<div class="htmlview paragraph">The Apollo spacecraft has 50 rocket engines arranged in 7 separate and independent systems. During a single mission there are approximately 100,000 rocket engine firings. In order to accomplish a lunar landing, all engines and systems must work reliably. Redundant components and system back-up capabilities are provided in the design. Back-up operational modes are possible to return the crew safely at all times in the event a system failure causes a mission abort. These crew safety requirements impose many unusual constraints that are not required in launch vehicle or unmanned propulsion system designs. These requirements and their effects on design and operation are discussed and the systems operational experience on Apollo models are presented.</div>