Are there any rocket engines in current or former use that aren’t normally restarted in flight, but have the capability for an emergency restart?

Question

(Inspired by my earlier question about restarting a flamed-out RS-25 SSME in flight.)

Most rocket engines are not designed to be lit more than once.¹ Most first-stage rocket engines, for that matter, are designed to be lit only once, and only on the ground. And most multiengine launch vehicles (unlike most multiengine aircraft) have, for the majority or entirety of ascent, no engine-out capability,² meaning that, if even a single engine fails during flight, the payload will either be stuck in a useless orbit,² or, even worse, be unable to reach orbit at all, and reenter the earth’s atmosphere somewhere downrange.

In an aircraft, if one or more engines unexpectedly cease to operate, the first, or one of the first, things to do is to attempt to relight the failed engine(s);⁴ with a rocket launch, in contrast, you often can’t do anything but write off the whole mission and give the customer their compensatory complimentary next flight. Having the ability to attempt an emergency in-flight restart (even for engines that would not be relit in flight during a normal launch) would provide, in many cases, at least the possibility of salvaging the mission. Now, granted, there are many failure modes that would either render a relight flat-out impossible (for instance, a main fuel or oxidiser valve jammed shut or a sheared turbopump shaft) or cause a relit engine to immediately go inferno⁵ (for instance, a burst fuel line or a combustion-chamber rupture), but, to quote the aforementioned earlier question:

...many of the situations that could cause an [engine] to fail would still leave it safe to restart - for instance, a hiccup in the combustion process resulting in a brief overheat, or a bubble entering one of the fuel lines and causing a momentary drop in fuel flow, or a failed sensor causing a good engine to spool down before the sensor could be taken offline.

Are there any currently-or-formerly-used rocket engines that aren’t/weren’t normally restarted during a nominal flight, but have/had the ability to perform an emergency relight if an engine nondestructively flamed out?

---

¹: At least, not without going back to the shop (usually on the ground) for refurbishment. Many liquid-fuelled rocket engines are routinely fired multiple times (for expendable engines, typically one or more times in a test cell, and then once in an actual flight; for engines designed for reuse over multiple missions, replace “once in an actual flight” with “one or more - usually more, barring a destructive launch failure - times in actual flights”, and don’t forget the fleet-leader engines which will spend their entire lives being fired over and over and over again in test cells), but have to be refurbished or rebuilt after each firing (not typically something that can easily be done in flight).

²: There are, however, exceptions (for instance, the Falcon 9 can still deliver its payload to a nominal orbit even if one first-stage engine fails right at liftoff).

³: This isn’t as much, or as ubiquitous, of a hard obstacle as it used to be, as many satellites nowadays come with built-in ion thrusters for on-orbit manoeuvring and/or stationkeeping (especially geosynchronous satellites, which have to be continually nudged to keep from wandering from their assigned spots and wreaking havok), which, due to their fantastically high efficiency, can be used to compensate for a considerable launch-vehicle underspeed. However, since ion engines produce next to no thrust, this takes ages, and can’t be used to compensate for a failure to reach orbit in the first place; since propellant used up in raising the payload’s orbit is propellant that can’t be used for manoeuvring or stationkeeping once in its operational orbit, this eats into the satellite’s operational lifetime (potentially by quite a lot, if it has to make up a large underspeed); and, since not all satellites have built-in thrusters, this is useable by only a portion of the launching-satellite population.

⁴: Unless, of course, they failed during a critical phase of takeoff or landing (in which case you focus on maintaining control of the aircraft and keeping from running into things like other aircraft, trees, or the ground, and wait to attempt a relight until doing so will no longer pose such a high risk of being a fatal distraction), flamed out due to fuel exhaustion (in which case it won’t be possible to restart them until you get the aircraft refuelled, which typically requires landing first), or failed in such a manner as to render a restart obviously impossible or unwise (for instance, if the engine falls off, catches fire, or disintegrates).

⁵: I am, for reasons that should be obvious, leaving out those failure modes where you’d never get a chance to even attempt a relight, due to “engine failure” quickly becoming “KABOOOOOM”.

Answer 1

The Lunar Module Ascent Engine. This document on page 66 states:

3-4. 4. ASCENT PROPULSION SECTION

The ascent propulsion section consists of a constant-thrust , pressure-fed rocket engine , one fuel and one oxidizer tank , two helium tanks , and associated propellant feed and helium pressurization components. The engine develops 3, 500 pounds of thrust in a vacuum. it can be shut down and restarted, as required by the mission.

AFAIK the engine was fired once for liftoff from the moon (Apollo Operations Manual page 604 onwards), though this answer shows that some of the early missions tested its multi-fire capabillities:

The ascent engine was tested at White Sands on the PA-1 test rig. Five "flight-qualified" engines and six thrust chambers were used among all the tests. I find no evidence that these test engines were re-used for actual flights, nor that hot-fire testing of production engines or their components was done. Test series #4 was 45 runs of "LM-1 mission duty cycle, restarts, engine stability, propellant depletion, off-nominal performance".

The unmanned Apollo 5 mission fired the ascent engine twice. The first firing was 60 seconds in duration. The second firing occurred 1-1/2 hours later, and continued to propellant depletion. The firing time was 40 seconds less than predicted. Later analysis concluded that at least 10 seconds of this missing time was attributable to problems in the helium system.

Apollo 9 was the first manned mission with the lunar module. It ran one manned 3 second firing of the ascent stage, followed by an unmanned firing of the ascent stage to depletion. During the first 290 seconds of the 362.3 seconds of the second firing, the system was significantly under-pressure. This was attributed to a malfunction of the helium pressure regulator.