Why did the Apollo Lunar Module have four landing legs?

Why did the Apollo Lunar Module have four landing legs? Is not just three legs enough? Also, three legs guaranties they always form a plane, four does not, as the fourth leg may dangle. To have the centre of mass over the landing leg polygon, even if one of the legs broke, you would need at least five. So why four?

• 1/6th gravity allows for choices you wouldn't make on Earth. – GdD Jan 13 '16 at 17:25
• Gravity does not affect the structural configuration, only the actual expected loading distribution! – Brian Lynch Jan 13 '16 at 22:35
• This is briefly touched on in the From the Earth to the Moon miniseries, episode 5 "Spider", with a group of engineers discussing the number of legs. Whether or not it was a consideration at the time I don't know, but one issue that is specifically mentioned there is interference with thruster quads (four thruster quads and five legs means you risk interference; with four thruster quads and four legs, avoiding interference between them is trivial). – a CVn Jan 17 '16 at 19:46
• Related: Why are four-legged chairs so common? on Physics. – a CVn Jan 21 '16 at 10:45

There is some interesting information here.

Three legs were probably not robust enough, they do not appear to have been considered seriously for any length of time.

Five fixed legs was the main option considered at first, however this wasn't thought to have a wide enough footprint for reliable landings. Eventually they selected the final design of four widely-splayed legs, which were stored folded.

Though the four leg design does not seem suited to an uneven surface (not all in the same plane), part of each leg was collapsible to absorb shock. In fact Apollo 15 did land at a moderate angle:

The vehicle at-rest attitude, as determined from the gimbal angles, was 6.9 degrees pitch up and 8.6 degrees roll to the left, resulting in a vehicle tilt angle on the lunar surface of approximately 11 degrees from the horizontal (Source)

• There is a full LM at the Cradle of Avaition Museum in Long Island. Was supposed to be used on Apollo 19. Pretty cool to see in person. – geoffc Jan 13 '16 at 16:01
• +1 for mentioning the collapsible legs; there was no danger of dangle. – Russell Borogove Jan 15 '16 at 1:04

Three legs offers less safety margin for steep slopes and sideways landings.

If a three-legged lander touches down on a steep slope such that the center of gravity of the ship is outside the triangle formed by the contact points, it will tip over.

The four-legged lander has a substantially larger area inside the quadrangle formed by the contact points; as long as the CG stays above that area, the ship is stable.

Projected to the ground, the shortest horizontal distance the CG could tip and become unsupported:

• for the three legged lander is half the landing gear radius;
• for the four-legged, it's $\frac { \sqrt 2 }{ 2 } = 0.7071$ of the radius.

At the time of landing, with the tanks in the descent stage empty, and the ascent stage full, the LM's CG is fairly high, and the absolute stability limit is about 43º. A three-legged lander with the same gear-radius-to-CG-altitude ratio could tip over at 29º.

Obviously the LM was never intended to land on that steep a slope (I think 15º was the design limit, which A15 got close to). The larger concern was stability in cases where the lander touched down with a substantial horizontal velocity component. In such cases, the fourth leg buys a lot of stability margin.

There's some interesting discussion of the Lunar Module design in chapter 6 of Chariots For Apollo (Brooks, Grimwood & Swenson 1979, NASA SP-4205). In particular, chapter 6.4 notes that a five-legged design was initially considered, but was changed to a four-legged one both to save weight and to simplify the design, which was already based on a four-way symmetric frame:

Grumman had first considered five legs but, during 1963, decided on four. The change was dictated by the weight-versus-strength tradeoff that had produced the cruciform descent stage, with its four obvious attachment points. The revised gear pattern also greatly simplified the structural mounting of the vehicle within the adapter. Four legs set on the orthogonal axes of the lander (forward, aft, left, and right) mated ideally with the pattern of four reaction control "quads" (the basic four-engine package). The quads were rotated 45 degrees so the downward-thrusting attitude control engine fired between the two nearest gear legs, overcoming a severe thermal problem of the five-leg arrangement.

and also:

A retractable gear therefore replaced the simpler fixed-leg gear. Retractability also figured in the shift from five to four legs - the fewer to fold, the better.

Obviously, three legs would've been even lighter and easier to fold than four, but would've had the same issues with mounting and thruster quad placement as five legs: the LM design was based on a cross-shaped frame, with four simple and sturdy attachment points, and it had four symmetrically placed packs of attitude control thrusters whose exhaust had to be directed away from the legs. Also, a three-legged design would've had a significantly smaller stability margin when landing on a slope, and/or if any residual horizontal velocity remained while landing.

• The reduction from 5 legs to 4, for those reasons, is confirmed in the relevant chapter in the cheekily named Haynes Manual. – Camille Goudeseune Jul 29 '19 at 17:15