Lunar Landing Nightmares

I became a member of the Lunar Module Crew Systems Group at Grumman Aircraft Engineering Corporation, in Bethpage, Long Island, in July 1966. During our weekly staff meeting, an engineer would occasionally identify a single point failure that could produce an event that neither the Lunar Module’s (LM’s) backup systems nor the astronauts could withstand and survive. These nightmare scenarios were met with stunned silence. After a discussion of all the ramifications, someone would say in a hushed voice, “OMIGOD, that really could happen!” We’d then form yet another team to develop a solution.

I was called upon to help negate two such nightmares. The first one turned out to be quite simple. Suppose, someone said, after successfully landing on the moon, one of the astronauts was outside the LM exploring the lunar surface while the other guy remained behind in the LM cabin. What if the guy inside the LM had a heart attack, or lost consciousness, or in some way became incapacitated and fell in such a way that he was wedged up against the cabin door, jamming it shut? The LM cabin hatch swings inboard, so in theory a large heavy object on the cabin floor placed against this hatch could prevent it from opening. The astronaut outside the LM would be left to his fate on the lunar surface, unable to re-enter the LM and return to Earth.

NASA had contracted Grumman to provide several non-flight-capable lunar modules for the sole purpose of using them in ground tests. These immobile vehicles were known as Lunar Test Articles, or LTAs. I recruited the biggest guy in the building to play the fallen astronaut in my little melodrama.

I explained to my test subject that I wanted him to lie down on the LTA’s cabin floor so that he’d be blocking the door. He was to remain inert and not dynamically oppose my efforts to enter the cabin. After he was in place, I pushed on the cabin door. Wearing normal office attire, the test subject outweighed me by 50 to 60 pounds, but he slid easily across the cabin floor, allowing the hatch to open, and I clambered over him. We repeated this procedure several times, with him trying a different position on the floor each time from which to oppose my entry. He could never position himself in such a way that the door was permanently jammed shut.

I wrote up a short engineering report describing my findings, and this nightmare scenario was never again mentioned.

We also considered a potential situation where the LM came to rest on the surface in a tilted position, such as on the side of a small hill. As the mission commander performed the touchdown, he would make constant vehicle attitude adjustments to keep the LM perfectly level in roll, pitch, and yaw. The commander controlled the vehicle’s attitude using his three-axis attitude hand controller. The signals from the hand controller, which looked much like a joystick, were routed to the LM’s Primary Guidance Navigation and Control System (PGNS).

PGNS then calculated the combination of reaction control system jets to be fired—along with the amount of thrust necessary—to achieve the desired attitude. It then stored the coordinates of the three-axis position so that this specific attitude could be automatically maintained. After touchdown, the commander would release the hand controller so it returned to its center, or neutral position, which would establish a new three-axis reference for PGNS.

In the landing scenario we were analyzing, because the LM came to rest on a slanted surface, PGNS would sense that the vehicle wasn’t level—and would keep trying to level it by firing the spacecraft’s reaction control rockets. If the vehicle’s tilt angle on the lunar surface was severe enough, the firing of these rockets could cause the vehicle to tip over.

Even if this didn’t happen, needlessly firing the rockets on the surface would squander precious fuel needed to rendezvous and dock with the Command Module waiting in lunar orbit. Clearly, something had to be done to stop the computer from firing the reaction control rockets in a futile attempt to change the LM’s attitude after it had landed.

An interdisciplinary engineering team was assembled to determine the correct shutdown sequence to “safe” all the vehicle’s systems. The procedure we developed took the form of a standard challenge and reply used by all flight crews and was incorporated in the astronaut’s flight handbook, entitled “Post lunar landing shutdown procedure.”

On July 20, 1969, the Lunar Module, named “Eagle” by its crew, descended to the lunar surface. At the Apollo Mission Time (MT) of 102:45:40 the LM Pilot Buzz Aldrin reported, “Contact light.”

At MT 102:45:43 Aldrin instructed Neil Armstrong, “Okay, ENGINE STOP.”

At MT 102:45:45 Aldrin said, “[Attitude Control Assembly]—out of detent.” A second later Armstrong responded, “Out of detent.”

This key step provided the PGNS with a new set of three axis reference points so the rockets would not be erroneously commanded to fire.

Continuing to follow our shutdown procedure, at MT 102:45:47 Aldrin instructed Armstrong, “MODE CONTROL—both OFF. DESCENT ENGINE COMMAND OVERRIDE—OFF.” One second later, Armstrong reported, “Engine Arm is OFF.” The LM was now “safed.”

After a short pause Armstrong made his world-stopping announcement: “Houston, Tranquility Base here. The Eagle has landed.”

Our effort to prevent a lunar landing nightmare had an unforeseen historical consequence: When we wrote the post lunar landing shutdown procedure, we had scripted the very first words spoken from the lunar surface.

They weren’t as poetic or memorable as Armstrong’s observance of a small step followed by a giant leap, but they helped ensure Armstrong and Aldrin were able to get home.