compensate against some unknown force.

Mission Control in Houston
Mission Control in Houston

Twenty-six seconds after the bang, Swigert called back to mission control, "Okay, Houston, we've had a problem here."

Lovell then repeated and elaborated. "Houston, we've had a problem. We've had a Main B Bus undervolt."

The initial fear was that Odyssey or Aquarius had been hit by a meteorite and that one or both of the crew modules had been holed, but there was no evidence of a serious loss of pressure. The Main Bus B undervolt fault indicated that the service module's three fuel cells were malfunctioning. Then Bus A started losing power and two of the fuel cells were fading, with both dead in under half an hour.

The more Mission Control and the astronauts checked, the worse things looked. Oxygen tank No. 2 had zero pressure and No. 1 was leaking fast. Also, the computer had reset and was running a fault check, while the high gain antenna had switched to a secondary mode.

Apollo 13 in flight configuration
Apollo 13 in flight configuration

Back on Earth, Liebergot couldn't believe what he was seeing on his panel. The service module was designed with multiple redundancies and constructed out of components that didn't need maintenance in flight, but he saw numerous systems failures of the sort that one only saw in simulators when the operator wanted to make sure the astronauts were paying attention.

At first, Liebergot thought that it had to be an instrument failure, but Lovell reported that he could see debris outside the ship and an expanding cloud of gas. It was this that was pushing on Odyssey and against which the autopilot was fighting. Worse, No. 1 tank was leaking fast and when it went, the service module would start sucking oxygen from the command module's tiny reserve surge tank.

Lead Flight Director Gene Kranz, who had such high authority at Mission Control that the only way to veto his decisions was to fire him, ordered the command module surge tank sealed off, but the rapidly depleted tank No. 1 would only keep the remaining fuel cell going for about two hours. After that, the only power would be from the command module batteries, which were only meant to last a few hours.

Post-flight test shows how the oxygen tank explosion blew off the service module's bay panel
Post-flight test shows how the oxygen tank explosion blew off the service module's bay panel

It was obvious that the Odyssey was a dying ship and that the lunar landing was scrubbed. The most obvious next step was to preserve what was left in the command module's batteries by powering down its systems – literally turning it off. This was something that had never been done on a mission before and the engineers weren't sure how to turn it back on again for the return to Earth. This raised two more obvious questions: How to get back to Earth and how to keep the three men alive during the trip.

Lifeboat LM

The answer to the second question was to use the lunar module as a lifeboat – a scenario that had already been considered as an emergency measure for Apollo 10, 11, and 12. It was possible. The LM was intact, had plenty of oxygen in its life support systems, engines, and spacesuit backpacks, but the LM was only designed to support two men for 45 hours. Now it had to keep three alive for four days.

One limiting factor was power. Instead of fuel cells, the LM used silver-oxide/zinc batteries with only 2,181 Ah capacity. Some of this was needed to keep the command module's batteries charged, so everything not absolutely essential on the LM was shut down and energy consumption kept below 20 percent.

The lunar module Aquarius
The lunar module Aquarius

It would be a very cold, dark journey home.

Water was another problem. It was not only required to keep the astronauts alive, but it was also used to cool the LM's systems. The crew was rationed to six ounces (177 ml) each a day and instructed to only eat wet-packed foods. Even then, the spacecraft would run out of water five hours before reentry, but experience on Apollo 11 indicated that the LM could continue to function for that long without it.

How to get home?

Under normal circumstances, the way to get Apollo 13 back to Earth would have been using a direct abort trajectory, which would have involved firing the service module's main engine to place the spacecraft in a truncated orbit home. This would have been the fastest way, but Kranz vetoed this because no one knew how badly damaged the engine was.

The alternative was to carry on, loop around the Moon, and swing back to earth, using the attitude control rockets for any course corrections. Had this been one of the earlier Apollo missions, such a free return orbit would have needed little more than sitting back and letting gravity do the work.

Possible abort trajectories for a lunar mission
Possible abort trajectories for a lunar mission

But that wasn't possible for Apollo 13 because its goal of landing in the lunar highlands put it in a hybrid orbit – a variation of the free return orbit, except that it needed an engine burn to make actual reentry on reaching Earth. Otherwise, the craft would simply have swung back into deep space.

Since the service module was unavailable, this left the crew with only the less powerful descent stage engines on the LM. Before shutting down the command module, Lovell wrote down the guidance readouts regarding the spacecraft's orientation and did the calculations (without a calculator but with Mission Control checking his sums) needed to feed the data into the LM's guidance system. However, making the necessary maneuvers using the LM required both Lovell and Haise at the controls and a lot of learning by doing.

There was also the question of whether to jettison the service module. This would have meant less weight for the lunar module's engine to push and cut the return trip by 36 hours. Unfortunately, this would have meant exposing the Command Module's phenol resin heat shield to the cold of space and the engineers weren't sure what damage this would do, so the service module stayed.

The Earth as seen from Apollo 13
The Earth as seen from Apollo 13

A 34-second burn with the LM's engine put the craft back on a free return trajectory but more burns would be needed if the command module was to land on Earth where it could be recovered safely. This meant one of three options: The Indian Ocean, where the US had few recovery units; the South Atlantic Ocean, where the same problem arose; and the South Pacific, where a recovery fleet was already steaming.

In the end, NASA opted to make another engine burn two hours after Apollo 13 passed its closest point to the Moon and 73 hours, 46 minutes into the flight. This would shorten the return by 12 hours and put the command module in the Pacific. This second four-minute burn was difficult enough, but with all the debris floating around it wasn't possible to orient the spacecraft using the stars, as was standard procedure, so the crew lined up using the Sun and the Moon – again, using the LM's guidance system. This brought them to within a half a degree of the desired angle.

Survival

There was still much to do on the way back to Earth, but a more immediate problem was the men's own breath, which was pumping carbon dioxide into the confined space of the LM. At first, this wasn't a threat because there were lithium hydroxide canisters that scrubbed the CO2 from the air. However, these were meant for two men for 45 hours and within 36 hours after moving into the LM, the atmosphere warning light came on. The air in Aquarius was turning deadly and, if the problem wasn't solved, the crew would be dead a day before reaching Earth.

The "mailbox" adapter installed
The "mailbox" adapter installed

In an ideal world, this would have been an easy fix. The command module also had scrubber canisters – more than enough for the trip home. Why not just move them over and plug them in? The crew couldn't because the canisters aboard Aquarius were round and the ones from Odyssey were square. Like a bad joke, the round holes of Aquarius' life support system wouldn't accept Odyssey's square pegs.

Like those school exercises where students are given a bag of items and are told to build a crane or a hovercraft, NASA engineers had to as quickly as possible figure out how to build an adapter using materials known to be on the spacecraft, write up clear and detailed instructions on how to assemble it, and relay this to the astronauts.

According to Apollo astronaut Ken Mattingly, the solution was from a simulator exercise for training the Apollo 8 mission crew, where a similar emergency was solved by blowing air through a canister using the spacecraft's vacuum cleaner hose.

Flight Director Kranz inspects the prototype of the "mailbox" adapter
Flight Director Kranz inspects the prototype of the "mailbox" adapter

They soon came up with a contraption called the "mailbox," which was made from plastic, covers from procedure manuals, vent hoses, and other bits and pieces, all held together with duct tape. Just reading the procedures over the radio took an hour.

Misery


Once the burns were completed, all but the most essential lunar module systems were shut down. This helped to conserve precious resources, but it also made the spacecraft a miserable place to be as both the command module and the LM went dark and dropped to the temperature of a refrigerator, reaching as low as 3 °C (38 °F).

There were the spacesuits, but their non-porous rubberized construction would have made the astronauts unbearably hot and sweat too much. Since they had only their flight suits, Lovell and Haise put on their EVA boots, while Swigert wore an extra coverall. Swigert was especially uncomfortable because his feet were wet after a spill while filling bags with drinking water.

Lovell trying to sleep aboard Aquarius
Lovell trying to sleep aboard Aquarius

As if to add insult to injury, the crew couldn't even dump their urine overboard for fear of altering the spacecraft's trajectory, so more plastic bags were used for storing the waste. The cold also caused the moisture in the air to condense on the bulkheads and behind the equipment panels in both the CM and the LM. Fortunately, the electronics were all well-insulated, but it was still like living in a leaky tin shed during a winter rainstorm.

Separation

Using the Earth's terminator line between day and night as a target, the LM made two more course corrections, which was tricky because the LM's computer had been shut down to conserve power.

About half an hour later, the service module was jettisoned by firing the explosive bolts that secured it to the command module. As it drifted away, the astronauts could see the damage caused by the explosion, including to the main engine, showing that the decision to not use it was justified.

Apollo 13 being recovered after splashdown
Apollo 13 being recovered after splashdown

However, they were not home free. Powering up the command module was hard enough, the protocols having been worked out in only three days, but without the reaction thrusters on the service module, the LM couldn't be jettisoned because the command module couldn't move away. This was solved by closing the hatches between Aquarius and Odyssey, leaving the air in the trunk instead of depressurizing. As the clamps were released, the air pushed the two craft apart as it escaped.

As Odyssey entered the Earth's atmosphere, the build-up of hot, ionized plasma around the capsule caused a radio blackout. If you saw the film Apollo 13, you may remember the tense scene as Mission Control waited anxiously to reestablish radio contact. This wasn't just a bit of Hollywood suspense building. The four-minute blackout stretched to six minutes, raising the fear that the heat shield had failed.

Fortunately, it did work, though exactly why the blackout was so long is still not entirely explained.

Recovery

On April 17, 1970, at 18:07 GMT, Odyssey splashed down in the South Pacific Ocean and was recovered by the aircraft carrier USS Iwo Jima. The mission lasted five days, 22 hours, 54 minutes, and 41 seconds.

The astronauts were in good condition despite being dehydrated and losing 50 percent more weight than any other space crew, though Haisse did have a serious urinary tract infection due to his lack of water.

The Apollo 13 crew were in reasonable condition despite their ordeal
The Apollo 13 crew were in reasonable condition despite their ordeal

When the crew of Apollo 13 stepped onto the deck of the Iwo Jima, they were unaware that the whole world had been following their ordeal in numbers not seen since Apollo 11.

"Nobody believes me, but during this six-day odyssey we had no idea what an impression Apollo 13 made on the people of Earth," said Lovell. "We never dreamed a billion people were following us on television and radio, and reading about us in banner headlines of every newspaper published. We still missed the point onboard the carrier Iwo Jima, which picked us up, because the sailors had been as remote from the media as we were. Only when we reached Honolulu did we comprehend our impact: there we found President Nixon and [NASA Administrator] Dr. Paine to meet us, along with my wife Marilyn, Fred's wife Mary, and bachelor Jack's parents, in lieu of his usual airline stewardesses."

Courage, brains, and luck

So what really got Apollo 13 home when the odds were so stacked against them? Certainly, courage played a part. All three men were test pilots and reacted like test pilots. Knowing that panic would do nothing other than waste precious time, they concentrated on the job at hand. Training was also important, as was innovation, as was the combination of relentless training combined with quick, expert thinking from the team on the ground.

The crew of Apollo 13 with President Richard Nixon
The crew of Apollo 13 with President Richard Nixon

But a later NASA report showed that luck had its part to play as well. This isn't to diminish the part played by the astronauts, NASA, or the contractors, because luck favors the prepared.

For one thing, it was fortunate that Gene Kranz and Glynn Lunny, the most experienced flight directors, were present when the accident happened. It was also good fortune that the LM had extra fuel aboard for the course corrections. In addition, Lovell had extensive carrier landing experience, allowing him to adapt quickly to the spacecraft's counterintuitive gyrations.

There was also the timing of the accident. If the explosion had occurred while the Odyssey was undocked from Aquarius, the crew would have been without their lifeboat and the engine needed to return to Earth.

The improved oxygen tank used on Apollo 14 and later missions
The improved oxygen tank used on Apollo 14 and later missions

Then there was the high-gain antenna surviving the explosion despite being damaged. This meant less than two seconds of vital data was lost. The timing of the explosion coming just after the television broadcast meant that some of the LM's systems were powered up, so emergency power wasn't needed to turn the spacecraft on. The broadcast also meant that the crew was not sleeping as scheduled, so they were already alert and active when the accident happened.

Even tragedy helped. The Apollo 1 fire in 1967 led to improvements in CM design, such as a better caution and warning system, and there were extensive electrical insulation improvements, protecting the systems against water damage.

In the short term, Apollo 13 was the mission that NASA wanted to forget. Despite the daring rescue, it was like Dunkirk – a successful defeat. The space agency played down the event. The command module was gutted as part of the accident investigation and the capsule itself was unceremoniously carted off to the Musée de l'air et de l'espace in Paris, though it has since been, put back together, and is on display at the Cosmosphere in Hutchinson, Kansas.

Mission Control celebrates the splashdown of Odyssey
Mission Control celebrates the splashdown of Odyssey

But the years have a way of changing things. In the past half-century, the legend of Apollo 13 has grown. Many lessons were learned from the harrowing adventure that were used to improve the design of later spacecraft and how they were operated. The story became the stuff of a number of best-selling books, two television plays, a feature film, and many documentaries. It's a story that continues to inform and inspire.

View gallery - 30 images
4 comments
Rusty Harris
I was almost 11 years old when this happened. I had followed the man space missions, since John Glenn on his first orbit of the Earth. The entire world was transfixed by this. I was a little hesitant when the movie Apollo 13 came along because Hollywood has a way of "Hollywooding" things like this, but they did a pretty good job of making it more of a "docu-movie".
pat
Comprehensive piece. For even more detail can I recommend the BBC podcast "thirteen minutes to the moon" series 2. Three hours of geeky info for the space obsessive.
guzmanchinky
It's sad that we need potential tragedy to get our attention.
Gregg Eshelman
The root cause what the people who bungled removing the shelf with the oxygen tanks from the Apollo 10 Service Module. When the damage to the tank was seen it should have been marked as damaged, not to be used. Then it should have been cut apart to see what was damaged.

Another cause was when the voltage for the system was increased but someone didn't go back and go over *everything* to ensure that all the wiring, switches, thermal cutouts, circuit breakers etc would handle it. For anything that mechanically switched electricity, it should have been verified that it could handle the increase when closed *and* when opening and closing.

The switching components in the O2 tank could handle the higher power, but could not switch it without damage. They welded closed, compounding the problem with the damaged drain line.

Only after it blew up was the 'fine toothed comb' run through everything as it should have been when the voltage had been increased. That's how they discovered the switches would weld shut during the attempt to use the tank heaters to boil off the liquid oxygen.

It was apathy, a go-go-go attitude, and ass covering that caused the explosion when there were multiple time when someone directly involved could have said "It's damaged, it has to be replaced or properly repaired." or "This isn't working right, we have to fix this or get it replaced with a new one.".

The same attitudes that caused the Apollo 1 fire had crept back in. People seemed to be treating the rockets more like an airliner or a car where it doesn't matter so much if something goes a little wrong. Leave a tool lost somewhere, it's not going to float around. Oh we'll get around to fixing the fuel gauges, soon. Then the plane runs out of fuel and becomes known as the Gimli Glider. (That also had quite a list of missed opportunities to figure out the tanks were only half full.)

The same attitudes came back during the Shuttle launches. I remember once there was a delay because when a Shuttle was raised up to mate it with the external tank a bang was heard inside the Shuttle. IIRC the public was never informed what had happened but I'd bet someone had left a wrench or other tool or some part laying loose in the cargo bay and forgot it was there.

When it comes to rockets, everyone who touches any part of them must know to their core that absolutely every part must work, and every part must have a job to do. Even if there is a backup system, there should be no parts just along for the ride (see the Ariane 5 first launch for what can happen with a superfluous component) and absolutely everything must be securely bolted, screwed, glued, riveted, or tied down. If anything gets so much as a scratch while being worked on it has to be inspected to determine if it's still safe to fly.

The "It was OK the previous flight so it should be good for the next one." attitude has been the cause of several disastrous outcomes in spaceflight.

What technology is finally able to make possible, as demonstrated by SpaceX and in limited fashion by others, is spacecraft that are robust enough to not only be reused but tough enough to be reused without having to re-inspect every last piece in fine detail to ensure it's good for another launch. They still have failures but I expect quite soon they'll have rockets that are tough enough and reliable to be 'gas and go' with minimal inspection like airplanes.