The CM Recovery System: Three Parachutes Between the Crew and the Ocean
How drogue chutes, pilot chutes, and three massive ring-sail mains slowed the Command Module from 300 mph to 22 mph—and what happened when one of them didn't open
The Command Module hit the top of the atmosphere at roughly 25,000 miles per hour and had to arrive at the ocean surface at roughly 22 miles per hour. The heat shield handled the first phase of that deceleration—converting velocity into thermal energy through ablation and aerodynamic drag, slowing the CM from Mach 36 to about Mach 1 by 80,000 feet altitude. After that, the parachute recovery system took over. Two drogue chutes deployed at 24,000 feet to stabilize and slow the CM. Three pilot chutes deployed at 10,700 feet to pull the three main parachutes from their packed containers. The mains inflated in a staged, reefed sequence, and the Command Module descended the final two miles at about 22 miles per hour, hitting the Pacific Ocean with a force of roughly 8-9 G experienced over a few hundred milliseconds. Three parachutes. Two stages of deployment. One chance to get it right.
The Forward Heat Shield: Getting It Out of the Way
Before any parachutes could deploy, the forward heat shield had to go. The CM’s parachutes were packed in the forward compartment—the space between the crew cabin’s forward bulkhead and the forward (apex) heat shield. This heat shield protected the parachute compartment during reentry, but it also blocked the parachutes from deploying. At approximately 24,000 feet altitude and Mach 0.9, the Earth Landing System (ELS) jettisoned the forward heat shield by firing a mortar that pushed it away from the CM.
The forward heat shield was held in place by a tension tie system—metal straps that connected the shield to the CM structure. Pyrotechnic devices severed the ties, and a thruster pushed the shield clear. The shield had to separate cleanly and move away from the CM without tumbling back into the parachute deployment zone. The thruster and the CM’s aerodynamic flow field ensured the shield departed to the side and fell away below the decelerating spacecraft.
If the forward heat shield failed to jettison, the parachutes couldn’t deploy, and the crew would ride the CM into the ocean at several hundred miles per hour. This single-point failure was mitigated by redundancy in the pyrotechnic system—dual NASA Standard Initiators on every separation device—and by extensive ground testing. The forward heat shield jettisoned successfully on every Apollo mission.
Drogue Chutes: Stabilization at Supersonic Speed
The two drogue chutes deployed immediately after forward heat shield jettison, at approximately 24,000 feet. They were mortar-deployed—small pyrotechnic mortars in the forward compartment fired the packed drogue chutes upward and away from the CM. The mortars were necessary because the CM at this point was in unstable aerodynamic flight—oscillating in pitch and yaw, possibly tumbling—and a simple drag-deployed chute might not have inflated reliably in the turbulent wake behind the blunt-body capsule.
Each drogue chute was a conical ribbon design, approximately 16.5 feet in diameter. The ribbon construction—narrow strips of nylon webbing rather than solid fabric—allowed the drogues to function at near-transonic speeds without being destroyed by the aerodynamic loads. A solid-canopy parachute of that size, deployed at Mach 0.9 and 24,000 feet, would have experienced dynamic pressures that could shred the fabric. The ribbon design let air flow through the gaps between the ribbons, reducing the opening shock and the steady-state drag load to levels the structure could handle.
The drogues served two functions: they stabilized the CM’s attitude, damping the oscillations and tumbling that characterized the capsule’s free-flight aerodynamics, and they slowed the CM from approximately 300 mph to about 175 mph. The CM, flying blunt-end forward, was aerodynamically unstable at subsonic speeds—its center of pressure was behind its center of gravity, creating a natural tendency to diverge from any given attitude. The drogues, by applying drag above and behind the CM, shifted the effective center of pressure and provided the stabilizing force that the CM’s shape couldn’t.
The two drogues provided redundancy—the loss of one drogue was survivable. The remaining single drogue would provide reduced stabilization and reduced deceleration, but the CM would still be in a controlled enough state for main parachute deployment. Both drogues functioned on every Apollo mission.
Pilot Chutes and Main Deployment
At approximately 10,700 feet altitude, the drogue chutes were released and three pilot chutes were mortar-deployed. The pilot chutes were small—roughly 7 feet in diameter—and their sole function was to pull the three main parachutes from their packed containers in the forward compartment. Each pilot chute was attached by a bridal line to one of the three mains. As the pilot chute inflated and generated drag, it extracted the main from its container, stretched the suspension lines, and began the main canopy inflation sequence.
The main parachutes were ring-sail canopies, each 83.5 feet in diameter when fully inflated. They were the largest parachutes used in any American space program up to that time. Each main was made of nylon fabric, with a ring-sail design that incorporated concentric rings of fabric with gaps (sails) between them. Like the ribbon construction of the drogues, the ring-sail design managed the aerodynamic loads during inflation by allowing controlled airflow through the canopy.
Main parachute inflation was staged through a reefing sequence. Each main canopy had reefing lines—cords threaded through rings at the canopy skirt that restricted the canopy’s mouth to a fraction of its full diameter. The mains first inflated to a reefed state, producing a fraction of their full drag, which limited the opening shock to a level the structure and the crew could tolerate. After approximately 10 seconds, pyrotechnic reefing line cutters severed the first-stage reefing lines, allowing the canopies to expand to an intermediate state. After another interval, second-stage reefing line cutters fired, and the canopies inflated fully.
The staged inflation reduced the peak deceleration from what would have been 20+ G (instant full inflation) to approximately 4 G—a significant but tolerable load for the crew, who were strapped into their couches and oriented so that the deceleration pressed them into their seat backs.
Descent Rate and Water Impact
With three mains fully deployed, the Command Module descended at approximately 22 miles per hour (about 32 feet per second). This descent rate was the result of a weight-versus-deceleration trade-off: slower descent meant larger (heavier) parachutes; faster descent meant higher impact loads on the crew and structure. The 22 mph figure was chosen as the maximum descent rate that the crew could tolerate at water impact without injury, given the CM’s impact attenuation system.
The impact attenuation system consisted of crushable ribs in the crew couches—honeycomb aluminum struts beneath each couch that compressed on impact, absorbing energy and reducing the peak G load experienced by the crew. The couches were also designed to stroke downward on rails during impact, further extending the deceleration distance and time. The combined effect of the crushable ribs and stroking couches reduced the water impact load from approximately 15 G (rigid structure) to about 8-9 G (attenuated).
The CM’s orientation at water impact mattered. The capsule hung beneath the parachutes at an angle—not perfectly vertical, but canted so that the aft heat shield hit the water at a slight angle, creating a scooping effect that spread the impact over a slightly longer time. The CM’s center of gravity was offset to produce this hang angle, and the parachute riser attachment points were positioned to maintain it.
Two-Chute Contingency: Apollo 15
On Apollo 15, one of the three main parachutes failed to inflate properly. During the final descent, one canopy collapsed—video from the recovery helicopters showed two fully inflated mains and one deflated, streaming canopy. The cause was determined to be a reaction control system propellant dump that occurred during the descent. The RCS propellant, vented from the CM’s thrusters, drifted into the airspace near one of the parachute canopies. The hypergolic propellant’s corrosive vapor likely damaged the nylon fabric or the suspension lines, causing the canopy to fail.
The CM was designed to survive on two mains. The descent rate increased from 22 mph to approximately 25 mph—about a 13% increase. The water impact was harder, and the crew experienced higher G loads, but the impact attenuation system handled the increased energy. The crew was uninjured.
The two-chute design margin was not accidental. The recovery system was designed from the beginning to be survivable on two of three mains, just as the CM RCS was designed to be survivable on one of two independent systems. This redundancy philosophy—sized for N, survivable on N-1—ran through every Apollo system. The Apollo 15 parachute failure was the only in-flight failure of the main parachute system across the entire program, and the designed-in redundancy ensured it remained a non-event for crew safety.
Uprighting System: Stable Two
After water impact, the CM could end up in one of two orientations: Stable 1 (apex up, heat shield in the water—the preferred orientation) or Stable 2 (apex down, heat shield up—inverted). Both were stable floating attitudes, but Stable 2 left the crew hanging upside down in their harnesses with the side hatch underwater, making recovery helicopter operations difficult and crew egress hazardous.
The CM carried an uprighting system—three inflatable bags stored in the forward compartment near the parachute containers. If the CM landed in Stable 2, the crew activated the uprighting system, which inflated the bags using a compressed gas supply. The bags, mounted around the CM’s apex, provided buoyancy that rotated the capsule from the inverted position to Stable 1. The inflation took a couple of minutes, during which the crew waited upside down for the capsule to slowly roll upright.
The CM’s tendency to land in Stable 2 was related to the sea state—calm water generally produced Stable 1 landings, while rough seas with waves catching the capsule during impact could flip it to Stable 2. Approximately half of the Apollo missions experienced Stable 2 landings initially, and the uprighting system functioned correctly every time.
From 25,000 Miles Per Hour to Zero
The Earth Landing System was the last system that operated on every Apollo mission—the final mechanism between the crew and survival. Everything upstream had to work first: the heat shield had to survive reentry, the CM RCS had to maintain the correct bank angle, the guidance had to hit the entry corridor. But after all of that, the crew’s lives depended on a sequence of pyrotechnic mortars, nylon fabric, reefing line cutters, and the simple physics of aerodynamic drag.
The system was entirely mechanical and pyrotechnic after the ELS was armed. No computer controlled the deployment sequence during the final phase—barometric switches sensed altitude and triggered the events at the correct heights. The forward heat shield jettisoned at 24,000 feet. Drogues deployed immediately after. Drogues released and mains deployed at 10,700 feet. The sequence was simple, deterministic, and driven by atmospheric pressure rather than software.
Fourteen manned Apollo missions ended with the Earth Landing System deploying over the Pacific (or, for Apollo 7, the Atlantic). Forty-two main parachute canopies inflated—forty-one of them fully. One failed, and the system handled it. Three parachutes, each 83.5 feet across, blooming in sequence above a charred capsule carrying three men home from the Moon, slowing them from the speed of a freeway on-ramp to the speed of a brisk jog. The last and simplest technology in the most complex engineering program ever attempted.