NASA Office of Logic Design

NASA Office of Logic Design

A scientific study of the problems of digital engineering for space flight systems,
with a view to their practical solution.

SP-287 What Made Apollo a Success?


Warren J. North and C. H. Woodling
Manned Spacecraft Center

[31] The formative stages of Project Mercury saw various opinions as to the degree of crew control that should be permitted. To most space planners, Mercury seemed a logical extension of high-performance aircraft flight, in which brief periods of high-altitude zero-g activity had been experienced with no adverse effects. However, there were skeptics who felt that space flight would require radically new procedures and crew operational constraints.

As it developed, Mercury and Gemini attitude control, systems monitoring, and longitudinal translation maneuvers evolved very similar procedurally to aircraft practice. Consequently, the basic concepts for Apollo crew procedures reflect techniques proved in aircraft, Mercury, and Gemini operations.

Over the past decade, space-vehicle designs have incorporated increased astronaut participation to improve vehicle reliability. Mercury used automatically guided military boosters, which were originally designed without consideration for manual monitoring and control. Therefore, it seemed expedient to accept a passive role for the crew. This was done at the expense of developing an elaborate automatic abort-sensing system to protect the pilot in the event of booster failure. The pilot did get a backup abort handle for slow-drift guidance failures that could not be sensed by the automatic system. In Gemini, the complex automatic escape system was eliminated in favor of manual launch-vehicle monitoring procedures and aircraft ejection seats that could be manually triggered if the launch vehicle malfunctioned or if the spacecraft parachute failed during descent.

The enormous TNT equivalency of a "worst case" Saturn booster explosion placed a Mercury-like escape rocket on the Apollo spacecraft. Then concern for a growing control-system failure, coupled with maximum aerodynamic pressure, prompted inclusion of an automatic abort system. Two minutes after lift-off, this automatic system is manually disabled, and the booster firing is terminated manually in the event of a malfunction. Crew displays include the status of launch-vehicle engines and tank pressures. The launch vehicle can be controlled manually if the Saturn inertial platform fails; this ability did not exist in Mercury or Gemini, but was introduced after several years of research and analysis.

Apollo rendezvous, formation flight, and docking maneuvers resemble closely those developed in Gemini. (This, of course, was a major reason for Gemini. ) Another significant Gemini carryover is the backup rendezvous procedure, which can [32] be used if the onboard radar, inertial platform, or computer should fail. Placement of rendezvous maneuvers for optimum orbital lighting took advantage of Gemini experience.

Gemini extravehicular activity revealed an anomaly in simulation, which was corrected for Apollo. Short-duration zero-g aircraft parabolas did not reveal the fatiguing effect of long-term tasks in a Gemini pressure suit. For the later Gemini flights, water-immersed simulations (fig. 4-1) provided realistic long-term zero-g workloads. This type of simulation enabled the development of Apollo contingency extravehicular activity (EVA) transfer procedures. An Apollo contingency transfer is required if the lunar module (LM) cannot be docked to the command module (CM) after lunar-orbit rendezvous.

Although the spacecraft guidance system normally specifies the proper reentry roll angle that is required to maneuver down range or cross range to the target, Gemini and Apollo employ basically the same backup techniques for using the earth horizon to monitor manually and achieve proper reentry roll angles for ranging.

[PICTURE MISSING] Figure 4-1. Astronaut trains underwater in simulated zero-g condition in water immersion facility. Astronaut wears weights on shoulders, wrists, and ankles. Total ballast is about 180 pounds.


Apollo of course encompassed the lunar landing. Although helicopter experience indicated that low-speed maneuvering and vertical descents were straightforward, the lunar landing involved a much higher approach velocity and descent rate, potential visibility problems, and a 1/6g maneuvering environment. Because of the difficulty in training for manual landings in this environment, there were suggestions that we should accept automatic landings and the attendant probability of abort, if the automatic system targeted the spacecraft to a boulder or crater. The obvious desire to land rather than to abort triggered a major effort to build a free flight training vehicle (fig. 4-2) which would fly in the atmosphere of the earth and would simulate the 1/6g handling characteristic of the LM. Early flights with this vehicle impressed the pilots with the unusually large pitch and roll angles required to achieve and null translational velocities. The flights also indicated that from altitudes of approximately 500 feet, the vehicle could be maneuvered to avoid obstructions after several familiarization flights.

Lunar-surface EVA likewise had no analogy in previous programs. Improved mobility of the Apollo suit, on the other hand, encouraged rapid development of lunar-surface EVA procedures. Three techniques were used to investigate the effects of 1/6g: The KC-135 aircraft (fig. 4-3), the overhead-supported gimbaled harness (fig. 4-4), and the water immersion facility. Used in a complementary fashion, these simulation devices yielded results which indicated that 1/6g maneuvering stability was no particular problem; in fact, if one started to fall, it was easy to recover because of the low falling acceleration.

Another significant procedural difference between Gemini and Apollo concerned the ability of the crew, in the event of a ground communications failure, to navigate with the onboard sextant/ computer and to calculate spacecraft maneuvers for safe return to the earth. Critical Gemini maneuvers were made within the communications range of ground stations, but the Apollo lunar-orbit retrograde burn and the critical transearth burn occur behind the moon, where crew procedures cannot be monitored by the ground.


Figure 4-2. Lunar landing training vehicle trains crews for last 500 feet of altitude in critical moon landing phase.


Figure 4-3. Lunar module mockup installed in KC-135 aircraft. Support structure takes loads imposed in 2-1/2g pull-up, after which zero g is achieved for 20 to 30 seconds on a parabolic flight path.


Figure 4-4. Familiarization run on the mobile partial-gravity simulator used for lunar walk indoctrination.



Some 40 percent of crew training involves becoming proficient in the use of the three spacecraft navigation systems (one in the CM and two in the LM) and the four guidance systems (two in the CM and two in the LM). The crew interfaces chiefly with these systems through computer keyboards which are about half the size of a typewriter keyboard. Approximately 10 500 individual computer keystrokes are required to complete the lunar mission. The crew must activate individual programs within the computer to execute launch, midcourse navigation, spacecraft propulsion maneuvers, lunar landmark tracking, lunar descent, lunar platform alignment, ascent, rendezvous, and reentry. Within each program, there are many routines or options. The computer display and keyboard includes three 5-digit registers through which the crew observes displays (such as total velocity, altitude, and altitude rate during the lunar descent).

The primary control systems in both the CM and the LM include digital autopilots which are adjusted through keyboard activity. The crew selects optimum jet configuration, attitude dead band, and maneuver rates. Large variations in vehicle configuration throughout the mission require the crew to be very familiar with control characteristics and handling qualities, which range from sluggish to sporty over the interval from initial booster staging to docking of the lightweight LM.

Much of the crew preflight time goes into reviewing propulsion and guidance malfunction procedures. In this work, alternate system displays are compared to the primary display. If it appears that the primary system has failed, the crew manually makes a switchover. As an example of system redundancy, the initial lunar-orbit insertion maneuver is made with the main service module (SM) engine under automatic control by the primary guidance system, but failure of the primary system can be [35] backed up manually by using the stabilization and control system. If the SM main engine fails during the burn, two crewmembers transfer to the LM, activate the systems, and ignite the descent-stage engine to place the two spacecraft on a return-to-earth trajectory. If the LM descent-stage engine fails, the descent stage is jettisoned, and the LM ascent-stage engine is ignited. The crew controls docked configuration from the LM manually by using the reaction-control system in a translation mode, rather than an efficient attitude-control mode (because of the shifted center of gravity of the docked configuration). A primary guidance system failure of the LM can be backed up by the abort guidance system; as an ultimate control-system backup, either vehicle can be controlled in a manual mode in which the LM pilot control inputs go directly to the reaction jets with no rate-damping feedback.

To provide the crew with this depth and ability to monitor, switch, and control may seem unduly redundant; however, this depth of capability has provided a verification of the adequacy of the primary procedures. Several changes to the primary rendezvous procedures were made, so that the maneuvers could be more easily monitored and remain consistent with the backup procedures.

During descent, the landing site comes into view at the bottom of the LM window at an altitude of 7000 feet, a range of 4 miles, a velocity of 450 fps, and a descent rate of 160 fps. By observing through his window, the commander (in the left-hand crew station) determines if the guidance is targeted to the correct landing area. If not, he can incrementally change the spacecraft flight path 2 laterally and 0.5 up range or down range, by actuations of the right-hand attitude controller.

In the right-hand crew station, the LM pilot is closely monitoring the altitude, the altitude rate, the lateral velocities, and the remaining propellant and is updating the backup guidance system altitude. He calls out altitude and altitude rate to the commander. All of these parameters are compared to nominal and to the limits set as abort criteria. The commander normally takes control in a manual attitude-hold mode at an altitude of approximately 500 feet. At this point, horizontal velocity has dropped to 70 fps and the vertical velocity to 17 fps. The rate of descent is controlled at this time by making discrete inputs to the guidance system at a rate of 1 fps per switch cycle.

Normally some 2 to 4 percent of the descent propellant remains after the landing. Aircraft fuel reserves at landing are considerably greater. Clearly, a critical Apollo crew procedure is propellant monitoring.

The percentage of descent propellant remaining is computed and displayed on digital read-outs. With 2 minutes of propellant remaining, a tank-level sensor is uncovered and a warning light is displayed. The LM descends at a rate of approximately 3 fps. After touchdown and engine shutoff, the crew immediately checks the status of all systems in preparation for an emergency lift-off. If all propulsion, environmental, and guidance systems are satisfactory, preparations are made for powering down the spacecraft and for lunar surface exploration. The subsequent ascent from the lunar surface involves spacecraft power-up, inertial-platform alinement, and a long series of checklist procedures which terminate with descent-stage separation and ascent engine ignition. During this phase of lunar activity, the two-man crew performs the functions of the entire launch complex and blockhouse crew at Cape Kennedy.



Besides providing a documentary record of the flight, in-flight photography has become a vital part of future mission planning. Television pictures taken several years ago by Orbiter spacecraft formed the base line for constructing the flight maps and the simulator relief model. However, because full coverage of high-resolution pictures does not exist for all of the Apollo landing sites, it has been necessary to obtain additional 70-millimeter still photography of some future sites. (See fig. 4-5. ) Coordination of this photography requires careful planning to schedule the photography passes at the proper sun angle and to minimize usage of critical spacecraft attitude-control propellants.


Figure 4-5. Apollo 12 landing and ascent model of Surveyor and Snowman craters as seen from 1800 feet.



The development of the Apollo simulation program and associated trainers closely paralleled the development of the Apollo flight hardware and the increasing mission complexity. As flight operations phased from Gemini to Apollo and as the Apollo flights progressed from single to dual spacecraft operations, from earth-orbital to lunar orbital activities, and finally to the lunar landing, the scope and capability of simulations matured to keep pace with the increasing complexity.

The Gemini Program provided an excellent beginning for Apollo training, because its progress in accurately simulating and adequately training flight crews in the launch, rendezvous, and entry modes was directly applicable. In fact, the first Apollo part-task simulators were converted Gemini simulators. The computer complex and infinity-optics system from the Gemini mission simulators were integrated with simulated crew stations for the CM procedures simulator (CMPS) and the LM procedures simulator shown in figure 4-6. The simulated Agena target vehicle and Gemini spacecraft were replaced with the CM target mockup and the LM crew station on the translation and [37] docking simulator, shown in figure 4-7. The dynamics crew procedures simulator, shown in figure 4-8, was converted to the CM crew station for launch and launch abort training, shown in figure 4-9.

The combined flight of two manned spacecraft during the Apollo 9 mission was a major step in all aspects of flight operations. A corresponding major accomplishment was the addition of the LM mission simulator (LMS), shown in figure 4-10, into the trainer complex and integration of the LMS with the CM mission simulator (CMS), shown in figure 4-11.

The tie-in between the mission simulators and the Mission Control Center at the NASA Manned Spacecraft Center (MSC) marked a significant step in realistically conducting space-flight dress rehearsals. The simulations required synchronization of 13 large digital computers, operating together in real time.


Figure 4-6. Command module procedures simulator and lunar module procedures simulator.



Figure 4-8. Dynamics crew procedures simulator.


Figure 4-7. Translation and docking trainer simulates lunar module active docking over last 100 feet of separation distance.


Figure 4-9. Simulated command module crew station for the dynamics crew procedures simulator.


Figure 4-10. Lunar module mission simulator with crew station and Farrand optical systems for three windows.


Figure 4-11. Visual optics and instructor station for command module mission simulator.

The progression of Apollo 8 and 10 to the lunar sphere of influence and the integrated operation of the two spacecraft in lunar orbit required more simulation capabilities, such as additional trajectory equations, new simulator operating modes (fast time, step ahead, safe store) and a complete new set of out-the-window scenes for the crews.

Apollo 11, of course, introduced the final operational phase, landing on the lunar surface. To simulate the lunar landing, it was necessary to build a lunar terrain model (fig. 4-12) for precise training on the mission simulators of the final-approach and manual-touchdown phases. It was also necessary to use the lunar landing (1/6g) free-flight trainer.

The scope and complexity of the Apollo missions necessitated a comprehensive procedures -verification and crew familiarization program through a variety of part-task and mission simulations. As mentioned previously, some of the Gemini procedures directly carried over to Apollo, but numerous new areas required further analysis and crew verification. Launch-abort monitoring and launch vehicle control (Saturn V launch vehicle) [39] were analyzed in detail at the NASA Ames Research Center and by contractor personnel in separate studies before the backup control of the launch vehicle from the spacecraft was developed. The first flight incorporating this backup mode was on AS-505 with the Apollo 10 flight. The ability to provide pilot control from the spacecraft for the Saturn IVB stage during the translunar injection maneuvers was thoroughly checked out by engineers and pilots on the DCPS and CMS before the Apollo 10 mission.


Figure 4-12. Apollo 12 landing and ascent visual simulation system.

Considerable revisions were made in the CM computer flight program after the Apollo 7 flight to improve the guidance and navigation logic during rendezvous. Some 1200 man-hours and 100 machine-hours were spent by the MSC engineers with the CMPS in working out the optimum crew displays, procedures, and tracking schedules for the new flight software. Many more hours were spent with the flight crews on the CMPS and CMS familiarizing and training them for the Apollo 9 mission.

In lunar descent and landing, simulation and training emphasized the monitoring of the primary guidance system and the takeover by the commander for the final phase of manual control to touchdown. More than 220 landings were flown on the LMS by two astronauts (who subsequently flew the first and second actual lunar landings) solely to determine the best hand-controller authority for LM attitude-control system.

Development of the activation procedures of the passive LM in flight (the first such requirement in manned space flight) necessitated a comprehensive and detailed systems simulation provided only by the LMS. The LM integrated activation checklists were worked out and verified for the two navigation systems, two radar systems, and three propulsion systems.

The maintenance of a high degree of mission-simulator fidelity was emphasized. No part of the system was more critical in this respect than the simulated guidance and navigation system. The use of an interpretive approach to simulate the Apollo guidance computer on both the CMS and the LMS provided not only exceptional fidelity but also the ability to accept late software changes and mission-peculiar tapes and to introduce these rapidly into the training. Numerous full-dress rehearsals were executed with the flight crews in the mission simulators at Cape Kennedy and the flight control team in the Mission Control Center at MSC. This training used the latest possible operational trajectory and spacecraft data to ensure complete verification of both flight and ground programs and comprehensive familiarization by the entire flight operations team.

Many simulations were executed with trainers other than the spacecraft mission and part-task simulators. Zero-g simulation of EVA contingency transfer by using the water-immersion facility at MSC (fig. 4-1) was an extension of the experience and techniques derived during Gemini. The partial-gravity simulator, which used a servoed, vertically mounted suspension system to take up five-sixths of the weight of the suited crewman, permitted long-duration 1/6g simulations. A truck-mounted device which used this same simulation technique allowed training at various traverse rates (fig. 4-4) .

Many training hours went to one-g walk-throughs with mockups of spacecraft and equipment. Specific areas of training ranged from onboard stowage, photographic equipment handling, and docking-tunnel probe and drogue operations to full-blown [40] lunar-surface EVA walk-throughs. The lunar-surface walk-throughs included special 1/6g mockups of the Apollo lunar-surface experiment package and the lunar-surface tools.



Apollo flight planning involves a much more complex procedures-integration task than did Mercury or Gemini, because of the large number of crew tasks associated with two manned spacecraft. Four or five months before launch, the flight planner must take the list of mission objectives, the preliminary launch-vehicle trajectory, the preliminary operational trajectory, the crew work and sleep constraints, and network tracking constraints and must integrate the numerous systems procedures of the many phased Apollo mission. Because of the requirement to minimize use of reaction control propellant, hydrogen, and oxygen, several iterations are required to establish the proper timing of maneuver rates and spacecraft power configurations during the mission.

Original time line estimates for the various mission phases derive from the mission simulators in which all spacecraft systems are dynamically simulated. Spacecraft housekeeping, EVA preparation, and post-EVA procedures are worked out in high-fidelity mockups. The spacecraft stowage list itemizes 445 pieces of equipment, each of which must be procedurally integrated into the flight plan. Some 1300 copies of the flight plan are distributed to NASA and contractor personnel 3 months before the launch. If the flight plan is considered in a broad context to include all onboard paper including time lines, checklists, and graphics, the package weighs about 20 pounds. For each Apollo mission, hundreds of changes were made and verified on these data during the last 3 months before flight. Many changes reflected differences in the final trajectory, procedural refinements derived from simulation experience, and correction of anomalies on the previous flight.

We set a rigorous procedures change discipline for 2 months before the flight. This controls suggested alternate techniques which may appear preferable for a particular subsystem, but must be considered in terms of the interrelated operational time line before acceptance. We also establish a rapid procedures information loop during the final simulation phase, which also begins 2 months before the launch. This simulation activity involves flight planners, flight crews, mission simulators, flight controllers, and the tracking network. Normal and emergency procedures are thoroughly tested.

The Apollo flights speak for the value of this simulation effort in verifying late changes, validating procedures, and establishing crew readiness.


Home - NASA Office of Logic Design
Last Revised: February 03, 2010
Web Grunt: Richard Katz