Approved:N . E . S EAPOLLO GUIDANCE AND NAVIGATION PKOGRAM

Date:

ATION PROGRAM

Approved:R. R. RAINSTRUME

E - 2 3 9 7

APOLLO GUIDANCE AND CONTROLSYSTEM FlIGHTEXPERiENCE

bY

John E. Miller, Ain Lasts

JUNE 1969

ACKNOWLEDGEMENT

This report was preparedunder DSR Project 55-23870, sponsored bythe MannedSpacecraft Center of the National Aeronautics and Space Administration throughContract NAS 9-4065 with the Instrumentation Laboratory, Massachusetts Institute

of Technology, Cambridge, Mass.

To be presented atThe AIAA Guidance, Control and

Flight Mechanics ConferencePrinceton, New Jersey

August 1969

The publication of this report does not constitute approval by the National

Aeronautics and Space Administration of the findings or the conclusions containedtherein. It is published only for the exchange and stimulation of ideas.

APOLLO GUIDANCE AND CONTROL SYSTEM FLIGIIT EXPERIENCE

John E. MillerIntermetrics, Inc. *

-Ain LaatsDeputy Associate DirectorInstrumentation Laboratory

Massachusetts Institute of TechnologyCambridge, Massachusetts

Albstract

The Xpollo Guidance, Navigation and Controlsystem is a complete, integrated, flight managementsystem with a central general-purpose digitalp: ocessor, multiple sensor information, astronautcomniand interface and space-to-ground command:md data links.

The 4~0110 G&NC system has successfully flown,r seven flights as of 12 March 1969. This experience:>rovides data for an identification of the elementsof system design, prelaunch and flight activities that‘,voere most influential in achieving success.

The prelaunch and flight activities and datareviewed include four unmanned Apollo launches(three command modules and one lunar module) andthree manned missions. Comparisons are madebetween ground measured data and measurementsmade during missions. The calculated systemperformance for some guidance phases of themission has been based upon ground measurementsa!id compared to actual in-flight performances andto system-specified performance.

The review of the experience indicates that thesignificant factors enabling the Apollo G&NC system‘.o successfully perform its function were the earlyrecognition of necessary design changes for stableperformance, the ability to predict the expectedsystem performance, the discipline imposed by thepolicy of allowing no unexplained failures and theability to diagnose flight operational anomalies.

I. Introduction

The Apollo Guidance, Navigation and Control1G%&C 1 system has previously been describedcl -6).The system is shown in Figure 1. It is the purposeof the GN&C to guide, navigate and control thespacecraft - Command Module (CM) and LunarModule (L;\/I) - through all phases of the lunarlanding mission. It is designed to have a completelyself-contained capability. The GN&C system hasas a central element, a general-purpose digitalcomputer that contains both flight operationalprograms and ground checkout programs. Theastronaut interface is via the display and keyboard(DSKY ). The primary sensors are the InertialMeasurement Unit (IMU) for reference coordinatememory and measurement of the specific force, andthe Optical Subsystem (OSS) for navigation and forreference coordinate alignment of the IMU. Inaddition, there are radar range measurements forl.anding, r ange and line-of-sight direction forI endeavous, hand-controller input commands formanual steering and attitude control, and VHFranging for rendezvous.

“Formerly Associate Director, Instrumentation!,abcratory, Massachusetts Institute of Technology.

The elapsed time of major items from the designinception to the first flight was less than five years.

Brief Time Schedule

System Design Start at MIT October 1951GN&C Installation in First FlightSpacecraft 22 September 1965First Flight Program Release(Corona) January 1966First Flight 25 August 1966

During this period of time, concepts of the lunar-landing-mission operations were changing andGN&C system requirements were added, subtracted,and modified. The system was designed to be fullyintegrated with the astronaut as well as to have anautomatic capability. The first four flights wereunmanned and required the automatic system. Theoriginal design intent was to have a completelyself-contained navigation system. During theprogram it was directed that primary navigationwould be by the ground-based tracking network.Both means of navigation are accommodated asground-transmitted spacecraft state vectors.

II. Pre-launch Operation

The Apollo GNgiC system on the launch pad atKSC has had approximately 12 months of systemtesting. The system will be tested once more fora final verification of flight readiness. When theflight readiness test has been successfully com-pleted, the GN&C system is ready for the mission.Next are the countdown operations. The averagelunar module GN&C system will have been checkedout several weeks before the scheduled flight. Thecomputer erasable memory is loaded for flight andthe system turned off except for IMU temperaturecontrol. The system is not activated again until itis in space. The average CM C&&C system isoperated fifty hours in support of the countdown.The system is exercised through automaticoperational checks and a final calibration test. Theinitial conditions for the mission are loaded intothe computer erasable memory and the inertialmeasurement unit commanded to start the automaticplatform alignment by gyro compassing. About twoweeks prior to launch the alignment of the inertialmeasurement unit is verified by the astronaut usingthe optical system space sextant to sight on il-luminated targets two miles from the launch vehicle.The launch vehicle has been demonstrated to bestable enough so that optical verification is now notrequired in the final countdown.

The control room for the spacecraft checkoutand launch is located 12 miles from the launch sitein the MSOB (Manned Spacecraft OperationsBuilding; Figure 2). In the control room the serialdigital data from the spacecraft is processed bythe ACE (Acceptance Checkout Equipment) comput-

ASTRONAUT INTEI(FACE

SPACECRAFT CONTROL

DOWNtlNK WORD :

:

; GYRO TOROUING COMMANQSUBSYSTEM

TIMING SIGNALS ; ALARMS(IMU)

APOLLO w .DOWNLINK SYNC SIGNALS : GUIDANCEL COMPUTER c ; M O D E I N D I C A T I O N S

UPtlNK WORD : ! VELOCITY INCFZhlENIS

I--SPACECRAFT

DOWNlmTRANSMISSION

IPACECRAFT

rGROUNDUPIINK

TRANSMISSIONA N A L O GI--TELEMETRY

Figure 1 Apollo Guidance Navigation and Control System Block Diagram

Uher test facilitln

f-Arming tanr

/-CM carry-anII

ACE - SC service =I3-Au- scu

l -

b r e s p o n s e

Digital linkscarry-on command& response systems

_ ._-_ ml/$-Umbilical twer

MSOB

Rf linkto MCC. tlouston

!l9-43tlnqeaui~ ! I~Dlgltal llnks

AM. X qrwrd stl(bn

Figure 2 Apollo Pre-launch Operations

2

ers which in turn drsplay this information to thetest engineers as meter and oscillograph readings,event lights or CRT (Cathode Ray Tube) displays.In addition to standard data the telemetry transmit-ted from the flight computer to the ground isprocessed to produce a CRT display analogous tothe oriboard DSKY display the astronauts arerr 2nitoring. The K-START (Keyboard Sequence to:?rtivate E2andom Testing) command system dupli-cates the keyboard section of the onboard computerDSKY. The keyboard entry is paralleled with a tapereader allowing for automatic, rapid, error-freecommand sequences from the control room to thennboard computer. The capability for monitoringdnd commanding the GN&C system remotely isexploited in the design of the prelaunch testprocedures to enable parallel testing of spacecrafts:!bsystems.

Prelaunch Checkout Design Objectivesand Description.

The Apollo guidance computer is programmedto compensate the system for the predominantinstrument errors. The objective of the prelaunchcalrbration testing is to provide best estimates ofthe present values of the error coefficients for usets compensation and to provide data for determiningthe uncertainties to be expected.

The unique characteristics of an inertial systemutilizing a general-purpose digital computer witha remote control capability were exploited in thedesign of the prelaunch calibration tests. Theguidance-system calibration test requirements:vere designed to minimize the launch preparationtime. The test method utilizes gravity to eliminatethe need for external references. The knownamplitude of gravity is used to calibrate the ac-celerometers. The gyro drift calibration is basedon the detection of the vector rotation of gravityby the accelerometers. The drift information must‘be separated from accelerations caused by launch-vehicle acceleration due to sway and from noisedue to quantization in the Pulsed IntegratingPendulous Accelerometer. The velocity quanta sizefor the CM is 5.05 cm/sand for the LM is 1 cm/s.The information is separated from the noise by Jsimplified optimum linear filter which includes inits state vector estimates of launch vehicledisturbances(3).

The measurements made on the launch pad areusually used as reconfirmatiocs of the selectedcompensation values. The compensation parame-ters are accelerometer bias and scale-factor errorsfor the three accelerometers, and gyro bias driftand two acceleration-sensitive drift terms for thethree gyros, for a total of fifteen terms.

Description of MIT Error Analysis for PrelaunchSystem Flight Worthiness Demonstration.

The measurements made prior to launch are usedas indications of uncertainties to be expected duringa mission. The prelaunch system performance datahas specified tolerances. In the cases where thespecified tolerances were exceeded, the flightworthiness of the system was evaluated on the basisof the probable mission effect of the deviatingparameter. As an example, shifts of gyro driftparameters beyond specified limits during pre-launch tests occurred on Apollo 3, 4, 5, 6. Decisions.ibout the flight worthiness of those systems were

made by first classifying the problem as ‘ndicatingpossible catastrophic failure in flight, t4, or oneindicating performance degradation. In cases wherereliability problems were suspected the InertialMeasurements Unit was replaced (Apollo 6). In theother cases, where the test data showed aperformance degradation, determination of themission effect was required, This determinationrequired the development of error analyses thatrelate variations of each of the measurableparameters to the mission.t7)

Each mission in the Apollo program is unique.A separate error analysis is performed for eachmission. The mission performance requirementswere defined early in the Apollo program based upona typical lunar landing. Because of the variety ofmissions and mission objectives, it is necessaryto have a separate error analysis for each mission.For all missions except Apollo 5 the segmentedmission phase approach to error analysis using alinearization technique is entirely adequate and waspursued. ,Zn error analysis is conducted using boththe specification values, as well as the demonstratedvalues, for the GN&.C system. A comparison ofspecification, actual ground measurement, and flightresults for selected mission phases is presentedin Table I , a.nd in Figures 3,4,5,6, and 7.

The unmanned Xpollo 5 flight was such thatknown initial conditions for each thrusting phasewere not available. As the system guided the vehiclebased upon its actual set of initial conditions, theguidance errors could not be treated with linearizedperturbations. The resulting position and velocityerrors became more nonlinear as the missionprogressed. The mission was scheduled for nineearth orbits and the small-angle assumptionsusually used with gyro drift were no longer ap-plicable. The only solution was to conduct a largenumber of Monte Carlo error analyses of thecomplete mission.

Some interesting examples of how error analysis‘helped resolve operational problems occurred onthe early flights. The flight plan for AS-202 calledfor a sub-orbital flight of approximately 314 of anorbit with a maximum entry range coupled with amaximum heat-rate input to the heat shield. Theoriginal requirements called for an entry-angleuncertainty specification of 1/2O. This was an easyachievement with the ground giving a state-vectorupdate. During the checkout phases of the vehicleit was learned there were phases in the missionprogramwhenan update should not be sent becauseof onboard software deficiencies. This resulted ina condition where a back-up system would berequired for guidance. As checkout proceeded itwas clear that inertial performance could, with a30 uncertainty, not exceed l/30. However, nearthe flight readiness test the performance require-ment was voiced to be 0.050 3~ uncertainty. Thesystem would not make it without update and mightnot with update. However, near launch therequirement of 1120 was reimposed and no updatewas attempted. Post-flight analysis showed theentry angle error to be 0.120.

JInother operational consideration where the er-ror analysis was used concerned notification to theGD;&C system that launch vehicle lift-off had occur-red. This discrete command to be given to thespacecraft guidance computer was to change themode of operation from gyrocompass to boost

Mission and Parameters

l-n Uncertainty Based onSpecified Actual Pre-

Perfcrmance Flight Data

Apollo 4 (SA501)1. Position error at re-entry start 2.75 nm2. Velocity error at re-entry start3. Position error at splash

26.6 ft/s22.5 nm

Note: *NASA-5-68-454

Apollo 5 (L&ll)1. Altitude uncertainty at perigee after APS cutoff2. Position error indicated at SIVB cutoff3. Velocity error indicated at SIVB cutoff

100.890.2 ft5.6 m-n

132.5 ft/s

Apollo 6 (AS502)1. Position error at re-entry start2. Velocity error at re-entry start3. Position error at re-entry end

2.8 run58 ft/s

14.2 nm

Notes:*MSC-PA-R-68-9

**Due to failure of the SIVB to re-ignite, there-entry trajectory was not as planned; there-fore, the entry error is meaningless.

Apollo 7 (AS205)1. EOI cutoff position uncertainty2. EOI cutoff velocity uncertainty3. Rendezvous TPI burn position uncertainty

3 . 1 n m73 ft/s

1.95 nm4. Rendezvous TPI burn velocity uncertainty5. Position uncertainty at drogue deploy6. Velocity uncertainty at drogue deploy

Apollo 8 (AS503)1. EOI cutoff position uncertainty2. EOI cutoff velocity uncertainty3. TLJ cutoff position uncertainty4. TLI cutoff velocity uncertainty5. Perilune uncertainty following LOI (3 )6. Apolune uncertainty following LO1 (3 )7. Position uncertainty at drogue deploy (CEP)

13.7 ft/s2.8 nm56 ft/s

4.3 nm70.7 ftls1.25 nm12.2 ftls0 . 3 1 n m4 . 7 n m1.92 run

Table

3.15 run51.5 ftls18.6 nm

109,079.7 ft4 . 2 2 n m100 ftls

2.75 nm57 ftls7.2 run

1.8 nm43 ftls0 . 7 n m5 ft/s1.4 nm

33.7 ftls

3.9 run66 ftls1.1 m-n10 ftls

0.23 mm2.2 nm

0.96 m-n

Best ’Estimate

Error.

7.5 run*140 ft/s*7 .4 nm*

U n a v a i l a b l e0 . 0 n m2 ftls

2.7nm*10.2 ftls*

**

2.6 nm60 ft/s

0 . 5 1 n mUnavailable

2.2 nmU n a v a i l a b l e

0.016 run1 ftls1.9 nm18 ft/s

0 . 1 5 n m1.46 nm0.815 run

POSITION PREDICTION BASED ON 3u SPEt. SYSTEMlmn) 9 k---- --.y PREDICTION BAJED ON ACTUAL MEASLlREMENl

ACNAL fMSFN TRACKlNGlE N T R Y S T A R T

6-w POSITION P R E D I C T I O N B A S E D O N loSRClFlCATlON F O R S Y S T E M5 I- I hlnl4 I 6 P R E D I C T I O N B A S E D O N ACTUAL MEASIJREMLM

.. I3 ..2

I 5..

I -. I 4 ---------70 : : :

0 20: :

40:‘.

60!

80 1~0 120 140 th, 180 VELOCIW ffps) 3

‘“KQ PSDICTED SPLASH CIRCLE BASffi ON ACTUR MEASUli?MFNlS P L A S H D O W N .-

20

IO

PREDICTED SPLASH- IoSPEC SYSKM

ACM4

I : i:I :10 20 30 lnml

Figure 3 Comparison of Predicted and ActualEntry Errors on Apollo 4

Figure 4 Comparison of Predicted and ActualSIVB Cutoff Errors on Apollo 5

ENTRY START

PosiTlolllnml ~ACTLIALIBASED WMSFNI

5

4PMDICTICC( BASED ONlrSPfClFlCATlONFOR SYSnhl

3EASEDONACTlJMMASUfifMEMT

2

1

1 0 2 0 3 0 4 0 5 0 a VELOCITY Cfpsl

Figure 5 Comparison of Predicted and ActualApollo 6 Entry Errors

L!iFz--- MPfCTED ERROR BASED

ON PRELAUKH DATA

- MRCTEDERRQRBASEDON MMINAL SYSTEM

8 ACTUAL

I

10 20 3 0 40 5 0 w j 7 0 al 90

msinof4 8 loERRORS ATiO.l. CUTOFF: VELOCITY

lnmlh

flrnl

1 -1

30ORBlTERRORS AnERLOICUTOff lnml

:f-$)2 : : : :CEPATDRCWE PARACHUTEDEROY

Figure 6 Comparison of Apollo 8Predicted and Actual System Errors

Lpsend

POSITICNhmb 2

1 - - - - - 12

hRlTl;;-;

4 16 8 10 u 4

1~ ERROR AT REFOENOUS TRANSRR PHASE

' : ' : ; 'N'Ti'T'o/' CUkF '

YnoC'TY'fm'

VELOCITY I@6110 WRY ERRORS ATDRXUE PARACHUTE DEWY

Figure 7 Comparison of Apollo 7Predicted and Actual System Errors

1monitor. Three methods were used to achieve this(1) At a time about five seconds before lift-off, adi.screte command was given, called GuidanceReference Release (GRR). (2) At lift-off, the samehard-wire discrete that went to the launch-vehicleguidance system was also sent to the Apollo GNKCsystem when the vehicle actually lifted off. (3) Abackup lift-off command could be sent to thecomputer either by the astronaut or by an uplinkcommand from the mission control center, Houston.

At T-15 seconds the Saturn vehicle countdown

proceeds automatically, monitored and progressedby a digital computer. Holds had occurred afterT- 5 seconds and it was common practice to recyclehack to T-15 minutes, thus creating a possibleproblem. Should a sequence like this occur, theguidance system would be released and proceed tomonitor the boost.be insufficient

Should recycle occur, there wouldsettling time to re-establish

orientation of the GN&C system by gyrocompassing.The error analysis results indicated that the GN&Csystem would navigate and monitor boost properlyevenif it were released well ahead of lift-off. Dueto program considerations, it was decided to removethe GRR signal and to launch with only two methodsof indicating lift-off.

Description of Checkout History and Experience.

The Apollo system spends a majority of Its lifem checkout. Table 11 summarizes the history ofsystems to date. The average number of operatinghours accumulated in checkout is 2460 hours duringan average 10.45-month spacecraft testing period.

The success inmeeting schedules and establish-ing the flight worthiness of all the hardware wasdue to early recognition of the importance ofconsidering checkout problems in the design, tominimization of equipment removals by carefullyreviewing all anomalies for their flight impact, andto the discipline imposed by allowmg no unexplamedfailures.

Early spacecraft testing revealed that there wasa high probability of applying and/or removingspacecraft power to the GNRC system in an incor-rect sequence. The first system design did notincorporate protective features for making thesystem tolerant of incorrect power sequencing.During checkout several instances occurred where,due to faulty procedures, power to the system WdS

inadvertently applied or removed in an incorrectsequence. This resulted in performance shifts.The design was changed to provide internalprotection to incorrect power sequencing. Thatdesign change saved many hours of re-test andstabilized the performance data obtained inspacecraft testing.

Another example involves ground potentialchanges in docked test configuration. The possibilityof reverse potential on the system was notconsidered in the initial design. When spacecrafttests indicated that reverse voltages could exist dueto grounding configurations, the GX&C systemelectronics design was changed to tolerate reversevoltages.

The prelaunch checkout has to guarantee that theequipment will operate during the mission. Whenany discrepancy exists, positive action is taken toeliminate possibility of failure in flight. An exampleof this was the failure of the GN&C system to acceptan entry mode change command once during checkoutof the AS-202 system. Even thugh the problemwas never duplicated, the relays that could havecaused this single malfunction were replaced.Another example involves the computer in the samemission. While one of the computers was undergoinginspection at the factory, it was discovered that oneof the vibration isolation pads was missing fromthe oscillator module. Subsequent examination ofother available modules revealed that, on the basisof the sample examined, there was about a 20%

Spacecraft Contractor’s Plant Kennedy Space Center G&N System ,

Installation+System Compieted

System Removed/Reinstalled

Shippedto KSC

Apollo 3AS202G&N 17

Apollo 4AS501G&N122

Apollo 5

$:603

Apollo 6AS502G & N 1 2 3

Apollo 7AS205G&N204

Apollo 8AS503G&N208

Apollo 9AS504CM104G&N209

L M 3G&N605

l/ 6166

8/29/66

11/12/66

11 3167

12/16/67

41 l/68

51 2168

101 7168

None

None

IMU replaced12/66

6167

None

None

Replaced DSKY

None

System Removed/Reinstalled

4116166

12/22/66

6123167

11/23/67

5130168

8/ 12/68

lO/ 5/68

6114168

None

None

ReplacedComputer 6/67

’ IMU 7/67

Replaced IMU

None

None

Replaced IMU

ReplacedA4U twice

Table II

chance that one of the vibration isolation pads wasmissing in the computer in the spacecraft. T h edecision taken 30 days prior to flight was to removethe computer and inspect. It was rapidly done andverified that the pad had been installed.

The earlyGN&C system operations were plaguedby the occurrence of unexplained restart(6)*“. Theconcept of NO unexplained failures required thateach restart be explained. The computer restartswere frequent early in the program but as effortwas applied to explain each one they were reducedto zero. Noise susceptibility in test connectors wasdiscovered and corrected by a shorting plug.Software errors were discovered and corrected bynew software. Procedural errors were discoveredby means o f ACE playbacks and laboratoryverification. The solution therefore involvedhardware changes, software changes, proceduralchanges and, above all, education and understandingon the part of all GN&C system operation personnel.The successful operation of the hardware duringthe Apollo flights was due primarily to this carefuldisciplined engineering that examines all facets ofthe situation and leaves no area uncorrected.

III. Flight Operations

During a miss ion the GN&C operation ismonitored by computers in the Real Time Control

* A restart is an internal protective mechanismthat enables the computer to recover from randomprogram errors , operator errors , and fromenvironmental disturbances. Restart attempts toprevent the loss of any operating functions.

Launch Months in OperationDate Spacecraft Hours

S/25/66

ll/ 9/67

l/22/68

41 4168

10/11/68

12/21/68

3/ 3169’

8.7

1

2192

14.3 2907

14.3 2626

8.6 2669

10.0 2345

8.6 1 9 0 5

10.0 Unavailable

17.0 Unavailable

TheCenter (RTCC) in Houston. digital datagenerated by the onboard computer consists of listsof two hundred 14-bit computer words transmittedonce every two seconds. The contents of the listsare designed to provide information relevant to themission activity. The data is used to drive displayson the guidance officer’s console and numerous othersupport consoles. The amount of data from theguidance computer is limited by the word size andtransmission rate. The design of the programselects the quantities to be transmitted and isusedto make up for this deficiency. The data used forthe real-time displays is selected prior to themission, based on the flight controller’s experienceand operational requirements. In real time the dataformat is quite inflexible.

The control of the system is accomplished inthe same computer complex. The data transmissionparallels the onboard keyboard-entry capability.The data transmitted consists for the most part ofan update of the spacecraft position and velocitywhich is determined by ground tracking stations andconverted into the proper format by the HoustonRTCC. The controller has the capability of com-manding the spacecraft computer through ananalogous keyboard with the same codes as theastronauts.

Review of the data obtained from the flightmonitoring indicates that the ground calibrationenables accurate error compensation. Review ofthe anomalies in flight operations indicates thatthere is a reasonable amount of time availableduring the mission for troubleshooting and diagnosis

of problems. The only cases that could not bediagnosed in real time involved inadequate real-time data.

Gyro Dlas DriftlFllght measurement ” Ground prediction1

Guidance System Monitoring During a Mission.The monitoring of the guidance-system perform-

ance during the mission consists of comparing? ,rvigation data from other sources (ground trackinghiturn V guidance, LM backup for CM, CM backupfor LM), computing accelerometer output with noinput at zero gravity, and determination of thequality of the inertial reference by successiveinflight optical re-alignments of the IMU. Theses’lccessive re-alignments are performed several:hours apart so that the rotations of the IMU stablemember required to re-align it are mostly due togyro drift with the fixed errors reduced inverselyproportional to this time interval. There are alsooperational techniques utilizing star and planethorizons for checking the commanded attitude priorto a velocity-change maneuver.

The onboard measurement of the available IMUperformance parameters can be used to furtherimprove the performance. The compensationp.rrameters can be modified through the keyboard,either onboard or from the guidance of f icer ’sconsole in Houston.

drift-meru UY.015°1hrI

Acce lerometer B ias Error(Flight measurement - Ground prediction(

2 12.”2 10 l-l

The guidance-system monitoring is designed toprovide the flight controllers with data upon whicha prediction of the future operation of the systemiq made. The flight controllers have pre-pro-grammed decision points enabling the continuationof the mission with a backup system in control, orwith a new mission plan, if their data indicates theD rimary system may not perform adequately duringthe next critlcsl mission phase.

The data telemetry from the spacecraft is limltedand the ability to predict future operation verydifficult. The limits set for the various parametersare selected on the basis of the worst performanceexperienced during design evaluation tests andprelaunch tests, excluding catastrophic failures.

Figure 8 Gyro Bias Drift (NBD) andAccelerometer Bias Flight Data

The onboard measurements to date have indicatedthat excellent performance should be predicted andexcellent performance has followed. The onlyonboard measurement available for the unmannedmissions (Apollo 4, 5, 6) is accelerometer outputat zero gravity (ab). The manned missions alsoinclude inertial platform drift at zero gravity (NBD).

The inertial component data is presented inTable III and Figure 8.

Apollo 8 afforded an unique opportunity formonitoring the IMU over a long period of continuousoperation, The data indicates that stability ofinertial operation has been achieved in the design.The entire component data history is presented in’Figures 9 and 10.

Diagnosis of problems occurring during the mission

troubleshooting is of no value. These are problemsinvolving actual hardware failures and problemsinvolving incompatibilities due to inaccurate modelsof the spacecraft being used in the control programs.

Examples of problems involvingsystem that have been explained m

t h e GN&C

lustrate the capability that does exist.real time il-

A) APOLLO 4 (AS501)During the mission it was reported that a large

difference existed between the L indicated by theonboard computer and the b as compared from radartracking data.vector

A is the angle between the positionand the velocity vector . Real-time

measurement of accelerometers indicated the GN&Csystem was operating properly. The difference wasfound to be a ground computation error T h eguidance system was allowed to continue in controlof the mission.

theThe adequacy of all subsystems to continue into

next phase and to complete the mission isreviewed continuously by the flight controllers. Itis therefore important to diagnose problems in realtime in support of the GO/NO-GO decisions. The‘light experience shows that there is adequate time-available for problem diagnosis and that there isI capability for real-time troubleshooting.3-I-e two

Theretypes of problems where real -t ime

B) APOLLO 6 (AS502)During the mission a divergence was observed

between the attitude information supplied by theGN&C inertial reference and the backup body-mounted attitude gyros. The divergence was firstattributed to GN&C malfunction. Real-time reviewof prelaunch data for the backup system indicatedthat the drift rates measured on the ground accountedfor the divergence. The GN&C system remainedin primary control for a successful mission.

C) APOLLO 7During the mission a procedure for using the

landmark-tracking navigation program for naviga-

Gyro Bias Drift.

Less CompensationNBDX N B D Y NBDZA bx

femls2)

A bY

(cm/s’)AbZ

(cm/s2) (mew)(l)

0 . 3 0 4 0.230.41

-0.390.21 -0.28

0.10.14

-0.35-0.22

0.00.12

-0.33 2.770.64

1.932.9 2.1

0.2 0.24 0.16 1.9

0 . 2 7 5 0.215 2.2

0.309 0.206 1.4 -0.63 0.0

0.0 0.615 0.93 2.2 1.3

0.0

0.0

0.0

0.0

0.845

0.83

0.63

0.83

0.62

-0.004

0.013

-0.34-0.10*

0.62 1.5 0.62 1.8

0 . 6 0 5 1.51

0.0 0.60 1.6 0.03 1.97

0.0 0.59 1.38 0.16 1.6

0.38 0 . 0 0 2 -1.6 -0.4 2.7

0.32 -0.008 -3.6 -0.1

-0.530.64*

0.36 -2.30.36

-0.5-1.2

-1.6-0.2 -2.4

herd (men) ,

0.4

0.2

-0.8

0 . 1 5

-0.13 1.64

3.3

1. The 3 I“esult was a computer restartdue to accessing a memory location address whichdid not “exist” . The restart was diagnosed fromreal-time displays.

Apollo 4In-flight measurementCompensation

Apollo 5In-flight measurementCompensation

Apollo 6In-flight measurementCompensation

Apollo 7

theDuring the Apollo 7 missmn the crew removed power from

guidance system during inactive periodsgathered on gyro drift and accelerometer bias.’

Data was

Last prelaunch measurement

a. Accelerometer and gyro data following boost.In-flight measurement

b. Accelerometer and gyro data at 145 hours followingseveral on-board removals and re-applications.In-flight measurement

Apollo 0The Apollo 6 mission was flown with the guidance system

continuously operating. The monitoring of the inertialreference and accelerometer errors provides us with a largeset of data on Apollo mertial system performance in spaceenvironment.

Expected value from last ground measurement

a. Accelerometer and gyro data following boostIn-flight measurement

b. Accelerometer and gyro data tiring translunar coastIn-flight measurement

c. Accelerometer and gyro data in lunar orbitIn-flight measurement

d. Accelerometer and gyro data during transearth coastIn-flight measurement

Apollo 9Expected value based on ground measurements

a. LM system after turn-on in orbitIn-flight measurement

b. CM system after turn-on in orbitIn-flight measurementExpected value based on ground measurements (2)

Notes:(1) @ne meru is 0.015 degree per hour.(2) The compensation value was changed in orbit.

Table III

tion sightings on the horizon was determined. Theprocedure did not work in the spacecraft. T h ecomputer was programmed with the reasonableassumption that landmarks would be on the surfaceof the earth. The attempt to use the program forhorizon sightings above the earth’s surface ratherthan the landmarks resulted in the attempt tocompute the square root of a negative number. Thisresulted in a restart.was quickly

The error in the proceduredetermined by ground tests.

Computer Restart: The Apollo computer has acatalogue of navigation stars identified by numbers.The astronaut, by keying in a numerical code, tellsthe computer the star to be used. The restart wasdue to the astronaut not selecting any star whenthe computer requested a star selection. T h ecomputer interpreted the selection of “no” star asstar number 0; the catalogue, however, started with

star numb6 ?r

Mark Button “Failure”: The computer assimi-lates line-of-sight data from the optics only uponastronaut command, which consists of an interruptcaused by depressing the “mark” button on thenavigator’s control panel. The line-of-sightinformation is used for rendezvous navigation aswell as for inertial-platform re-alignment. Toprotect the rendezvous navigation information frombeing modified by platform alignment sighting data,the computer programmers prevent the processingof alignment “marks” during rendezvous navigation,The problem occurred when the astronaut termi-nated the rendezvous navigation program in a fashionnot expected by the programmers. This termination

GYRO DRIR

-3

*3

l 2

*15f 0

E -12ie -2s

-3l 3

+2

+1

0

-1

-2

-3

GROUND ELAPSED TIME (noursl

E’igure 9 Gyro Drift

.

” 3 ‘1 ‘1 ‘1 ” ’ “1 1 ‘1 1’ “1 1” 1”19 20 30 do so 60 7 0 a0 ‘)I) lr)r) 1 1 0 l29 l30 193

Figure 10 PIP Bias

left the computer with the information that noalignment “marks” were to be processed. The next

Ground troubleshooting uncovered the cause and areselection and proper termination of the navigation

attempt at re-alignment failed due to an apparentfailure in the “mark”

program eliminated the problem.interface to the computer.

Accelerometer Bias Change: The accelerome-ters in the Apollo inertial measurement unit arePulsed Integrating Pendulous Accelerometers,PIPAs. The accelerometer uses a pendulous massas a torque-summing element. The accelerometerbias (output with no input) is due to the residualtorques in the instrument. During a mission, atzero gravity, the accelerometer is calibrated bymonitoring its output. During Apollo 7 the flightcontrollers noticed that the expected low output atzero gravity decreased to zero. This wasinterpreted as a possible hardware failure and anin-flight test was conducted to determine if theinstrument was operating properly. The testconsisted of a maneuver to thrust along bothdirections of the accelerometer input axes. Theresults showed that the instrument was operatingproperly. The cause for the lack of any output wassimply the PIPA reaching an operating region infree-fall where the torque generated by electronicnonlinearities was equal and opposite to the residualelectromagnetic torques and this yielded zero bias.

D) APOLLO 8Prelaunch Alignment During the Trans-earth

Coast: The commanding of the Apollo guidancecomputer consists mainly in selecting numerically-coded programs and loading the desired number atthe time the computer requests the information.The loaded information is re-displayed for confir-mation by the astronaut prior to being acted uponby the computer. The astronaut confirms that heindeed wants the displayed program to be executedby depressing a key on the keyboard.

The prelaunch alignment program is coded 01.It was inadvertently selected by the astronaut duringthe trans-earth coast. The ‘problem” caused bythat procedure was mainly due to the fact that theerasable portion of the computer memory is timeshared. The effect on the contents of the erasablememory of starting program 01 at that time wasunknown. The problem was quickly dealt with bythe crew and the contents of the memory verifiedby the ground to be correct.

The problems involving the GN&C system in theApollo program have beenminor. They do providean object lesson of the types of problems to beexpected in a large program with many opportunitiesfor error in design and operation.

The operational problems can be categorized toindicate where the operational system is mostsusceptible to error.

The types of problems to date have been thefollowing:

1. Ground flight control errors2. Operator errors3. Misinterpretation of design data4. Misinterpretation of flight telemetry data5. New phenomena6. Hardware problems

1. Ground Errors

The problems that can be categorized as grounderrors includeonly those which arose in real time.These type of errors can be dealt with by real-timetroubleshooting. Some examples have been alreadydescribed.

2. Operator Errors

While the interface between the astronauts andthe guidance system had been carefully engineered,during manned missions the system’s deficienciesshow up very clearly in the examples described.The selected major real-time “problems” categor-ized below as operator errors clearly reflect dif-ficulties in the design of the interactive computerprograms and their use under mission conditions.These types of problems also can be easily diagnosedand corrected.

3. Misinterpretation of Design Data

The attitude and thrust-vector control systemsincorporated in the Apollo guidance computermemory depend on accurate models o f thespacecraft. Problems arise when the spacecraftresponds to commands differently than the computerprogram expects it to respond. The result can bea performance degradation resulting from eithera logical error or incorrect information in thecomputer. Both have occurred to date.

A) AS202 L/D ProblemThe otherwise-successful sub-orbital mission

missed the target by 200 miles. The major causewas the lift-to-drag ratio, L/D, of anexpected 0.35versus an actual 0.25 with the result that the vehiclehad insufficient lift to attain the targeted range.

B) APOLLO 5 DPS Engine ShutdownThe control program for guidance during LM

descent propulsion system engine operation moni-tored the thrust build-up after the engine had beencommanded to fire. If the thrust build-up did notoccur, the program was designed to turn off theengine and generate an alarm. During the flightthe engine thrust build-up for the first descentengine burn did not occur at the rate expected bythe program and the computer turned off the engine.The program was designed so that appropriatereal-time commands could have re-started thecontrol program but, due to ground trackingconsiderations, the mission was flown with back-upprocedures.

4. Misinterpretation of Flight Telemetry Data

The spacecraft telemetry data is processed bya computer complex at Houston to provide real-timedisplays for the flight controllers. The limitationsof that system require that some data not bedisplayed. The display, therefore, does not givean exact picture of the spacecraft status. The primeexample of how the selected displays can causemisinterpretation occurred on Apollo 8.

A) APOLLO 8 “travelling trunnion” ProblemThe flight plan of Apollo 8 called for the power

to the GN&C optical subsystem to be left ONthroughout the mission. The telemetry for the stateof that power was not selected for real-time display.The computer monitors the sextant articulatingline-of-sight angles and this information istransmitted as part o f the computer down-telemetry. Several times during the mission thecomputer data indicated that the “trunnion” angle,one of the two data-encoded optics-system angles*changed from the expected Oo to an unexpected 450.This change was unexplainable from the available

10

data. The system operation, however, indicated thatby recycling normal optics-operating proceduresthe system was not a,ffected. The decision to continueto the moon was based on that fact, Several failuremodels were invented during the mission to explainthe problem. Later, during the astronaut debriefing,it became apparent that the problem was due toSWi.iLChi3g OFF the optics power. With powerremoved the change in angle was to be expectedeach time the power was re-applied. Search throughthe data which was not processed in real timeconfirmed that explanation.

5. New Phenomena

To date there have been very few, surprises inthe flight operations of the Apollo GN&C system.The following observations will have an effect onfixture GNPLC design:

A) VisibilityXavigation *in cislunar space and alignment of

the inertial platform depend on the astronaut’sidentifying navigation stars. The debris generatedby the spacecraft can appear in the optics as starsto make true star identification difficult. The Apollomissions, therefore, have made extensive use ofthe computer-inertial measurement unit combina-tion to direct the optical line of sight to aid staridentification.

BJ Perigee TorquingThe size of the .Ipollo spacecraft resulted in

considerable attitude changes in earth orbit due toatmospheric drag at perigee. This could be costlyin fuel for !arge space-stations.

6. IHardware Problems

There have been very few G&N-related hardwareproblems to date in the Apollo missions. The carefulground t?st and reviewof test results are the mainreasons for the in-flight success. Hardwareproblems occur ring in flight result in use of backupsystems.

The major problem that involved the G&N wasthe .?pollo 6 ground update problem.

The unmanned Apollo missions were dependenton ground tracking navigation data to a much greaterestent than the manned missions, Several navigationupdates were planned for Apollo 6. The navigationdata or other remote commands to the computerare transmitted in a triple-redundant code, KKK.The computer will not accept data that does notconform to this code. During the Apollo 6 missionseveral attempts to send navigation updates wererejected by the computer. The most likely causefor rejecting the data is electromagnetic interfer-ence. Review of the interface (Figure 2) did indicateapossibleproblem due to the ground command linesleft disconnected at launch andunterminated. Thesewires were the probable antenna for picking up thenoise. The source of the interference was laterdetermined to be an ion pump associated with thefuel cells. Theion pump in the Apollo 7 spacecraftgenerated the same problem during a ground testin the altitude chamber, The Apollo 6 ion pumphad not been ground tested in thealtitude chamber.Wiring changes were also made in subsequentspacecraft to eliminate the possible noise pick-upin the ground command lines.

TV, Conclusions

1. Flight performance to date indicates that thesystem-error model contained in the specificationis a good representation of the actual system errorsduring a mission. There is excellent agreementbetween the ground and the free-fall initialparameter measurements.

2. The quality and reliability is designed and builtinto the equipment. With a well-planned and well-designed prelaunch checkout in-flight hardwareproblems will be minimized.

3. Operational experience shows that automaticprelaunch checkout of space guidance, navigationand control systems is the best and mandatory ifthese costs are to be reduced.

4. The mission techniques are designed after thehardware is built; therefore, the hardware must bef lexible to accomodate different mission ap-plications.

5. The complexity of the GNBrC system, as well asof the total spacecraft, dictates that emphasis beplaced on simulation for verifi.cation and training.

V. Object Lessons

1. There is a reasonable amount of time availabiefor in-fl.ight problem diagnosis and there exists anability for troubleshooting and diagnosis both inflight and on the ground.

2. Care must be taken in the mission error analysiswhere the guidance system is in the steering 100pto see that mission phases can be treated as separatephases. This can always be done with correct initialconditions.

3. Discipline is necessary to understand, explainand, where required, fix all phenomena associatedwith checkout.

4. Any problem found must be related (by the useof strict build control) toall possible systems, andthe effects evaluated based upon requirements.

5. The concept of NO unexplained failure is thefoundation of a discipline that enabled success tobe achieved in a complex national goal - APOLLG,

References

1. Miller, J. E., (Editor), G & Space Navigation,Guidance and Control, AG,IRDOGRAPH 105, Techni-vision Limited, Maidenhead, Engiand, 1966.

2. L’Jartin, F. II., and Battin, R. H., “Computer-Controlled Steering of the Apollo Spacecraft”,Journal of Spacecraft and Rockets, Vol. 5, No. 4,1968.

3. Schmidt, G. T., and Brock, L. D.. “GeneralQuestions of KalmanSystems”,

Filtering in NavigationChapter 10 of Theory and Applications-

of Kalman Filtering, NATO-AGARD. (Edited by C.T. Leondes)

4. Feldman, J., and Miller, J, E., “Gyro Reliabilityin the Apollo Guidance, INavigation and ControlSystem”, Journal of Spacecraftand Rockets, Vol.5, No. 6, ppe 638-643, June 1968.

External:NASA/RASP0

AC ElectronicsKollsman

RaytheonCapt. M. Jensen (AFSC/MIT)

MSC:

National Aeronautics and Space AdministrationManned Spacecraft CenterHouston, Texas 77058ATTN: Apollo Document Control Group (BM 86)

M. HolleyT. Gibson

KSC:

National Aeronautics and Space AdministrationJ. F. Kennedy Space CenterJ. F. Kennedy Space Center, Florida 32899ATTN: Technical Document Control Office

LRC :National Aeronautics and Space AdministrationLangley Research CenterHampton, VirginiaATTN: Mr. A. T. Mattson

CAEC:Grumman Aircraft Engineering CorporationData Operations and Services, Plant 25Bethpage, Long Island, New YorkATTN: Mr. E. Stern

NAR:North American Rockwell, Inc.Space and Information Systems Division122 14 Lakewood BoulevardDowney, CaliforniaATTN: Apollo Data Requirements

Dept. 096-340, Bldg. 3, CA 99

NAR RASPO:NASA Resident Apollo Spacecraft Program OfficeNorth American Rockwell, Inc.Space and Information System DivisionDowney, California 90241

GE RASPO:NASA Daytona Beach OperationsP.O. Box 2500Daytona Beach Florida 32015ATTN: Mr. H. Lyman

(1)

(3)

(2)

(2)

(1)

(21&1R)

(18&1R)(2)(1)

(1R)

(2)

(3&1R)

(8&1R)

(1)

(1)