ct NAS g-4065, with the Instrumentation Laboratory, Massachusetts
Institute of Technology, Cambridge, Massachusetts.
The author extends his thanks to the following members of the Instrumenta-
tion Laboratory.
For technical criticism Mr. Ivan Johnson and Mr. John Scanlon
For editing Mr. Jack Reed
For publishing Mr. Robert Weatherbee and associates, particularly

Bean for editorial support.
The publication of this report does not constitute approval by the National
Aeronautics and Space Administration of the findings or the conclusions contained
therein.
It is published only for the exchange and stimulation of ideas.
2 Man-Machine Design for the Apollo Navigation,
Guidance, and Control System-Revisited:
Sub-title
Apollo, A Transition in the Art of Piloting a Vehicle
J. L. Nevins
I INTRODUCTION
Apollo can be considered a transition in the art
of piloting avehicle, where the principal dimensions
a r e
F l i g h t O p e r a t i o n s ,
t h e F l i g h t C r e w s
Role, and
the man-machine communications, as
illustrated by Fig. 1. The transitional aspects are
the level and the nature of integration of the
and ground controllers for flight operations.
F o r
the crews, the aspects are
the spectrum, or range
of levels, of the general tasks and the necessity for
certain tasks,
the nature and the requirements
o f t h e s u p e r v i s o r y r o l e .
For the man-machine
communications, the significant items are the levels
and the nature of interaction of the crew with their
equipment, from direct actuation of
to a
first level of functional communications.
Consider, for example, the primary guidance,
navigation, and control system designed for the
Apollovehicles. The system was designed to provide
the crew with a complete
flight-management
system that would enable them to navigate and guide
their spacecraft without ground assistance. As such,
Apollo is the first manned U. S. spacecraft to contain
enough sensors and data processing capability to do
the job.
A . F L I G H T O P E R A T I O N S
Apollo is the culmination of development both in
ground and airborne systems. Ground systems (Fig.
have progressed from a few people giving minimal
assistance to airplane crews (beginning in the
to relatively advanced systems for military com-
mand and control, such as the continental air defense
network for North America. Systems that essentially
give only directional data, however, are significantly
different from the systems developed for supporting
manned spacecraft: the systems supporting Apollo
monitor all spacecraft systems, and, in effect, the
ground controllers feel as though they are inside
the vehicle and are giving direct support to flight
operations. This ground support ranges all the way
from sequencing the proper charging of batteries,
to trajectory control in scheduling the small thrusting
effects
f o r w a s t e - w a t e r d u m p s .
T h e
demonstrated capability of the grounds monitoring
ability,
p l u s t h e n e a r - p e r f e c t r e l i a b i l i t y o f t h e
*Modified by the fact that the data are old, both
because of transmission delay and because of system
delays in the ground communication system and
associated processors.
equipment, give the
the
to rest without keeping one man on watch.
Spaceborne systems for manned spacecraft have
progressed from the minimal
capability of
Mercury, through Gemini with
navigation
and guidance capability for rendezvous, to Apollo
with full
capability for performing the full
lunar-landing mission.
To achieve the desired mission reliability goals,
the flight-management system, instead of being
primarily an
operation, is actually a highly
integrated system of airborne and ground-based
equipment. The nature of this integrated team is a
finely structured multilevel monitoring and decision
process. In its simplest mode, the aircrew monitors
t h e
detecting errors that require immediate
action, while the ground controllers are responsible
for detecting the gradual-degradation-type failure
of the
sensors. The latter failures can only
b e d e t e c t e d o n t h e g r o u n d b y m o n i t o r i n g a n d
comparing the long-term trends of the
from
the airborne and ground-tracking systems.
In addition, since Apollo was mans first venture
deep space, maximum support was organized
on the ground to help with any contingency.
This
support included not only the people manning the
consoles in Houston, but hundreds of people at the
various contractor facilities around the country
(North American Rockwell in Downey, California;
Grumman Aircraft and Engineering Corporation, on
L o n g I s l a n d , N . Y . ; t h e M . I . T . I n s t r u m e n t a t i o n
Laboratory,
etc.), all tied together by voice- and
data-communication links. Marshalling this kind of
support in depth would be impractical if we were
flying multiple missions simultaneously; e.g., a
lunar-landing mission, an earth-orbit-equatorial
long-duration mission, and an earth-orbit-polar
mission,
all manned.
T h e r e f o r e ,
ground- support
systems for future manned missions can be expected
either to become more automatic or else airborne
systems will become more autonomous. T h e l a t t e r
technique is necessary at distances where trans-
mission delays are minutes long.
Under these
**Another example
leaving the LM vehicle unat-
tended while both crewmen are exploring the moon.
At first reading, this would to appear break one of
the old explorers prime ground rules; namely, (a)
never leave a vehicle unattended, or
n e v e r l e t a
man explore alone.
The ground in this case really
acts as a third crew member to monitor the LM
while the other crew members explore the moon.
3 conditions,
ground systems for space operations
could only support airborne operations in the same
w a y t h a t t h e p r e s e n t g r o u n d s y s t e m s s u p p o r t
airplanes in flight.
B . F L I G H T C R E W S R G L E
1 . G e n e r a l T a s k s . - M a n s r o l e i n s p a c e c r a f t
guidance and navigation ranges from supervising
automatic systems to performing specific sensing
and control functions.
The crew functions can be
categorized as follows:
a. Monitoring of, and decision making associated
with,
t h e n a v i g a t i o n a n d g u i d a n c e p r o c e s s ,
including the effects of navigation sensor data
(target-tracking data, both visual and radar) on
state-vector updates; comparing
data
with ground-tracking data and backup charts
b . S e q u e n c i n g a n d i n i t i a l i z a t i o n o f p r i m a r y
guidance, navigation, sensing systems, as well
as propulsion and timing systems
c. Initializing and sequencing of backup systems
d . P e r f o r m i n g t h e p a t t e r n - r e c o g n i t i o n t a s k s
associated
w i t h
c o m m a n d - m o d u l e o p t i c a l
tracking of the lunar module during rendezvous;
(2) star acquisition, identification, and geo-
metrical alignment to visual horizon (earth or
moon) for cislunar navigation.
As technology improves in capability and relia-
bility,
m a n y o f t h e s e t a s k s w i l l b e r e p l a c e d b y
automatic systems.
In Apollo, however, in many
respects the
most
complex vehicle every piloted,
success depended upon a design that thoroughly
integrated man and machine, a design concept that
u t i l i z e d m a n t o a c h i e v e s y s t e m f l e x i b i l i t y a n d
reliability not otherwise possible given present
technology.
2. Supervisory
The reliability of Apollo
equipment demonstrated industrys ability to produce
systems that meet specified goals.
Nevertheless,
the limited reliability of basic components, together
with the constraints on weight, volume, and power,
produced system designs where single failures can
cause large functional incapacitation of the affected
systems.
To guarantee functional capability, re-
d u n d a n t s y s t e m s a r e n e c e s s a r y .
M a n s m o s t
important role, therefore, especially during dynamic
conditions, is to monitor both the primary system
and its required backup systems.
F o r c r i t i c a l
functions, this requires that the crew give continual,
time-shared attention to several levels of backup
systems in order that their status be known should
their use become necessary. Moreover, smooth and
rapid transition to backup modes requires the crew
functional involvement in the operation of the total
system.
Awareness of, and involvement in, the operation
of many levels of redundant systems, operating in
parallel, places a most severe burden on the crew.
With increased reliability and smaller size of basic
components of the future, it will be possible to
provide enough
redundant sensors, electronics,
processors,
and highly reliable switching logic to
not only detect malfunctions, but to automatically
switch to redundant modes-that is, a system that
degrades gracefully rather than instantly (Ref. 1).
Such a system would operate most of the time in a
fully automatic mode. For the next five to ten years,
however, it is unlikely that mans present unique
flexibility
a n d d e c i s i o n c a p a b i l i t y c a n b e f u l l y
replaced; during this time, systems will have to be
configured to allow mans continued involvement at
levels other than required strictly for supervising
or monitoring.
The depth of this involvement,
however,
s h o u l d b e m u c h l e s s t h a n i n A p o l l o .
Consequently, the burden on the crew will continue
t o d e c r e a s e a s i t s r o l e b e c o m e s m o r e p u r e l y
administrative, or supervisory.
C . M A N - M A C H I N E C O M M U N I C A T I O N
Communication between crew and the airborne
equipment comprises everything from direct task
sequencing,