Don’t get me started

The excerpt below is from the site of Apollo 17 Lunar Module Pilot and geologist Harrison “Jack” Schmitt, and it’s the most…well, invigorating description of a jump start I’ve ever read.

This goes hand-in-hand with my article on the explosive guillotine in the Lunar Module because Schmitt describes an emergency scenario that Apollo crews planned for and practiced in which the launch sequence has failed: The guillotine has not fired, the four explosive bolts holding the two stages together have not exploded, and the ascent engine has not started. This is one of several contingency methods mission planners worked out.

Bear in mind as you read Schmitt’s explanation that this would be happening after they had tossed their Portable Life Support System backpacks out onto the lunar surface to save weight during the ascent, and after they had closed up the LM and repressurized the cabin in preparation for departure from the lunar surface.

It’s not often I find something about Apollo I’ve never heard before, and this one is boggling. I bolded the last bit of the excerpt because that’s the point when the ramifications sank in and my eyebrows shot off.

Wednesday, November 8th, brought on our last full Lunar Ascent Mission Simulation involving Mission Control in Houston. Six weeks hence, we hoped we would be undertaking the real thing and departing the Moon at the conclusion of a highly successful exploration effort. This “Sim” required over three straight hours in LMS2, including the debriefing with SIMSUP (Simulation Supervisor). Failure or degradation of the primary guidance or engine ignition subsystems constituted the primary concerns addressed in Ascent Simulations. We particularly worked through several scenarios involving failure of the various software-initiated means of igniting the Ascent Engine.

Schmitt in Lunar Module Simulator 2. NASA photo ap17-KSC-72PC-539

We did not have a great deal of concern about our Challenger Lunar Module, like all the others before it, having just one Ascent Engine, because, in fact, it was at least two engines that just looked like one. Only the solid metal fuel and oxidizer injector ring and the exhaust nozzle below that ring did not have identical, that is, “redundant” components that would function even if a primary component failed. No one could imagine a failure mode for these non-electronic and solid pieces of hardware.

If all internal Ascent Engine ignition options actually failed, and many such options existed to fall back on, we also had a set of jumper cables that could be used as a next to last backup to ignite the Ascent Engine. These were called the “ED/APS Emergency Jumper Cable” and would use power from an independent Pyrotechnic Battery in the Descent Stage to open the engine’s fuel and oxidizer valves and fire the pyrotechnic cable and bolt cutters that would simultaneously separate us from the Descent Stage.

To use the second of these cables, however, one of us would need to egress Challenger in order to access a regular Descent Stage battery. Integrity checks of our suit would determine which one of us would perform this emergency EVA. If Cernan’s pressure suit did not pass its pre-egress checks sufficiently to permit egress with the jumper cables, we would change positions in the cabin, a tough task on its own. As we would have already jettisoned our Portable Life Support Systems, it would be necessary to use the OPS (Oxygen Purge System) we had retained to support the EVA that Evans would perform to retrieve film canisters from America’s Scientific Equipment Bay after leaving lunar orbit for home. The 8000 psi oxygen bottle in the OPS could provide a maximum of 30 minutes of oxygen and air-cooling once activated. There would be no water cooling, however, without a PLSS.

With the Challenger’s cabin depressurized, the winner of the integrity check contest would take one end of the pair of cables out the hatch and down the ladder and move to QUAD III where a battery could be accessed. He would then tear away the Kevlar covers and attach the color-coded pair of cables to the positive and negative terminals of a battery and then return to the cabin. At the optimum liftoff time for ascent into a rendezvous sequence with Evans, Cernan would attach the cables to two circuit breakers near his left shoulder. This action would supply instant power to the two sets of hypergolic (ignite on contact) hydrazine and nitrous oxide valves in the Ascent Engine. Once power reached these valves, they would open and lock open. With opening of these valves, a signal would go to the cable and bolt cutters. We would be instantly on our way into lunar orbit, still in an un-pressurized cabin, dragging our jumper cables behind us. Once back in lunar orbit, we could clear and seal the hatch and pressurize the cabin.

The aim of this emergency EVA was to bypass relay boxes, internal wiring, and the Explosive Devices control panel in order to get power directly from a descent stage battery.

The descent stage explosive device battery, aka the pyro battery, in question was near the front, highlighted here. This procedure bypassed that in favor of a regular descent stage battery.

In later LMs, Apollo 17’s included, four descent stage batteries were at the back of the LM, shown below in an illustration from the Lunar Module LM 10 through LM 14 Vehicle Familiarization Manual [link to PDF]. The jumper cable would be affixed to one of those four.

I’m glad they never had to do this, but it actually sounds like it would work. You might think, “Yeah, except for all the cardiac arrests and such”, but you have to remember that these guys were cool customers. Witness the fact that they practiced for this instead of climbing out of the sim and seeking the nearest bar posthaste when told of the method.

Schmitt says this method was the “next to last backup”, which makes me wonder intensely what on Earth Moon the last backup was. Spit and baling wire?


The explosive guillotine in the Lunar Module

You: “Did you say ‘guillotine’?”
Me [approximating John Cleese]: “Explosive guillotine, yes.”

August 2018 update: See also the companion article Don’t get me started, in which Apollo 17 LMP Jack Schmitt describes a mind-boggling workaround they could attempt if the ascent stage launch pyrotechnics failed to fire.

LM guillotine

In missions past and present, explosive devices feature in pretty much every spacecraft because they’re a safe, reliable way to ensure that processes start, items such as antennas are deployed, and connected assemblies that need to come apart are quickly and cleanly separated.

On the Apollo missions, over 210 pyrotechnic devices were in the Saturn V stack and the Command, Service, and Lunar Modules, used for everything from extending the LM landing gear to deploying drogue and main parachutes to ensuring fuel was at the correct side of a tank – for which the word ullage (in French, ouillage) was borrowed from vintners, to whom it means the headspace between the top of the wine and the container it’s in, whether a cask or a bottle.

The Lunar Module had several devices on board:

ED Locations

Control over them was through the Explosive Devices Control Panel:

ED Control Panel

All of these devices were essential, but particularly key were the devices set off to initiate separation of the ascent and descent stages of the LM when the astronauts departed the lunar surface. This was a three-stage process that took place in the tenths of seconds before the ascent engine was lit:

  • First, fire circuit interrupters to cut off electrical signals between the stages
  • Second, fire and shear the four explosive nut and bolt assemblies that affix the ascent stage to the descent stage
  • Third, using the explosive guillotine, slice through a thick bundle of umbilical cables and wires and a water supply line that run between the two stages

Though these devices were known to be generally reliable, a certain level of trepidation about them is understandable. Blowing up some high explosives to drive a big blade through wires doesn’t exactly sound like the most controlled process even though it actually was.

“Did you know when that unit was up on the moon, and the ascent stage was going to take off, they had all those wires – fourteen miles of them – running from the ascent stage into the descent stage, and it all had to be disconnected before you took off, or you didn’t take off? That’s all there was to it. You couldn’t use wire couplings that just pulled out when you gave it a good, hard yank. Do you want to trust a wire coupling to hold through a Saturn V liftoff and all that g-force and vibration? Uh-uh. Try flying a ship with a few loose wires. So, it was all solid connections, which is why we put a guillotine inside the descent stage: to cut all the wires. Everything had to be timed just right. The explosives had to trigger the guillotine and the blade had to cut through some pretty thick cables, and at the same time, the ascent rocket engine, which was never run before, had to start.”
– Bob Ekenstierna, LM descent stage construction supervisor at Grumman

In Chariots for Apollo by Pellegrino and Stoff, a somewhat sensationalist telling of the building of the Lunar Module at Grumman*, they speak of Joe Kingfield, the director of quality control. I won’t quote them directly since they went over the top with their narrative, but Kingfield had frequent nightmares about the liftoff from the moon that involved the guillotine and one or more of the explosive bolts failing. In his dreams, the ascent stage lifted off, but, still connected by miles of wire, dragged the descent stage along the ground and eventually crashed back into the surface. In later years, Kingfield still could not bring himself to watch the footage of the lunar liftoffs taken by the Mission Control-directed TV cameras on the Lunar Roving Vehicles of Apollo 15, 16, and 17.

*Not to be confused with the unimpeachable NASA volume of the same name by Brooks, Grimwood, and Swenson; web and epub links at the link. 2018 update: You can get a free high-quality scanned PDF of this book and many other official NASA histories – see the I got mine at the GPO bookstore post for the NASA Technical Reports Server links.

Charlie Duke, Lunar Module Pilot of the Apollo 16 Orion (the LM pictured in the Finley Quality Network banner above), said that the pyrotechnics for the ascent stage separation gave him brief pause just before he and Commander John Young lifted off from the moon. When the circuit interrupters fired, then the four interstage bolts at the corners were sheared, and finally the guillotine sliced through the umbilical and water lines, the entire ascent stage suddenly dropped an inch or so. Duke thought, “Oh, sh…” but did not have time to finish that thought as the ascent engine fired and abruptly took them away from the surface back toward Ken Mattingly awaiting their return aboard the Casper Command and Service Module in lunar orbit.

You can see a fair amount of the thermal protection fly off the ascent stage as it lifts off, which happened to all of the ascent stages to some extent. In addition, panels on the rear that provided thermal protection for the Aft Equipment Bay were damaged during the liftoff, but they had done their job already. Mattingly took this photograph of the Orion before docking:


Apollo deniers like to point to this and other photographs of the Orion damage as ineluctable proof of chicanery, but what it really means is that they prefer extending and enhancing their apparently quite enjoyable fantasies to, say, reading the post-mission report (9th link in the background material):

At lunar lift-off, four vertical thermal shields (fig. 14-26) on the aft equipment rack were torn loose from the lower standoffs and remained attached only at the upper standoffs. This occurrence was observed from the lunar-based television.

The most probable cause of the failure was ascent engine exhaust entering the cavity behind these thermal shields. A cross section of the lower edge of the shields is shown in figure 14-27. Analysis shows that the thermal shield which extends below the support tube allows a pressure buildup on the closure shield which exceeds its capability. Once the closure shield failed, the exhaust entered the cavity behind the shield, resulting in a pressure buildup exceeding the capability of the vertical thermal shields.

In the lunar surface photographs taken prior to lift-off, some of the shields appear to have come loose from the center standoff (fig. 14-28). Excessive gaps between some of the panels are evident. Both conditions could be caused by excessive pressure in the thermal blanket due to insufficient venting during boost.

The corrective action will include a redesign of the thermal shield to eliminate the projection below the support tube, as shown in figure 14-27, and to provide additional venting to the blankets as well as additional standoffs.

This anomaly is closed.

Not one problem was detected in any of the pyrotechnics during any Apollo mission. The device designs used in Apollo were later adopted by the Shuttle program, with, for instance, the Single-Bridgewire Apollo Standard Initiator (SBASI) becoming the NASA Standard Initiator (NSI).