Why Apollo’s Lunar Module Ascent Engine Was Never Live Fired

The lunar module ascent engine was the only engine of the Apollo Moon missions to be classed as so critical that even the most minor alteration had to be signed off by the highest management in NASA. It was also the only engine that was not live fired as a complete unit before being fitted to the lander. If it failed to start on the Moon, there would be no way to rescue the crew.

Why the lander came in two parts

When John F Kennedy announced the Moon missions in 1962, the US had about 15 minutes of experience in orbit. Many, including Apollo leader Wernher von Braun, suggested landing one large rocket. NASA engineer John Houbolt argued that it would be far too large and carry unnecessary weight, and proposed that the command service module stay in orbit while a smaller, lighter lander descended and returned to rendezvous. Von Braun, to everyone's surprise, chose Houbolt's idea over his own.

The lander contract went to Grumman, the last major contractor to join Apollo. Its two-stage craft would descend and land, then a smaller, lighter ascent section would take off and leave the descent section behind. Grumman subcontracted the descent engine to TRW and the ascent engine to Bell Aerosystems.

Why reliability was non-negotiable

The descent engine had to be throttleable while the lander came down from 50,000 ft, something not done before. It also served as a backup for a failed command service module engine, which is what happened on Apollo 13 after an oxygen tank exploded. The ascent engine did not need throttling, but it had to be as light as possible and 100% reliable. If the descent engine failed during landing, the crew would abort and the ascent engine would be their only source of thrust.

Hypergolic fuel

The most reliable way to start an engine in space was hypergolic propellant, where fuel and oxidizer combust on contact and work even in vacuum. The fuel was a 50/50 mix by weight of hydrazine and unsymmetrical dimethylhydrazine, with nitrogen tetroxide as the oxidizer, also used in Titan 2 ICBM engines. These are highly corrosive and dangerous; even five parts per million was considered very hazardous to lungs, eyes and skin, and the fuel is carcinogenic.

The design was simple: a couple of valves let propellant into the combustion chamber, and a helium-pressurized system removed any need for pumps or turbines. High pressure helium forced fuel and oxidizer to the engine just before the valves opened.

Instability and the untested engine

Simple as it was, small changes made a large difference to performance. Bell had continuing combustion chamber instability that could make the engine fail, and changes to the injector plate did not fix it. The nozzle's ablative coating also eroded, and growing ascent module weight meant the engine needed more power or longer burns.

Because the propellants were so corrosive, engines had to be completely rebuilt after each ground test. They could therefore not be live fired before fitting; designers could only test run them to check the design, then build new ones. Testing took place at White Sands because of its remote location. Spills produced a red vapor, and a base downwind would have to be evacuated immediately.

Rocketdyne's injector plate

With Bell's injector problems unresolved and a May 1968 schedule looming, Grumman brought in Rocketdyne to create its own injector plate as a backup. Tests showed the Rocketdyne injector was more suitable. The engine was first to be built by Bell with the Rocketdyne injector under Grumman's direction, but by September 1968 NASA directed Rocketdyne to assemble the engine, leaving Bell to supply parts.

On Apollo 9 and Apollo 10 both the descent and ascent engines performed as expected, with no unforeseen issues, clearing the way for Apollo 11 and the first landing on 20 July 1969.