July 20, 2019, is the 50th anniversary of the Apollo 11 Moon landing. To commemorate that momentous event, we revisit Richard J. Gran’s firsthand account of designing the Lunar Module digital autopilot, published in 1999. In that article, Richard described the approach he used in the 1960s and compared it with the way Model-Based Design with MATLAB® and Simulink® could be used to design GN&C systems in 1999. In the 20 years since Richard wrote his article, Model-Based Design has evolved significantly. To highlight this evolution, we describe how MATLAB and Simulink can be applied to GN&C system design today.

Richard’s account follows.

As a young boy I always knew I wanted to be an engineer. What I didn't know was that shortly after graduating from college, I would become involved in one of the greatest engineering projects ever. On September 12, 1962, President John F. Kennedy declared, “We choose to go to the Moon in this decade,” setting this nation on an accelerated path to landing a man on the Moon. That same year, I became a member of the Grumman Guidance and Control group, and from 1963 to 1966, participated in the design of the Lunar Module (LM) digital autopilot at Massachusetts Institute of Technology Instrumentation Laboratories (MIT IL).

The Lunar Module Digital Autopilot Design, 1961–1969

The original autopilot proposed for the LM was an analog system that used a modulator to pulse the reaction control jets on and off. While the control system was analog, the navigation and guidance functions ran on a digital computer that was also used by the Command and Service Module (CSM) and the Apollo Booster. The algorithms for guidance and navigation were created by a team at MIT IL, now called Draper Labs.

Early in the Apollo program, NASA decided to enhance mission reliability by programming the Guidance and Navigation Computer to serve as a backup control system for the LM. To do this, a design competition among three of the Apollo contractors (Grumman, MIT IL, and BellComm) was begun in early 1963.

The main issues with the digital autopilot design were its computer speed and storage limits. Roughly 2000 16-bit instructions were allocated to the digital autopilot, and these operations could not interfere with the primary guidance and navigation functions. Among the many problems that had to be solved was the fact that the computer was not designed to process time-critical events. For this reason, there was only one interrupt level, and there were no digital-to-analog interfaces.

To give a feel for how simple this computer was, Table 1 shows the entire set of its operation codes. To implement the digital autopilot, a second interrupt was required. We used the ones-complement structure of the computer, which meant that there was both a positive zero and a negative zero. This allowed a different interrupt to occur when a counter was incremented from a negative number or decremented from a positive number.