There's a specific kind of engineering courage required to put one engine between your crew and a fatal outcome. No backup. No second chance. One combustion chamber, one turbopump, one shot at getting off the lunar surface. That's the architecture NASA has carried forward from Apollo into Artemis — and a peer-reviewed paper published in the journal Chinese Space Science and Technology in March 2026 called it out directly, describing the single-engine descent and ascent configuration as containing "glaring weaknesses" that pose life-threatening risks.
The critique is pointed, and worth taking seriously on its technical merits — not as geopolitical posturing, but as a genuine systems-thinking question. Why would experienced engineers accept a single-point failure mode in the most critical phase of a crewed mission?
The answer, as usual, is that they're not being reckless. They're making a trade.
The Weight Budget Doesn't Lie
Every kilogram you add to a lunar lander has to be lifted from Earth, accelerated to lunar orbit, decelerated into low lunar orbit, and then carried down to the surface. Redundant engines aren't free. They bring additional mass, additional plumbing, additional valves, additional failure modes in the redundancy system itself. The Chinese approach — four engines with backup capability so that no single failure is catastrophic — is genuinely safer against engine-out scenarios. But it's heavier, more complex to throttle and gimbal in concert, and harder to qualify for human rating.
The Apollo engineers ran this calculation in the 1960s and landed on a single high-thrust engine for the descent stage and a single pressure-fed engine for ascent. The ascent engine in particular was chosen for its simplicity: pressure-fed hypergolic propellants ignite on contact, with no ignition system to fail, no turbopump to cavitate. The single-point risk was real, but the failure modes were well-understood and the engine itself was ruthlessly reliable. That philosophy — minimize complexity in the most critical system — is a coherent engineering position, not an oversight.
What Starship Changes About the Equation
Here's where the Artemis picture gets more interesting than the Chinese paper's framing suggests. NASA's Artemis program doesn't use a legacy Apollo-style lander. It uses SpaceX's Starship as the Human Landing System, and Starship's propulsion architecture is fundamentally different — multiple Raptor engines, not a single main engine.
The revised mission profile announced at Johnson Space Center in June makes this clearer. Rather than rendezvousing in near-rectilinear halo orbit, Starship will now dock with Orion in Earth orbit, perform the translunar injection with Orion attached, and then separate for the lunar landing from low lunar orbit. SpaceX's Jessica Jensen noted the approach "improves crew safety" by moving the critical docking event to Earth orbit — where abort options are far more accessible — and enabling surface abort "almost any time" rather than waiting days from NRHO.
That's a meaningful safety improvement, and it addresses a different failure mode than engine redundancy: the scenario where something goes wrong during the lunar approach and the crew needs options fast. The single-engine critique applies more cleanly to legacy lander architectures than to Starship's multi-engine design.
The Testing Infrastructure Behind the Bet
None of this works without a testing program that can actually validate the thermal and propulsion systems before crew gets aboard. NASA's HLS acting program manager Steve Creech described how the agency is drawing on capabilities across all ten of its space centers — arc jet testing at Ames, component testing at JPL, flammability testing for HLS materials at White Sands. The thermal protection system work is particularly intensive: Orion's heat shield on Artemis II showed significantly reduced charring compared to Artemis I, with results matching ground test predictions from arc jet facilities.
That last point matters for understanding how NASA manages risk without redundancy. When you can't add a backup engine, you invest heavily in understanding and eliminating failure modes through testing. The heat shield data from Artemis II — samples headed to Marshall Space Flight Center for X-ray analysis — is part of that same discipline: build confidence in the primary system rather than hedging with a secondary one.
The Deeper Trade-Off
The Chinese paper frames this as a values question — what does each program's design reveal about how it weighs human life? That's a fair framing, but it elides the engineering reality that redundancy itself introduces complexity, and complexity introduces its own failure modes. The question isn't whether redundancy is good in principle. It's whether the specific redundancy you're adding reduces overall mission risk or redistributes it.
Watch for how Blue Origin's Blue Moon Mark 2 — the other lander competing for Artemis 4 — handles this question. Its architecture hasn't been disclosed in the same detail, and the June crew announcement event focused primarily on the Starship approach. If Blue Moon takes a different position on engine redundancy, that comparison will tell us something real about where the engineering community has landed on this trade — and whether the single-engine bet is a consensus position or a contested one.
