One of NASA's biggest deliberately accepted risks occurred 17 years ago, when it bet everything on the moon lander's single rocket engine. Had that engine failed, Neil Armstrong and Edwin (Buzz) Aldrin would have been marooned on the moon with no prospect of rescue.

"It was an acceptable risk and it was a morally acceptable risk, because everybody understood the situation and because the engine had been tested so many times," said Jerome F. Lederer, who was NASA's safety director in July 1969 when the first moon landing occurred.

Before the landing, each of the 14 engines Rocketdyne had built for the Grumman Corp.'s lunar lander was tested on simulated missions that involved 18 starts and a total of 460 seconds of operation. The fuel injector, one part that proved balky, was retested 871 times until experts were sure it was right.

The engines were intentionally made as simple as possible to reduce the number of things that could go wrong. The liquid fuels were fed by pressure to avoid the use of sometimes cranky pumps and the chemicals used as fuels would ignite on contact and thus not require an ignition system.

Despite the confidence purchased with those tests, Grumman's Thomas J. Kelly, who was engineering manager for the lunar module, said that the most exciting television picture for him "was when they rigged that camera that looked back as it lifted off."