1968: Apollo 11’s LM-5 ascent stage under construction at Grumman in Bethpage, Long Island. The ascent stage without fuel weighed 2,445 kg/5,390 lb; double that with fuel. Click for a larger version.

You: “Did you say ‘guillotine’?”
Me [approximating John Cleese]: “Explosive guillotine, yes.”

August 2018 update: See also the companion article Don’t get me started, in which Apollo 17 LMP Jack Schmitt describes a mind-boggling workaround they could attempt if the ascent stage launch pyrotechnics failed to fire.

See also the comments at the end of this article for a photo of a guillotine housing, sent by a fellow who machined many of them at Grumman.

In missions past and present, explosive devices feature in pretty much every spacecraft because they’re a safe, reliable way to ensure that processes start, items such as antennas are deployed, and connected assemblies that need to come apart are quickly and cleanly separated.

On the Apollo missions, over 210 pyrotechnic devices were in the Saturn V stack and the Command, Service, and Lunar Modules, used for everything from extending the LM landing gear to deploying drogue and main parachutes to ensuring fuel was at the correct side of a tank in zero G – for which the word ullage (in French, ouillage) was borrowed from vintners, to whom it means the headspace between the top of the wine and the container it’s in, whether a cask or a bottle.

The Lunar Module had several devices on board:

Control over them was through the Explosive Devices Control Panel:

All of these devices were essential, but particularly key were the devices set off to initiate separation of the ascent and descent stages of the LM when the astronauts departed the lunar surface. This was a three-stage process that took place in the tenths of seconds before the ascent engine was lit:

• First, fire circuit interrupters to cut off electrical signals between the stages
• Second, fire and shear the four explosive nut and bolt assemblies that affix the ascent stage to the descent stage
• Third, using the explosive guillotine, slice through a thick bundle of umbilical cables and wires and a water supply line that run between the two stages

Though these devices were known to be generally reliable, a certain level of trepidation about them is understandable. Blowing up some high explosives to drive a big blade through wires doesn’t exactly sound like the most controlled process even though it actually was.

“Did you know when that unit was up on the moon, and the ascent stage was going to take off, they had all those wires – fourteen miles of them – running from the ascent stage into the descent stage, and it all had to be disconnected before you took off, or you didn’t take off? That’s all there was to it. You couldn’t use wire couplings that just pulled out when you gave it a good, hard yank. Do you want to trust a wire coupling to hold through a Saturn V liftoff and all that g-force and vibration? Uh-uh. Try flying a ship with a few loose wires. So, it was all solid connections, which is why we put a guillotine inside the descent stage: to cut all the wires. Everything had to be timed just right. The explosives had to trigger the guillotine and the blade had to cut through some pretty thick cables, and at the same time, the ascent rocket engine, which was never run before, had to start.”
– Bob Ekenstierna, LM descent stage construction supervisor at Grumman

In Chariots for Apollo by Pellegrino and Stoff, a somewhat sensationalist telling of the building of the Lunar Module at Grumman*, they speak of Joe Kingfield, the director of quality control. I won’t quote them directly since they went over the top with their narrative, but Kingfield had frequent nightmares about the liftoff from the moon that involved the guillotine and one or more of the explosive bolts failing. In his dreams, the ascent stage lifted off, but, still connected by miles of wire, dragged the descent stage along the ground and eventually crashed back into the surface. In later years, Kingfield still could not bring himself to watch the footage of the lunar liftoffs taken by the Mission Control-directed TV cameras on the Lunar Roving Vehicles of Apollo 15, 16, and 17.

*Not to be confused with the unimpeachable NASA volume of the same name by Brooks, Grimwood, and Swenson; web and epub links at the link. 2018 update: You can get a free high-quality scanned PDF of this book and many other official NASA histories – see the I got mine at the GPO bookstore post for the NASA Technical Reports Server links.

Charlie Duke, Lunar Module Pilot of the Apollo 16 Orion (the LM pictured in the Finley Quality Network banner above), said that the pyrotechnics for the ascent stage separation gave him brief pause just before he and Commander John Young lifted off from the moon. When the circuit interrupters fired, then the four interstage bolts at the corners were sheared, and finally the guillotine sliced through the umbilical and water lines, the entire ascent stage suddenly dropped an inch or so. Duke thought, “Oh, sh…” but did not have time to finish that thought as the ascent engine fired and abruptly took them away from the surface back toward Ken Mattingly awaiting their return aboard the Casper Command and Service Module in lunar orbit.

You can see a fair amount of the thermal protection fly off the ascent stage as it lifts off, which happened to all of the ascent stages to some extent. In addition, panels on the rear that provided thermal protection for the Aft Equipment Bay were damaged during the liftoff, but they had done their job already. Mattingly took this photograph of the Orion before docking:

Apollo deniers like to point to this and other photographs of the Orion damage as ineluctable proof of chicanery, but what it really means is that they prefer extending and enhancing their apparently quite enjoyable fantasies to, say, reading the post-mission report (9th link in the background material):

At lunar lift-off, four vertical thermal shields (fig. 14-26) on the aft equipment rack were torn loose from the lower standoffs and remained attached only at the upper standoffs. This occurrence was observed from the lunar-based television.

The most probable cause of the failure was ascent engine exhaust entering the cavity behind these thermal shields. A cross section of the lower edge of the shields is shown in figure 14-27. Analysis shows that the thermal shield which extends below the support tube allows a pressure buildup on the closure shield which exceeds its capability. Once the closure shield failed, the exhaust entered the cavity behind the shield, resulting in a pressure buildup exceeding the capability of the vertical thermal shields.

In the lunar surface photographs taken prior to lift-off, some of the shields appear to have come loose from the center standoff (fig. 14-28). Excessive gaps between some of the panels are evident. Both conditions could be caused by excessive pressure in the thermal blanket due to insufficient venting during boost.

The corrective action will include a redesign of the thermal shield to eliminate the projection below the support tube, as shown in figure 14-27, and to provide additional venting to the blankets as well as additional standoffs.

This anomaly is closed.

Not one problem was detected in any of the pyrotechnics during any Apollo mission. The device designs used in Apollo were later adopted by the Shuttle program, with, for instance, the Single-Bridgewire Apollo Standard Initiator (SBASI) becoming the NASA Standard Initiator (NSI).