do not select P01 during flight

Margaret Hamilton’s first fix for the P01 bug was a line in the documentation. The documentation failed twice, and the code held both times.

Margaret Hamilton died on 30 September. She was 90. MIT announced it a week later, and the obituaries all lead the same way: the woman whose software landed Apollo 11, the 1202 alarm, the Presidential Medal of Freedom, the Lego minifigure.

All true. I want to start with the four-year-old.

the note

Hamilton used to bring her daughter Lauren to the MIT Instrumentation Laboratory on nights and weekends. While her mother ran simulations, Lauren went exploring on the DSKY — the keypad astronauts used to talk to the guidance computer — and pressed keys in what Draper’s account calls an “off nominal” manner. She selected P01, the pre-launch program, in the middle of a simulated flight. The simulation crashed. P01 wipes the navigation data.

Hamilton’s question was the obvious one, and Draper preserves it: what if P01 were inadvertently selected by a real astronaut during midcourse in a real mission? She proposed a software change to stop it.

She was overruled. The reasoning, as MIT’s obituary gives it, was that highly trained astronauts were never going to make that mistake. What shipped instead was a program note:

do not select P01 during flight

Then came Apollo 8, in December 1968. Jim Lovell selected P01 during flight. The navigation data went. Hamilton’s team worked out how to get it back, the crew re-uploaded it, and afterwards her change went into the software.

two places to put a bug

Every known failure in a system ends up in one of two places. You fix it in the code, or you write it down.

Writing it down is cheaper. It costs a sentence instead of code, testing time and a schedule argument. That isn’t a stupid trade, and the people who made it weren’t stupid.

But a warning in the documentation is not a fix. It is a decision about whose fault the failure will be, made in advance. A program note is a bug that has been assigned to the user. The note doesn’t make P01 harder to select. It only makes sure that when someone selects it, the report will say operator error.

Hamilton’s proposal moved the bug back. If the machine lets you do the catastrophic thing, the machine is responsible for the catastrophic thing.

the checklist

The famous part comes seven months later.

Five minutes into the Apollo 11 powered descent, the PROG light came on and Aldrin read out 1202 — executive overflow, the computer running out of places to put work. Don Eyles, who programmed the descent guidance, was in the MIT back room. He wrote twenty years later that his mind screamed for an abort. Houston said press on. Four more alarms followed.

What Eyles and the others knew was that each alarm meant the computer was flushing its entire schedule and rebuilding it, keeping the jobs that mattered and dropping the rest. MIT’s obituary credits Hamilton’s team with that priority-driven design. Some guidance commands were lost at every restart. Enough got through.

Nobody in the room knew what was stealing the time. A hardware specialist, George Silver, worked it out that evening: the rendezvous radar, unused during landing, could still be wired to the computer and taking up to 15 percent of its cycles. The next day it was confirmed. The radar switch in the cockpit was in the auto-track position.

Eyles’ verdict, from the same account: the real malfunction was in the checklist — the manual that set the switch positions for landing.

Put the two missions side by side. On Apollo 8 the manual said don’t, and a person did. On Apollo 11 the manual itself was wrong. Both times the documentation was the component that failed, and both times the code was the component that held.

And the second time is the stronger case. The P01 fix handles one error that someone thought of in advance. The restart logic handled an error nobody had imagined, and it did it without needing to know what the error was. It didn’t diagnose the radar. It assumed something would go wrong someday and decided ahead of time what to keep.

crooked timber

Kant has a line in his 1784 essay on universal history. He is talking about political order, about why a just constitution is the hardest of all problems. His answer is that humanity is crooked timber, and nothing entirely straight can be built out of it.

NASA’s position in 1968 was that astronauts were the exception: the straightest timber the species had, trained until error was not a live possibility. Hamilton’s position was Kant’s. Not cynicism about the crew. A design premise. You build for the material you have, and the material makes mistakes.

That’s the distinction that matters. “Never going to make that mistake” is a claim about people. “If it can be selected, it will be” is a claim about systems. The first one is flattering, and it is the one that fails.

what the name was for

Hamilton is the person who named the field. In her account she started saying “software engineering” to give the work legitimacy, to set it beside hardware and the other engineering disciplines, and when she first used it people found it quite amusing.

The name won completely. What it means now is mostly process: titles, ladders, ceremonies, methods with capital letters. Put her definition next to the P01 story and it reads differently. The term was coined during an argument about who carries the blame when a well-trained operator does a predictable wrong thing. It was a liability rule before it was a methodology. Engineering, in her sense, is the moment the system stops pointing at the manual.

The program note never went away. It lives in every README that says do not run this against production, every config file that says change this only if you know what you’re doing, every wiki page with a red box at the top. Each one is P01 with a sentence in front of it.

Jim Lovell was about as well trained as a human being has ever been for anything.

He selected P01.

Sources: Margaret Hamilton, computing pioneer who led software development for the Apollo program, dies at 90, MIT News ↗ · Margaret Hamilton, We Hack the Moon (Draper) ↗ · Landing Apollo via Cambridge, Don Eyles, MIT News ↗ · Immanuel Kant, Idea for a Universal History from a Cosmopolitan Point of View (1784), marxists.org ↗