Margaret Hamilton died on 7 October, aged 90. She led the teams that wrote the on-board flight software for the Apollo Lunar Module and Command Module — “more than 400 people,” in MIT’s phrasing.

The story that will be retold all week is the landing: ninety seconds from the lunar surface, the guidance computer raises a 1202 alarm, Houston says go anyway, and the software holds. It is usually told as software surviving an overload.

I don’t think that’s quite right, and the listing is public, so I went and checked.

→ The interactive version is here. Fill the slots yourself, run the radar storm, watch which work gets dropped.

The allocator is five if-statements

The Executive hands each new job a core set — eleven registers to work in — and, if the job needs the interpreter, a VAC area, a vector-accumulator workspace. Here is how it finds you a VAC area, from Luminary099/EXECUTIVE.agc, the Apollo 11 Lunar Module build:

FINDVAC2	TS	EXECTEM1	# (SAVE CALLER'S BANK FIRST.)
		CCS	VAC1USE
		TCF	VACFOUND
		CCS	VAC2USE
		TCF	VACFOUND
		CCS	VAC3USE
		TCF	VACFOUND
		CCS	VAC4USE
		TCF	VACFOUND
		CCS	VAC5USE
		TCF	VACFOUND
		LXCH	EXECTEM1
		CA	Q
		TC	BAILOUT1
		OCT	1201		# NO VAC AREAS.

Nothing is looked up. Five literal checks written out in a row, and if all five are busy you fall off the bottom of the list into an alarm. The core sets get a loop, and the count is sitting right there in the instruction stream, as both a comment and a constant:

		CAF	NO.CORES	# SEVEN SETS OF ELEVEN REGISTERS EACH.
NOVAC3		TS	EXECTEM2
		INDEX	LOCCTR
		CCS	PRIORITY	# EACH PRIORITY REGISTER CONTAINS -0 IF
		TCF	NEXTCORE	# THE CORESPONDING CORE SET IS AVAILABLE.
NO.CORES	DEC	7

Seven. That is all there was — seven places to put a job, five of which could also do interpretive maths, aboard the vehicle landing two people on the moon.

The best line in the file is a comment about a sign bit

Read those last two comments again. They are a single sentence, carried across the trailing comments of two separate instructions:

		CCS	PRIORITY	# EACH PRIORITY REGISTER CONTAINS -0 IF
		TCF	NEXTCORE	# THE CORESPONDING CORE SET IS AVAILABLE.

The AGC is a ones’ complement machine, which means it has two zeros — +0 and -0 — and most of the time the second one is an embarrassment you have to write extra code to handle. The Executive spends it. One fifteen-bit word carries three states:

priority register	means
-0	the slot is free
positive	“AN ACTIVE JOB HAS A POSITIVE PRIORITY”
negative, but not -0	“BUT A DORMANT JOB’S PRIORITY IS NEGATIVE”

Free, running, and asleep, in one word, with no separate occupancy flag that could drift out of step with it. On a two’s-complement machine — which is to say, on anything you or I will ever program — this is simply unavailable. There is one zero, and you need another bit or another array.

I enjoyed this more than I expected to. Someone looked at the machine they actually had, noticed it was handing them a spare value for free, and spent it on the one thing that would otherwise have cost memory they did not have.

Why 1201 came first

During the descent the rendezvous radar had been left feeding the computer a stream of spurious data, and each burst scheduled a radar-read job. In the source, that request looks like this:

		CAF	PRIO26		# YES -- SCHEDULE R22 JOB (RR DATA READ)
		TC	FINDVAC

TC FINDVAC — not TC NOVAC. The radar job needs a VAC area, and there are five of those against seven core sets. So a flood of radar reads exhausts the smaller pool first, and the 1201 alarm — “NO VAC AREAS” — arrives before 1202. Which is the order the crew saw.

I checked that rather than assuming it: modelling the two request paths, a FINDVAC-only storm raises 1201 with core sets still available, and a NOVAC-only storm raises 1202 with every VAC area untouched. The asymmetry is just 5 < 7, and which door the job knocks on.

What the alarm actually is

So: the computer was asked to hold more jobs than it had slots for. It did not crash, and it did not heroically survive. It executed a branch that someone had written years earlier, for exactly this case, and given a number. TC BAILOUT1, then the code. The surrounding routines are named BAILOUT, BORTENT, WHIMPER and POODOO, which tells you something about the mood in which they were written.

The restart dumps the backlog and rebuilds, and the guidance job — higher priority than any radar read — comes back. That is the design, and it answers why it was safe to keep landing: what to abandon had already been settled, in writing, on the ground, by people who assumed they would one day be asked for more than they could give.

Hamilton spent a career arguing that this was engineering and deserved the name. She told El País that when she started calling it software engineering, “it was considered to be quite amusing. It was an ongoing joke for a long time.”

A paper listing, a camera, and someone willing to type

One last thing, from the top of the file. The header records when the program was built:

#	Assemble revision 001 of AGC program LMY99 by NASA 2021112-061
#	16:27 JULY 14, 1969

Two days before launch. And above that, the reason any of this is readable at all: the file is a transcription of digitised images of a hardcopy from the MIT Museum — photographed by Paul Fjeld, arranged by Deborah Douglas, typed back in by Ron Burkey, who maintains the Virtual AGC project.

A paper printout, a camera, and someone willing to do the typing. That is all that connects a room in Cambridge in 1969 to a page you can poke at this morning. The code survives because the listing survived, and the listing survived because somebody thought it was worth the trouble.

---

Sources & notes. Code quotations are from Luminary099/EXECUTIVE.agc and Luminary099/P20-P25.agc — Luminary 1A build 099, the Apollo 11 LM flight software. Biography and the El País quotation are from MIT News, 7 October 2026.

What’s mine: finding the allocator and the two alarm branches in the listing; reading the pool sizes, the request paths and the sign-encoding out of the source rather than from secondary accounts; locating the real R22 call site and working out that its use of FINDVAC is why 1201 precedes 1202; checking that ordering by modelling both paths; and building the explainer. The engineering is Hamilton’s team’s, and it is still legible fifty-seven years later, which is its own argument.

Boundary, stated plainly: the explainer models the allocation and priority rules. It does not execute AGC instructions, model interrupts, implement WAITLIST or keep time. Virtual AGC is the real thing and a far larger undertaking. What I claim is faithful: the pool sizes, the search order, the sign-encoded states, which path needs a VAC area, the priority ordering, and which alarm fires when which pool runs dry.