Explosive bolts are often used for stage and payload separation. If only one of the many explosive bolts used fails to break into two pieces, the payload of the rocket may be lost. Are there more than one detonator used to initiate the explosive charges of these bolts, together with separate electric circuits for the control? Very little weight will be added by several initiators and their connections, but the probability of a failure should be much lower.
Sometimes they can do their job a little too well, or blow out some stuff when they're not supposed to, but I've never heard of one failing. They are normally used in a redundant pair fired close to simultaneously where either one will do the trick. The electronics firing them are also redundant. If your pyro fails to do its job, I'll be willing to bet 20:1 odds it was because either a) there was no power, or b) the software or controller made a boo boo and didn't try to fire it.
I found a document about that theme:
Apollo Spacecraft & Saturn V Launch Vehicle Pyrotechnics / Explosive Devices
- More than 210 pyrotechnic devices per Apollo Mission.
- All devices required high reliability and safety
- Most devices were classified as either crew safety critical or mission critical.
- When complete system redundancy was not possible, redundant cartridges or single cartridges with dual initiators were used.
- Typically, two separate and electrically independent systems operated in parallel and provided complete redundancy in the firing circuitry.
- No failures of any pyrotechnic device were ever detected during any of the Apollo missions.
I know of at least one NASA pyrotechnic failure, although it was arguably not really the fault of the pyros themselves. It occurred on the Skylab 1 launch in 1973, the then-unmanned space station itself on a modified Saturn V. The interstage ring between the first and second stage failed to detach from the second stage because the linear shaped charge (LSC) used to cut them apart did not completely fire.
There were detonators at both ends of the LSC. When the first one fired, the detonation propagated partway around the ring until it was stopped by a section of LSC that had been damaged by impact from the micrometeoroid shield that had come off Skylab 63 seconds after launch. (The impact caused a section of the explosive to burn, not detonate.) Although the second firing signal was sent 100 ms after the first, the ring had separated just far enough to pull the electrical connectors apart so the firing signal did not reach the second detonator. (I assume that the second firing signal was delayed to minimize shock forces on the structure.)
The adapter ring, which weighed about 5 tonnes, remained attached to the launcher all the way into orbit. This caused serious thermal problems around the engines, but they tolerated it. And fortunately there was enough mass margin that the launch succeeded; had this been an Apollo lunar mission the smaller mass margin would have forced an abort.
This is a good example of how failures can quickly snowball in unanticipated ways, outsmarting design engineers even when they include redundancy.
See "Saturn V Launch Vehicle Flight Evaluation Report SA-513 Skylab 1", MPR-SAT-FE-73-4. I found it online.