The Machine Entire

What It Was Made Of

The airframe is the least discussed part of the vehicle and one of the more remarkable.

The S-IC first stage was built almost entirely of aluminium alloy 2219, chosen for strength retained at cryogenic temperature and for weldability. Its tank walls were not sheet metal with stiffeners riveted on. They were thick plates into which a stiffening pattern was machined -- an isogrid, a lattice of triangular pockets milled out of the solid, leaving a mesh of integral ribs. The result behaves like a stiffened structure but has no fasteners, no joints and no stress concentrations at attachment points, and it can be chemically milled to remove metal wherever loads are lower.

The kerosene tank and the oxygen tank were separate, with a cylindrical intertank between them, and five ducts ran from the oxygen tank down through the kerosene tank to the engines -- because the oxygen tank sat above the fuel tank and the propellant had to get past it somehow.

The thrust structure at the base carried five F-1 engines and transferred 34 million newtons into the tank above. The centre engine was fixed. The four outboard engines were mounted on gimbals and could pivot through about five degrees. Four fins at the base provided aerodynamic stability in the lower atmosphere and were, in the end, of marginal value; later analyses suggested the vehicle would have been controllable without them.

The second stage was the hardest. The S-II had to be enormous in volume, because hydrogen is not dense, and extremely light, because every kilogram of it had to be lifted by the stage below. North American Aviation ran a weight reduction programme through the mid-1960s that removed several tonnes by chemical milling, thinner welds, and the common bulkhead described in the previous part. The finished stage was 92.5 percent propellant by mass.

Two Kilobytes and a Gyroscope

Between the third stage and the spacecraft sat a ring 10.1 metres across and 0.9 metres tall, built of bonded aluminium honeycomb and packed with electronics. This was the instrument unit, and it flew the launch vehicle. Nothing in the command module controlled the Saturn V during ascent; the crew were passengers with an abort handle.

The instrument unit contained two things that mattered above all others.

The ST-124-M3 inertial platform was the vehicle's sense of where it was and which way it was pointing. It was a three-gimbal stabilised platform carrying three gyroscopes and three accelerometers, held in a fixed orientation in inertial space while the vehicle rotated around it. The gimbals ran on gas bearings: dry nitrogen forced through fine orifices supported the rotating elements on a film of gas, eliminating mechanical contact and therefore friction, which is the dominant source of drift in a mechanical gyroscope. The whole assembly was temperature-controlled to a fraction of a degree, because thermal expansion of the structure is itself an error source.

The Launch Vehicle Digital Computer was built by IBM. It was triple-redundant in a manner that deserves description: three identical logic channels ran the same calculation simultaneously, and their outputs were compared bit by bit by voting circuits. If one channel disagreed, the majority result was used and the dissenting channel was ignored for that operation. A failed channel did not stop the flight and did not even require detection in advance; it was simply outvoted.

Its memory was magnetic core, measured in tens of kilobytes. Its instruction rate was a few thousand operations per second. A modern telephone performs more arithmetic while displaying its lock screen.

The Computer That Rewrote the Route

The most important piece of software aboard was the guidance law, and it was genuinely novel.

The obvious way to guide a rocket is to compute an optimal trajectory before flight, store it, and steer to follow it. That is how the A-4 worked and how most missiles of the 1950s worked. It has a fatal weakness: if the vehicle underperforms, it is now following a path that is no longer optimal for the vehicle it has become, and it will run out of propellant short of the target.

The Saturn V's upper stages used Iterative Guidance Mode. Rather than following a stored path, the computer solved, repeatedly during flight, the calculus-of-variations problem of the minimum-propellant path from wherever the vehicle actually was, with whatever velocity it actually had and whatever thrust it was actually producing, to the required orbital conditions. The solution was recomputed roughly once a second, and the vehicle steered to the current answer.

The consequence is that the Saturn V did not merely tolerate underperformance. It re-planned around it.

This was demonstrated in the most convincing way possible on Apollo 6 in April 1968. Two of the five second-stage J-2 engines shut down. The vehicle had lost forty percent of its second-stage thrust. Iterative Guidance Mode recalculated, held the remaining three engines burning far longer than nominal, adjusted the pitch profile, and put the stage into orbit -- an incorrect orbit, but orbit. A vehicle following a stored trajectory would have fallen into the Atlantic. Apollo 6

Nine Seconds

The countdown's final minutes are worth walking through, because almost every element exists for a reason that is not obvious.

At about T minus 17 seconds, guidance was released to internal control: the platform stopped taking updates from the ground and the vehicle became responsible for itself.

At T minus 8.9 seconds the ignition sequence began. The five F-1 engines were not lit together. The centre engine fired first, then the two opposing outboard pairs at intervals of roughly 300 milliseconds, in a one-two-two pattern, so that the thrust structure was loaded progressively rather than shocked with 34 million newtons at once.

Simultaneously the water deluge began. Roughly 1.4 million litres of water poured onto the pad and into the flame trench over about forty seconds. Its primary purpose was not cooling. A Saturn V at ignition produced a sound pressure level of roughly 200 decibels close in, enough to ignite grass at a distance and, more seriously, enough that acoustic energy reflected off the pad could damage the vehicle and its payload. Water injected into the exhaust stream and sprayed across the deck absorbed acoustic energy and broke up the reflected wave. The deluge existed to stop the rocket shaking itself apart with its own noise.

Beneath the platform, a flame trench with a wedge-shaped deflector split the exhaust and turned it horizontally out of two openings, so that the plume was not reflected straight back up into the engines.

Through all of this the vehicle was held down. Four hold-down arms gripped the base of the S-IC while the computer read thrust from each engine in turn and verified that all five had reached commit level. Only then were the arms released -- and even then not instantly. Each arm withdrew through tapered pins that were drawn out over about half a second, so that the vehicle was let go progressively. A rocket released instantaneously at full thrust would leap, and the structural rebound could damage it.

From first ignition to release: about nine seconds, of which the last several were the machine being asked whether it meant it.

Two entries in that table are worth pausing on.

The centre engine shutdown at 135 seconds was not a failure. As the first stage burned off two thousand tonnes of propellant, the vehicle became dramatically lighter while thrust stayed constant, so acceleration climbed steadily. Left alone it would have exceeded four times gravity, which was more than the structure was designed for and more than the crew were rated to endure while lying on their backs in a couch. Shutting one engine down dropped the acceleration and let it climb again toward the limit, which is why the acceleration trace of a Saturn V ascent has a sawtooth in it.

The interstage jettison at 194 seconds is one of the most photographed moments in spaceflight, because a camera mounted on the S-II filmed the ring falling away against the curve of the Earth. The ring was a cylindrical section that had to remain attached for about thirty seconds after S-II ignition, because the J-2 nozzles hung down inside it, and then be dropped cleanly without touching any of the five engines burning within it.

Pogo

There is one failure mode that recurred throughout the programme and that illustrates the difficulty of large vehicles better than anything else.

If the vehicle's structure flexes longitudinally, it accelerates the propellant in the feed lines. That changes the pressure at the pump inlet, which changes the flow, which changes the thrust, which pushes the structure -- and if the timing of that loop matches a structural resonance, the oscillation grows. The vehicle begins to bounce along its own axis. The name for it, from the toy, is pogo.

On Apollo 6 the first stage developed a pogo oscillation at about five and a half cycles per second, severe enough to damage the spacecraft adapter structure. The fix was elegant: helium gas was introduced into cavities in the oxygen prevalves, creating a compressible gas spring in the feed line that shifted its resonant frequency away from the structure's, breaking the coupling.

It was not fully solved. On Apollo 13, the centre engine of the second stage shut down 132 seconds early after a pogo oscillation reaching about sixteen cycles per second, with measured accelerations of 34 times gravity at the engine mount. The engine's own thrust chamber pressure sensor detected the excursion and commanded shutdown, which was the correct action and almost certainly prevented structural failure. The remaining four engines burned longer, Iterative Guidance Mode compensated, and the mission reached orbit.

The problem then remaining for that crew was not the second stage. Apollo 13

What Comes Next

At 697 seconds the vehicle was in a 185-kilometre parking orbit, travelling at 7,793 metres per second, with the third stage still attached and roughly two-thirds of its propellant unburned.

It then did nothing at all for about two and a half hours, coasting through one and a half orbits while the crew and the ground checked every system, and while the geometry of the Earth, the vehicle and the Moon came into the correct relationship for departure.

The next part is about the decision that determined what happened after that burn, and it is the single most consequential architectural argument in the history of spaceflight.

There were three ways to go to the Moon. Direct Ascent required a vehicle so large that nobody could build it in time. Earth Orbit Rendezvous required two launches and assembly in orbit. Lunar Orbit Rendezvous required leaving part of the spacecraft in lunar orbit while a separate small vehicle went down and came back -- and it was advocated for two years by a mid-level engineer at Langley who went around his own management chain to argue for it, and was very nearly fired.

It covers why the logarithm decided the argument, and then goes inside the machine that resulted: the Lunar Module, with a throttleable descent engine whose pintle injector became the ancestor of the Merlin, an ascent engine with no ignition system and no backup because it had exactly one chance to work, and walls in places thinner than a drinks can.