Hoag (1963): Apollo G&N — Man and Machine Integration
David Hoag was the Technical Director of Apollo Guidance and Navigation at MIT’s Instrumentation Laboratory (now Draper Laboratory). This paper describes the complete G&N system architecture for the Apollo Command Module — the sensors, the computer, the displays, and critically, how the astronaut interacts with all of it. Written before any Apollo hardware flew, it established the design philosophy that would guide manned spaceflight for decades.
The Central Question
Section titled “The Central Question”The paper opens with a question that remains relevant to every autonomous system: how much should the human do, and how much should the machine do?
Hoag frames two extremes:
- Completely Automatic — the astronaut is “wrapped and bundled as it were, in a life-maintaining cocoon” and delivered to the lunar surface like inert payload
- Completely Manual — “a rocket, a control stick, a big window, and appropriate charts and tables” — suitable for Lindbergh’s Atlantic crossing, but not for a moon landing where the energy budget is razor-thin
The chosen compromise: the navigator has complete choice and control over system operation, using human senses and judgement where they are superior (pattern recognition, landmark identification, situation assessment), and depending on mechanisms where humans cannot perform (high-speed computation, precision inertial measurement, real-time trajectory integration).
The G&N System
Section titled “The G&N System”Four major subsystems, all mounted on a rigid Navigation Base in the Command Module’s lower equipment bay:
Inertial Measurement Unit (IMU)
Section titled “Inertial Measurement Unit (IMU)”Three 25 IRIG gyros (2.5” diameter) and three 16 PIPA accelerometers (1.6” diameter) in a three-degree-of-freedom gimbal structure. The deliberate choice of 3 gimbals instead of 4 — accepting gimbal lock as an operational constraint managed by pre-alignment procedures rather than adding a fourth gimbal ring — is a textbook example of trading hardware complexity for operational procedure.
The outer gimbal axis (OGA) is mounted 33 degrees from the spacecraft symmetry axis, parallel to the reentry roll/wind axis, so high angular rates during reentry lift control are “unwound” by the outer gimbal. The inner gimbal axis (IGA) is aligned normal to the planned trajectory plane before each mission phase.
- Coarse alignment: ~1 degree accuracy, driven from estimated spacecraft attitude via CDU angle commands
- Fine alignment: ~1 arcminute accuracy, using star sightings through the sextant with gyro torquing corrections
Optics
Section titled “Optics”Sextant (SXT) — two lines of sight, 28x magnification, 1.8° field of view. The landmark line is fixed along the shaft axis; the star line articulates via shaft and trunnion angles. Measurement accuracy: 10 arc-seconds (~0.05 milliradians). Trunnion range limited to ~50° by spacecraft structure.
Scanning Telescope (SCT) — single line of sight, 1x magnification, 60° field of view. Used for target acquisition, star identification, and orbital navigation (where angular rates are too high for the sextant but accuracy requirements are relaxed to ~1 milliradian).
Apollo Guidance Computer (AGC)
Section titled “Apollo Guidance Computer (AGC)”| Parameter | Value |
|---|---|
| Word length | 15 bits + 1 parity |
| Single-precision add | 20 μs |
| Double-precision multiply | 800 μs (subroutine) |
| Fixed memory (core rope) | 12,000 words |
| Erasable memory (ferrite) | 1,000 words |
| Scheduling | Priority-based multi-program |
| Construction | Replaceable modules with carried spares |
The AGC handles multiple programs simultaneously with priority scheduling — more urgent programs preempt less urgent ones. Both the AGC and the Power Servo Assembly (PSA) use common replaceable modules; one tray in each carries spares. This in-flight repair capability was designed in from the start.
Displays and Controls (DSKY)
Section titled “Displays and Controls (DSKY)”The verb-noun interface:
| Component | Digits | Example Values |
|---|---|---|
| Program | 2 | Translunar injection, Midcourse navigation, Entry |
| Verb | 2 | Display, Compute, Read In, Change |
| Noun | 2 | Position, Velocity, Star-Planet Angle, Abort Velocity |
The astronaut enters a verb code, then a noun code, then optional data. Nothing executes until the ENTER key is pressed. Invalid combinations trigger the “illegal order” light. When the computer needs attention, the verb and noun displays flash at 1.5 Hz until the astronaut responds.
Celestial Navigation
Section titled “Celestial Navigation”Cislunar (Midcourse)
Section titled “Cislunar (Midcourse)”The astronaut makes star-to-planet angle measurements with the sextant. Each sighting defines a conical surface of position. Three measurements at different times (using different star-planet pairs) determine a fix — similar in principle to maritime celestial navigation, but in three dimensions rather than on a surface.
For Apollo, ~40 sightings per midcourse leg, spaced 15 minutes to several hours apart according to an optimized schedule. Each measurement is fed to the AGC’s statistical navigation algorithm (Battin’s recursive Bayesian estimator, Report R-341), which updates all six state components (position and velocity) and maintains an estimate of the remaining uncertainty.
Velocity corrections are applied only when the correction is both sufficiently well-known and large enough to justify the fuel expenditure. Approximately 3 corrections per midcourse leg, with a total ΔV budget of ~100 ft/s RMS per leg.
Earth Horizon Sensing
Section titled “Earth Horizon Sensing”On the sunlit side, the atmosphere scatters sunlight with brightness that halves for every 17,000 ft increase in altitude above ~100,000 ft. A 10% absolute brightness measurement determines line-of-sight altitude to ~2,500 ft — well above all cloud types.
On the dark side, two methods:
- Star refraction — measure the decrease in apparent angular separation between two stars as one sets through the atmosphere; 1 arcminute of vertical change corresponds to a determinable altitude near 100,000 ft
- Star attenuation — photometer measures the intensity drop as starlight passes through increasing atmospheric density; the time of reaching a preset attenuation level is the measurement
Orbital Navigation
Section titled “Orbital Navigation”In low orbit (100 miles), angular rates are too high and angular accuracy requirements are relaxed (~1 milliradian, corresponding to 0.1 mile position error). The scanning telescope tracks landmarks while the IMU provides attitude reference. The AGC computes landmark direction relative to the star-aligned IMU frame.
Error Detection and In-Flight Repair
Section titled “Error Detection and In-Flight Repair”Error monitors at critical points throughout the equipment are combined into master failure signals (IMU fail, accelerometer fail, etc.). Emergency conditions interrupt the AGC, which displays the failure on condition lights at both the navigation station and the main panel.
Individual monitor points can be sampled by the spacecraft in-flight test system to localize the failure. Repair consists of replacing the failed module with a spare — the small number of common module types means a minimum of carried spares can back the many modules in the system.
If a major subsystem fails, the remaining equipment can operate in backup modes. Complete G&N failure falls back to the spacecraft stabilization and control system with ground tracking data via voice radio.
What This Paper Teaches
Section titled “What This Paper Teaches”The paper is a snapshot of a system designed before anyone had flown it. Yet the engineering choices it describes — the 3-gimbal tradeoff, the verb-noun interface, the module replacement strategy, the backup mode hierarchy — all survived contact with reality. The lunar missions flew with this architecture essentially unchanged.
The most durable insight is the man-machine philosophy itself: automation should be a tool that enhances human capability, not a replacement for human judgement. The astronaut can take over “at his discretion to enhance the probabilities of mission success and crew safety.” This is not a philosophical statement — it’s an engineering requirement backed by specific hardware features (manual CDU control, override switches, condition displays, backup modes).