The Entry Monitoring System: A Scroll, a Needle, and the Reentry Corridor
The analog instrument that could guide Apollo astronauts through reentry without a computer—a scrolling chart, a scribing needle, and the thin corridor between skipping off the atmosphere and burning up
The Apollo Command Module hits the top of Earth’s atmosphere at 36,194 feet per second—nearly 25,000 miles per hour, Mach 32. At this velocity, the reentry corridor is a razor’s edge. Come in too steep—entry angle greater than about 7.7 degrees below the local horizontal—and the deceleration loads will crush the crew, or aerodynamic heating will overwhelm the heat shield. Come in too shallow—less than about 5.3 degrees—and the capsule will skip off the atmosphere like a stone off a pond, sailing back into space on a trajectory that will never bring it home. The margin between death by fire and death by ice is roughly 2.4 degrees wide.
The Apollo Guidance Computer could manage this reentry automatically, modulating the spacecraft’s bank angle to control where it flew within the corridor. But what if the computer failed? What if it had been damaged by the same emergency that was already bringing the crew home early? For that scenario, NASA built one of the most remarkable instruments ever installed in a spacecraft: the Entry Monitoring System, a scrolling paper chart with a scribing needle that could guide a pilot through manual reentry by drawing a line that had to stay between two printed boundaries.
The Reentry Problem
Reentry from lunar distance was a fundamentally different challenge from the low-orbit reentries of Mercury and Gemini. Those earlier capsules entered at roughly 17,500 mph. Apollo came in at nearly 25,000 mph—carrying almost twice the kinetic energy. That extra energy had to be dissipated, and the only way to dissipate it was through atmospheric drag, which meant heat.
The Apollo Command Module used a blunt-body ablative heat shield designed by Avco Corporation. The AVCOAT 5026-39 ablator worked by charring and vaporizing in the plasma flow, carrying heat away as it was consumed. The heat shield could handle the thermal load, but only if the trajectory stayed within the designed corridor. Too steep an entry concentrated the heating and deceleration into too short a time window. Too shallow an entry meant extended heating at lower intensity but for much longer duration, potentially exhausting the ablator.
The flight plan called for a “double-dip” or “skip” reentry profile. The CM would plunge into the upper atmosphere, pull several G’s of deceleration and bleed off a significant fraction of its velocity, then use its lift vector to climb partially back out of the atmosphere before descending again for the final approach to splashdown. This skip trajectory distributed the heating load across two passes and allowed the spacecraft to reach downrange landing targets that a simple ballistic entry couldn’t achieve.
Controlling this trajectory required continuous bank angle management. The Apollo CM, despite its blunt shape, generated a small but critical amount of aerodynamic lift—a lift-to-drag ratio of about 0.3. By rolling the capsule, the crew could direct this lift vector: bank angle zero pointed the lift straight up, providing maximum altitude gain; bank angle 180 degrees pointed it straight down, driving the spacecraft deeper into the atmosphere. Intermediate bank angles allowed precise control of the flight path within the corridor.
The AGC handled this beautifully through its entry guidance program. But bank angle management required accurate accelerometer data, trajectory computation, and control commands—all functions that depended on a working computer. The Entry Monitoring System was the answer to the question: what if the computer isn’t working?
Anatomy of the EMS
The Entry Monitoring System occupied Panel 1 of the Command Module’s main display console, directly in front of the crew. It was a self-contained electromechanical instrument with five key components:
The Scroll: A strip of specially printed chart paper, approximately 18 inches long, wound between two rollers. The chart was pre-printed with two boundary lines—the upper limit and lower limit of the acceptable reentry corridor—along with range-to-go markings. The scroll moved vertically through the display window, driven by an accelerometer that translated the spacecraft’s velocity change into physical motion of the paper.
The Scribing Needle: A stylus that moved horizontally across the scroll, driven by a second accelerometer that measured G-loading. As the spacecraft decelerated, the needle traced a line on the moving scroll. The result was a real-time plot of the vehicle’s reentry trajectory in velocity-vs-G-force space.
The Velocity Counter: A mechanical readout displaying the spacecraft’s current inertial velocity, driven by the same accelerometer that moved the scroll. This started at the entry velocity (approximately 36,194 fps for a lunar return) and counted down as the atmosphere decelerated the vehicle.
The G-meter: A display showing the current deceleration load in Earth G’s. During the high-G phase of reentry, this reading could reach 6 to 7 G’s.
The Corridor Verification Display: A threshold indicator tied to the 0.05G accelerometer reading. When the spacecraft first encountered measurable atmospheric drag (the 0.05G level), the EMS began its timing sequence. If the 0.05G onset occurred at the correct velocity and time, the entry angle was confirmed to be within the corridor.
All of these components were driven by a single, self-contained accelerometer package. The EMS had no connection to the Apollo Guidance Computer whatsoever. It was electrically and mechanically independent—a completely separate system with its own sensors, its own display, and its own logic.
How the Scroll Worked
The genius of the EMS scroll lay in its encoding of a complex, multidimensional navigation problem into a simple, intuitive visual display. The crew didn’t need to understand differential equations or orbital mechanics to use it. They needed to keep a line between two boundaries.
Vertical motion of the scroll represented velocity change. As the spacecraft decelerated, the scroll moved upward through the display window at a rate proportional to the velocity decrease. The pre-printed scale along the edge showed velocity in thousands of feet per second, counting down from entry velocity toward zero.
Horizontal motion of the scribing needle represented G-loading. Higher deceleration pushed the needle further to one side. The pre-printed corridor boundaries on the scroll defined the acceptable envelope: at any given velocity, there was a minimum G-loading (too shallow, risking skip-out) and a maximum G-loading (too steep, risking structural or thermal failure).
The result was a continuously drawn trace on the scroll. If the trace stayed between the printed boundaries, the spacecraft was in the corridor and the crew would survive. If the trace drifted toward the upper boundary, the spacecraft was pulling too many G’s—the crew should decrease bank angle to generate more lift and climb away from the atmosphere. If the trace drifted toward the lower boundary, the spacecraft wasn’t decelerating enough—the crew should increase bank angle to drive deeper into the atmosphere.
The boundaries themselves were computed for each specific mission and printed onto the scroll before flight. They accounted for the particular entry velocity, entry angle, spacecraft weight, lift-to-drag ratio, and target landing point. No two mission scrolls were identical.
Flying a Manual Reentry
The manual reentry procedure using the EMS was practiced extensively in simulators by every Apollo crew, though it was never needed operationally. The procedure began before entry interface—the moment the spacecraft encountered the first detectable traces of atmosphere at approximately 400,000 feet altitude.
The crew would configure the Stabilization and Control System for manual attitude control, verify the EMS was functioning by checking the velocity counter against the AGC’s last known velocity, and orient the spacecraft to the proper entry attitude. The Command Module Pilot, occupying the center couch with the best view of Panel 1, was the primary EMS monitor.
At the 0.05G threshold, the EMS scroll began to move and the needle began to scribe. The crew watched the trace develop on the scroll and compared it against the printed corridor boundaries. Bank angle commands were called out by the CMP based on the trace position: “Increase bank angle”—roll toward lift-down to drive deeper into the atmosphere. “Decrease bank angle”—roll toward lift-up to reduce deceleration and stretch the trajectory.
The high-G phase was the most critical. Deceleration loads peaked at 6 to 7 G’s, and the trace moved rapidly across the scroll. Small bank angle errors at this point propagated quickly. The crew had to respond promptly but smoothly—overcontrolling could oscillate the trajectory between the corridor boundaries.
After the initial high-G pulse, the skip phase began. If the trajectory was nominal, the spacecraft would partially exit the atmosphere, experiencing a brief period of reduced G-loading. The scroll trace would show this as a retreat of the needle back toward the low-G boundary. The crew held their bank angle through this phase, trusting the trace to show whether the skip was developing correctly.
The second dip followed, with lower peak G-loading as the spacecraft had shed much of its velocity during the first pass. The trace wound down through the lower portion of the scroll toward the subsonic regime, where parachute deployment would begin.
The Velocity Counter and Corridor Verification
Beyond the scroll, the EMS velocity counter served as an independent check on the entire entry trajectory. The counter, driven by the same accelerometer that moved the scroll, provided a continuous readout of inertial velocity that the crew could monitor throughout reentry.
Before entry interface, the counter was set manually to the predicted entry velocity. As atmospheric drag decelerated the spacecraft, the counter decremented. The crew could cross-check this value against predicted velocity milestones—at certain times after the 0.05G onset, the velocity should have decreased to specific values. Deviations indicated the trajectory was off-nominal and bank angle corrections were needed.
The corridor verification function provided the earliest possible warning that the entry angle was wrong. The 0.05G level was detected by a sensitive accelerometer threshold circuit. The time at which this threshold was crossed, relative to the predicted time, told the crew whether they were steep, shallow, or nominal. A table in the flight data file gave the crew the expected 0.05G onset time. If the actual onset was early, the entry was steep. If late, it was shallow. If the onset was so late that it fell outside the printed “safe” range, the crew had one final option: an abort maneuver using the RCS thrusters to steepen the entry angle before it was too late.
This abort decision point was perhaps the most sobering aspect of the EMS. The system wasn’t just a guidance tool—it was a go/no-go indicator. If the corridor verification said you were outside the corridor, you had seconds to act, and the action itself—a manual RCS burn without guidance computer support—was the last card in the deck.
The Clockwork Parachute
The Entry Monitoring System embodies a design philosophy that permeated Apollo’s safety architecture: critical backup systems must share no failure modes with the primary system they back up. The AGC and the EMS had no common components, no shared sensors, no interconnected circuits. A power supply failure that killed the AGC would not affect the EMS. A software error that sent the guidance program into an endless loop would leave the EMS needle still scribing its trace, still telling the truth about where the spacecraft actually was in its corridor.
This principle of independence went beyond mere redundancy. Redundant systems that share a common design can share common failure modes. The AGC and EMS didn’t just duplicate each other’s function—they achieved the same goal through completely different means. The AGC used digital computation, integrating accelerometer data over time and comparing results against a stored trajectory model. The EMS used analog measurement, directly translating physical deceleration into mechanical motion of paper and needle. A systematic error in one approach—a programming bug, a calibration drift, an algorithmic flaw—could not propagate to the other.
The EMS was, in essence, a clockwork parachute: a mechanical device that could save your life when all the electronics failed. It asked nothing of the crew beyond the ability to watch a line being drawn and adjust a bank angle to keep that line between two boundaries. In the hierarchy of human skills, this ranked somewhere between reading a thermometer and parking a car. Any pilot who could fly the CM—and they were all exceptional pilots—could fly a manual reentry using the EMS.
No Apollo crew ever had to fly a manual reentry. The AGC performed flawlessly through every mission’s return. But every crew practiced the procedure, every Command Module carried a correctly printed scroll, and every CMP knew that if the screens went dark and the DSKY went blank, there was still a needle, still a scroll, and still a corridor traced in ink that would tell them the only thing they needed to know: are we going to make it?