The Charming Genius of the Apollo Guidance Computer

so that the lights actually dimmed a little bit if we could bring those down yeah more please they're going to be diagrams and folks are going to miss out brilliant okay so my talk is the charming genius of the Apollo guidance computer and I am led to understand that there is a prohibition against swearing and I just want to point out that my shirt says ass Buzz Aldrin runs a foundation second man on the moon that helps people get into stem and everyone can go by this t-shirt get your ass to Mars so charming geniuses the Apollo guidance computer this is the earth this is our planet this is where all of us are presently there are no people that are alive that are not on this planet this is the moon there are no people that are currently alive that are on the moon right now however we still have some of the people to touch the moon still living the moon is about 400,000 kilometers distant so if you're going to go from the earth to the moon you have a bit of a trip it's about two days we could probably do it a little faster if we had a bigger rocket but bigger Rockets have a tendency to blow up speaking of big Rockets so we're talking about the Apollo spacecraft what we're not really talking about is the Saturn five the Saturn five is the lift system for the Apollo spacecraft it's a three-stage rocket here you see Apollo 11 this will be the first experimental mission to land on the moon I say experimental because they only walked around for about five hours and then left Apollo 12 was really the real deal for in terms of we've gone to the moon mount now let's do something Stage one is separating stage one burns kerosene because we didn't know how to build a big rocket that burned liquid oxygen everything else liquid oxygen hydrogen everything else burns LOX and hydrogen's so Saturn 5 goes up drops all of its stages and then once they've finally achieved orbit once they've finally gotten around the earth there's only a single stage of the Saturn 5 that's left and it's stage 3 its primary job is to kick you out to the moon but before they do that all through the Apollo flight they do these system checks the astronauts are responsible for asserting that the spacecraft won't kill them the way because the Apollo craft we designed it in such a way that if the line of fatal is here the Apollo craft is just shy of fatal because we were in a rush to get to the moon before the Soviets did so they make a couple of passes around the earth they check out that everything is okay and then the final stage boosts Apollo into a free return orbit so are any of you orbital dynamicists one person okay okay so free return orbit I will explain this so there is a burn that is made on the far side of the Earth from the moon that's called the translunar injection and it's the last thing that the saturn v list system does it's the last thing before you have the apollo spacecraft so the way a translunar injection works is you start raising the orbit so you you extend your orbit from where it is in kind of a little bit of an ellipse and you increase this ellipse until that ellipse gets you closer and closer to the gravitational body gravitational well that you want to fall into and then you have capture so this is called a free return orbit and it's called a free return orbit because you get a free return if in fact your spacecraft pops an oxygen tank and you have to come back you swing around the moon which happened in Apollo 13 and then you come back to the earth and you land or you crash through the atmosphere which is what we actually do the interesting thing about this particular orbit is it was considered too difficult to do so what we were originally going to do was build a really big rocket and the Saturn 5 is so big that if you don't put the right type of concrete into the blast furnace the concrete will melt and then catch fire just from the sound waves not actually from the flame itself we were going to build a bigger rocket and then we were going to go straight to the moon so it would be a ballistic arc that takes you straight to the moon now the problem is if anything goes wrong in that trip you are dead you just land on the moon dead or crash into the moon it's really easy to get through a planetary body it's very difficult to land on a planetary body the main distinguishing thing that allowed us to do this sort of free return orbit it's called the lunar orbit rendezvous was the idea that we could integrate a computer into the spacecraft the idea that you can have these complicated astrodynamics ships or in the spacecraft's path that is moderated by a computer but we'll sort of get to that so the Apollo spacecraft is interesting so you see here on the bottom the third stage and there are two components to the Apollo spacecraft one is the command module that's where the astronauts write up their the couches it's where the the primary functioning of the craft happens then you have the service module and that's the the cylinder that sits below the command module so command module service module now the lunar module the thing that actually lands people on the moon sits in the top of the third stage so once the third stage is spent on the way to the moon they pull the service module out they flip it around and then they dock the service module the lunar module and then they back it up and the third stage shifts itself a little bit in the orbit crashes itself into the moon and then you have the assault the Apollo spacecraft it is the only non Lert low-earth orbit orbit spacecraft that is man that has ever been created by humanity so you see on the far left side that is the command module the service module and then on the far right hand side these are my directions that is the lunar module the lunar module is basically an aluminum balloon it's real thin so space travel is a tricky business so in the Apollo craft you know if you have a solar flare you're just cooked you are dead there's there's no way to stop that if a micrometeoroid your spacecraft you are dead there's no stop that so spacecraft is very terrifying because things go wrong very quickly but for this talk because we're talking about the computer what we're really concerned about our orbital paths and orbital paths are this narrow balance of accelerations so if you have a human that's trying to make these complex orbit ships and they fire five seconds too long or too short bad things can happen so you know if you fire too little you miss your goal you don't quite get to the moon it's not so bad because you swing back around if you fire too long you also miss your goal and this is bad because now you're orbiting the Sun and you either want to orbit the Earth or the moon and not ever the Sun so the guidance control system of a spacecraft must answer three questions it's very important that it's capable of answering these questions which ways up which is a weird question to ask in space so we just kind of made an arbitrary frame of reference we took a couple of stars and we said that one's down and that one's up so that's the universal coordinate system and through the through the trip to the moon we actually have reference ships so if you're in Earth orbit we say that North is Z and then as soon as you leave Earth orbit we say that Polaris is Z and so on but there isn't up where am I so you kind of have to know that you're actually in a spot and then where am I going so you have to know where your position is shifting and if you can't ask answer any one of these questions you will die so Apollo because you have to be able to answer these questions has triply redundant means to answer these questions so the first is the most interesting to me it's called the Deep Space Network it's basically giant radar dishes scattered all over the planet that bounce telemetry off the spacecraft and it's able to because of the relativistic differences between the the time sink of the radar be able to translate the position of the spacecraft extremely accurately we not have the Second World War in developing radar we wouldn't be able to do this interestingly enough this was the only means that the Soviets had to determine their spacecrafts position because the Soviet cosmonauts were really just people along for a ride it was a fully automatic system so it's a global network of long-range radar stations and I don't know if you've ever seen one of these but they're gigantic you can actually use them for radio telescopic and in the 60s which is when we're talking about they're just sort of scattered right now what we do is we have we've extended the Deep Space Network and we have put things outside of the orbit of the moon nothing had ever been outside of the orbit of the moon so you have no ability to use that sort of thing in the Apollo craft the interesting thing here is you can go behind the moon you lose contact so if you ever watch say Apollo 13 or something like that there's the dramatic moment where they've lost radio contact because they've gone behind the far side of the moon so the Apollo spacecraft on the service module as a high gain antenna so this antenna is what the Deep Space Network is using to communicate back and forth with the spacecraft and in particular it does one thing that is interesting to us it updates what's called the state vector so the state vector is is really just a vector of positions and accelerations and so the ground will periodically send to the spacecraft the update for its state vector and say you are right here so that's one method so the other method is very interesting to me because it's so old it's celestial navigation so if any of you have never used an astrolabe or you've never walked outside with a sextant I highly recommend that you do that it's fascinating to be able to determine your position by just taking the angle of a couple of stars so the Apollo spacecraft actually has all of the equipment that you need to do celestial navigation it has a telescope it's not really much of a telescope it's actually 1x magnification telescope so it's really just a window and it has a sextant so the question becomes if you're in space how do you cite you know if if you're using a sextant to the planet you have a very convenient horizon but there is no horizon in space for you to be able to sight off of so they have mission x star charts this actually landed on the moon it's from the lunar module each of these little dots represents a star of a certain brightness and so the responsibility of the navigator there actually was a navigator was to go to the instrument panel and then align the sextant with the well-known stars and then press a button and that button would update the angle of that star and then from that angle compute the state vector so now you have the state vector being updated in two ways two independent ways so one fails if a meteor happens to snap off the high-gain antenna you don't have to abandon the mission or you don't die so this is the command module down here at the bottom or where the couches are that's where the astronauts sit when they ride up then they fold the couches back and then they have a place to work in space and you can see on the far left hand side what it calls the optics assembly that's the sextant and that's the telescope / window it's not just a window because you can actually fold this thing up so the Navigator just sort of floats up grabs ahold of it sites and that's where celestial navigation happens so the last method if all of these fail there's still one more method that the Apollo spacecraft has to be able to tell where it is to be able to update a state vector and that's with dead reckoning so dead reckoning is is interesting that missile that's being launched is the polaris rocket so actually the polaris weapon it's a submarine-launched nuclear weapon launching a nuclear weapon from a submarine is an interesting challenge because submarines move around so you have to be able to continually tell the the missile where it's going to start from and then the missile has to be able to guide itself to destroying people it does this using internal guidance and I meant I mentioned the Polaris because it was built by the MIT instrument or YZ which also built the Apollo guidance computer and they used the same methodology that they did for Polaris as they did for the Apollo guidance so inertial guidance is interesting this is basically a top but it's an extremely sophisticated table so what this is is three interlocking gimble's they're called spinning all the time and when your spacecraft has any sort of change in acceleration say fuel is sloshing or person kicks off a wall this these gimble's get deflected slightly and that deflection causes don't like causes an electrical pulse of a certain magnitude and that magnitude of that pulse then tells the system on the far side which is going to be the computer which will talk about how far the craft is deflected so if you know how far you've deflected you can now update your state vector using dead reckoning the gimbals are limited in terms of accuracy over the course of a month they'll go completely out of whack but it doesn't matter because the spacecraft only needs to be in space for two weeks and they can realign them by using the sextant they can realign it to the global reference frame so there are three gimble's in this and if any of you know anything about say fighter planes they also use dead reckoning but they have four gimbals and they have four gimble's because you if you happen to have gimbals that come into alignment if you make a move so that the X and the y axis gimbals come in to the same plane you've now lost the ability to distinguish between x and y movement so that's called gimbal lock but they only have three to save weight because the Apollo spacecraft is very very weight conscious and you save about 50 pounds if you cut out a single gimbal the challenge here is that you have gimbal lock now so this is the the nav ball is what they called it it tells the pilot of the craft what their orientation is relative to the standard reference frame that they're operating in and at the very top they had a big red circle and that red circle is gimbal lock so if you hit that you've now lost the ability for the spacecraft to update on its own its position and then you have to realign the thing and it takes a an hour and a half so they've they avoid it as much as they can Apollo 11 gimbal locked Apollo 13 gimbal locked Apollo 16 gimbal locked so the person that designed the inertial guidance unit deeply deeply regretted saving 50 pounds it ended up not being worth it so that's where the dead reckoning happens so the command module is relatively small it sits exactly below or off to the side depending on how you're orienting yourself the below the celestial navigation so the Apollo guidance computer is responsible for integrating all of these things you know this is a very complex spacecraft it is possible to fly manually the astronauts can do it but they can do nothing else and they're likely to screw it up so we really wanted to have science missions but if you make a completely manual spacecraft you have no scientists you also have the potential for catastrophic accident so the standard engineering philosophy of the United States at the time of building the Apollo spacecraft was if a human could do it the machine should not do it but the machine should relieve tedium so the machine should do things that a human could not do the machine could determine that an RCS jet which changes attitude and what not was not firing and could then adjust now a human can technically do that but it takes about 30 minutes and the guy staring out of the window going hey boss that jet isn't firing but the computer can tell that immediately however landing on the moon is a job for a human because even though a computer can do it it is something that a human can do and should do so that that's kind of the standard philosophy the machine should not take over from the human the human is supreme but the Apollo guidance computer is tasked with integrating all of these extremely complex systems and you can see sort of a diagram and this is a simplified diagram of what the Apollo guidance computer does in the middle you have the guidance computer reaction control jets all of that stuff the very interesting thing is the Apollo guidance computer is not just an integrator it's also a fly-by-wire control system so fly-by-wire just means that you don't actually fly the spacecraft manually what you're doing is you're flying an idealized model inside of the computer and then the computer makes up the difference for you so every time the pilot puts his hand on the stick he's not flying the spacecraft directly he is having his commands moderated by the machine it also manages all the analog and digital displays so these are the displays the astronauts see and it's a hugely complicated thing these are all switches toggles even though the entire spacecraft is digital there are analog displays because of human limitations we actually do very well if we see some things as changing dials versus just seeing them as numbers that get spread across so the Apollo guidance computer was originally designed in 1961 and it does all of these very complicated things with just five interrupts it has a one megahertz clock it has 16-bit words one one parity bit and fifteen data bits it has 248 words I didn't drop a k' 248 words of RAM it has 36 K words of ROM and 17 registers it weighs 70 pounds it's one meter cubed and it draws 55 watts which is basically what a modern laptop draws now when I said it was 70 pounds there was a little bit of laughter and that sounds like a really heavy computer but this was the state of the art at the time this is the real-time computing complex which sat in the basement of Houston this is what the the Deep Space Network used to do all of its computation this computer takes up two floors it draws a half a gigawatt of electricity it's waste heat requires a refrigeration system and it's easily several thousand tons worth of computing equipment equivalent machines questions after so the AGC is a digital computer and there have been other computers this is ENIAC this is not the first digital computer the main advance that you see in the Apollo guidance computer is that it's made out of integrated circuits so this is a flat-pack circuit it doesn't look like an integrated circuit that we would see now because we use a slightly different technology but integrated circuits were brand-spanking-new they were so new in fact that NASA had to figure out how to do quality control on integrated circuits my favorite test that they did was they would take the batches of integrated circuits they would weigh them very precisely before and they would dunk them into liquid zeon and they would leave them there overnight and they would pull the chips out and if the tips were slightly heavier they would reject the entire batch because Zeon had leaked into the chips the Apollo guidance computer uses core rope memory so core rope memory is you have a magnetic doughnut and then you have a piece of wire that either goes inside of it or outside of it if it's outside it's a zero if it's inside it's a one so that's where the ROM is and it's wrong because somebody has to so this somebody has to sit down at a loom and so this so these are the star charts these are the programs these are the other bits of data that can't be overwritten so the interesting thing when the programmers would program they would take their AGC assembly language and they would hand compile it into zeros and ones and then they would take a stack of zeros and ones to a loom operator who would then weave this into the computer so this is the Apollo guidance computer and this is the Apollo guidance computer on the far right hand side it's a shoebox basically and then what you see next to it is called the disc II and the Apollo guidance computer is also interesting because it's one of the first interactive computers so before this you would take a shoebox full of paper tape and you would sort of feed it into the machine then he would come back there was no sense that you could have this interaction that a human could have an interaction with a machine we just sort of unheard of people have been sort of playing around with that idea but only in their minds and the Apollo guidance computer was one of the first one designed to be interactive and you did this through the display keyboard or they shortened it to disc II so the disc is is is quite interesting because it is the first example of a user interface for human for a computer it's also the first example of a human interface for human in a spacesuit so it's hard to show you the scale here but each one of these buttons are about this big because you have a big sausage finger that you got to push so the disky allows the agc to give fast updates to the astronauts so you can kind of see and I'll zoom in a little bit but you can kind of see a whole block of numbers here that don't make any sense because we're not trained to use the disky this updates and the the dis key makes a really wonderful sound it's built out of micro relays so whenever it changes the numbers it makes one of those wonderful old sounds that you see in ferry buildings and train stations but it's able to change relatively rapidly rapidly so if an astronaut calls up a program that says what's our attitude change based on this firing the computer is able to say what the drift of the attitude changes it also allows the astronaut to run select programs so to zoom in a little bit you can see on the top right hand side prog stands for program or master program and then you see verb and noun so verb is the command that you are giving to the Machine and the noun is the information that you are giving to it or the prompt to ask you for more information and then up at the top is the active program so this is a dis key that is waiting to take off it it is sitting on the pad program 0 of 0 is I'm waiting for the Saturn 5 to give me info you can see also on the far right hand side that there are some more indicator lights and the one that I want to call attention to right now is gimbal lock so the computer before you would get into gimbal lock would start furiously beeping this thing at you like watch out you're going to hit gimbal lock and the other one is uplink activity so that's right there uplink means that NASA that ground control is sending you information through the deep space network and you would see this blip every so often it's just that the astronauts know what's going on and the question is what does the computer actually doing back there so the astronauts are trained not in computing Gus Grissom who sadly died in Apollo 1 was one of the first astronauts to be trained in the computer and the the poor schlub from the MIT instrumentation laboratory came to explain it and he started giving a breakdown of hardware and he started explaining how the hardware worked and then Gus Grissom stood up and he said goddamnit I don't need to know how to run a computer I just need to know how to operate it so the ADC is is primarily predicated on interrupts and is predicated on six interrupts so this is the view of what the AGC is doing within one second so the AGC is a relatively slow computer so we can actually visualize it on second Interpol's instead of one one thousandth of a second so the first two interrupts are mission time so they're flipped the words are flipped time one has a period of one or it has a period of ten milliseconds so every 10 milliseconds you have a clock tick and that clock tick overflows its 15 bits every 164 seconds and that flips over into the high word so this runs out after 3 months but it doesn't matter because you're not going to be in space for 3 months but this is how when you know the clock starts running this is how you keep track of time so there is only one clock and it is kept by the AGC so time 3 is the waitlist so the wait list will get into a little bit more but it is the fundamental lowest level for the tasks that need to be run by the system the wait list is also on a 10 millisecond interval t4 RuPt is polling every it's interrupting every 20 milliseconds and it runs for a little while t4 RuPt is interesting because it is the thing that is waiting for astronaut input so it's basically what runs the disky so they had to give it its own specific interrupt and they didn't want to originally but they had to give its own specific interrupts because they found that astronauts were getting impatient because the computer was doing other things and they're very slow humans are very slow but the astronauts wanted immediate response so the human gets their own interrupts the digital autopilot also kicks on very quickly every 20 milliseconds and the digital autopilot is the thing that keeps the attitude of the ship while you're traveling and it kicks on and it is the highest priority tasks in the system and it runs anywhere from between you know 10 milliseconds to 120 milliseconds which is an outrageous amount of time and then the fine-scale clock and this is actually a sub millisecond clock in the Machine and it's programmable by the digital autopilot so the digital autopilot kicks on every 20 milliseconds which is an eternity if you are firing a rocket engine so what they do is they have something that a sub millisecond so that the digital autopilot can say I have a job and it needs to update every millisecond and that's how they do rocket fires so time three time four and time six are programmable so jobs that are running in this computer can take these interrupts and say I need them to fire at a certain rate or I need them to fire now or schedule in a general manner so nowadays we would call the AGC a priority scheduled real-time embedded computer which is a bit of a jargon thing to get your word around but we actually had have words for these things now at the time they had none of these words and we'll sort of see that priority scheduling was actually invented for the AGC before this all you had was round-robin time batching so you would say each job has ten milliseconds god bless you and then go round and round and round and round so it was a controversial to actually have the AGC do priority scheduling because it had never been done and how laning is the the MIT instrumentation laboratory employee that suggested it at the time I believe she was a graduate student so people really weren't having that but the Charles Draper just said well he's very smart and he says it so it goes now we don't think anything of priority scheduler but this was outrageous so there are two tables that exist for jobs in the Apollo guidance computer and the lowest level one is the wait list which we've sort of talked about and by convention and there's nothing to enforce this but it is mandatory each of these jobs has less than 4 milliseconds of execution so because the clock is so slow in AGC this is actually about a hundred and twenty instructions that each one of these jobs are allowed to run before they must stop it has a nine task limit so in the wait list the computer can only do nine things if you try to get it to do more than those nine things it will fail the wait list is nice because it's not programmable it's baked into the core rope memory so you can verify before you fly the thing that will only try to do nine things it has very basic instructions so the AGC is a very primitive computer it would had a primitive instruction set even for the time and there's no rescheduling so if a job needs to if a job on the wait list decides that it needs to be rescheduled in a slightly later date it can't do that so each one of these things have to run on a fixed interval and it has no executive we haven't talked about the executive so what is the executive the AGC software provides two operating abstractions so the wait list is the lowest level it's terrible it's tedious and you can't work that way so in software they built things to make their job easier they didn't call in an operating system because operating systems hadn't gotten to the MIT instrumentation laboratory yet they didn't know they existed so the executive has low level routines we would now call them functions but they called them routines at the time they're very low level they're take a bit of memory fiddled with it a little bit and then store it in another bit of memory but it saves time because you can repeat these things it does system restarts so the executive is responsible for running jobs and if it notices that the job is taking too much time or if it notices that the job has failed it will reboot the computer or it will reboot the job depending it has supervision so it's capable of telling that a job has failed in a bad state and then restart it later so if a job is failed in a bad state but scheduled itself to run in another 120 milliseconds that can't be allowed because it probably didn't do the the right thing and it keeps the core set so the core set is another one of the priority scheduling task queues and it's limited to 12 and the interesting thing about the core set versus the wait list is that the core set is programmable so at runtime the software that's inside of the AGC can add more and more things to this core set now there's nothing to stop the core set from filling up you've only got 12 and by convention you should never go past 11 but there's no invariant in the system to mandate this because the system does not have spare resources to do this sort of thing and you see that all throughout the Apollo guidance computer most invariant guarantees are left to analysis and testing so the way they would test is they would simulate this on a Honeywell mainframe and then have an astronaut sit in a mock-up of the Apollo of the Apollo spacecraft and then fly the thing and if it killed them in simulation they went back to the drawing board so the core set is priority order this is where priority scheduling comes in so each one of these jobs has a metadata tag of 7 bits and it tells you the priority the relative priority of these things so the AGC when it gets interrupted periodically by t4 RuPt will go through and it will pick the job of the highest priority and it will run it for 20 milliseconds and if this is not enough time too bad so the 20 milliseconds interrupt happens and then you have the option to use the interpreter so the executive is very low level you have very basic instructions to what is the interpreter so the native instructions from the AGC they don't give you that much you can you can add you can subtract you can divide and you can fiddle with memory which is great if you're doing accounting but it's terrible if you're trying to figure out rendezvous accelerations so also the AGC word size for data is 15 bits and that's insufficient accuracy for face for spaceflight so when they designed this thing they thought it's approximate it'll be enough and they realized after the fact that it wasn't enough so they built the interpreter and the interpreter gives you high-level routines so you have instead of you know having to manually do cross products there is a function to do cross products for you which at the time was revolutionary especially on such a very tiny computer it has a rich instruction set so not only do you call out to a function to do a cross product you can have a pseudo instruction that does that for you the interpreter itself is a routine in the executive that takes what we would now call a string and that string is just a list of interpreter instructions because we're just working with assembler here that was also new in the Apollo guidance computer it has extra wide words so it has 32 data bits to represent which is insufficient accuracy to get anywhere past the moon but you only need to get to the moon and it's radically simpler programming so you have higher level which we would can still consider to be very low level but you have higher level constructions now so you have a you have an Apollo spacecraft and it's in a free return orbit it's going to whip around the moon so you have to do what's called capture breaking so you flip yourself around and you fire opposite to your acceleration to slow yourself and this has to be done by the computer and it has to be done by the computer because the computer has to calculate what's happening to the orbit of the spacecraft while this is happening so capture breaking you fire opposite to your acceleration and then eventually you achieve lunar orbit so up to this point loss of the command module computer hasn't been abort worthy so the lunar module separates right so there have to be two computers because there is no such thing as a remote network at this point you have radar that can sort of beam you five bits but not a remote network so there are two computers one is in the lunar module one is in the command module and you can technically lose the command module computer and they will attempt the mission it's a different matter for the lunar module so in lunar orbit the lunar module separates from the command module and the command module pushes itself into a slightly higher orbit because the command module has a lot of fuel the lunar module is a an aluminum balloon with just enough fuel to not kill you so the lunar module computer is absolutely essential to the control landing on the moon the at no point does the astronaut manually fly the lunar module it's all fly-by-wire so at the top of the orbit once they've separated from the service module program 63 fires the the LM engines so again they're breaking by firing engine against their acceleration and program 63 an astronaut punches that in hits prog for progress and then that fires and then they start to descend so this is what's called the high gate if you ever read any more any more about the Apollo project of interest the routines in the Apollo guidance computer has names the name for this routine was burned baby apollo 11's corset overflowed here so as soon as they did this the Apollo 11 computer tried to schedule more tasks than 12 this caused computer restarts so it caused the computer to crash and then bring itself back up it turns out so we've sort of blamed Buzz Aldrin for a long time that it was his fault for leaving a radar on but it turns out we can now actually accurately simulate the Apollo craft in a computer and then make it run the run the AGC it turns out that no matter what Buzz Aldrin did that still would have happened there were two cables that ran side by side and they happen to be phased slightly wrong so that when a signal went through one cable that caused an alternate signal in the other and one of those cables happen to be the radar rendezvous cable so the computer continually saw updates from the radar that was not that the radar wasn't actually sending because the radar wasn't close enough to the moon and at eight of 80 percent of the computers processing time just dealing with those errant signals now if the Apollo guidance computer had been round-robin the Apollo 11 lunar module would have crashed into the Loom into the moon but as it happened because it was all priority scheduled the computer was able to take all of those interrupts and schedule the most important tasks which at this point were programmed 63 because you needed to have controlled descent so priority scheduling if it had not been invented for the AGC we would have lost the astronauts so eventually they leave the high gate and they enter what's called the low gate they're within 5,000 meters of lunar service and they run program 64 and I say they because the astronauts call this up the astronauts are in control and the program 64 pitches the spacecraft so that now the astronaut the the pilot can see out of the window before they were pitched on their back and looking up into space so this is a waste of fuel if you were going to automatically land you would never do this but because we want the astronauts to be able to be in control the spacecraft we give them the ability to look out of the window all the lunar modules that ever flew had a potentially fatal bug and this is my favorite bug in the Apollo guidance computer spacecraft it turns out the radar is designed so that it detects that it's landed from a certain signal if you happen to fly over a crater that is shaped in a certain way it will send it will cause the radar to erroneously detect that it is landed and the Apollo guidance computer has no way to check that the radar is correct it just assumes that it's correct when the radar sends the signal it says that we've landed it shuts the engines off so had they flown over three craters that exist on the moon that would cause this bug there are only three of them have they flown over one of these they would have shut off the radar and then they would have died actually they would have aborted because they were high enough but they might have tried to recover and then they would have died so the last program is programmed 60-66 and it steadies the thrust vector so standing the thrust vector is kind of a jargony way of saying it allows the astronaut to control the rate of descent so in Apollo 11 Neil Armstrong you know has to change where they're going to land and he does this while they're doing program 66 so they are still descending at a rate that the astronaut is controlling so they're descending at say 10 meters a second and then you want to descend slower and slower and slower so you eventually touched the lunar surface so if any of you played with industrial control this is a pin controller my second favorite bug in the apollo guy in the Apollo guidance computer has to do with this pin controller so if you've ever worked with pin controllers you know they can be erratic if you feed the wrong signals in so the stabilization of the engine is is done by a pig but it's erratic so it's just barely stable so Apollo 11 12 13 and 14 had an engine thrust that was almost not quite stable so they almost flipped over on their side and crashed but they didn't we landed on the moon the only one that we missed out on was Apollo 13 and that was the fault of the service module because an oxygen tank burst so the the AGC is interesting but why study it you know the sort of question comes up who cares I mean it's interesting but why study it and sort of the easiest answer is it's because the AGC was barely possible so that device you see behind there is five tons it is the instrumentation unit for the Saturn 5 it's what controls the Saturn's five flight it's tall enough that I can stand inside of it and reach up and still not quite hit the top it was so heavy that they turned the computer for the Saturn 5 into a structural element that computer has basically the same capability as the Apollo guidance computer so if you compare something with five tons versus something that is 70 pounds whew believes the Apollo guidance computer could ever be dependable we had very little experience with fly-by-wire systems so this is the x-15 it is a rocket plane it goes to space on the ass end of it is a rocket engine it is the first craft to ever be flown fly-by-wire so it is the first spacecraft and Neil Armstrong actually did the first flight doing this where you flew an idealized spacecraft because it turns out when you're re-entering the atmosphere and a craft like this it's very easy to skip off the atmosphere the x-15 when flown under totally manual control would bounce off the atmosphere or several times and then descend back down because it didn't have escape velocity you believed it could ever be dependable some of the research experience in the x-15 suggested that it could be and it was the Apollo guidance computer never caused a craft loss it never caused an abort so how did they actually do this and this this to me is the very interesting question how do you take something that's so primitive under such constrained circumstances and how do you make it not kill people and the way that they actually did that was they had careful pragmatic and empirical engineering so every change they would make they would stick an astronaut in a mock-up a complete mock-up and they would have them run through it the entire flight checklist because nothing was unscripted everything had a checklist so every bug that we've since discovered had to be discovered by flying millions of missions against the moon because we can simulate physically we can simulate the Apollo craft have this computer run inside of it and land arbitrarily on the moon this sort of engineering is is very common in aeronautics and many of these people were Aeronautics engineers you see it lesson software and sort of interesting that at least in the Apollo guidance computer era Engineering their methodology fed into what the instrumentation laboratory employees did so they started out with three and they eventually turned into 400 but they kept that same very rigorous proof by exhaustive testing and the techniques that were developed for the AGC are still in use today we call them different things and they're so fundamental we don't really notice them so this book real-time c++ efficient object-oriented so on and so forth it discusses priority scheduling and it never mentions the AGC it discusses dealing with machines that have odd bit size and it never discusses the AGC because it doesn't need to because they've become such foundational principles to software engineering to embedded systems engineering to software engineering in general and the interesting thing to me the last interesting thing is that you know the past informs our present you know whatever we do in the past sort of sets what we can do right now so because because James Watt figured it would be real great to build a thing that could pump water out of a coal mine we had the Industrial Revolution because we had the Industrial Revolution we had the information revolution and so on and so on wherever we sit we sit beholdin to the past to the the work the innovations that the past is made and we sit inside of this great project and the Victorian in the Victorian period they would capitalize great project because they meant civilization and I don't necessarily mean civilization I mean you know the the techniques that we developed today to say get to Pluto are the foundations of the future you know whatever we invent today whatever we take from the past and use in the present informs what people that come after us can do so human civilization all the way from the cro-magnon zone from the first cro-magnon to look at a hand axe and go man I wish this thing didn't cut my hand so much all the way to you know the people working in the AGC they're all looking at the past taking the technology and doing something new and the thing that we have for us is that whatever techniques that we develop today dependent typing however it is that we can influence the future by building new things you know we are able to give the future more tools to do interesting stuff to get outside of the planet to in poverty and that to me is fascinating that's primarily why I'm interested in studying the Apollo guidance computer because it's an example of people who are trying to do a very specific thing and they think it's pedestrian they don't think it's that special they don't think it's outrageous they think they're just very busy and very hurried and a lot of us I'm sure feel very busy and very hurried but what we're doing is actually very interesting we're living in a very unique time so I would encourage everybody to go out and build something [ __ ] amazing thank you incidentally this is Margaret Hamilton she is standing with a printout of the Apollo guidance computer program Colossus which ran inside of the command module she was the lead software engineer for the Apollo guidance computer software ever she is pretty tall so that's a lot of source code yeah he said the AGC was 70 pounds - I believe that includes the very heavy case yeah yeah so the case was a hermetically sealed so the Apollo guidance computer comes in two variants one is the block one one is the block two or the other is the block two so version 1 version 2 block 1 is completely open meaning that every human that breathes around it can get moisture into it so originally they thought that they would ship up three computers and if the computer failed because they had no faith that a digital computer built on integrated circuits could run for more than two hours without burning up what they would do is they would have the astronauts service the Machine pull bits and pieces out and solder and so on eventually NASA got comfortable with the idea that this thing could run for at least three weeks and so they ripped that out and so block 2 was hermetically sealed the reason that they went to a hermetic seal which drastically increased the weight was because in Germany the computer was not sealed and they had a computer failure because someone urinated on the computer microgravity is very hard to deal with waste and some of it escapes so the computer shorted out so NASA now hermetically sealed all of the electrical systems inside a spacecraft and the metal that they had available to ground the computer was aluminum and aluminum is relatively light but it was 30 pounds worth of aluminum to seal the thing questions how much thought and to the experience trial and error went into engineering the sort of years interface from the initial version to the one we used on the mission yeah yeah so the first contract that was ever awarded for the Apollo craft was for the Apollo guidance computer so you have Kennedy who gives this famous speech in 61 and the NASA signs up or is obligated to go to the moon in late 61 and by December of 1961 there is a contract for the AGC because they recognize very very quickly that they need to have an integrated control system at this time they're thinking that they're going to do direct descent but even still they recognize that they need to be able to land on the moon and that's a very difficult thing to do so they need a computer eventually the originally the Apollo guidance computer was meant to just be in the lunar module but eventually it moves also to the command module to save time basically in terms of engineering so from 1961 all the way to 1969 you have eight years but really the the control system had been developed for the Polaris in 54 something like that so roundup say 20 years um was the was the computer built by NASA or was it built by a contractor and if so who yeah so I believe it was Raytheon that fabricated so NASA was a systems integrator NASA's manged main deal is that it is an integrator of systems Marshall Space Flight Center has in-house experts they're the people that build the Rockets but even they don't actually build the Rockets they build the prototypes for the computer NASA contracted out to they're now called Draper laboratories they contracted out to Draper laboratories Draper laboratories design the computer but then they contracted out to Raytheon to build the thing so it was built in the Boston area basically yeah yeah so we uh we're out of time lunch is now I'd like to just invite people to stay and talk to Brian about this if you're interested but I also want to let you go if you want to get some lunch so thank you Brian for that amazing you