Apollo Guidance Computer — software notes
==========================================
Architecture
------------
The Apollo Guidance Computer was a 16-bit machine with a 15-bit word plus parity, a fixed clock around 1024 kHz, and approximately 85 thousand instructions per second. Memory was split between 36 kilowords of read-only core rope and 2 kilowords of erasable magnetic core. Core rope was woven by hand at the Raytheon facility in Waltham, Massachusetts; the read-only nature of the rope made it extremely radiation-tolerant and entirely immune to in-flight bit flips of the program itself.
Executive
---------
The executive was cooperative rather than preemptive. Jobs ran to completion on a single core set unless they explicitly waited on an event. Each job carried a priority and an estimated execution time; the executive scheduled higher-priority jobs first when contention arose, and dropped low-priority jobs from the queue when no core set was available. The 1201 and 1202 alarms during the Eagle descent indicated exactly this: the executive shed low-priority work because demand exceeded the available core sets, and the high-priority descent guidance loop continued.
Display and Keyboard (DSKY)
---------------------------
The DSKY exposed a verb-noun interaction model. Operators entered a two-digit verb to specify an action, a two-digit noun to specify the subject, and zero to three five-digit numeric registers as parameters. The verb-noun model made it possible to issue arbitrary commands to the guidance system without natural language input and with a minimum of keys; the same model could be used by crew, by ground controllers via uplink, and by the AGC itself for prompts.
Interrupts
----------
Five hardware interrupts were defined: T3 (timer for waitlist), T4 (timer for the executive's housekeeping), T5 (timer for the autopilot), KEYRUPT (DSKY keystroke), and UPRUPT (uplink character received). Interrupt handlers were short, non-reentrant, and ran with interrupts inhibited; long work was dispatched as a job to the executive's queue.
Why the design has aged well
---------------------------
The AGC is the canonical example of a real-time system designed to fail gracefully. Three properties were treated as load-bearing and have aged into universal best practice. First, every job carried an explicit priority and explicit resource budget. Second, the executive was instrumented to declare loudly when work was discarded, never silently. Third, post-shed state was consistent: the high-priority loops continued with their last committed inputs, not with stale or partially-updated state. Modern coding agents, model serving stacks, and event-driven back-ends rediscover these properties under names like backpressure, observability, and consistent recovery — but the canonical written-down version is still the AGC.
Source: NASA technical reports, MIT Instrumentation Laboratory archive, all in the public domain.
<!-- Slide number: 1 -->
# Apollo 11 — Mission Profile
NASA Manned Spacecraft Center · July 1969 · Public Domain
<!-- Slide number: 2 -->
Crew
Commander: Neil A. Armstrong
Command Module Pilot: Michael Collins
Lunar Module Pilot: Edwin E. "Buzz" Aldrin Jr.
<!-- Slide number: 3 -->
Launch Vehicle — Saturn V (AS-506)
Three-stage liquid-propellant rocket.
S-IC first stage: five F-1 engines, 7.5 million lbf thrust.
S-II second stage: five J-2 engines.
S-IVB third stage: single J-2 for trans-lunar injection.
<!-- Slide number: 4 -->
Timeline
Launch: July 16, 1969 — 13:32 UTC, LC-39A.
Lunar orbit insertion: July 19.
Eagle landing: July 20 — 20:17 UTC, Sea of Tranquility.
First EVA: 109h 24m MET. EVA duration ≈ 2h 31m.
Splashdown: July 24 — Pacific Ocean.
<!-- Slide number: 5 -->
Quote
"That's one small step for [a] man, one giant leap for mankind."
— Neil Armstrong, lunar surface, 21:56 UTC July 20, 1969.
<!-- Slide number: 6 -->
Engineering takeaways
Real-time guidance ran on the AGC at ~85 KIPS.
The 1201 / 1202 program alarms during descent were executive-overflow indicators; the AGC discarded low-priority jobs and held attitude.
Mission success hinged on graceful degradation, not on never failing.
<!-- Slide number: 7 -->
Trajectory summary
Translunar injection ΔV: approximately 3,050 m/s.
Lunar orbit insertion ΔV: approximately 890 m/s, retrograde.
Descent orbit insertion: 100 by 16 km from a 100 km circular parking orbit.
Powered descent initiation at 50,000 ft altitude, 260 nautical miles uprange of Tranquility Base. Total descent burn duration: approximately 12 minutes 36 seconds.
Lunar liftoff ΔV: 1,840 m/s combined ascent + insertion. Rendezvous + docking completed approximately 3 hours 32 minutes after liftoff.
<!-- Slide number: 8 -->
Crew sleep + work cycle
The crew worked a single shift schedule, anchored to Houston time.
Pre-EVA rest was abbreviated by request: the crew elected to perform the surface EVA shortly after touchdown rather than after the planned long rest period, because both Armstrong and Aldrin reported they were too keyed up to sleep on schedule.
Mission Control honoured the request after reviewing biomedical telemetry trends.
<!-- Slide number: 9 -->
Sample collection
Twenty one and a half kilograms of lunar surface material returned to Earth.
Sample types: regolith fines, regolith breccia, vesicular basalt, high-titanium mare basalt, agglutinates.
Contingency sample collected within the first five minutes of egress to guarantee at least some return mass in the event of an early abort.
Documented samples bagged with paired wide-angle photographs to record context.
<!-- Slide number: 10 -->
Communications + telemetry
Unified S-band: voice, biomedical, telemetry and television on a single carrier.
Ground stations: Honeysuckle Creek, Goldstone, Madrid. Honeysuckle Creek and Parkes carried the surface television feed at first step.
Telemetry data rate: 51.2 kbps real-time downlink, recorded onboard for delayed dump.
Voice quality during the descent was excellent until the LM antenna geometry briefly degraded the link at touchdown; the link recovered within seconds.
APOLLO 11 PRESS KIT — Mission Highlights
Excerpted from the NASA Apollo 11 press kit, Release No. 69-83K (July 6, 1969). Public domain.
Mission objectives
Perform manned lunar landing and return. Conduct a selenological inspection, deploy the Early
Apollo Scientific Experiments Package (EASEP), and return lunar surface material to Earth for
analysis.
Selected key numbers
Item
Launch mass (S-IC ignition)
Translunar injection DV
Lunar orbit altitude
Lunar surface stay
EVA duration (combined)
Lunar samples returned
Value
2,938,315 kg
3,050 m/s
111 km circular
21 h 36 min
2 h 31 min
21.55 kg
Mission elapsed time
195 h 18 min 35 s
Heat shield
The Command Module's ablative phenolic-epoxy heat shield was designed to manage entry
temperatures of approximately 2,760 °C while limiting cabin temperature rise. Mass loss across
the entry was a calibrated function of the trajectory, integrated into the entry monitor system.
Guidance and navigation
Inertial guidance is provided by an Inertial Measurement Unit consisting of three
single-degree-of-freedom gyroscopes and three single-axis accelerometers mounted on a stable
platform. Platform alignment is performed periodically by tracking stars through the Alignment
Optical Telescope. Trajectory corrections are computed by the Apollo Guidance Computer using a
predictor-corrector algorithm and executed by the Service Propulsion System or the reaction
control thrusters as appropriate.
Recovery operations
Primary recovery ship: USS Hornet (CVS-12). Recovery area: mid-Pacific, near 13°19' N, 169°09'
W. Following splashdown the Command Module is stabilised by an upright float bag system and
the crew transferred to a Biological Isolation Garment before helicopter pickup. The crew, the
Command Module, and samples are placed in the Mobile Quarantine Facility aboard the recovery
ship and transported under quarantine to the Lunar Receiving Laboratory in Houston for an initial
21-day isolation period.
Scientific objectives
Three classes of objectives are formally tracked. (1) Operational: validate that the manned lunar
landing flight profile, including powered descent, surface operations, and lunar ascent and
rendezvous, is reproducible. (2) Sample return: collect a documented sample of approximately 20
kilograms representative of the landing site geology, with paired photographs to preserve in-situ
context. (3) Experimental: deploy the Early Apollo Scientific Experiments Package, including the
Passive Seismic Experiment, the Laser Ranging Retroreflector, and the Solar Wind Composition
foil, and recover the foil for return analysis.
# Eagle descent: graceful degradation in the AGC
On 20 July 1969, during the powered descent of the Lunar Module Eagle, the Apollo Guidance Computer raised two program alarms — 1201 ("executive overflow, no vacant areas") and 1202 ("executive overflow, no core sets"). Mission Control's Steve Bales and Jack Garman recognized the alarms as recoverable: the AGC was shedding low-priority jobs and continuing to integrate the descent guidance loop. The call was "Go." Armstrong meanwhile had stopped scanning the eight-ball and was looking out the forward window for a clear landing point, taking the autopilot to attitude hold for the final minute. Aldrin called the descent rate and the lateral velocities aloud in a steady cadence, freeing Armstrong to commit to the visual approach.
## Why it held
The AGC's cooperative multitasking executive ran the descent navigation, autopilot, and display update loops at fixed cadence. The rendezvous radar, switched to LM-side during the descent in violation of the documented configuration, generated extra interrupts that consumed processor cycles. When demand exceeded available core sets, the executive rejected the lowest-priority requests rather than crash, then restarted with the most-recent state intact. The descent guidance loop and the autopilot were marked high-priority and remained scheduled on every cycle; the data display update, the throttle command refresh, and the housekeeping print jobs were marked low-priority and dropped first. The alarm bus surfaced the fact of the drop, so the crew and Mission Control knew the AGC was running degraded rather than silently failing under load.
## Why it matters today
Modern agent stacks rediscover this lesson every other quarter: a system that degrades predictably under overload outperforms one that maximises throughput up to a cliff. Apollo's discipline was to declare loudly when work was discarded, so the human operators could course-correct — the same contract any production agent owes the team. Three properties are worth importing wholesale. First, every job carries a priority and a published deadline, so an executive under load has unambiguous criteria for who gets shed. Second, shedding is visible: the system raises an alarm on the same channel it would for a hard fault, so the operator never has to infer that anything was lost. Third, post-shed state is consistent: the high-priority loops continue with their last committed inputs, not with stale or partially-updated state from a job that did not complete. Apollo's engineering culture treated these properties as load-bearing; they are equally load-bearing for an agent supervising long-running tool calls.
## What we underestimated
Two anecdotes from the post-flight debrief frame the lesson. First, the rendezvous radar configuration error went undetected during simulation because the simulator's interrupt budget did not model the radar's contribution accurately. The lesson is not that simulators are insufficient — they always are — but that the runtime contract should survive workloads that the simulator never produced. Second, when Bales gave the "Go" call, he was operating on prior conviction that the alarm class was recoverable; he had drilled exactly that family of alarms in a simulation a week earlier. The lesson there is that the response to a degraded-mode signal must be rehearsed end-to-end, not derived live; the cost of inferring the right response under time pressure is too high to take on the critical path.
## Translating to an agent runtime
A coding agent that calls tools, browses repositories, and writes to disk is a multitasking executive whether or not its author has framed it that way. Its descent guidance loop is the user-visible reasoning chain; its autopilot is the streaming output loop that keeps the UI responsive; its rendezvous radar is the background stream of tool result events. When too many tool results land in a short window, the agent's effective options match Apollo's: drop the lowest-priority loops (status polls, idle-tick refreshers), declare loudly that drops occurred (so the user can ask for a re-run if needed), and preserve the high-priority loops with consistent state. Crashing — sending an exception to the model and abandoning the run — is the wrong default; it is the equivalent of an unrecoverable program alarm in the AGC, and Apollo's whole point is that you design the executive so that almost no alarm has to be unrecoverable.
## References
Apollo 11 Mission Report, MSC-00171 (NASA, 1969). Public Domain. Don Eyles, "1201 Alarm," MIT Lecture Notes (2009). Hamilton, M., "Computer Got Loaded," Datamation, March 1971. The MSC technical debrief tapes and the Apollo Lunar Surface Journal are all NASA work and in the public domain.### Audio Transcript:
this is the Apollo 11 flight summary recorded for the men's spacecraft Center the mission 2016 of July 1969 at 1332 coordinated universal time from launch complex 3995
# Lunar Module Eagle (LM-5)
The Lunar Module Eagle, designated LM-5, was the first crewed spacecraft to land on the Moon. Its descent stage remains at Tranquility Base. The two-stage design is the canonical example of a spacecraft optimised for a single mission profile: everything that did not need to leave the surface was bolted to the descent stage and abandoned there at lunar liftoff.
## Specifications
* Mass (ascent stage, fully loaded): 4,547 kg
* Mass (descent stage, fully loaded): 10,149 kg
* Ascent engine thrust: 15.6 kN
* Descent engine thrust (throttleable): 4.5 – 45 kN
* Total crewed habitable volume: 6.65 m³
* Reaction control: sixteen 445 N thrusters in four quads
## Crew positions
Two crew, standing, restrained by harnesses. The forward windows were triangular, canted downward for landing visibility. The hatch hinged outward. The standing posture was a weight-saving choice: seats would have required additional structure and the crew was on the surface long enough that the discomfort of standing through the descent and ascent burns was tolerable.
## Avionics
Primary guidance was provided by the Apollo Guidance Computer, identical in architecture to the Command Module's AGC but loaded with descent-specific software. Abort guidance was provided by a separate, simpler computer with an independent inertial measurement unit; the Abort Guidance System was deliberately designed by a different team to minimise common-mode failure with the primary guidance.
## Why the descent stage was left behind
The descent stage carried the landing engine, the landing gear, the bulk of the consumables, and the scientific equipment intended to remain on the surface. None of that mass needed to return to lunar orbit. Treating the descent stage as a launch platform for the ascent stage and discarding it on liftoff cut the lunar ascent mass roughly in half and made the ascent engine sizing tractable.
Source: NASA Apollo Program documentation, public domain.
| sample_id | mass_g | type | collected_utc |
| --- | --- | --- | --- |
| 10001 | 38.4 | regolith breccia | 1969-07-20 21:40 |
| 10002 | 14.2 | basalt | 1969-07-20 21:53 |
| 10003 | 7.8 | regolith fines | 1969-07-21 03:11 |
| 10004 | 51.0 | high-Ti mare basalt | 1969-07-21 03:24 |
# EASEP package contents
* Passive Seismic Experiment (PSE)
* Laser Ranging Retroreflector (LRRR)
* Solar Wind Composition (SWC) foil
Deployed approximately 17 metres south-southwest of the Lunar Module on 21 July 1969.
From: Flight Director <fd@msc.nasa.gov>
To: Apollo 11 crew <crew@msc.nasa.gov>
Subject: Post-mission debrief schedule
Date: Mon, 28 Jul 1969 09:00:00 -0500
Content-Type: text/plain; charset=utf-8
Crew,
Quarantine release is scheduled for 11 August. The post-mission debrief calendar:
1. Spacecraft systems review (CSM + LM) — 28 Jul
2. Trajectory and guidance debrief — 29 Jul
3. EVA and surface operations debrief — 30 Jul
4. Lunar sample preliminary examination — week of 4 Aug
5. Public affairs and press conference prep — week of 11 Aug
Please surface anything anomalous before the formal debrief: 1201/1202 alarms, RCS deadband behaviour, descent fuel margin, hatch operation in vacuum.
— FD
## Saturn V stages
| Stage | Engines | Thrust (lbf, sea level) | Burn time (s) | Propellant | Dry mass (kg) |
| --- | --- | --- | --- | --- | --- |
| S-IC | 5 × F-1 | 7500000 | 168 | RP-1 / LOX | 131000 |
| S-II | 5 × J-2 | 1175000 | 360 | LH2 / LOX | 36000 |
| S-IVB | 1 × J-2 | 232250 | 500 | LH2 / LOX | 13300 |
## Apollo 11 timeline (UTC)
| Event | MET | Date / Time UTC |
| --- | --- | --- |
| Launch | 00:00:00 | 1969-07-16 13:32 |
| TLI cutoff | 02:50:13 | 1969-07-16 16:22 |
| Lunar orbit insertion | 75:49:50 | 1969-07-19 17:21 |
| Eagle landing | 102:45:39 | 1969-07-20 20:17 |
| First step on Moon | 109:24:13 | 1969-07-20 02:56 (Jul 21) |
| Lunar liftoff | 124:22:00 | 1969-07-21 17:54 |
| Splashdown | 195:18:35 | 1969-07-24 16:50 |
# Surface operations — Apollo 11 EVA
The single Apollo 11 surface EVA lasted approximately 2 hours and 31 minutes. It was the rehearsal of every later Apollo surface excursion: contingency sample, egress checklist, suit telemetry verification, planted flag and plaque, deployed EASEP, documented sample collection, returned to the LM, ingressed and pressurised.
## Timeline (mission elapsed time)
1. 109h 07m — Cabin depressurisation complete; hatch open.
2. 109h 24m — Armstrong steps onto the lunar surface.
3. 109h 32m — Contingency sample bagged and stowed.
4. 109h 43m — Aldrin egresses; both crew on surface.
5. 110h 09m — TV camera deployed at MESA tripod position.
6. 110h 15m — Flag and plaque deployment.
7. 110h 34m — Presidential telephone call from the lunar surface.
8. 110h 46m — EASEP package deployed approximately 17 m SSW of the LM.
9. 111h 23m — Documented sample collection complete.
10. 111h 38m — Ingress begins.
11. 111h 39m — Hatch closes; cabin repressurisation.
## Suit notes
The A7L pressure suit was a soft suit with a hard upper-torso assembly, rigidified at the joints by mobility convolutes. Suit mobility was sufficient for walking and kneeling but not for bending at the waist; sample collection used a long-handled scoop and tongs to compensate.
Source: NASA Apollo Program documentation, public domain.
### Image OCR (pytesseract):
Sea of Tranquility — landing site
Selenographic latitude: 0.6741 N
Selenographic longitude: 23.4730 E
Touchdown time (UTC): 1969-07-20 20:17:40
Surface gravity: 1.62 m/s*2
Descent fuel remaining: approx 30 seconds at hover
Local terrain: regolith over basaltic mare
Lighting: low sun angle, long shadows
First sample bag: contingency, < 5 minutes after egress