Margaret Hamilton

MIT Instrumentation Laboratory and the Apollo Guidance Computer

Hamilton learned of the Apollo project in 1965 and wanted to get involved due to it being "very exciting" as a Moon program. She joined the MIT Instrumentation Laboratory, which developed the Apollo Guidance Computer for the Apollo lunar exploration program. Hamilton was initially hired as a programmer for this process but moved on into systems design.

Her first program for the Apollo mission involved lunar landmark tables for an unmanned mission to the Moon. After the mission had already launched, it was discovered that the tables had been entered in reverse order. Nevertheless, the mission was ultimately successful.

Hamilton recalled that during the next mission, she was still treated as a novice programmer. She believed this was why she had been assigned to write a contingency program that was never expected to be executed. She even named the program "Forget It". However, the program proved crucial when the unlikely scenario actually occurred. Hamilton became the mission expert, and control was handed over to "Forget It".

With time she became Director of the new Software Engineering Division. She was responsible for the team writing and testing all onboard in-flight software for the Apollo spacecraft's Command and Lunar Module and for the subsequent Skylab space station. Another part of her team designed and developed the systems software. This included error detection and recovery software such as restarts and the Display Interface Routines (also known as the Priority Displays), which Hamilton designed and developed. She worked to gain hands-on experience during a time when computer science courses were uncommon and software engineering courses did not exist.

Olivier de Weck, the Apollo Program Professor at MIT, later called Hamilton "a pioneer" in the new field of software engineering and "a fundamental contributor" to the Apollo program. He added that she not only was an advanced systems programmer in her own right, but also headed a team that developed "one of the most complex systems humanity had ever achieved".

Apollo 11 landing

In one of the critical moments of the Apollo 11 mission, the Apollo Guidance Computer, together with the on-board flight software, averted an abort of the landing on the Moon. Three minutes before the lunar lander reached the Moon's surface, several computer alarms were triggered. According to software engineer Robert Wills, Buzz Aldrin entered the codes to request that the computer display altitude and other data on the computer's screen. The system was designed to support seven simultaneous programs running, but Aldrin's request was the eighth. This action was something he requested many times while working in the simulator. The result was a series of unexpected error codes during the live descent. The on-board flight software captured these alarms with the "never supposed to happen displays" interrupting the astronauts with priority alarm displays.

Hamilton had prepared for just this situation years before:

There was one other failsafe that Hamilton likes to remember. Her "priority display" innovation had created a knock-on risk that astronaut and computer would slip out of sync just when it mattered most. As the alarms went off and priority displays replaced normal ones, the actual switchover to new programmes behind the screens was happening "a step slower" than it would today.

Hamilton had thought long and hard about this. It meant that if Aldrin, say, hit a button on the priority display too quickly, he might still get a "normal" response. Her solution: when you see a priority display, first count to five.

By some accounts, the astronauts had inadvertently left the rendezvous radar switch on (this is disputed by Robert Wills with the National Museum of Computing), causing these alarms to be triggered. The computer was overloaded with interrupts caused by incorrectly phased power supplied to the lander's rendezvous radar. The program alarms indicated "executive overflows", meaning the guidance computer could not complete all of its tasks in real time and had to postpone some of them. The asynchronous executive designed by J. Halcombe Laning was used by Hamilton's team to develop asynchronous flight software:

Because of the flight software's system-software's error detection and recovery techniques that included its system-wide "kill and recompute" from a "safe place" restart approach to its snapshot and rollback techniques, the Display Interface Routines (AKA the priority displays) together with its man-in-the-loop capabilities were able to be created in order to have the capability to interrupt the astronauts' normal mission displays with priority displays of critical alarms in case of an emergency. This depended on our assigning a unique priority to every process in the software in order to ensure that all of its events would take place in the correct order and at the right time relative to everything else that was going on.

Hamilton's priority alarm displays interrupted the astronauts' normal displays to warn them that there was an emergency "giving the astronauts a go/no-go decision (to land or not to land)". Jack Garman, a NASA computer engineer in mission control, recognized the meaning of the errors that were presented to the astronauts by the priority displays and shouted, "Go, go!" and they continued. Paul Curto, a senior technologist who nominated Hamilton for a NASA Space Act Award, called Hamilton's work "the foundation for ultra-reliable software design".

Hamilton later wrote of the incident:

The computer (or rather the software in it) was smart enough to recognize that it was being asked to perform more tasks than it should be performing. It then sent out an alarm, which meant to the astronaut, 'I'm overloaded with more tasks than I should be doing at this time and I'm going to keep only the more important tasks'; i.e., the ones needed for landing... Actually, the computer was programmed to do more than recognize error conditions. A complete set of recovery programs was incorporated into the software. The software's action, in this case, was to eliminate lower priority tasks and re-establish the more important ones... If the computer hadn't recognized this problem and taken recovery action, I doubt if Apollo 11 would have been the successful Moon landing it was.

Businesses

Hamilton co-founded with Saydean Zeldin a company called Higher Order Software (HOS) to further develop ideas about error prevention and fault tolerance emerging from their experience at MIT working on the Apollo program. They created a product called USE.IT, based on the HOS methodology they developed at MIT. It was successfully used in numerous government programs including a project to formalize and implement C-IDEF, an automated version of IDEF, a modeling language developed by the U.S. Air Force in the Integrated Computer-Aided Manufacturing (ICAM) project. In 1980, British-Israeli computer scientist David Harel published a proposal for a structured programming language derived from HOS from the viewpoint of and/or subgoals. Others have used HOS to formalize the semantics of linguistic quantifiers, and to formalize the design of reliable real-time embedded systems.

Hamilton was the CEO of HOS and left the company later on. In March 1986, she founded Hamilton Technologies, Inc. in Cambridge, Massachusetts. The company was developed around the Universal Systems Language (USL) and its associated automated environment, the 001 Tool Suite, based on her paradigm of development before the fact for systems design and software development.